@kelpie/server 0.12.0 → 0.14.0

package/src/modules/auth/service.ts

@@ -9,6 +9,8 @@ import { MINIMUM_PASSWORD_LENGTH, hashPassword, verifyPassword } from '../../lib
 import { generateToken, hashToken } from '../../lib/tokens.ts'
 import type { VerifiedIdentity } from '../../runtime/module.ts'
 import type { TransactionScope } from '../../runtime/transaction.ts'
+import type { MemberRole } from '../workspace/roles.ts'
+import { parseMemberRole } from '../workspace/roles.ts'
 import type { SessionActor } from './actor.ts'
 import { DEFAULT_PREFERENCES, applyPreferenceChanges } from './preferences.ts'
 import type { PreferenceChanges, PreferenceValues } from './preferences.ts'
@@ -36,6 +38,13 @@ export interface AuthDependencies {
   readonly now: () => Date
   /** The deployment's own base URL. Every emailed link is built from it. */
   readonly appBaseUrl: string
+  /**
+   * Whether a brand-new account may be created, through `signUp` or
+   * `completeExternalSignIn` provisioning. Joining an existing workspace via
+   * invite, and workspace creation by an already-verified account, are
+   * unaffected either way — this only gates the account-creation step itself.
+   */
+  readonly signupsEnabled: boolean
   /** Injected only so tests can pin tokens. Production uses the crypto default. */
   readonly newToken?: () => string
 }
@@ -70,6 +79,24 @@ export interface SessionView {
   readonly signedInVia: string | null
 }
 
+/** What `GET /v1/auth/me` and `POST /v1/auth/workspace` answer with. */
+export interface MeView {
+  readonly userId: string
+  readonly sessionId: string
+  readonly workspaceId: string | null
+  readonly role: MemberRole | null
+  readonly emailVerified: boolean
+}
+
+/** One membership on `GET /v1/auth/workspaces`. */
+export interface AccountWorkspaceView {
+  readonly id: string
+  readonly name: string
+  readonly slug: string
+  readonly timezone: string
+  readonly role: MemberRole
+}
+
 export interface SignUpInput {
   readonly email: string
   readonly name: string
@@ -166,6 +193,10 @@ export interface AuthService {
   updatePreferences(actor: SessionActor, changes: PreferenceChanges): Promise<PreferenceValues>
   listSessions(actor: SessionActor): Promise<readonly SessionView[]>
   revokeSession(actor: SessionActor, sessionId: string): Promise<void>
+  /** Workspaces this account belongs to. Oldest membership first. */
+  listWorkspaces(actor: SessionActor): Promise<readonly AccountWorkspaceView[]>
+  /** Moves this session into a membership. Answers the same shape as `GET /v1/auth/me`. */
+  switchWorkspace(actor: SessionActor, workspaceId: string): Promise<MeView>
   /** Resolves whether or not the address is registered. */
   requestPasswordReset(email: string): Promise<void>
   confirmPasswordReset(token: string, newPassword: string): Promise<void>
@@ -250,6 +281,10 @@ export function createAuthService(dependencies: AuthDependencies): AuthService {
   return {
     /** Creates the account only. The first workspace comes from onboarding. */
     async signUp(input: SignUpInput): Promise<IssuedSession> {
+      if (!dependencies.signupsEnabled) {
+        throw new AppError('forbidden', 'Signups are closed on this instance')
+      }
+
       if (input.password.length < MINIMUM_PASSWORD_LENGTH) {
         throw AppError.validationFailed('Password is too short', [
           { field: 'password', message: `Must be at least ${MINIMUM_PASSWORD_LENGTH} characters` },
@@ -372,6 +407,12 @@ export function createAuthService(dependencies: AuthDependencies): AuthService {
         return dependencies.transaction(({ tx }) => link(tx, existing))
       }
 
