elevenlabs-webhook-nodejs 1.0.0

package/docs/FRONTEND_CHECKLIST.md

@@ -0,0 +1,227 @@
+# Frontend Development Checklist
+
+> Portal Asistan 7/24 — React Frontend Progress
+> Last updated: 2026-04-03
+
+---
+
+## Infrastructure
+
+- [x] Vite + React 19 + TypeScript + React Compiler
+- [x] Tailwind CSS v4 + shadcn/ui (Base UI)
+- [x] Brand theme (#e77d22) with light/dark mode
+- [x] i18n (Turkish + English, localStorage persisted)
+- [x] React Router v7 with lazy loading
+- [x] TanStack Query (React Query)
+- [x] Zustand stores (auth + UI)
+- [x] Axios API client with interceptors
+- [x] Vite proxy (/api → backend)
+- [x] Sonner toast notifications
+- [ ] Socket.IO client connection
+- [ ] Error boundary (global)
+
+## Components
+
+- [x] 33 shadcn/ui components
+- [x] PageHeader
+- [x] StatCard
+- [x] EmptyState
+- [x] StatusDot
+- [x] StatusBadge
+- [x] ConfirmDialog
+- [x] DataTableToolbar
+- [x] DataTablePagination
+- [x] AppointmentCalendar (Schedule-X)
+- [x] ChatBubble
+- [x] ActivityTimeline
+- [x] FileUpload
+- [x] NotificationDropdown
+- [x] Combobox
+- [x] LanguageSwitcher
+- [x] Component showcase page (/components)
+
+## Layout
+
+- [x] Login page (mobile-friendly, i18n, error handling) ✅ TESTED
+- [x] Auth guard (redirect to /login) ✅ TESTED
+- [x] App layout (header + sidebar + content) ✅ TESTED
+- [x] Collapsible desktop sidebar (20 nav items, 6 groups) ✅ TESTED
+- [x] Mobile sidebar (Sheet overlay)
+- [x] User dropdown (profile, settings, logout) ✅ TESTED
+- [x] Dark mode toggle (persisted) ✅ TESTED
+- [x] Language switcher in header ✅ TESTED
+- [x] Notification bell in header
+
+## Pages — CRM Core
+
+### Patients
+- [x] Patient list (search, pagination, clinic filter) ✅ TESTED
+- [x] Create patient dialog (all fields, Zod validation, referral tracking) ✅ TESTED
+- [x] Patient detail page (header, stats, tabs) ✅ TESTED
+- [x] Edit patient dialog (all fields match create) ✅ TESTED
+- [x] Overview tab (medical history, AI summary, latest notes) ✅ TESTED
+- [x] Appointments tab (table with status badges)
+- [x] Notes tab (add, list, delete) ✅ TESTED
+- [x] Documents tab (upload, list, detail modal, view via proxy, delete) ✅ TESTED
+- [x] Photos tab (sets grid with cover previews, detail with lightbox, upload with thumbnails) ✅ TESTED
+- [x] Examinations tab (create, view, edit — linked to appointments optionally) ✅ TESTED
+- [x] Medical history edit form (allergies, conditions, medications, smoking, alcohol, pregnancy) ✅ TESTED
+- [x] Patient timeline (unified activity feed — all events sorted) ✅ TESTED
+
+### Appointments
+- [x] Appointment list (search, filters, pagination) ✅ TESTED
+- [x] Create appointment dialog ✅ TESTED
+- [x] Appointment detail modal (row click) ✅ TESTED
+- [x] Status transitions (confirm, start, complete, cancel, no-show) ✅ TESTED
+- [x] Cancellation reason dialog ✅ TESTED
+- [x] Calendar view (Schedule-X week/day/month, doctor colors) ✅ TESTED
+- [x] Availability checker (dialog on appointments page + sidebar on calendar)
+- [x] Doctor schedule view (doctor filter on calendar + appointments page)
+
+### Treatments
+- [x] Treatment catalog list (category filter chips, table) ✅ TESTED
+- [x] Create treatment (name, category, description, duration, price, recall) ✅ TESTED
+- [x] Edit treatment ✅ TESTED
+- [x] Delete treatment (soft-delete) ✅ TESTED
+- [x] Treatment plans list (per patient, collapsible cards with progress) ✅ TESTED
+- [x] Create treatment plan with items ✅ TESTED
+- [x] Add items to plan (treatment combobox, auto-fill name) ✅ TESTED
+- [x] Plan item status management (inline dropdown) ✅ TESTED
