create-bw-app 0.20.0 → 0.22.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "create-bw-app",
   "private": false,
-  "version": "0.20.0",
+  "version": "0.22.0",
   "type": "module",
   "bin": {
     "create-bw-app": "bin/create-bw-app.mjs",

package/src/constants.mjs

@@ -171,16 +171,16 @@ export const PLATFORM_STARTER_FILES = [
 ];
 
 export const APP_DEPENDENCY_DEFAULTS = {
-  "@brightweblabs/app-shell": "^0.8.0",
-  "@brightweblabs/core-auth": "^0.7.3",
-  "@brightweblabs/infra": "^0.4.0",
-  "@brightweblabs/module-admin": "^0.5.11",
-  "@brightweblabs/module-crm": "^0.10.1",
-  "@brightweblabs/module-marketing": "^0.2.10",
-  "@brightweblabs/module-orgs": "^0.3.11",
-  "@brightweblabs/module-projects": "^0.9.2",
-  "@brightweblabs/theme": "^0.5.1",
-  "@brightweblabs/ui": "^1.2.0",
+  "@brightweblabs/app-shell": "^0.9.0",
+  "@brightweblabs/core-auth": "^0.9.0",
+  "@brightweblabs/infra": "^0.5.0",
+  "@brightweblabs/module-admin": "^0.7.0",
+  "@brightweblabs/module-crm": "^0.11.0",
+  "@brightweblabs/module-marketing": "^0.2.12",
+  "@brightweblabs/module-orgs": "^0.3.13",
+  "@brightweblabs/module-projects": "^0.10.0",
+  "@brightweblabs/theme": "^0.7.0",
+  "@brightweblabs/ui": "^1.4.0",
   "geist": "1.7.2",
   "lucide-react": "^1.8.0",
   "next": "^16.0.0",

package/src/generator.mjs

@@ -1021,33 +1021,39 @@ export function createShellConfig(selectedModules) {
 
 export function createModuleToolbarControlsConfig(selectedModules) {
   const imports = [];
-  const branches = [];
+  const entries = [];
 
   if (selectedModules.includes("admin")) {
     imports.push('import { AdminToolbarControls } from "@brightweblabs/module-admin/ui";');
-    branches.push('  if (pathname === "/admin/users") return <AdminToolbarControls />;');
+    entries.push('  "admin-users": () => <AdminToolbarControls />,');
   }
   if (selectedModules.includes("crm")) {
     imports.push('import { CrmToolbarControls } from "@brightweblabs/module-crm/ui";');
-    branches.push('  if (pathname === "/crm") return <CrmToolbarControls />;');
+    entries.push('  crm: () => <CrmToolbarControls />,');
   }
   if (selectedModules.includes("projects")) {
     imports.push('import { ProjectsToolbarControls } from "@brightweblabs/module-projects/ui";');
-    branches.push('  if (pathname === projectsBaseHref) return <ProjectsToolbarControls />;');
+    entries.push('  projects: () => <ProjectsToolbarControls />,');
   }
 
   return [
     '"use client";',
     "",
+    'import type { ReactNode } from "react";',
+    'import { resolveShellToolbarSurface, type ShellToolbarRouteConfig, type ShellToolbarSurface } from "@brightweblabs/app-shell";',
     "// MANAGED BY BRIGHTWEB — regenerated when modules are added, removed, or updated.",
     ...imports,
-    imports.length > 0 ? "" : null,
-    "export function getModuleToolbarControls(pathname: string, projectsBaseHref: string) {",
-    ...branches,
-    "  return null;",
+    "",
+    "const toolbarControlBySurface: Partial<Record<ShellToolbarSurface, () => ReactNode>> = {",
+    ...entries,
+    "};",
+    "",
+    "export function getModuleToolbarControls(pathname: string, toolbarRoutes: ShellToolbarRouteConfig[]) {",
+    "  const surface = resolveShellToolbarSurface(pathname, toolbarRoutes);",
+    "  return surface ? toolbarControlBySurface[surface]?.() ?? null : null;",
     "}",
     "",
-  ].filter((line) => line !== null).join("\n");
+  ].join("\n");
 }
 