+      // The instance-level gate applies before the module's own policy: a
+      // module that would provision does not get to override it.
+      if (!dependencies.signupsEnabled) {
+        throw new ExternalSignInError('signups_closed')
+      }
+
       if (input.provision === 'refuse') {
         throw new ExternalSignInError('unknown_identity')
       }
@@ -426,15 +467,25 @@ export function createAuthService(dependencies: AuthDependencies): AuthService {
      * password reset. The current password must verify, every other session
      * ends, and the address being replaced is told, in case the caller was not
      * its owner.
+     *
+     * A real change of address also resets verification and sends a fresh
+     * token to the new one. Verifying the old address proves nothing about the
+     * new one, and leaving the flag set would let anyone who can rename an
+     * unregistered account onto a given address inherit "verified" for free —
+     * exactly the mailbox-ownership proof signup's own token exists to require.
+     * Submitting the address already on file is not a change and resets nothing.
      */
     async updateAccount(actor: SessionActor, changes: UpdateAccountChanges): Promise<AccountView> {
       const user = await requireUser(actor.userId)
 
+      const nextEmail =
+        changes.email === undefined ? undefined : requireText(normaliseEmail(changes.email), 'email')
+      const emailChanging = nextEmail !== undefined && nextEmail !== user.email
+
       const values = {
         ...(changes.name === undefined ? {} : { name: requireText(changes.name, 'name') }),
-        ...(changes.email === undefined
-          ? {}
-          : { email: requireText(normaliseEmail(changes.email), 'email') }),
+        ...(nextEmail === undefined ? {} : { email: nextEmail }),
+        ...(emailChanging ? { emailVerifiedAt: null } : {}),
       }
 
       // A passwordless account cannot prove itself this way. It sets a password
@@ -449,10 +500,12 @@ export function createAuthService(dependencies: AuthDependencies): AuthService {
       }
 
       const previousEmail = user.email
+      const now = dependencies.now()
+      const verificationToken = emailChanging ? newToken() : undefined
 
       try {
         const updated = await dependencies.transaction(async ({ tx }) => {
-          const saved = await repository.updateUserProfile(tx, actor.userId, values, dependencies.now())
+          const saved = await repository.updateUserProfile(tx, actor.userId, values, now)
 
           if (saved === undefined) {
             throw AppError.unauthorized('This session no longer belongs to an account')
@@ -462,6 +515,15 @@ export function createAuthService(dependencies: AuthDependencies): AuthService {
             await repository.deleteOtherSessionsForUser(tx, actor.userId, actor.sessionId)
           }
 
+          if (verificationToken !== undefined) {
+            await repository.insertEmailVerificationToken(tx, {
+              id: dependencies.createId('emailVerificationToken'),
+              userId: actor.userId,
+              tokenHash: hashToken(verificationToken),
+              expiresAt: new Date(now.getTime() + EMAIL_VERIFICATION_TOKEN_LIFETIME_MS),
+            })
+          }
+
           return saved
         })
 
@@ -481,6 +543,13 @@ export function createAuthService(dependencies: AuthDependencies): AuthService {
           })
         }
 
+        // Sent after commit, same as signup: a rolled-back change never emails
+        // a token, and this token is only ever minted alongside a committed
+        // `emailVerifiedAt: null` write.
+        if (verificationToken !== undefined) {
+          await sendVerificationEmail(updated.email, verificationToken)
+        }
+
         return toAccountView(updated)
       } catch (error: unknown) {
         if (postgresErrorCode(error) === UNIQUE_VIOLATION) {
@@ -551,6 +620,51 @@ export function createAuthService(dependencies: AuthDependencies): AuthService {
       }
     },
 
+    async listWorkspaces(actor: SessionActor): Promise<readonly AccountWorkspaceView[]> {
+      const rows = await repository.listWorkspacesForUser(dependencies.db, actor.userId)
+
+      return rows.map((row) => {
+        const role = parseMemberRole(row.role)
+
+        if (role === undefined) {
+          throw new Error(`workspace_members.role holds "${row.role}", which its check constraint forbids`)
+        }
+
+        return {
+          id: row.id,
+          name: row.name,
+          slug: row.slug,
+          timezone: row.timezone,
+          role,
+        }
+      })
+    },
+
+    async switchWorkspace(actor: SessionActor, workspaceId: string): Promise<MeView> {
+      const membership = await repository.findMembership(dependencies.db, workspaceId, actor.userId)
+
+      if (membership === undefined) {
+        throw AppError.notFound('Workspace not found')
+      }
+
+      const role = parseMemberRole(membership.role)
+
+      if (role === undefined) {
+        throw new Error(`workspace_members.role holds "${membership.role}", which its check constraint forbids`)
+      }
+
+      await repository.setActiveWorkspace(dependencies.db, actor.sessionId, workspaceId)
+      const user = await requireUser(actor.userId)
+
+      return {
+        userId: actor.userId,
+        sessionId: actor.sessionId,
+        workspaceId,
+        role,
+        emailVerified: user.emailVerifiedAt !== null,
+      }
+    },
+
     /**
      * Always resolves, whether or not the address is registered. Telling a
      * stranger which addresses have accounts is the whole attack.