+- [x] Delete plan / remove items ✅ TESTED
+- [x] Tooth number input (dental badge display) ✅ TESTED
+
+### Users
+- [x] Users list (table, role badges, clinic assignments, status) ✅ TESTED
+- [x] Invite user dialog (name, email, password, role, clinics) ✅ TESTED
+- [x] User edit page (/users/:id/edit — name, role, phone, permissions grid)
+- [x] Per-user custom permissions (full override, grouped checkbox grid)
+- [x] Doctor profile page (/users/:id/profile — specialty, working hours, breaks, holidays)
+- [x] Availability blocks (holidays, leaves, breaks — AvailabilityBlock model)
+- [x] Per-day slot duration + break times in working hours
+- [x] Deactivate user (soft-delete)
+- [x] Clinic assignments management (checkbox list on user edit page)
+
+### Clinics
+- [x] Clinics list (card grid with patient/appointment counts, timezone)
+- [x] Create clinic dialog (name, slug, address, phone, email, timezone)
+- [x] Clinic settings page (/clinics/:id/settings — general, AI, operator, SMS, retention)
+- [x] Meta connections management (WhatsApp/Instagram — add, delete, token status)
+- [x] Google Calendar connection (OAuth connect/disconnect)
+
+## Pages — Communication
+
+### Chats (WhatsApp/Instagram)
+- [x] Chat list (sidebar, search, status filter, auto-refresh) ✅ TESTED
+- [x] Chat view (message bubbles — contact/AI/human, timestamps)
+- [x] Send message (text input, Enter to send)
+- [x] Session status indicators (AI/Human/Waiting badges)
+- [x] Takeover / release / resolve actions
+- [x] Chat assignment system (assign to staff, chats:read_own for sales)
+- [ ] Blacklist management
+- [ ] Real-time updates (Socket.IO — currently polling)
+
+### Calls
+- [ ] Calls list (filterable by direction, status)
+- [ ] Call detail (transcript, summary, recording)
+- [ ] Call stats dashboard
+
+### Leads
+- [ ] Leads list (filterable by status)
+- [ ] Lead detail
+- [ ] Status update (contacted, scheduled, lost, etc.)
+- [ ] Today's leads view
+- [ ] CSV export
+
+## Pages — Campaigns & Validation
+
+### Outbound Campaigns
+- [ ] Campaign list
+- [ ] Create campaign wizard (agent config, schedule, extraction schema)
+- [ ] Upload entries (CSV)
+- [ ] Campaign detail (stats, entries, results)
+- [ ] Start / pause / resume / stop controls
+- [ ] Results export
+
+### Appointment Validation
+- [ ] Batch list
+- [ ] Create batch (CSV upload, column mapping)
+- [ ] Batch detail (entries, stats)
+- [ ] Submit / cancel / retry actions
+- [ ] Export results
+
+## Pages — Admin & Settings
+
+### Billing
+- [ ] Usage summary (plan vs actual)
+- [ ] Daily trend chart
+- [ ] Billing history
+- [ ] Past period snapshots
+- [ ] Record payment
+
+### Agents
+- [ ] Agent list
+- [ ] Agent config (ElevenLabs settings)
+- [ ] Toggle active
+
+### Phone Numbers
+- [ ] Phone number list
+- [ ] Register phone number
+- [ ] Schedule management (inbound calls)
+
+### Settings
+- [ ] General settings
+- [ ] Profile / password change
+
+### Audit & Logs
+- [ ] Audit trail (filterable)
+- [ ] System logs (admin)
+
+## Dashboard
+- [x] Stat cards (patients, appointments, sessions, leads)
+- [ ] Charts (calls per day, appointment trends)
+- [ ] Recent activity feed
+- [ ] Today's appointments list
+- [ ] Active AI sessions
+- [ ] Quick actions
+
+## Security & Auth
+- [x] Opaque token auth (localStorage) ✅ TESTED
+- [x] 401 interceptor with refresh ✅ TESTED
+- [x] Auth guard on protected routes ✅ TESTED
+- [x] Token cleared on login page mount ✅ TESTED
+- [x] File proxy (no MinIO URL exposure) ✅ TESTED
+- [x] Query param token for file streaming ✅ TESTED
