@kelpie/server 0.12.0 → 0.13.0

package/src/modules/attachedRecords.ts

@@ -1,10 +1,16 @@
-import { PIPELINE_KINDS } from '@kelpie/schemas'
+import {
+  EVENT_ASSOCIATION_TARGET_TYPES,
+  FORM_ATTACH_TARGET_TYPES,
+  PIPELINE_KINDS,
+  PLAN_ITEM_TARGET_TYPES,
+} from '@kelpie/schemas'
 import type { PipelineKind } from '@kelpie/schemas'
 import { and, eq } from 'drizzle-orm'
 
 import type { Queryable } from '../runtime/transaction.ts'
 import * as activityRepository from './activities/repository.ts'
 import * as decisionRepository from './decisions/repository.ts'
+import { attendances, eventAssociations } from './events/schema.ts'
 import { formAttachTargets } from './forms/schema.ts'
 import { candidates } from './hiring/schema.ts'
 import * as listRepository from './lists/repository.ts'
@@ -20,19 +26,26 @@ import * as planRepository from './plans/repository.ts'
  * the target deletes these, in the same transaction, or the rows outlive the
  * record they described and reappear the day an id is reused.
  *
- * `plan_items` attach the same way but their check constraint allows only the
- * four pipeline types, so they are removed only for those targets. `person_links`
- * follows the same rule: it holds a person's involvement in a pipeline record
- * and its check constraint allows only the four pipeline types, so a deleted
- * deal/opportunity/raise/partnership sheds its people here. `form_attach_targets`
- * is the same shape: forms pinning submitters into a pre-existing pipeline
- * record shed the mapping when the target goes.
+ * `plan_items` attach the same way but their check constraint allows the
+ * pipeline types plus Event, so they are removed only for those targets.
+ * `person_links` stays pipeline-only. `form_attach_targets` follows the plan
+ * set (pipelines plus Event). `event_associations` is Event-only: deleting the
+ * other record strips rows that pointed at it.
  */
 
 /** Target types that can own attached records here. */
-export type AttachableTargetType = 'person' | 'company' | 'candidate' | PipelineKind
+export type AttachableTargetType =
+  | 'person'
+  | 'company'
+  | 'candidate'
+  | 'event'
+  | 'attendance'
+  | PipelineKind
 
-const PLAN_TARGET_TYPES: ReadonlySet<string> = new Set(PIPELINE_KINDS)
+const PLAN_TARGET_TYPES: ReadonlySet<string> = new Set(PLAN_ITEM_TARGET_TYPES)
+const LINK_TARGET_TYPES: ReadonlySet<string> = new Set(PIPELINE_KINDS)
+const FORM_ATTACH_TYPES: ReadonlySet<string> = new Set(FORM_ATTACH_TARGET_TYPES)
+const ASSOCIATION_TARGET_TYPES: ReadonlySet<string> = new Set(EVENT_ASSOCIATION_TARGET_TYPES)
 
 /**
  * @param db Must be the caller's transaction. Called on its own, this deletes the
@@ -53,13 +66,13 @@ export async function deleteRecordsAttachedTo(
   const plans = PLAN_TARGET_TYPES.has(targetType)
     ? await planRepository.deleteForTarget(db, workspaceId, targetType, targetId)
     : 0
-  const links = PLAN_TARGET_TYPES.has(targetType)
+  const links = LINK_TARGET_TYPES.has(targetType)
     ? await personLinks.deleteLinksForTarget(db, workspaceId, {
         targetType: targetType as PipelineKind,
         targetId,
       })
     : 0
-  const attachTargets = PLAN_TARGET_TYPES.has(targetType)
+  const attachTargets = FORM_ATTACH_TYPES.has(targetType)
     ? (
         await db
           .delete(formAttachTargets)
@@ -79,8 +92,36 @@ export async function deleteRecordsAttachedTo(
     targetType,
     targetId,
   )
+  const associations = ASSOCIATION_TARGET_TYPES.has(targetType)
+    ? await deleteEventAssociationsForTarget(db, workspaceId, targetType, targetId)
+    : 0
+
+  return notes + activities + decisions + plans + links + attachTargets + memberships + associations
+}
+
+/**
+ * Event↔record rows have no FK to the target, so the target's delete must strip
+ * them. Event delete itself cascades `event_id`. Role is not an attachable
+ * notes target, so its service calls this helper directly.
+ */
+export async function deleteEventAssociationsForTarget(
+  db: Queryable,
+  workspaceId: string,
+  targetType: string,
+  targetId: string,
+): Promise<number> {
+  const deleted = await db
+    .delete(eventAssociations)
+    .where(
+      and(
+        eq(eventAssociations.workspaceId, workspaceId),
+        eq(eventAssociations.targetType, targetType),
+        eq(eventAssociations.targetId, targetId),
+      ),
+    )
+    .returning({ id: eventAssociations.id })
 