package/src/modules/companies/repository.ts

@@ -58,6 +58,7 @@ function matchesTerm(term: string): SQL | undefined {
     ilike(companies.summary, pattern),
     ilike(companies.accountType, pattern),
     arrayContainsPattern(companies.tags, pattern),
+    sql`kelpie_addresses_search_text(${companies.addresses}) ilike ${pattern}`,
   )
 }
 

package/src/modules/companies/routes.ts

@@ -1,4 +1,4 @@
-import { customFieldsPatchShape } from '@kelpie/schemas'
+import { addressBody, companyAddressesSchema, customFieldsPatchShape } from '@kelpie/schemas'
 import type { Context, Hono } from 'hono'
 import { z } from 'zod'
 
@@ -25,8 +25,7 @@ const companyShape = {
   description: z.string(),
   stage: z.enum(COMPANY_STAGES),
   size_band: z.enum(SIZE_BANDS),
-  hq: z.string().nullable(),
-  website: z.string().nullable(),
+  addresses: companyAddressesSchema,
   account_type: z.enum(ACCOUNT_TYPES),
   icp_fit: z.enum(ICP_FITS),
   tech_stack: z.array(z.string().min(1)),
@@ -48,8 +47,7 @@ export const createBody = z.strictObject({
   description: companyShape.description.default(''),
   stage: companyShape.stage.default('startup'),
   size_band: companyShape.size_band.default('1-10'),
-  hq: companyShape.hq.default(null),
-  website: companyShape.website.default(null),
+  addresses: companyShape.addresses.default([]),
   account_type: companyShape.account_type.default('prospect'),
   icp_fit: companyShape.icp_fit.default('unknown'),
   tech_stack: companyShape.tech_stack.default([]),
@@ -73,8 +71,7 @@ export function toCreateInput(body: z.infer<typeof createBody>): CreateCompanyIn
     description: body.description,
     stage: body.stage,
     sizeBand: body.size_band,
-    hq: body.hq,
-    website: body.website,
+    addresses: body.addresses,
     accountType: body.account_type,
     icpFit: body.icp_fit,
     techStack: body.tech_stack,
@@ -93,8 +90,7 @@ export function toUpdateInput(body: z.infer<typeof updateBody>): UpdateCompanyIn
     ...(body.description === undefined ? {} : { description: body.description }),
     ...(body.stage === undefined ? {} : { stage: body.stage }),
     ...(body.size_band === undefined ? {} : { sizeBand: body.size_band }),
-    ...(body.hq === undefined ? {} : { hq: body.hq }),
-    ...(body.website === undefined ? {} : { website: body.website }),
+    ...(body.addresses === undefined ? {} : { addresses: body.addresses }),
     ...(body.account_type === undefined ? {} : { accountType: body.account_type }),
     ...(body.icp_fit === undefined ? {} : { icpFit: body.icp_fit }),
     ...(body.tech_stack === undefined ? {} : { techStack: body.tech_stack }),
@@ -114,8 +110,7 @@ export function companyResponse(company: CompanyView): Record<string, unknown> {
     description: company.description,
     stage: company.stage,
     size_band: company.sizeBand,
-    hq: company.hq,
-    website: company.website,
+    addresses: company.addresses.map(addressBody),
     account_type: company.accountType,
     icp_fit: company.icpFit,
     tech_stack: company.techStack,