+- [ ] Role-based UI (hide buttons/pages by permission)
+- [ ] Session timeout warning
+
+## Performance
+- [x] Lazy loading (React.lazy + Suspense)
+- [x] React Compiler (automatic memoization)
+- [ ] Code splitting per route chunk
+- [ ] Image optimization
+- [ ] Virtual scrolling for large lists
+
+## Testing
+- [ ] Unit tests
+- [ ] Integration tests
+- [ ] E2E tests (Playwright)
+
+## Deployment
+- [ ] Production build config
+- [ ] Docker container
+- [ ] Electron desktop wrapper
+- [ ] Auto-update mechanism
+
+---
+
+## Bug Fixes Applied
+- [x] CORS: added PUT/PATCH/DELETE methods
+- [x] Patient search: frontend sends ?q= (was ?search=)
+- [x] Response structure: reads data.meta.total (was data.total)
+- [x] Doctor role: added patients:create permission
+- [x] Default clinic: auto-assigned on patient creation
+- [x] Note author: display author.firstName + lastName (was authorName)
+- [x] Document size: reads doc.sizeBytes (was doc.size → NaN)
+- [x] DB schema sync: pushed appt_reminder_sent columns
+- [x] File size limit: increased Fastify body limit to 50MB
+- [x] Referral tracking: sourceDetail field in create/edit forms

package/docs/IMPLEMENTATION_STATUS.md

@@ -0,0 +1,470 @@
+# Implementation Status
+
+> NestJS Backend — Portal Asistan 7/24
+> Last updated: 2026-04-03
+
+---
+
+## Tech Stack (Implemented)
+
+| Layer | Technology | Status |
+|-------|-----------|--------|
+| Framework | NestJS + Fastify adapter | Working |
+| Language | TypeScript (strict) | Working |
+| Database | PostgreSQL + Prisma ORM | Working (44 models, 31 enums) |
+| Cache & Queues | Redis + BullMQ | Working (18 queues registered) |
+| Object Storage | MinIO (S3-compatible) | Client implemented |
+| Auth | Opaque tokens + Redis-backed JWT | Working |
+| API Docs | Swagger (auto-generated) | Working at /api/docs |
+| Security | Helmet, CORS, class-validator DTOs | Working |
+| Rate Limiting | @nestjs/throttler + Redis | Working |
+| Encryption | AES-256-GCM (5 keys) | Working |
+| Events | @nestjs/event-emitter | Working |
+
+---
+
+## Modules (34 total)
+
+### Infrastructure (7 modules)
+
+| Module | Path | Description | Status |
+|--------|------|-------------|--------|
+| ConfigModule | `src/config/` | Global, loads .env | Working |
+| DatabaseModule | `src/database/` | Global, PrismaService with PostgreSQL + Prisma adapter | Working |
+| RedisModule | `src/redis/` | Global, ioredis client | Working |
+| QueueModule | `src/queue/` | Global, 18 BullMQ queues | Working (queues registered, processors are stubs) |
+| EncryptionModule | `src/encryption/` | Global, AES-256-GCM encrypt/decrypt | Working |
+| AuthModule | `src/auth/` | Global, opaque tokens + Redis JWT, login/register/refresh/logout/password reset | Working |
+| EventEmitterModule | (NestJS built-in) | Inter-module communication | Working |
+
+### Core Domain (9 modules)
+
+| Module | Endpoints | Status | Details |
+|--------|-----------|--------|---------|
+| TenantsModule | 2 | Working | GET/PUT /tenants/me |
+| UsersModule | 6 | Working | Full CRUD with invite, clinic assignments, soft delete |
+| ClinicsModule | 5 | Working | Full CRUD, 27-column config, auto-slug |
+| PlansModule | 4 | Working | CRUD (superadmin manages, all read) |
+| PatientsModule | 12 | Working | CRM with search, medical history, notes, PII encryption |
+| TreatmentsModule | 13 | Working | Catalog + treatment plans with items, encrypted notes |
+| AgentsModule | 5 | Working | CRUD + toggle active |
+| PhoneNumbersModule | 6 | Working | CRUD + schedule update |
