@kelpie/server 0.8.0 → 0.9.0

package/src/modules/enquiries/tools.ts

@@ -0,0 +1,66 @@
+import { z } from 'zod'
+
+import type { McpToolRegistry } from '../../runtime/module.ts'
+import {
+  idArg,
+  idSetArg,
+  listWindowShape,
+  registerCrudTools,
+  termArg,
+  toSet,
+} from '../crudTools.ts'
+import { dealResponse } from '../deals/routes.ts'
+import { createBody, enquiryResponse, toCreateInput, toUpdateInput, updateBody } from './routes.ts'
+import type { EnquiriesService } from './service.ts'
+
+/** `enquiries_*`. Same schemas and mappers as `/v1/enquiries`. */
+
+const listArgs = z.strictObject({
+  ...listWindowShape,
+  q: termArg,
+  source: idSetArg.optional().describe('Sources are free text, so a match here is exact.'),
+  company_id: idSetArg.optional().describe('Only enquiries with these companies.'),
+  stage_id: idSetArg.optional().describe('Only enquiries in these pipeline stages.'),
+  person_id: idSetArg.optional().describe('Only enquiries any of these people are on.'),
+})
+
+export function registerEnquiriesTools(mcp: McpToolRegistry, service: EnquiriesService): void {
+  registerCrudTools(mcp, {
+    resource: 'enquiries',
+    subject: 'enquiry',
+    about:
+      'An inbound enquiry: a top-of-funnel request that may become a Deal once qualified. ' +
+      'Not itself a deal.',
+    service,
+    render: enquiryResponse,
+    listArgs,
+    toFilters: (args) => ({
+      term: args.q,
+      sources: toSet(args.source),
+      companyIds: toSet(args.company_id),
+      stageIds: toSet(args.stage_id),
+      personIds: toSet(args.person_id),
+    }),
+    createArgs: createBody,
+    toCreateInput,
+    updateArgs: updateBody.extend({ id: idArg }),
+    toUpdateInput,
+  })
+
+  mcp.tool({
+    name: 'enquiries_convert_to_deal',
+    description:
+      'Convert an enquiry to a Deal. Copies name, company, owner and linked ' +
+      'people to a new deal in the first open deal stage, moves the enquiry ' +
+      'to its first closed stage, and records the link on the enquiry. 409 if ' +
+      'the enquiry has already been converted; 422 if it has no company. ' +
+      'Mirrors POST /v1/enquiries/{id}/convert.',
+    inputSchema: z.strictObject({ id: idArg }),
+    invoke: async ({ id }, actor) => {
+      const { deal, personIds } = await service.convertToDeal(actor, id)
+      const { workspaceId: _workspaceId, ...dealView } = deal
+
+      return dealResponse({ ...dealView, personIds })
+    },
+  })
+}

package/src/modules/eventCatalogs.ts

@@ -24,7 +24,10 @@ import './companies/events.ts'
 import './positions/events.ts'
 import './notes/events.ts'
 import './lists/events.ts'
+import './consent-purposes/events.ts'
+import './custom-fields/events.ts'
 import './deals/events.ts'
+import './enquiries/events.ts'
 import './opportunities/events.ts'
 import './partnerships/events.ts'
 import './raises/events.ts'

package/src/modules/forms/embed.ts

@@ -7,6 +7,11 @@ import type { FormFieldRecord, FormRecord } from './repository.ts'
  * frames a page from the Kelpie origin, and that page must not drag the CRM's
  * React bundle into somebody else's marketing site to draw five inputs.
  *
+ * The hosted layout carries Kelpie's look. The iframe layout is intentionally
+ * unbranded (system font, Field colours) so it does not paint Kelpie onto the
+ * host site — an iframe cannot inherit the host's CSS, so staying neutral is
+ * the alternative.
+ *
  * Everything here is pure: a form, its fields, and a URL in; a string out. That
  * is what makes the escaping testable, which for a page built by string
  * concatenation is the part worth testing.
@@ -74,9 +79,56 @@ function renderControl(field: FormFieldRecord): string {
   return `<input ${shared} type="${field.type === 'email' ? 'email' : 'text'}">`
 }
 