-  return notes + activities + decisions + plans + links + attachTargets + memberships
+  return deleted.length
 }
 
 /**
@@ -117,3 +158,34 @@ export async function deleteRecordsAttachedToCandidaciesOf(
 
   return removed
 }
+
+/**
+ * The same cleanup for Attendances a person's (or Event's) delete takes with
+ * them. `attendances.person_id` / `event_id` cascade, so notes on those rows
+ * would otherwise outlive the Attendance.
+ */
+export async function deleteRecordsAttachedToAttendancesOf(
+  db: Queryable,
+  workspaceId: string,
+  filter: { readonly personId: string } | { readonly eventId: string },
+): Promise<number> {
+  const held = await db
+    .select({ id: attendances.id })
+    .from(attendances)
+    .where(
+      and(
+        eq(attendances.workspaceId, workspaceId),
+        'personId' in filter
+          ? eq(attendances.personId, filter.personId)
+          : eq(attendances.eventId, filter.eventId),
+      ),
+    )
+
+  let removed = 0
+
+  for (const attendance of held) {
+    removed += await deleteRecordsAttachedTo(db, workspaceId, 'attendance', attendance.id)
+  }
+
+  return removed
+}

package/src/modules/auth/index.ts

@@ -37,6 +37,7 @@ export function createAuthModule(migrationsDirectory: string): KelpieModule {
         createId: context.createId,
         now: context.now,
         appBaseUrl,
+        signupsEnabled: context.signupsEnabled ?? true,
       })
 
       // `Secure` everywhere except development. A test host reaches the API

package/src/modules/auth/repository.ts

@@ -1,8 +1,8 @@
-import { and, desc, eq, gt, isNull, ne } from 'drizzle-orm'
+import { and, asc, desc, eq, gt, isNull, ne } from 'drizzle-orm'
 
 import type { Database } from '../../lib/database.ts'
 import type { Transaction } from '../../runtime/transaction.ts'
-import { workspaceMembers } from '../workspace/schema.ts'
+import { workspaceMembers, workspaces } from '../workspace/schema.ts'
 import {
   emailVerificationTokens,
   passwordResetTokens,
@@ -64,11 +64,15 @@ export async function updateUserPassword(
 /**
  * Writes name and email. Not the password: that one has its own function because
  * it also ends sessions, and the two must not be reachable through one call.
+ *
+ * `emailVerifiedAt` rides along with an email change: the service resets it to
+ * null in the same call rather than a second write, so there is no window where
+ * the row holds a new address and the old address's verification.
  */
 export async function updateUserProfile(
   db: Queryable,
   userId: string,
-  changes: { readonly name?: string; readonly email?: string },
+  changes: { readonly name?: string; readonly email?: string; readonly emailVerifiedAt?: Date | null },
   now: Date,
 ): Promise<UserRecord | undefined> {
   const [updated] = await db
@@ -294,3 +298,30 @@ export async function findFirstMembership(
 
   return found
 }
+
+/** Every workspace this account belongs to, oldest membership first. */
+export interface AccountWorkspaceRecord {
+  readonly id: string
+  readonly name: string
+  readonly slug: string
+  readonly timezone: string
+  readonly role: string
+}
+
+export async function listWorkspacesForUser(
+  db: Queryable,
+  userId: string,
+): Promise<AccountWorkspaceRecord[]> {
+  return db
+    .select({
+      id: workspaces.id,
+      name: workspaces.name,
+      slug: workspaces.slug,
+      timezone: workspaces.timezone,
+      role: workspaceMembers.role,
+    })
+    .from(workspaceMembers)
+    .innerJoin(workspaces, eq(workspaces.id, workspaceMembers.workspaceId))
+    .where(eq(workspaceMembers.userId, userId))
+    .orderBy(asc(workspaceMembers.joinedAt))
+}