 function createOrganizationRoute(methods, enabled) {
@@ -1088,7 +1094,7 @@ export function createOptionalModuleRouteFiles(selectedModules) {
 
   if (adminEnabled) {
     dependencyImports.push(
-      'import { getAdminUserInvitationDetails, registerUserFromAdminInvitation } from "@brightweblabs/module-admin";',
+      'import { acceptAdminUserInvitation, getAdminUserInvitationDetails, registerUserFromAdminInvitation } from "@brightweblabs/module-admin";',
     );
   }
   if (orgsEnabled) {
@@ -1107,6 +1113,7 @@ export function createOptionalModuleRouteFiles(selectedModules) {
       'import { requireServerUserAccess } from "@brightweblabs/core-auth/server";',
       'import { requireServiceRoleClient } from "@brightweblabs/infra/server";',
       "import {",
+      "  acceptAdminUserInvitation,",
       "  getAdminUserInvitationDetails,",
       "  registerUserFromAdminInvitation,",
       '} from "@brightweblabs/module-admin";',
@@ -1132,6 +1139,7 @@ export function createOptionalModuleRouteFiles(selectedModules) {
       "    ensureCrmContactForProfile,",
       "  }),",
       "  registerAdminInvitation: registerUserFromAdminInvitation,",
+      "  acceptAdminInvitation: acceptAdminUserInvitation,",
       "  acceptOrganizationInvitation: (client: never, input: {",
       "    invitationId: string;",
       "    profileId: string;",
@@ -1174,6 +1182,7 @@ export function createOptionalModuleRouteFiles(selectedModules) {
     "    ensureCrmContactForProfile,",
     "  }),",
     "  registerAdminInvitation: registerUserFromAdminInvitation,",
+    ...(adminEnabled ? ["  acceptAdminInvitation: acceptAdminUserInvitation,"] : []),
     "  acceptOrganizationInvitation: (client: never, input: {",
     "    invitationId: string;",
     "    profileId: string;",

package/template/base/app/(shell)/layout.tsx

@@ -5,7 +5,7 @@ import { ShellLayoutClient, type ShellViewer } from "./shell-layout-client";
 export const dynamic = "force-dynamic";
 
 export default async function ShellLayout({ children }: Readonly<{ children: ReactNode }>) {
-  const { supabase, user, role } = await requireServerPageAccess();
+  const { profileId, supabase, user, role } = await requireServerPageAccess();
   const { data: profile } = await supabase
     .from("profiles")
     .select("first_name, last_name")
@@ -13,6 +13,7 @@ export default async function ShellLayout({ children }: Readonly<{ children: Rea
     .maybeSingle<{ first_name: string | null; last_name: string | null }>();
 
   const viewer: ShellViewer = {
+    profileId,
     email: user.email ?? null,
     firstName: profile?.first_name ?? null,
     lastName: profile?.last_name ?? null,

package/template/base/app/(shell)/shell-layout-client.tsx

@@ -8,10 +8,12 @@ import {
   DesktopSidebar,
   MobileNav,
   ShellActionsProvider,
+  ShellRealtimeBridge,
   computeInitials,
   isShellNavItemActive,
   useShellAction,
   useShellActionDispatch,
+  useShellNotifications,
   useShellNavState,
   type ShellContextualAction,
   type ShellNavStateGroup,
@@ -23,6 +25,7 @@ import { getStarterShellConfig } from "../../config/shell";
 import "@brightweblabs/app-shell/dashboard.css";
 
 export type ShellViewer = {
+  profileId: string | null;
   email: string | null;
   firstName: string | null;
   lastName: string | null;
@@ -31,18 +34,12 @@ export type ShellViewer = {
 };
 