package/src/modules/companies/schema.ts

@@ -1,5 +1,5 @@
 import { ACCOUNT_TYPES, COMPANY_STAGES, ICP_FITS, SIZE_BANDS } from '@kelpie/schemas'
-import type { CustomFieldValue } from '@kelpie/schemas'
+import type { CompanyAddress, CustomFieldValue } from '@kelpie/schemas'
 import { boolean, index, jsonb, pgTable, text, unique } from 'drizzle-orm/pg-core'
 
 import {
@@ -36,8 +36,7 @@ export const companies = pgTable(
     description: text('description').notNull().default(''),
     stage: text('stage').notNull(),
     sizeBand: text('size_band').notNull(),
-    hq: text('hq'),
-    website: text('website'),
+    addresses: jsonb('addresses').$type<readonly CompanyAddress[]>().notNull().default([]),
     accountType: text('account_type').notNull(),
     icpFit: text('icp_fit').notNull(),
     techStack: text('tech_stack').array().notNull().default([]),
@@ -62,6 +61,7 @@ export const companies = pgTable(
       { column: companies.summary, weight: 'B' },
       { column: companies.tags, weight: 'C', array: true },
       { column: companies.techStack, weight: 'C', array: true },
+      { column: companies.addresses, weight: 'C', addresses: true },
     ]),
   },
   (table) => [

package/src/modules/companies/service.ts

@@ -1,4 +1,4 @@
-import type { CustomFieldWireValue } from '@kelpie/schemas'
+import type { CompanyAddress, CustomFieldWireValue } from '@kelpie/schemas'
 
 import { changedKeys } from '../../lib/changes.ts'
 import { UNIQUE_VIOLATION, isReferenceViolation, postgresErrorCode } from '../../lib/database.ts'
@@ -49,8 +49,7 @@ const COMPANY_FIELD_LABELS: FieldLabels = {
   description: 'Description',
   stage: 'Stage',
   sizeBand: 'Size',
-  hq: 'Headquarters',
-  website: 'Website',
+  addresses: 'Addresses',
   accountType: 'Account type',
   icpFit: 'ICP fit',
   techStack: 'Tech stack',
@@ -69,8 +68,7 @@ export interface CreateCompanyInput {
   readonly description: string
   readonly stage: CompanyStage
   readonly sizeBand: SizeBand
-  readonly hq: string | null
-  readonly website: string | null
+  readonly addresses: readonly CompanyAddress[]
   readonly accountType: AccountType
   readonly icpFit: IcpFit
   readonly techStack: readonly string[]
@@ -102,7 +100,7 @@ function toView(record: CompanyRecord): CompanyView {
  * The stored form of what the caller sent. A domain arrives however someone
  * pasted it and is reduced to a host; blank becomes null, because the domain is
  * unique per workspace and a stored `''` would make the second company without a
- * website a 409.
+ * domain a 409.
  */
 function toStoredColumns(input: UpdateCompanyInput): Partial<repository.CompanyColumns> {
   return {
@@ -114,8 +112,7 @@ function toStoredColumns(input: UpdateCompanyInput): Partial<repository.CompanyC
     ...(input.description === undefined ? {} : { description: input.description }),
     ...(input.stage === undefined ? {} : { stage: input.stage }),
     ...(input.sizeBand === undefined ? {} : { sizeBand: input.sizeBand }),
-    ...(input.hq === undefined ? {} : { hq: input.hq }),
-    ...(input.website === undefined ? {} : { website: input.website }),
+    ...(input.addresses === undefined ? {} : { addresses: input.addresses }),
     ...(input.accountType === undefined ? {} : { accountType: input.accountType }),
     ...(input.icpFit === undefined ? {} : { icpFit: input.icpFit }),
     ...(input.techStack === undefined ? {} : { techStack: [...input.techStack] }),
@@ -180,8 +177,7 @@ export function createCompaniesService(dependencies: CompaniesDependencies): Com
             description: input.description,
             stage: input.stage,
             sizeBand: input.sizeBand,
-            hq: input.hq,
-            website: input.website,
+            addresses: input.addresses,
             accountType: input.accountType,
             icpFit: input.icpFit,
             techStack: [...input.techStack],