package/src/modules/auth/routes.ts

@@ -10,7 +10,7 @@ import type { SessionActor } from './actor.ts'
 import { resolveActorFrom } from './credentials.ts'
 import type { CredentialDependencies } from './credentials.ts'
 import type { PreferenceValues } from './preferences.ts'
-import type { AccountView, AuthService, IssuedSession, SessionView } from './service.ts'
+import type { AccountView, AuthService, IssuedSession, MeView, SessionView } from './service.ts'
 import { clearSessionCookie, describeClient, writeSessionCookie } from './session.ts'
 import type { SessionCookieOptions } from './session.ts'
 
@@ -44,6 +44,10 @@ const changePasswordBody = z.object({
   new_password: z.string().min(1),
 })
 
+const switchWorkspaceBodySchema = z.object({
+  workspace_id: z.string().min(1),
+})
+
 const verifyEmailConfirmBody = z.object({
   token: z.string().min(1),
 })
@@ -135,6 +139,32 @@ function preferencesResponse(preferences: PreferenceValues): Record<string, unkn
   }
 }
 
+function sessionMeResponse(session: MeView): Record<string, unknown> {
+  return {
+    user_id: session.userId,
+    session_id: session.sessionId,
+    workspace_id: session.workspaceId,
+    role: session.role,
+    email_verified: session.emailVerified,
+  }
+}
+
+function accountWorkspaceResponse(workspace: {
+  readonly id: string
+  readonly name: string
+  readonly slug: string
+  readonly timezone: string
+  readonly role: string
+}): Record<string, unknown> {
+  return {
+    id: workspace.id,
+    name: workspace.name,
+    slug: workspace.slug,
+    timezone: workspace.timezone,
+    role: workspace.role,
+  }
+}
+
 function sessionResponse(session: SessionView): Record<string, unknown> {
   return {
     id: session.id,
@@ -194,6 +224,19 @@ export function mountAuthRoutes(router: Hono, dependencies: AuthRoutesDependenci
     })
   })
 
+  router.get('/auth/workspaces', async (context) => {
+    const workspaces = await dependencies.service.listWorkspaces(await requireActor(context))
+
+    return context.json({ data: workspaces.map(accountWorkspaceResponse), next_cursor: null })
+  })
+
+  router.post('/auth/workspace', async (context) => {
+    const body = await readBody(context, switchWorkspaceBodySchema)
+    const session = await dependencies.service.switchWorkspace(await requireActor(context), body.workspace_id)
+
+    return context.json(sessionMeResponse(session))
+  })
+
   /**
    * `/account` rather than `/auth/account`: `/auth/*` is how a browser gets a
    * session, and this is the person that session belongs to. The auth module

package/src/modules/auth/service.ts

@@ -9,6 +9,8 @@ import { MINIMUM_PASSWORD_LENGTH, hashPassword, verifyPassword } from '../../lib
 import { generateToken, hashToken } from '../../lib/tokens.ts'
 import type { VerifiedIdentity } from '../../runtime/module.ts'
 import type { TransactionScope } from '../../runtime/transaction.ts'
+import type { MemberRole } from '../workspace/roles.ts'
+import { parseMemberRole } from '../workspace/roles.ts'
 import type { SessionActor } from './actor.ts'
 import { DEFAULT_PREFERENCES, applyPreferenceChanges } from './preferences.ts'
 import type { PreferenceChanges, PreferenceValues } from './preferences.ts'
@@ -36,6 +38,13 @@ export interface AuthDependencies {
   readonly now: () => Date
   /** The deployment's own base URL. Every emailed link is built from it. */
   readonly appBaseUrl: string
+  /**
+   * Whether a brand-new account may be created, through `signUp` or
+   * `completeExternalSignIn` provisioning. Joining an existing workspace via
+   * invite, and workspace creation by an already-verified account, are
+   * unaffected either way — this only gates the account-creation step itself.
+   */
+  readonly signupsEnabled: boolean
   /** Injected only so tests can pin tokens. Production uses the crypto default. */
   readonly newToken?: () => string
 }
@@ -70,6 +79,24 @@ export interface SessionView {
   readonly signedInVia: string | null
 }
 