-function renderField(field: FormFieldRecord): string {
+function renderField(
+  field: FormFieldRecord,
+  consentPurposeLabels: ReadonlyMap<string, string>,
+): string {
   const required = field.required ? '<span class="req" aria-hidden="true">*</span>' : ''
 
+  if (field.type === 'notice') {
+    // Text-only: prose the visitor reads before submitting. Submission is the
+    // consent (see readConsentGrants), so no input is rendered. `label` is
+    // the heading; `statement` is the prose.
+    const statement = field.statement ?? ''
+    return [
+      '<div class="field notice">',
+      `<div class="field-label">${escapeHtml(field.label)}</div>`,
+      `<p class="notice-body">${escapeHtml(statement)}</p>`,
+      '</div>',
+    ].join('')
+  }
+
+  if (field.type === 'consent') {
+    // Layout: the field label above (heading, e.g. "Consent"), the intro
+    // statement, then one checkbox per configured purpose. The submit reads
+    // the ticked checkboxes' values (purpose ids) from EMBED_SCRIPT and
+    // sends them as a comma-separated string under the field id.
+    const statement = field.statement ?? field.label
+    const rows = field.consentPurposeIds
+      .map((purposeId, index) => {
+        const boxId = `${field.id}__${String(index)}`
+        // Field-level override wins over the workspace's default label. Falls
+        // back to the workspace label, then the raw id — the id only shows up
+        // when a purpose has been deleted and its label was never overridden.
+        const override = field.consentPurposeLabels[purposeId]
+        const label = override ?? consentPurposeLabels.get(purposeId) ?? purposeId
+        return [
+          '<div class="consent-row">',
+          `<input type="checkbox" id="${escapeHtml(boxId)}" data-consent-field="${escapeHtml(field.id)}" value="${escapeHtml(purposeId)}">`,
+          `<label for="${escapeHtml(boxId)}">${escapeHtml(label)}</label>`,
+          '</div>',
+        ].join('')
+      })
+      .join('')
+    return [
+      '<div class="field consent">',
+      `<div class="field-label">${escapeHtml(field.label)}${required}</div>`,
+      `<p class="consent-statement">${escapeHtml(statement)}</p>`,
+      rows,
+      '</div>',
+    ].join('')
+  }
+
   return [
     '<div class="field">',
     `<label for="${escapeHtml(field.id)}">${escapeHtml(field.label)}${required}</label>`,
@@ -86,26 +138,247 @@ function renderField(field: FormFieldRecord): string {
 }
 