package/src/modules/core.ts

@@ -13,6 +13,7 @@ import { createDealsModule } from './deals/index.ts'
 import { createDecisionsModule } from './decisions/index.ts'
 import { createEmailDomainLinkerModule } from './email-domain-linker/index.ts'
 import { createEnquiriesModule } from './enquiries/index.ts'
+import { createEventsModule } from './events/index.ts'
 import { createFormsModule } from './forms/index.ts'
 import { createHandbookModule } from './handbook/index.ts'
 import { createHiringModule } from './hiring/index.ts'
@@ -68,6 +69,7 @@ export const coreModules: readonly KelpieModule[] = [
   createPartnershipsModule(coreMigrationsDirectory),
   createRaisesModule(coreMigrationsDirectory),
   createHiringModule(coreMigrationsDirectory),
+  createEventsModule(coreMigrationsDirectory),
   createPlansModule(coreMigrationsDirectory),
   createDecisionsModule(coreMigrationsDirectory),
   createListsModule(coreMigrationsDirectory),

package/src/modules/custom-fields/repository.ts

@@ -8,6 +8,7 @@ import type { Queryable } from '../../runtime/transaction.ts'
 import { companies } from '../companies/schema.ts'
 import { deals } from '../deals/schema.ts'
 import { enquiries } from '../enquiries/schema.ts'
+import { events } from '../events/schema.ts'
 import { opportunities } from '../opportunities/schema.ts'
 import { partnerships } from '../partnerships/schema.ts'
 import { people } from '../people/schema.ts'
@@ -178,6 +179,7 @@ const TABLES = {
   partnership: partnerships,
   raise: raises,
   enquiry: enquiries,
+  event: events,
 } as const
 
 /**

package/src/modules/dashboard/index.ts

@@ -27,6 +27,7 @@ export function createDashboardModule(): KelpieModule {
       'raises',
       'partnerships',
       'plans',
+      'events',
       'decisions',
       'notes',
       'activities',

package/src/modules/dashboard/repository.ts

@@ -9,6 +9,7 @@ import { activities } from '../activities/schema.ts'
 import { decisions } from '../decisions/schema.ts'
 import { deals } from '../deals/schema.ts'
 import { enquiries } from '../enquiries/schema.ts'
+import { attendances, events } from '../events/schema.ts'
 import { notes } from '../notes/schema.ts'
 import { opportunities } from '../opportunities/schema.ts'
 import { partnerships } from '../partnerships/schema.ts'
@@ -242,6 +243,69 @@ export async function listPartnershipTouchpoints(
   )
 }
 
+/** A scheduled Event whose start is inside `[from, to)`. */
+export interface UpcomingEventRecord {
+  readonly id: string
+  readonly name: string
+  readonly startsAt: Date
+  readonly endsAt: Date
+  readonly format: string
+  readonly location: string
+  readonly attendeeCount: number
+  readonly ownerId: string | null
+}
+
+function upcomingEventConditions(workspaceId: string, from: Date, to: Date): (SQL | undefined)[] {
+  return [
+    eq(events.workspaceId, workspaceId),
+    eq(events.status, 'scheduled'),
+    gte(events.startsAt, from),
+    lt(events.startsAt, to),
+  ]
+}
+
+export async function countUpcomingEvents(
+  db: Queryable,
+  workspaceId: string,
+  from: Date,
+  to: Date,
+): Promise<number> {
+  const [row] = await db
+    .select({ total: count() })
+    .from(events)
+    .where(and(...upcomingEventConditions(workspaceId, from, to)))
+
+  return row?.total ?? 0
+}
+
+export async function listUpcomingEvents(
+  db: Queryable,
+  workspaceId: string,
+  from: Date,
+  to: Date,
+  limit: number,
+): Promise<readonly UpcomingEventRecord[]> {
+  const rows = await db
+    .select({
+      id: events.id,
+      name: events.name,
+      startsAt: events.startsAt,
+      endsAt: events.endsAt,
+      format: events.format,
+      location: events.location,
+      ownerId: events.ownerId,
+      attendeeCount: sql<number>`coalesce(count(${attendances.id}) filter (where ${attendances.status} <> 'cancelled'), 0)::int`,
+    })
+    .from(events)
+    .leftJoin(attendances, eq(attendances.eventId, events.id))
+    .where(and(...upcomingEventConditions(workspaceId, from, to)))
+    .groupBy(events.id)
+    .orderBy(asc(events.startsAt), asc(events.id))
+    .limit(limit)
+
+  return rows
+}
+
 /**
  * The calendar day a contact happened on, in the workspace's zone.
  *