+/** What `GET /v1/auth/me` and `POST /v1/auth/workspace` answer with. */
+export interface MeView {
+  readonly userId: string
+  readonly sessionId: string
+  readonly workspaceId: string | null
+  readonly role: MemberRole | null
+  readonly emailVerified: boolean
+}
+
+/** One membership on `GET /v1/auth/workspaces`. */
+export interface AccountWorkspaceView {
+  readonly id: string
+  readonly name: string
+  readonly slug: string
+  readonly timezone: string
+  readonly role: MemberRole
+}
+
 export interface SignUpInput {
   readonly email: string
   readonly name: string
@@ -166,6 +193,10 @@ export interface AuthService {
   updatePreferences(actor: SessionActor, changes: PreferenceChanges): Promise<PreferenceValues>
   listSessions(actor: SessionActor): Promise<readonly SessionView[]>
   revokeSession(actor: SessionActor, sessionId: string): Promise<void>
+  /** Workspaces this account belongs to. Oldest membership first. */
+  listWorkspaces(actor: SessionActor): Promise<readonly AccountWorkspaceView[]>
+  /** Moves this session into a membership. Answers the same shape as `GET /v1/auth/me`. */
+  switchWorkspace(actor: SessionActor, workspaceId: string): Promise<MeView>
   /** Resolves whether or not the address is registered. */
   requestPasswordReset(email: string): Promise<void>
   confirmPasswordReset(token: string, newPassword: string): Promise<void>
@@ -250,6 +281,10 @@ export function createAuthService(dependencies: AuthDependencies): AuthService {
   return {
     /** Creates the account only. The first workspace comes from onboarding. */
     async signUp(input: SignUpInput): Promise<IssuedSession> {
+      if (!dependencies.signupsEnabled) {
+        throw new AppError('forbidden', 'Signups are closed on this instance')
+      }
+
       if (input.password.length < MINIMUM_PASSWORD_LENGTH) {
         throw AppError.validationFailed('Password is too short', [
           { field: 'password', message: `Must be at least ${MINIMUM_PASSWORD_LENGTH} characters` },
@@ -372,6 +407,12 @@ export function createAuthService(dependencies: AuthDependencies): AuthService {
         return dependencies.transaction(({ tx }) => link(tx, existing))
       }
 
+      // The instance-level gate applies before the module's own policy: a
+      // module that would provision does not get to override it.
+      if (!dependencies.signupsEnabled) {
+        throw new ExternalSignInError('signups_closed')
+      }
+
       if (input.provision === 'refuse') {
         throw new ExternalSignInError('unknown_identity')
       }
@@ -426,15 +467,25 @@ export function createAuthService(dependencies: AuthDependencies): AuthService {
      * password reset. The current password must verify, every other session
      * ends, and the address being replaced is told, in case the caller was not
      * its owner.
+     *
+     * A real change of address also resets verification and sends a fresh
+     * token to the new one. Verifying the old address proves nothing about the
+     * new one, and leaving the flag set would let anyone who can rename an
+     * unregistered account onto a given address inherit "verified" for free —
+     * exactly the mailbox-ownership proof signup's own token exists to require.
+     * Submitting the address already on file is not a change and resets nothing.
      */
     async updateAccount(actor: SessionActor, changes: UpdateAccountChanges): Promise<AccountView> {
       const user = await requireUser(actor.userId)
 
+      const nextEmail =
+        changes.email === undefined ? undefined : requireText(normaliseEmail(changes.email), 'email')
+      const emailChanging = nextEmail !== undefined && nextEmail !== user.email
+
       const values = {
         ...(changes.name === undefined ? {} : { name: requireText(changes.name, 'name') }),
-        ...(changes.email === undefined
-          ? {}
-          : { email: requireText(normaliseEmail(changes.email), 'email') }),
+        ...(nextEmail === undefined ? {} : { email: nextEmail }),
+        ...(emailChanging ? { emailVerifiedAt: null } : {}),
       }
 