 /**
- * Styles for the page. Deliberately plain and system-font: this renders inside
- * somebody else's design, and a form that tries to bring its own brand fights
- * the site it was embedded in.
+ * Styles for the standalone hosted page — Kelpie tokens, brand chrome, card.
  */
-const EMBED_STYLES = `
-:root { color-scheme: light dark; }
+const HOSTED_STYLES = `
+:root {
+  color-scheme: light;
+  --surface: #fafafa;
+  --surface-raised: #ffffff;
+  --ink: #18181b;
+  --ink-muted: #52525b;
+  --ink-faint: #71717a;
+  --border: #e4e4e7;
+  --accent: #0f766e;
+  --accent-hover: #0d9488;
+  --accent-soft: #f0fdfa;
+  --accent-fg: #ffffff;
+  --danger: #dc2626;
+  --font: "IBM Plex Sans", ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+}
+@media (prefers-color-scheme: dark) {
+  :root {
+    color-scheme: dark;
+    --surface: #0c0c0d;
+    --surface-raised: #141416;
+    --ink: #fafafa;
+    --ink-muted: #a1a1aa;
+    --ink-faint: #71717a;
+    --border: #27272a;
+    --accent: #2dd4bf;
+    --accent-hover: #5eead4;
+    --accent-soft: #134e4a;
+    --accent-fg: #042f2e;
+    --danger: #f87171;
+  }
+}
 * { box-sizing: border-box; }
-body { margin: 0; padding: 16px; font: 15px/1.5 -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; }
-form { display: grid; gap: 14px; max-width: 32rem; margin: 0 auto; }
+html { background: var(--surface); }
+body {
+  margin: 0;
+  min-height: 100vh;
+  font: 14px/1.5 var(--font);
+  color: var(--ink);
+  -webkit-font-smoothing: antialiased;
+  background:
+    radial-gradient(ellipse at top, color-mix(in srgb, var(--accent-soft) 85%, transparent), transparent 55%),
+    var(--surface);
+}
+.shell {
+  width: 100%;
+  max-width: 28rem;
+  margin: 0 auto;
+  padding: 2.5rem 1rem 3rem;
+}
+.brand { text-align: center; margin-bottom: 1.5rem; }
+.eyebrow {
+  font-size: 11px;
+  font-weight: 600;
+  letter-spacing: 0.06em;
+  text-transform: uppercase;
+  color: var(--accent);
+}
+.brand h1 {
+  margin: 0.25rem 0 0;
+  font-size: 1.375rem;
+  font-weight: 600;
+  letter-spacing: -0.02em;
+  line-height: 1.25;
+  color: var(--ink);
+}
+.lead {
+  margin: 0.35rem 0 0;
+  font-size: 13px;
+  color: var(--ink-muted);
+}
+.card {
+  border: 1px solid var(--border);
+  border-radius: 8px;
+  background: var(--surface-raised);
+  padding: 1.5rem;
+}
+form { display: grid; gap: 1rem; margin: 0; }
+.field { display: grid; gap: 0.35rem; }
+label { font-weight: 500; font-size: 12px; color: var(--ink); }
+.req { color: var(--danger); margin-left: 2px; }
+input, textarea, select {
+  width: 100%;
+  padding: 0.5rem 0.75rem;
+  border: 1px solid var(--border);
+  border-radius: 6px;
+  font: inherit;
+  font-size: 14px;
+  color: var(--ink);
+  background: var(--surface);
+  outline: none;
+  transition: border-color 120ms ease, box-shadow 120ms ease;
+}
+input::placeholder, textarea::placeholder { color: var(--ink-faint); }
+input:focus-visible, textarea:focus-visible, select:focus-visible {
+  border-color: var(--accent);
+  box-shadow: 0 0 0 3px color-mix(in srgb, var(--accent) 20%, transparent);
+}
+textarea { resize: vertical; min-height: 6.5rem; }
+/* Consent field: label above (heading), a statement, then a checkbox per purpose. */
+.field.consent { gap: 0.35rem; }
+.field.consent .field-label {
+  font-weight: 500;
+  font-size: 12px;
+  color: var(--ink);
+}
+.field.consent .consent-statement {
+  margin: 0 0 0.35rem;
+  font-size: 12px;
+  color: var(--ink-muted);
+}
+.field.consent .consent-row {
+  display: grid;
+  grid-template-columns: auto 1fr;
+  align-items: start;
+  gap: 0.5rem;
+  padding: 0.15rem 0;
+}
+.field.consent input[type="checkbox"] {
+  width: 1rem;
+  height: 1rem;
+  margin-top: 0.2rem;
+  padding: 0;
+  background: var(--surface);
+}
+.field.consent .consent-row label {
+  font-weight: 400;
+  color: var(--ink);
+}
+.field.notice { gap: 0.35rem; }
+.field.notice .field-label {
+  font-weight: 500;
+  font-size: 12px;
+  color: var(--ink);
+}
+.field.notice .notice-body {
+  margin: 0;
+  padding: 0.5rem 0.75rem;