 const authClient = createAuthUiClient();
-const toolbarWindowEventByAction: Record<string, string> = {
-  "projects-refresh": "projects:refresh",
-  "projects-new-menu": "projects:open-new-project",
-  "crm-create-menu": "brightweb:crm:create-contact",
-};
-
 export function ShellLayoutClient({
   children,
   viewer,
 }: Readonly<{ children: ReactNode; viewer: ShellViewer }>) {
   return (
-    <ShellActionsProvider aliases={toolbarWindowEventByAction}>
+    <ShellActionsProvider>
       <ShellLayoutInner viewer={viewer}>{children}</ShellLayoutInner>
     </ShellActionsProvider>
   );
@@ -67,6 +64,7 @@ function ShellLayoutInner({
   );
   const { isSidebarCollapsed, isGroupOpen, toggleGroup, toggleSidebar } =
     useShellNavState({ pathname, groups: shellGroups });
+  const notifications = useShellNotifications({ enabled: viewer.isStaff });
   const isAdminSurface = pathname === "/admin" || pathname.startsWith("/admin/");
   const shellNavItems = [
     ...config.primaryNav,
@@ -87,7 +85,7 @@ function ShellLayoutInner({
     viewer.email ||
     "Conta";
   const projectsBaseHref = pathname.startsWith("/projects") ? "/projects" : "/projetos";
-  const toolbarControls = getModuleToolbarControls(pathname, projectsBaseHref);
+  const toolbarControls = getModuleToolbarControls(pathname, toolbarRoutes);
 
   const dispatchShellAction = useShellActionDispatch();
   useShellAction("projects-back-to-portfolio", () => {
@@ -156,7 +154,7 @@ function ShellLayoutInner({
           toolbarRoutes={toolbarRoutes}
           toolbarActions={toolbarActions}
           onToolbarAction={handleToolbarAction}
-          notifications={{}}
+          notifications={viewer.isStaff ? notifications : undefined}
         >
           {toolbarControls}
         </AppHeader>
@@ -174,6 +172,7 @@ function ShellLayoutInner({
         />
       }
     >
+      <ShellRealtimeBridge viewer={viewer} />
       {children}
       {isAdminSurface || pathname === "/account" ? <Toaster /> : null}
     </AppShellFrame>

package/template/base/app/api/invitations/_dependencies.ts

@@ -1,6 +1,7 @@
 import { requireServerUserAccess } from "@brightweblabs/core-auth/server";
 import { requireServiceRoleClient } from "@brightweblabs/infra/server";
 import {
+  acceptAdminUserInvitation,
   getAdminUserInvitationDetails,
   registerUserFromAdminInvitation,
 } from "@brightweblabs/module-admin";
@@ -26,6 +27,7 @@ export const invitationHttpDependencies = {
     ensureCrmContactForProfile,
   }),
   registerAdminInvitation: registerUserFromAdminInvitation,
+  acceptAdminInvitation: acceptAdminUserInvitation,
   acceptOrganizationInvitation: (client: never, input: {
     invitationId: string;
     profileId: string;

package/template/base/app/api/notifications/route.ts

@@ -0,0 +1 @@
+export { handleNotificationsGetRequest as GET, handleNotificationsPostRequest as POST } from "@brightweblabs/core-auth/notifications";

package/template/base/config/module-toolbar-controls.tsx

@@ -1,6 +1,19 @@
 "use client";
 
+import type { ReactNode } from "react";
+import { resolveShellToolbarSurface, type ShellToolbarRouteConfig, type ShellToolbarSurface } from "@brightweblabs/app-shell";
+import { AdminToolbarControls } from "@brightweblabs/module-admin/ui";
+import { CrmToolbarControls } from "@brightweblabs/module-crm/ui";
+import { ProjectsToolbarControls } from "@brightweblabs/module-projects/ui";
+
 // MANAGED BY BRIGHTWEB — regenerated when modules are added, removed, or updated.
-export function getModuleToolbarControls(_pathname: string, _projectsBaseHref: string) {
-  return null;
+const toolbarControlBySurface: Partial<Record<ShellToolbarSurface, () => ReactNode>> = {
+  "admin-users": () => <AdminToolbarControls />,
+  crm: () => <CrmToolbarControls />,
+  projects: () => <ProjectsToolbarControls />,
+};
+
+export function getModuleToolbarControls(pathname: string, toolbarRoutes: ShellToolbarRouteConfig[]) {
+  const surface = resolveShellToolbarSurface(pathname, toolbarRoutes);
+  return surface ? toolbarControlBySurface[surface]?.() ?? null : null;
 }

package/template/supabase/modules/admin/migrations/20260731122500_admin_activity_visibility.sql