       // A passwordless account cannot prove itself this way. It sets a password
@@ -449,10 +500,12 @@ export function createAuthService(dependencies: AuthDependencies): AuthService {
       }
 
       const previousEmail = user.email
+      const now = dependencies.now()
+      const verificationToken = emailChanging ? newToken() : undefined
 
       try {
         const updated = await dependencies.transaction(async ({ tx }) => {
-          const saved = await repository.updateUserProfile(tx, actor.userId, values, dependencies.now())
+          const saved = await repository.updateUserProfile(tx, actor.userId, values, now)
 
           if (saved === undefined) {
             throw AppError.unauthorized('This session no longer belongs to an account')
@@ -462,6 +515,15 @@ export function createAuthService(dependencies: AuthDependencies): AuthService {
             await repository.deleteOtherSessionsForUser(tx, actor.userId, actor.sessionId)
           }
 
+          if (verificationToken !== undefined) {
+            await repository.insertEmailVerificationToken(tx, {
+              id: dependencies.createId('emailVerificationToken'),
+              userId: actor.userId,
+              tokenHash: hashToken(verificationToken),
+              expiresAt: new Date(now.getTime() + EMAIL_VERIFICATION_TOKEN_LIFETIME_MS),
+            })
+          }
+
           return saved
         })
 
@@ -481,6 +543,13 @@ export function createAuthService(dependencies: AuthDependencies): AuthService {
           })
         }
 
+        // Sent after commit, same as signup: a rolled-back change never emails
+        // a token, and this token is only ever minted alongside a committed
+        // `emailVerifiedAt: null` write.
+        if (verificationToken !== undefined) {
+          await sendVerificationEmail(updated.email, verificationToken)
+        }
+
         return toAccountView(updated)
       } catch (error: unknown) {
         if (postgresErrorCode(error) === UNIQUE_VIOLATION) {
@@ -551,6 +620,51 @@ export function createAuthService(dependencies: AuthDependencies): AuthService {
       }
     },
 
+    async listWorkspaces(actor: SessionActor): Promise<readonly AccountWorkspaceView[]> {
+      const rows = await repository.listWorkspacesForUser(dependencies.db, actor.userId)
+
+      return rows.map((row) => {
+        const role = parseMemberRole(row.role)
+
+        if (role === undefined) {
+          throw new Error(`workspace_members.role holds "${row.role}", which its check constraint forbids`)
+        }
+
+        return {
+          id: row.id,
+          name: row.name,
+          slug: row.slug,
+          timezone: row.timezone,
+          role,
+        }
+      })
+    },
+
+    async switchWorkspace(actor: SessionActor, workspaceId: string): Promise<MeView> {
+      const membership = await repository.findMembership(dependencies.db, workspaceId, actor.userId)
+
+      if (membership === undefined) {
+        throw AppError.notFound('Workspace not found')
+      }
+
+      const role = parseMemberRole(membership.role)
+
+      if (role === undefined) {
+        throw new Error(`workspace_members.role holds "${membership.role}", which its check constraint forbids`)
+      }
+
+      await repository.setActiveWorkspace(dependencies.db, actor.sessionId, workspaceId)
+      const user = await requireUser(actor.userId)
+
+      return {
+        userId: actor.userId,
+        sessionId: actor.sessionId,
+        workspaceId,
+        role,
+        emailVerified: user.emailVerifiedAt !== null,
+      }
+    },
+
     /**
      * Always resolves, whether or not the address is registered. Telling a
      * stranger which addresses have accounts is the whole attack.

package/src/modules/companies/repository.ts

@@ -58,6 +58,7 @@ function matchesTerm(term: string): SQL | undefined {
     ilike(companies.summary, pattern),
     ilike(companies.accountType, pattern),
     arrayContainsPattern(companies.tags, pattern),
+    sql`kelpie_addresses_search_text(${companies.addresses}) ilike ${pattern}`,
   )
 }
 

package/src/modules/companies/routes.ts

@@ -1,4 +1,4 @@
-import { customFieldsPatchShape } from '@kelpie/schemas'
+import { addressBody, companyAddressesSchema, customFieldsPatchShape } from '@kelpie/schemas'
 import type { Context, Hono } from 'hono'
 import { z } from 'zod'
 