+  font-size: 12px;
+  color: var(--ink-muted);
+  background: var(--surface);
+  border: 1px solid var(--border);
+  border-radius: 6px;
+  white-space: pre-line;
+}
+button[type="submit"] {
+  width: 100%;
+  padding: 0.625rem 0.875rem;
+  border: 0;
+  border-radius: 6px;
+  background: var(--accent);
+  color: var(--accent-fg);
+  font: inherit;
+  font-size: 13px;
+  font-weight: 600;
+  cursor: pointer;
+  transition: background 120ms ease;
+}
+button[type="submit"]:hover:not([disabled]) { background: var(--accent-hover); }
+button[type="submit"][disabled] { opacity: 0.55; cursor: progress; }
+.note { margin: 0; font-size: 12px; color: var(--ink-muted); }
+.error { color: var(--danger); font-weight: 500; }
+.done {
+  margin: 0;
+  text-align: center;
+  font-size: 15px;
+  font-weight: 500;
+  line-height: 1.45;
+  color: var(--ink);
+}
+.paused {
+  margin: 0;
+  font-size: 13px;
+  color: var(--ink-muted);
+  text-align: center;
+}
+`
+
+/**
+ * Styles for the iframe document.
+ *
+ * Deliberately not Kelpie: system font, browser field colours, a plain button.
+ * An iframe cannot pick up the host page's CSS, so the only way not to fight
+ * the host is to stay neutral and leave the background transparent.
+ */
+const IFRAME_STYLES = `
+* { box-sizing: border-box; }
+html, body { background: transparent; }
+body {
+  margin: 0;
+  padding: 12px;
+  font: 15px/1.5 system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+  color: CanvasText;
+  -webkit-font-smoothing: antialiased;
+}
+.shell { margin: 0; padding: 0; }
+form { display: grid; gap: 14px; margin: 0; }
 .field { display: grid; gap: 5px; }
 label { font-weight: 600; font-size: 0.875rem; }
 .req { color: #b4232c; margin-left: 2px; }
-input, textarea, select { width: 100%; padding: 9px 10px; border: 1px solid #b9bfc9; border-radius: 6px; font: inherit; background: Field; color: FieldText; }
-input:focus-visible, textarea:focus-visible, select:focus-visible { outline: 2px solid #2f6feb; outline-offset: 1px; }
-textarea { resize: vertical; }
-button { padding: 10px 16px; border: 0; border-radius: 6px; background: #2f6feb; color: #fff; font: inherit; font-weight: 600; cursor: pointer; }
-button[disabled] { opacity: 0.6; cursor: progress; }
-.note { margin: 0; font-size: 0.875rem; }
-.error { color: #b4232c; }
-.done { max-width: 32rem; margin: 0 auto; }
+input, textarea, select {
+  width: 100%;
+  padding: 9px 10px;
+  border: 1px solid #b9bfc9;
+  border-radius: 6px;
+  font: inherit;
+  background: Field;
+  color: FieldText;
+}
+input:focus-visible, textarea:focus-visible, select:focus-visible {
+  outline: 2px solid #2f6feb;
+  outline-offset: 1px;
+}
+textarea { resize: vertical; min-height: 6rem; }
+.field.consent { gap: 5px; }
+.field.consent .field-label { font-weight: 600; font-size: 0.875rem; color: CanvasText; }
+.field.consent .consent-statement { margin: 0 0 5px; font-size: 0.8125rem; color: #5c6570; }
+.field.consent .consent-row { display: grid; grid-template-columns: auto 1fr; align-items: start; gap: 8px; padding: 2px 0; }
+.field.consent input[type="checkbox"] { width: 1rem; height: 1rem; margin-top: 3px; padding: 0; background: Field; }
+.field.consent .consent-row label { font-weight: 400; }
+.field.notice { gap: 5px; }
+.field.notice .field-label { font-weight: 600; font-size: 0.875rem; color: CanvasText; }
+.field.notice .notice-body { margin: 0; padding: 9px 10px; font-size: 0.8125rem; color: CanvasText; background: Field; border: 1px solid #b9bfc9; border-radius: 6px; white-space: pre-line; }
+button[type="submit"] {
+  width: 100%;
+  padding: 10px 16px;
+  border: 0;
+  border-radius: 6px;
+  background: #2f6feb;
+  color: #fff;
+  font: inherit;
+  font-weight: 600;
+  cursor: pointer;
+}
+button[type="submit"][disabled] { opacity: 0.6; cursor: progress; }
+.note { margin: 0; font-size: 0.875rem; color: #5c6570; }
+.error { color: #b4232c; font-weight: 500; }
+.done { margin: 0; font-size: 15px; font-weight: 500; line-height: 1.45; }
+.paused { margin: 0; font-size: 13px; color: #5c6570; }
 `
 