@@ -0,0 +1,51 @@
+-- Admin activity is visible only to admins. Other non-project activity remains
+-- visible to staff/admin; the Projects module installs its own audience rules.
+
+CREATE OR REPLACE FUNCTION public.can_profile_view_app_activity_event(
+  p_profile_id uuid,
+  p_domain text,
+  p_entity_table text,
+  p_entity_id uuid,
+  p_payload jsonb DEFAULT '{}'::jsonb
+)
+RETURNS boolean
+LANGUAGE plpgsql
+STABLE
+SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_role text;
+BEGIN
+  IF p_profile_id IS NULL THEN
+    RETURN false;
+  END IF;
+
+  SELECT assignment.role_code
+  INTO v_role
+  FROM public.user_role_assignments assignment
+  WHERE assignment.profile_id = p_profile_id
+  LIMIT 1;
+
+  IF p_domain = 'admin' THEN
+    RETURN v_role = 'admin';
+  END IF;
+
+  RETURN v_role = ANY (ARRAY['staff', 'admin']);
+END;
+$$;
+
+REVOKE ALL ON FUNCTION public.can_profile_view_app_activity_event(uuid, text, text, uuid, jsonb)
+  FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.can_profile_view_app_activity_event(uuid, text, text, uuid, jsonb)
+  TO service_role;
+
+DROP POLICY IF EXISTS "Staff can view app activity events" ON public.app_activity_events;
+CREATE POLICY "Staff can view app activity events"
+  ON public.app_activity_events
+  FOR SELECT
+  TO authenticated
+  USING (
+    public.is_staff()
+    AND public.can_view_app_activity_event(domain, entity_table, entity_id, payload)
+  );

package/template/supabase/modules/core/migrations/20260731120000_core_notifications.sql