@@ -25,8 +25,7 @@ const companyShape = {
   description: z.string(),
   stage: z.enum(COMPANY_STAGES),
   size_band: z.enum(SIZE_BANDS),
-  hq: z.string().nullable(),
-  website: z.string().nullable(),
+  addresses: companyAddressesSchema,
   account_type: z.enum(ACCOUNT_TYPES),
   icp_fit: z.enum(ICP_FITS),
   tech_stack: z.array(z.string().min(1)),
@@ -48,8 +47,7 @@ export const createBody = z.strictObject({
   description: companyShape.description.default(''),
   stage: companyShape.stage.default('startup'),
   size_band: companyShape.size_band.default('1-10'),
-  hq: companyShape.hq.default(null),
-  website: companyShape.website.default(null),
+  addresses: companyShape.addresses.default([]),
   account_type: companyShape.account_type.default('prospect'),
   icp_fit: companyShape.icp_fit.default('unknown'),
   tech_stack: companyShape.tech_stack.default([]),
@@ -73,8 +71,7 @@ export function toCreateInput(body: z.infer<typeof createBody>): CreateCompanyIn
     description: body.description,
     stage: body.stage,
     sizeBand: body.size_band,
-    hq: body.hq,
-    website: body.website,
+    addresses: body.addresses,
     accountType: body.account_type,
     icpFit: body.icp_fit,
     techStack: body.tech_stack,
@@ -93,8 +90,7 @@ export function toUpdateInput(body: z.infer<typeof updateBody>): UpdateCompanyIn
     ...(body.description === undefined ? {} : { description: body.description }),
     ...(body.stage === undefined ? {} : { stage: body.stage }),
     ...(body.size_band === undefined ? {} : { sizeBand: body.size_band }),
-    ...(body.hq === undefined ? {} : { hq: body.hq }),
-    ...(body.website === undefined ? {} : { website: body.website }),
+    ...(body.addresses === undefined ? {} : { addresses: body.addresses }),
     ...(body.account_type === undefined ? {} : { accountType: body.account_type }),
     ...(body.icp_fit === undefined ? {} : { icpFit: body.icp_fit }),
     ...(body.tech_stack === undefined ? {} : { techStack: body.tech_stack }),
@@ -114,8 +110,7 @@ export function companyResponse(company: CompanyView): Record<string, unknown> {
     description: company.description,
     stage: company.stage,
     size_band: company.sizeBand,
-    hq: company.hq,
-    website: company.website,
+    addresses: company.addresses.map(addressBody),
     account_type: company.accountType,
     icp_fit: company.icpFit,
     tech_stack: company.techStack,

package/src/modules/companies/schema.ts

@@ -1,5 +1,5 @@
 import { ACCOUNT_TYPES, COMPANY_STAGES, ICP_FITS, SIZE_BANDS } from '@kelpie/schemas'
-import type { CustomFieldValue } from '@kelpie/schemas'
+import type { CompanyAddress, CustomFieldValue } from '@kelpie/schemas'
 import { boolean, index, jsonb, pgTable, text, unique } from 'drizzle-orm/pg-core'
 
 import {
@@ -36,8 +36,7 @@ export const companies = pgTable(
     description: text('description').notNull().default(''),
     stage: text('stage').notNull(),
     sizeBand: text('size_band').notNull(),
-    hq: text('hq'),
-    website: text('website'),
+    addresses: jsonb('addresses').$type<readonly CompanyAddress[]>().notNull().default([]),
     accountType: text('account_type').notNull(),
     icpFit: text('icp_fit').notNull(),
     techStack: text('tech_stack').array().notNull().default([]),
@@ -62,6 +61,7 @@ export const companies = pgTable(
       { column: companies.summary, weight: 'B' },
       { column: companies.tags, weight: 'C', array: true },
       { column: companies.techStack, weight: 'C', array: true },
+      { column: companies.addresses, weight: 'C', addresses: true },
     ]),
   },
   (table) => [

package/src/modules/companies/service.ts

@@ -1,4 +1,4 @@
-import type { CustomFieldWireValue } from '@kelpie/schemas'
+import type { CompanyAddress, CustomFieldWireValue } from '@kelpie/schemas'
 