 /**
@@ -136,8 +409,28 @@ const EMBED_SCRIPT = `
     button.disabled = true;
 
     var answers = {};
+    // Consent fields render a checkbox per purpose, each tagged with
+    // data-consent-field=<field_id> and value=<purpose_id>. Collect the
+    // ticked ones into a comma-separated list under the field id — the
+    // server parses that back into a set of ticked purpose ids.
+    var consentBoxes = form.querySelectorAll('input[type="checkbox"][data-consent-field]');
+    var consentByField = {};
+    for (var i = 0; i < consentBoxes.length; i += 1) {
+      var box = consentBoxes[i];
+      var fieldId = box.getAttribute('data-consent-field');
+      if (!consentByField[fieldId]) { consentByField[fieldId] = []; }
+      if (box.checked) { consentByField[fieldId].push(box.value); }
+    }
+    for (var fieldId in consentByField) {
+      if (consentByField[fieldId].length > 0) {
+        answers[fieldId] = consentByField[fieldId].join(',');
+      }
+    }
     config.fieldIds.forEach(function (id) {
-      var value = form.elements[id].value.trim();
+      if (consentByField[id] !== undefined) { return; }
+      var element = form.elements[id];
+      if (!element) { return; }
+      var value = element.value.trim();
       if (value) { answers[id] = value; }
     });
 
@@ -166,13 +459,56 @@ const EMBED_SCRIPT = `
 })();
 `
 
+export type EmbedLayout = 'page' | 'embed'
+
 export interface EmbedPageOptions {
   readonly form: FormRecord
   readonly fields: readonly FormFieldRecord[]
+  /** Labels for the consent purposes the fields refer to, keyed by purpose id. */
+  readonly consentPurposeLabels: ReadonlyMap<string, string>
   /** Absolute URL of the public submit endpoint this page posts to. */
   readonly submitUrl: string
   /** Per-response value tying the inline style and script to the CSP header. */
   readonly nonce: string
+  /** Workspace name shown above the form title on the hosted page layout. */
+  readonly workspaceName: string
+  /**
+   * `page` is the standalone hosted URL (brand chrome). `embed` is the iframe
+   * document: fields only, no page design around them.
+   */
+  readonly layout: EmbedLayout
+}
+
+/**
+ * Public heading for the hosted page: the form's `title`, falling back to
+ * `name` if somehow blank (legacy rows, a cleared field).
+ */
+function displayTitle(form: FormRecord): string {
+  const title = form.title.trim()
+
+  return title.length > 0 ? title : form.name
+}
+
+function renderFormBody(
+  form: FormRecord,
+  fields: readonly FormFieldRecord[],
+  consentPurposeLabels: ReadonlyMap<string, string>,
+  config: string,
+  nonce: string,
+): string {
+  if (form.status === 'paused') {
+    return `<p class="paused">This form is not accepting submissions right now.</p>`
+  }
+
+  return [
+    '<form id="kelpie-form" novalidate>',
+    fields.map((field) => renderField(field, consentPurposeLabels)).join(''),
+    '<div><button id="kelpie-submit" type="submit">Submit</button></div>',
+    '<p id="kelpie-status" class="note" role="status" aria-live="polite"></p>',
+    '</form>',
+    `<script type="application/json" id="kelpie-config">${config}</script>`,
+    `<script nonce="${escapeHtml(nonce)}">${EMBED_SCRIPT}</script>`,
+  ].join('')
 }
 