@@ -0,0 +1,165 @@
+-- Shared notification inbox primitives. Module-specific migrations may replace
+-- can_profile_view_app_activity_event to add audience rules for their domains.
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_publication WHERE pubname = 'supabase_realtime')
+    AND NOT EXISTS (
+      SELECT 1
+      FROM pg_publication_tables
+      WHERE pubname = 'supabase_realtime'
+        AND schemaname = 'public'
+        AND tablename = 'app_activity_events'
+    )
+  THEN
+    ALTER PUBLICATION supabase_realtime ADD TABLE public.app_activity_events;
+  END IF;
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION public.can_profile_view_app_activity_event(
+  p_profile_id uuid,
+  p_domain text,
+  p_entity_table text,
+  p_entity_id uuid,
+  p_payload jsonb DEFAULT '{}'::jsonb
+)
+RETURNS boolean
+LANGUAGE plpgsql
+STABLE
+SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_payload jsonb := COALESCE(p_payload, '{}'::jsonb);
+BEGIN
+  IF p_profile_id IS NULL THEN
+    RETURN false;
+  END IF;
+
+  IF jsonb_typeof(v_payload->'visible_profile_ids') = 'array' THEN
+    RETURN EXISTS (
+      SELECT 1
+      FROM jsonb_array_elements_text(v_payload->'visible_profile_ids') AS visible(profile_id)
+      WHERE visible.profile_id = p_profile_id::text
+    );
+  END IF;
+
+  -- Project audience rules are installed by the projects module.
+  RETURN p_domain <> 'projects';
+END;
+$$;
+
+REVOKE ALL ON FUNCTION public.can_profile_view_app_activity_event(uuid, text, text, uuid, jsonb)
+  FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.can_profile_view_app_activity_event(uuid, text, text, uuid, jsonb)
+  TO service_role;
+
+CREATE OR REPLACE FUNCTION public.can_view_app_activity_event(
+  p_domain text,
+  p_entity_table text,
+  p_entity_id uuid,
+  p_payload jsonb DEFAULT '{}'::jsonb
+)
+RETURNS boolean
+LANGUAGE sql
+STABLE
+SECURITY DEFINER
+SET search_path = public
+AS $$
+  SELECT public.can_profile_view_app_activity_event(
+    public.current_profile_id(),
+    p_domain,
+    p_entity_table,
+    p_entity_id,
+    p_payload
+  )
+$$;
+
+REVOKE ALL ON FUNCTION public.can_view_app_activity_event(text, text, uuid, jsonb)
+  FROM PUBLIC, anon;
+GRANT EXECUTE ON FUNCTION public.can_view_app_activity_event(text, text, uuid, jsonb)
+  TO authenticated;
+
+DROP POLICY IF EXISTS "Staff can view app activity events" ON public.app_activity_events;
+CREATE POLICY "Staff can view app activity events"
+  ON public.app_activity_events
+  FOR SELECT
+  TO authenticated
+  USING (
+    public.is_staff()
+    AND public.can_view_app_activity_event(domain, entity_table, entity_id, payload)
+  );
+
+CREATE OR REPLACE FUNCTION public.current_notification_summary(p_profile_id uuid)
+RETURNS TABLE(seen_at timestamptz, unread_count bigint)
+LANGUAGE sql
+STABLE
+SECURITY DEFINER
+SET search_path = public
+AS $$
+  WITH notification_state AS (
+    SELECT state.alerts_seen_at
+    FROM public.user_notification_state state
+    WHERE state.profile_id = p_profile_id
+    LIMIT 1
+  )
+  SELECT
+    (SELECT alerts_seen_at FROM notification_state) AS seen_at,
+    count(event.id) AS unread_count
+  FROM public.app_activity_events event
+  WHERE public.can_profile_view_app_activity_event(
+      p_profile_id,
+      event.domain,
+      event.entity_table,
+      event.entity_id,
+      event.payload
+    )
+    AND (
+      (SELECT alerts_seen_at FROM notification_state) IS NULL
+      OR event.created_at > (SELECT alerts_seen_at FROM notification_state)
+    )
+    AND (event.actor_profile_id IS NULL OR event.actor_profile_id <> p_profile_id)
+$$;
+
+REVOKE ALL ON FUNCTION public.current_notification_summary(uuid)
+  FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.current_notification_summary(uuid)
+  TO service_role;
+
+CREATE OR REPLACE FUNCTION public.current_notification_items(
+  p_profile_id uuid,
+  p_limit integer DEFAULT 8
+)
+RETURNS TABLE(
+  id uuid,
+  created_at timestamptz,
+  domain text,
+  summary text
+)
+LANGUAGE sql
+STABLE
+SECURITY DEFINER
+SET search_path = public
+AS $$
+  SELECT event.id, event.created_at, event.domain, event.summary
+  FROM public.app_activity_events event
+  LEFT JOIN public.user_notification_state state
+    ON state.profile_id = p_profile_id
+  WHERE public.can_profile_view_app_activity_event(
+      p_profile_id,
+      event.domain,
+      event.entity_table,
+      event.entity_id,
+      event.payload
+    )
+    AND (state.alerts_seen_at IS NULL OR event.created_at > state.alerts_seen_at)
+    AND (event.actor_profile_id IS NULL OR event.actor_profile_id <> p_profile_id)
+  ORDER BY event.created_at DESC
+  LIMIT LEAST(GREATEST(COALESCE(p_limit, 8), 0), 50)
+$$;
+
+REVOKE ALL ON FUNCTION public.current_notification_items(uuid, integer)
+  FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.current_notification_items(uuid, integer)
+  TO service_role;

package/template/supabase/modules/core/migrations/20260731122000_core_realtime_activity.sql

@@ -0,0 +1,50 @@
+-- Keep the notification list useful after acknowledgement. The unread summary
+-- still uses alerts_seen_at; the item list returns the latest visible events.
+
+CREATE OR REPLACE FUNCTION public.current_notification_items(
+  p_profile_id uuid,
+  p_limit integer DEFAULT 8
+)
+RETURNS TABLE(
+  id uuid,
+  created_at timestamptz,
+  domain text,
+  event_type text,
+  entity_table text,
+  entity_id uuid,
+  actor_profile_id uuid,
+  summary text,
+  payload jsonb
+)
+LANGUAGE sql
+STABLE
+SECURITY DEFINER
+SET search_path = public
+AS $$
+  SELECT
+    event.id,
+    event.created_at,
+    event.domain,
+    event.event_type,
+    event.entity_table,
+    event.entity_id,
+    event.actor_profile_id,
+    event.summary,
+    COALESCE(event.payload, '{}'::jsonb)
+  FROM public.app_activity_events event
+  WHERE public.can_profile_view_app_activity_event(
+      p_profile_id,
+      event.domain,
+      event.entity_table,
+      event.entity_id,
+      event.payload
+    )
+    AND (event.actor_profile_id IS NULL OR event.actor_profile_id <> p_profile_id)
+  ORDER BY event.created_at DESC
+  LIMIT LEAST(GREATEST(COALESCE(p_limit, 8), 0), 50)
+$$;
+
+REVOKE ALL ON FUNCTION public.current_notification_items(uuid, integer)
+  FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.current_notification_items(uuid, integer)
+  TO service_role;