package/src/modules/dashboard/routes.ts

@@ -15,6 +15,7 @@ import type {
   SignalList,
   StaleContactSignal,
   TouchpointSignal,
+  UpcomingEventSignal,
 } from './service.ts'
 
 /**
@@ -83,6 +84,19 @@ function touchpointBody(touchpoint: TouchpointSignal): Record<string, unknown> {
   }
 }
 
+function upcomingEventBody(event: UpcomingEventSignal): Record<string, unknown> {
+  return {
+    id: event.id,
+    name: event.name,
+    starts_at: event.startsAt.toISOString(),
+    ends_at: event.endsAt.toISOString(),
+    format: event.format,
+    location: event.location,
+    attendee_count: event.attendeeCount,
+    owner_id: event.ownerId,
+  }
+}
+
 function staleContactBody(contact: StaleContactSignal): Record<string, unknown> {
   return {
     id: contact.id,
@@ -147,6 +161,7 @@ export function dashboardResponse(snapshot: DashboardSnapshot): Record<string, u
     overdue_plan_items: signalListBody(snapshot.overduePlanItems, planItemBody),
     due_soon_plan_items: signalListBody(snapshot.dueSoonPlanItems, planItemBody),
     partnership_touchpoints: signalListBody(snapshot.partnershipTouchpoints, touchpointBody),
+    upcoming_events: signalListBody(snapshot.upcomingEvents, upcomingEventBody),
     stale_contacts: signalListBody(snapshot.staleContacts, staleContactBody),
     recent_activity: snapshot.recentActivity.map(activityBody),
     recent_notes: snapshot.recentNotes.map(noteBody),

package/src/modules/dashboard/service.ts

@@ -117,6 +117,17 @@ export interface DecisionSignal extends TargetRef {
   readonly dueAt: Date | null
 }
 
+export interface UpcomingEventSignal {
+  readonly id: string
+  readonly name: string
+  readonly startsAt: Date
+  readonly endsAt: Date
+  readonly format: string
+  readonly location: string
+  readonly attendeeCount: number
+  readonly ownerId: string | null
+}
+
 export interface DashboardSnapshot {
   readonly generatedAt: Date
   /** The day everything below was computed against, `YYYY-MM-DD`. */
@@ -129,6 +140,7 @@ export interface DashboardSnapshot {
   readonly overduePlanItems: SignalList<PlanItemSignal>
   readonly dueSoonPlanItems: SignalList<PlanItemSignal>
   readonly partnershipTouchpoints: SignalList<TouchpointSignal>
+  readonly upcomingEvents: SignalList<UpcomingEventSignal>
   readonly staleContacts: SignalList<StaleContactSignal>
   readonly recentActivity: readonly ActivitySignal[]
   readonly recentNotes: readonly NoteSignal[]
@@ -155,6 +167,10 @@ interface DayBounds {
   readonly through: string
   /** The first day a contact still counts as fresh. */
   readonly staleCutoff: string
+  /** Instant the upcoming Events window starts (now). */
+  readonly fromInstant: Date
+  /** Instant the upcoming Events window ends (now plus `UPCOMING_DAYS`). */
+  readonly throughInstant: Date
 }
 
 /** Everything read from the database, before any of it is named or shaped. */
@@ -163,6 +179,7 @@ interface SignalRows {
   readonly overduePlanItems: SignalList<repository.PlanItemRecord>
   readonly dueSoonPlanItems: SignalList<repository.PlanItemRecord>
   readonly partnershipTouchpoints: SignalList<repository.TouchpointRecord>
+  readonly upcomingEvents: SignalList<repository.UpcomingEventRecord>
   readonly staleContacts: SignalList<repository.StaleContactRecord>
   readonly recentActivity: readonly repository.ActivityRecord[]
   readonly recentNotes: readonly repository.NoteRecord[]
@@ -201,6 +218,19 @@ async function readTouchpoints(
   }
 }
 