 /**
@@ -183,39 +519,46 @@ export interface EmbedPageOptions {
  * form whose submit answers 409.
  */
 export function renderEmbedPage(options: EmbedPageOptions): string {
-  const { form, fields, submitUrl, nonce } = options
+  const { form, fields, consentPurposeLabels, submitUrl, nonce, workspaceName, layout } = options
+  const heading = displayTitle(form)
   const config = escapeScriptJson({
     formId: form.id,
     submitUrl,
     thankYou: form.thankYouMessage,
     fieldIds: fields.map((field) => field.id),
   })
-  const body =
-    form.status === 'paused'
-      ? `<div class="done"><p class="note">This form is not accepting submissions right now.</p></div>`
-      : [
-          '<form id="kelpie-form" novalidate>',
-          fields.map(renderField).join(''),
-          '<div><button id="kelpie-submit" type="submit">Submit</button></div>',
-          '<p id="kelpie-status" class="note" role="status" aria-live="polite"></p>',
-          '</form>',
-          `<script type="application/json" id="kelpie-config">${config}</script>`,
-          `<script nonce="${escapeHtml(nonce)}">${EMBED_SCRIPT}</script>`,
+  const formBody = renderFormBody(form, fields, consentPurposeLabels, config, nonce)
+
+  const styles = layout === 'page' ? HOSTED_STYLES : IFRAME_STYLES
+  const shell =
+    layout === 'page'
+      ? [
+          '<div class="shell">',
+          '<header class="brand">',
+          `<div class="eyebrow">${escapeHtml(workspaceName)}</div>`,
+          `<h1>${escapeHtml(heading)}</h1>`,
+          form.description === null || form.description.trim().length === 0
+            ? ''
+            : `<p class="lead">${escapeHtml(form.description)}</p>`,
+          '</header>',
+          `<div class="card">${formBody}</div>`,
+          '</div>',
         ].join('')
+      : `<div class="shell">${formBody}</div>`
 
   return [
     '<!doctype html>',
-    '<html lang="en">',
+    `<html lang="en" class="layout-${layout}">`,
     '<head>',
     '<meta charset="utf-8">',
     '<meta name="viewport" content="width=device-width, initial-scale=1">',
     // Not indexed: the canonical page for this form is the customer's own, and
     // a bare embed ranking above it would be a worse result for a reader.
     '<meta name="robots" content="noindex">',
-    `<title>${escapeHtml(form.name)}</title>`,
-    `<style nonce="${escapeHtml(nonce)}">${EMBED_STYLES}</style>`,
+    `<title>${escapeHtml(heading)}</title>`,
+    `<style nonce="${escapeHtml(nonce)}">${styles}</style>`,
     '</head>',
-    `<body>${body}</body>`,
+    `<body class="layout-${layout}">${shell}</body>`,
     '</html>',
   ].join('')
 }
@@ -239,28 +582,32 @@ export function embedContentSecurityPolicy(nonce: string): string {
   ].join('; ')
 }
 
-/** What a customer pastes into their site. Both put the same hosted page on the page. */
+/** What a customer pastes into their site, plus the standalone hosted URL. */
 export interface EmbedSnippets {
+  /** Standalone hosted page (brand chrome). */
   readonly url: string
+  /** Bare document the iframe snippets load (fields only). */
+  readonly embedUrl: string
   readonly iframe: string
   readonly script: string
 }
 