package/template/supabase/modules/projects/migrations/20260731121000_project_notification_audiences.sql

@@ -0,0 +1,81 @@
+-- Extend the Core notification audience contract with project membership rules.
+
+CREATE OR REPLACE FUNCTION public.can_profile_view_app_activity_event(
+  p_profile_id uuid,
+  p_domain text,
+  p_entity_table text,
+  p_entity_id uuid,
+  p_payload jsonb DEFAULT '{}'::jsonb
+)
+RETURNS boolean
+LANGUAGE plpgsql
+STABLE
+SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_payload jsonb := COALESCE(p_payload, '{}'::jsonb);
+  v_project_id uuid;
+BEGIN
+  IF p_profile_id IS NULL THEN
+    RETURN false;
+  END IF;
+
+  IF jsonb_typeof(v_payload->'visible_profile_ids') = 'array' THEN
+    RETURN EXISTS (
+      SELECT 1
+      FROM jsonb_array_elements_text(v_payload->'visible_profile_ids') AS visible(profile_id)
+      WHERE visible.profile_id = p_profile_id::text
+    );
+  END IF;
+
+  IF p_domain <> 'projects' THEN
+    RETURN true;
+  END IF;
+
+  BEGIN
+    v_project_id := NULLIF(v_payload->>'project_id', '')::uuid;
+  EXCEPTION WHEN invalid_text_representation THEN
+    v_project_id := NULL;
+  END;
+
+  IF v_project_id IS NULL AND p_entity_table = 'projects' THEN
+    v_project_id := p_entity_id;
+  END IF;
+  IF v_project_id IS NULL THEN
+    RETURN false;
+  END IF;
+
+  RETURN EXISTS (
+    SELECT 1
+    FROM public.user_role_assignments assignment
+    WHERE assignment.profile_id = p_profile_id
+      AND assignment.role_code = 'admin'
+  )
+    OR EXISTS (
+      SELECT 1
+      FROM public.projects project
+      WHERE project.id = v_project_id
+        AND project.owner_profile_id = p_profile_id
+    )
+    OR EXISTS (
+      SELECT 1
+      FROM public.project_members member
+      WHERE member.project_id = v_project_id
+        AND member.profile_id = p_profile_id
+    )
+    OR EXISTS (
+      SELECT 1
+      FROM public.projects project
+      JOIN public.organization_members member
+        ON member.organization_id = project.organization_id
+      WHERE project.id = v_project_id
+        AND member.profile_id = p_profile_id
+    );
+END;
+$$;
+
+REVOKE ALL ON FUNCTION public.can_profile_view_app_activity_event(uuid, text, text, uuid, jsonb)
+  FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.can_profile_view_app_activity_event(uuid, text, text, uuid, jsonb)
+  TO service_role;

package/template/supabase/modules/projects/migrations/20260731123000_project_realtime_visibility.sql