 import { changedKeys } from '../../lib/changes.ts'
 import { UNIQUE_VIOLATION, isReferenceViolation, postgresErrorCode } from '../../lib/database.ts'
@@ -49,8 +49,7 @@ const COMPANY_FIELD_LABELS: FieldLabels = {
   description: 'Description',
   stage: 'Stage',
   sizeBand: 'Size',
-  hq: 'Headquarters',
-  website: 'Website',
+  addresses: 'Addresses',
   accountType: 'Account type',
   icpFit: 'ICP fit',
   techStack: 'Tech stack',
@@ -69,8 +68,7 @@ export interface CreateCompanyInput {
   readonly description: string
   readonly stage: CompanyStage
   readonly sizeBand: SizeBand
-  readonly hq: string | null
-  readonly website: string | null
+  readonly addresses: readonly CompanyAddress[]
   readonly accountType: AccountType
   readonly icpFit: IcpFit
   readonly techStack: readonly string[]
@@ -102,7 +100,7 @@ function toView(record: CompanyRecord): CompanyView {
  * The stored form of what the caller sent. A domain arrives however someone
  * pasted it and is reduced to a host; blank becomes null, because the domain is
  * unique per workspace and a stored `''` would make the second company without a
- * website a 409.
+ * domain a 409.
  */
 function toStoredColumns(input: UpdateCompanyInput): Partial<repository.CompanyColumns> {
   return {
@@ -114,8 +112,7 @@ function toStoredColumns(input: UpdateCompanyInput): Partial<repository.CompanyC
     ...(input.description === undefined ? {} : { description: input.description }),
     ...(input.stage === undefined ? {} : { stage: input.stage }),
     ...(input.sizeBand === undefined ? {} : { sizeBand: input.sizeBand }),
-    ...(input.hq === undefined ? {} : { hq: input.hq }),
-    ...(input.website === undefined ? {} : { website: input.website }),
+    ...(input.addresses === undefined ? {} : { addresses: input.addresses }),
     ...(input.accountType === undefined ? {} : { accountType: input.accountType }),
     ...(input.icpFit === undefined ? {} : { icpFit: input.icpFit }),
     ...(input.techStack === undefined ? {} : { techStack: [...input.techStack] }),
@@ -180,8 +177,7 @@ export function createCompaniesService(dependencies: CompaniesDependencies): Com
             description: input.description,
             stage: input.stage,
             sizeBand: input.sizeBand,
-            hq: input.hq,
-            website: input.website,
+            addresses: input.addresses,
             accountType: input.accountType,
             icpFit: input.icpFit,
             techStack: [...input.techStack],

package/src/modules/core.ts

@@ -13,6 +13,7 @@ import { createDealsModule } from './deals/index.ts'
 import { createDecisionsModule } from './decisions/index.ts'
 import { createEmailDomainLinkerModule } from './email-domain-linker/index.ts'
 import { createEnquiriesModule } from './enquiries/index.ts'
+import { createEventsModule } from './events/index.ts'
 import { createFormsModule } from './forms/index.ts'
 import { createHandbookModule } from './handbook/index.ts'
 import { createHiringModule } from './hiring/index.ts'
@@ -68,6 +69,7 @@ export const coreModules: readonly KelpieModule[] = [
   createPartnershipsModule(coreMigrationsDirectory),
   createRaisesModule(coreMigrationsDirectory),
   createHiringModule(coreMigrationsDirectory),
+  createEventsModule(coreMigrationsDirectory),
   createPlansModule(coreMigrationsDirectory),
   createDecisionsModule(coreMigrationsDirectory),
   createListsModule(coreMigrationsDirectory),

package/src/modules/custom-fields/repository.ts

@@ -8,6 +8,7 @@ import type { Queryable } from '../../runtime/transaction.ts'
 import { companies } from '../companies/schema.ts'
 import { deals } from '../deals/schema.ts'
 import { enquiries } from '../enquiries/schema.ts'
+import { events } from '../events/schema.ts'
 import { opportunities } from '../opportunities/schema.ts'
 import { partnerships } from '../partnerships/schema.ts'
 import { people } from '../people/schema.ts'
@@ -178,6 +179,7 @@ const TABLES = {
   partnership: partnerships,
   raise: raises,
   enquiry: enquiries,
+  event: events,
 } as const
 
 /**

package/src/modules/dashboard/index.ts

@@ -27,6 +27,7 @@ export function createDashboardModule(): KelpieModule {
       'raises',
       'partnerships',
       'plans',
+      'events',
       'decisions',
       'notes',
       'activities',