 /**
- * The two ways to embed.
+ * The two ways to embed, plus the hosted page URL.
  *
- * The iframe is the honest minimum: one tag, no JavaScript, fixed height. The
- * script adds the listener that resizes it as fields appear and as the thank-you
- * replaces the form, which is the only thing an iframe cannot do for itself.
+ * Hosted `url` is the full page. The iframe snippets point at `embedUrl`, which
+ * is the same form without page chrome — what belongs inside somebody else's
+ * site. The plain iframe is fixed height; the script listens for height
+ * messages as fields appear and as the thank-you replaces the form.
  */
-export function embedSnippets(url: string, formId: string): EmbedSnippets {
+export function embedSnippets(hostedUrl: string, embedUrl: string, formId: string): EmbedSnippets {
   const iframe =
-    `<iframe src="${escapeHtml(url)}" title="Contact form" ` +
-    `style="width:100%;border:0;height:520px" loading="lazy"></iframe>`
+    `<iframe src="${escapeHtml(embedUrl)}" title="Contact form" ` +
+    `style="width:100%;border:0;height:720px" loading="lazy"></iframe>`
 
   const script = [
-    `<iframe id="kelpie-${formId}" src="${escapeHtml(url)}" title="Contact form"`,
-    `        style="width:100%;border:0;height:520px" loading="lazy"></iframe>`,
+    `<iframe id="kelpie-${formId}" src="${escapeHtml(embedUrl)}" title="Contact form"`,
+    `        style="width:100%;border:0;height:720px" loading="lazy"></iframe>`,
     `<script>`,
     `  window.addEventListener('message', function (event) {`,
     `    if (event.data && event.data.kelpie === 'height' && event.data.formId === '${formId}') {`,
@@ -270,5 +617,5 @@ export function embedSnippets(url: string, formId: string): EmbedSnippets {
     `</script>`,
   ].join('\n')
 
-  return { url, iframe, script }
+  return { url: hostedUrl, embedUrl, iframe, script }
 }

package/src/modules/forms/events.ts

@@ -1,3 +1,5 @@
+import { FORM_ACTION_STATUSES } from '@kelpie/schemas'
+import type { FormActionStatus } from '@kelpie/schemas'
 import { z } from 'zod'
 
 import type { ModuleEventCatalog } from '../../runtime/module.ts'
@@ -7,14 +9,32 @@ import type { ModuleEventCatalog } from '../../runtime/module.ts'
  *
  * `forms.form.*` cover the form definition CRUD. `forms.submission.submitted`
  * fires once per submission; the webhooks bridge translates it to the wire
- * `form.submitted` event (the ids live in `data`).
+ * `form.submitted` event (the ids and per-action statuses live in `data`).
+ *
+ * The action summary carries statuses only, no detail strings: the webhook
+ * receiver learns whether each action ran; the authenticated Submissions
+ * reader gets the full detail from `action_log` on the row.
  */
 
+const actionSummarySchema = z
+  .object({
+    action: z.string(),
+    status: z.enum(FORM_ACTION_STATUSES),
+  })
+  .readonly()
+
 export const formsEvents = {
   'forms.form.created': z.object({}).strict(),
   'forms.form.updated': z.object({ changed: z.array(z.string()).readonly() }),
   'forms.form.deleted': z.object({}).strict(),
-  'forms.submission.submitted': z.object({ formId: z.string(), submissionId: z.string() }),
+  'forms.submission.submitted': z.object({
+    formId: z.string(),
+    submissionId: z.string(),
+    opportunityId: z.string().nullable(),
+    partnershipId: z.string().nullable(),
+    enquiryId: z.string().nullable(),
+    actions: z.array(actionSummarySchema).readonly(),
+  }),
 } satisfies ModuleEventCatalog
 
 export type FormCreatedData = Record<string, never>
@@ -22,9 +42,17 @@ export interface FormUpdatedData {
   readonly changed: readonly string[]
 }
 export type FormDeletedData = Record<string, never>
+export interface FormSubmissionActionSummary {
+  readonly action: string
+  readonly status: FormActionStatus
+}
 export interface FormSubmissionData {
   readonly formId: string
   readonly submissionId: string
+  readonly opportunityId: string | null
+  readonly partnershipId: string | null
+  readonly enquiryId: string | null
+  readonly actions: readonly FormSubmissionActionSummary[]
 }
 
 declare module '../../runtime/events.ts' {