@@ -0,0 +1,143 @@
+-- Align project activity visibility with the canonical project read policy.
+-- Removed members and deleted-project audiences are retained in event payloads.
+
+CREATE OR REPLACE FUNCTION public.can_profile_view_app_activity_event(
+  p_profile_id uuid,
+  p_domain text,
+  p_entity_table text,
+  p_entity_id uuid,
+  p_payload jsonb DEFAULT '{}'::jsonb
+)
+RETURNS boolean
+LANGUAGE plpgsql
+STABLE
+SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_payload jsonb := COALESCE(p_payload, '{}'::jsonb);
+  v_project_id uuid;
+  v_role text;
+BEGIN
+  IF p_profile_id IS NULL THEN
+    RETURN false;
+  END IF;
+
+  SELECT assignment.role_code
+  INTO v_role
+  FROM public.user_role_assignments assignment
+  WHERE assignment.profile_id = p_profile_id
+  LIMIT 1;
+
+  IF p_domain = 'admin' THEN
+    RETURN v_role = 'admin';
+  END IF;
+
+  IF p_domain <> 'projects' THEN
+    RETURN v_role = ANY (ARRAY['staff', 'admin']);
+  END IF;
+
+  IF v_role = 'admin' THEN
+    RETURN true;
+  END IF;
+
+  IF jsonb_typeof(v_payload->'visible_profile_ids') = 'array'
+    AND EXISTS (
+      SELECT 1
+      FROM jsonb_array_elements_text(v_payload->'visible_profile_ids') AS visible(profile_id)
+      WHERE visible.profile_id = p_profile_id::text
+    ) THEN
+    RETURN true;
+  END IF;
+
+  BEGIN
+    v_project_id := NULLIF(v_payload->>'project_id', '')::uuid;
+  EXCEPTION WHEN invalid_text_representation THEN
+    v_project_id := NULL;
+  END;
+
+  IF v_project_id IS NULL AND p_entity_table = 'projects' THEN
+    v_project_id := p_entity_id;
+  END IF;
+  IF v_project_id IS NULL THEN
+    RETURN false;
+  END IF;
+
+  RETURN EXISTS (
+    SELECT 1
+    FROM public.projects project
+    WHERE project.id = v_project_id
+      AND project.owner_profile_id = p_profile_id
+  )
+    OR EXISTS (
+      SELECT 1
+      FROM public.project_members member
+      WHERE member.project_id = v_project_id
+        AND member.profile_id = p_profile_id
+    )
+    OR EXISTS (
+      SELECT 1
+      FROM public.projects project
+      JOIN public.organization_members member
+        ON member.organization_id = project.organization_id
+      WHERE project.id = v_project_id
+        AND member.profile_id = p_profile_id
+        AND member.role = 'admin'
+    );
+END;
+$$;
+
+REVOKE ALL ON FUNCTION public.can_profile_view_app_activity_event(uuid, text, text, uuid, jsonb)
+  FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.can_profile_view_app_activity_event(uuid, text, text, uuid, jsonb)
+  TO service_role;
+
+DROP POLICY IF EXISTS "Project members can view project activity events"
+  ON public.app_activity_events;
+CREATE POLICY "Project members can view project activity events"
+  ON public.app_activity_events
+  FOR SELECT
+  TO authenticated
+  USING (
+    domain = 'projects'
+    AND public.can_view_app_activity_event(domain, entity_table, entity_id, payload)
+  );
+
+CREATE OR REPLACE FUNCTION public.capture_removed_project_member_realtime_audience()
+RETURNS trigger
+LANGUAGE plpgsql
+SET search_path = public
+AS $$
+DECLARE
+  v_profile_id text;
+  v_visible jsonb;
+BEGIN
+  IF NEW.domain <> 'projects' OR NEW.event_type <> 'member_removed' THEN
+    RETURN NEW;
+  END IF;
+
+  v_profile_id := NULLIF(NEW.payload->>'profile_id', '');
+  IF v_profile_id IS NULL THEN
+    RETURN NEW;
+  END IF;
+
+  v_visible := COALESCE(NEW.payload->'visible_profile_ids', '[]'::jsonb);
+  IF jsonb_typeof(v_visible) <> 'array' THEN
+    v_visible := '[]'::jsonb;
+  END IF;
+  IF NOT v_visible @> jsonb_build_array(v_profile_id) THEN
+    v_visible := v_visible || jsonb_build_array(v_profile_id);
+  END IF;
+
+  NEW.payload := COALESCE(NEW.payload, '{}'::jsonb)
+    || jsonb_build_object('visible_profile_ids', v_visible);
+  RETURN NEW;
+END;
+$$;
+
+DROP TRIGGER IF EXISTS capture_removed_project_member_realtime_audience
+  ON public.app_activity_events;
+CREATE TRIGGER capture_removed_project_member_realtime_audience
+  BEFORE INSERT ON public.app_activity_events
+  FOR EACH ROW
+  EXECUTE FUNCTION public.capture_removed_project_member_realtime_audience();