+async function readUpcomingEvents(
+  db: Database,
+  workspaceId: string,
+  from: Date,
+  to: Date,
+  limit: number,
+): Promise<SignalList<repository.UpcomingEventRecord>> {
+  return {
+    total: await repository.countUpcomingEvents(db, workspaceId, from, to),
+    items: await repository.listUpcomingEvents(db, workspaceId, from, to, limit),
+  }
+}
+
 async function readStaleContacts(
   db: Database,
   workspaceId: string,
@@ -236,6 +266,7 @@ async function readSignals(
     overduePlanItems,
     dueSoonPlanItems,
     partnershipTouchpoints,
+    upcomingEvents,
     staleContacts,
     recentActivity,
     recentNotes,
@@ -245,6 +276,7 @@ async function readSignals(
     readPlanItems(db, workspaceId, { before: days.today }, limit),
     readPlanItems(db, workspaceId, { from: days.today, to: days.through }, limit),
     readTouchpoints(db, workspaceId, days.through, limit),
+    readUpcomingEvents(db, workspaceId, days.fromInstant, days.throughInstant, limit),
     readStaleContacts(db, workspaceId, timezone, days.staleCutoff, limit),
     repository.listRecentActivity(db, workspaceId, limit),
     repository.listRecentNotes(db, workspaceId, limit),
@@ -256,6 +288,7 @@ async function readSignals(
     overduePlanItems,
     dueSoonPlanItems,
     partnershipTouchpoints,
+    upcomingEvents,
     staleContacts,
     recentActivity,
     recentNotes,
@@ -376,6 +409,19 @@ function toSnapshot(
     overduePlanItems: toPlanItemSignal(rows.overduePlanItems, nameOf),
     dueSoonPlanItems: toPlanItemSignal(rows.dueSoonPlanItems, nameOf),
     partnershipTouchpoints: toTouchpointSignal(rows.partnershipTouchpoints, days.today),
+    upcomingEvents: {
+      total: rows.upcomingEvents.total,
+      items: rows.upcomingEvents.items.map((row) => ({
+        id: row.id,
+        name: row.name,
+        startsAt: row.startsAt,
+        endsAt: row.endsAt,
+        format: row.format,
+        location: row.location,
+        attendeeCount: row.attendeeCount,
+        ownerId: row.ownerId,
+      })),
+    },
     staleContacts: toStaleContactSignal(rows.staleContacts, days.today),
     recentActivity: rows.recentActivity.map((row) => ({
       id: row.id,
@@ -436,6 +482,8 @@ export function createDashboardService(dependencies: DashboardDependencies): Das
         today,
         through: upcomingEnd(today),
         staleCutoff: staleContactCutoff(today),
+        fromInstant: generatedAt,
+        throughInstant: new Date(generatedAt.getTime() + UPCOMING_DAYS * 24 * 60 * 60 * 1000),
       }
 
       const rows = await readSignals(dependencies.db, workspaceId, timezone, days, limit)

package/src/modules/decisions/repository.ts

@@ -8,6 +8,7 @@ import type { Queryable } from '../../runtime/transaction.ts'
 import { companies } from '../companies/schema.ts'
 import { deals } from '../deals/schema.ts'
 import { enquiries } from '../enquiries/schema.ts'
+import { events } from '../events/schema.ts'
 import { opportunities } from '../opportunities/schema.ts'
 import { partnerships } from '../partnerships/schema.ts'
 import { people } from '../people/schema.ts'
@@ -57,6 +58,7 @@ const NAMED_TARGET_TABLES = [
   { table: partnerships, id: partnerships.id, workspaceId: partnerships.workspaceId, name: partnerships.name },
   { table: raises, id: raises.id, workspaceId: raises.workspaceId, name: raises.name },
   { table: enquiries, id: enquiries.id, workspaceId: enquiries.workspaceId, name: enquiries.name },
+  { table: events, id: events.id, workspaceId: events.workspaceId, name: events.name },
 ]
 
 /**