+| BillingModule | 5 | Working | Usage summary, daily trend, snapshots, payments |
+
+### Communication (7 modules)
+
+| Module | Endpoints | Status | Details |
+|--------|-----------|--------|---------|
+| WhatsAppModule | 11 | Partial | Chat/session queries work, message decryption works, blacklist CRUD works. AI engine (ElevenLabs WS, grace period, message buffer) is TODO |
+| CallsModule | 3 | Working | Paginated list, stats, detail with transcript |
+| LeadsModule | 5 | Working | List, today, get, update status, CSV export |
+| GoogleCalendarModule | 5 | Working | OAuth flow, availability checking, event CRUD |
+| OutboundCampaignsModule | 13 | Working | Full state machine, entries, start/pause/resume/stop, retry, export |
+| AppointmentValidationModule | 8 | Working | Batch lifecycle, submit, cancel, retry, export |
+| WebhooksModule | 4 | Partial | Meta webhook verification + event emission works. ElevenLabs webhook enqueues to BullMQ. Tool webhook returns stub. |
+
+### Tools (1 module)
+
+| Module | Details | Status |
+|--------|---------|--------|
+| ToolsModule | 13 tool handlers registered via @Tool() auto-discovery | Partial — Registry, adapters, and handler structure work. Tool handler implementations are TODO stubs. |
+
+### Integrations (6 modules)
+
+| Module | Status | Details |
+|--------|--------|---------|
+| ElevenLabsModule | Working | HTTP client for signed URLs, conversations, batch calls, SIP outbound, STT |
+| MetaBusinessModule | Working | WhatsApp Cloud API (send text/template/media/interactive), Instagram Messenger, webhook HMAC verification |
+| AIModule | Working | OpenAI + Anthropic providers, provider resolution chain (agent -> clinic -> env) |
+| MinioModule | Working | Upload, download, signed URLs, bulk delete, bucket management |
+| NetGSMModule | Stub | Returns `{ success: false }` |
+| TekTipPayModule | Stub | Returns `{ success: false }` |
+
+### Platform & Admin (2 modules)
+
+| Module | Endpoints | Status | Details |
+|--------|-----------|--------|---------|
+| PlatformModule | 6 | Working | Sales tenant onboarding (create tenant+clinic+owner, list, update, deactivate/reactivate) |
+| AdminModule | 2 | Working | System health check, global usage stats |
+
+### Observability (2 modules)
+
+| Module | Endpoints | Status | Details |
+|--------|-----------|--------|---------|
+| LoggingModule | 4 | Working | Async batched PostgreSQL writer (buffer 100, flush 5s), paginated log queries, stats, cleanup, request tracing |
+| AuditModule | 3 | Working | Synchronous immutable writes, @Auditable() decorator + interceptor, entity/user history queries |
+
+---
+
+## Endpoints Summary (~131 total)
+
+### Auth (8 endpoints)
+
+| Method | Path | Permission | Status |
+|--------|------|-----------|--------|
+| POST | `/auth/login` | Public (rate limited: 5/min) | Working |
+| POST | `/auth/register` | Public (rate limited: 3/hr) | Working |
+| POST | `/auth/refresh` | Public | Working |
+| POST | `/auth/logout` | Authenticated | Working |
+| POST | `/auth/change-password` | Authenticated | Working |
+| POST | `/auth/forgot-password` | Public (rate limited: 3/15min) | Working |
+| POST | `/auth/reset-password` | Public | Working |
+| GET | `/auth/me` | Authenticated | Working |
+
+### Tenants (2 endpoints)
+
+| Method | Path | Permission | Status |
+|--------|------|-----------|--------|
+| GET | `/tenants/me` | Authenticated | Working |
+| PUT | `/tenants/me` | `tenant:update` | Working |
+
+### Users (6 endpoints)
+
+| Method | Path | Permission | Status |
+|--------|------|-----------|--------|
+| GET | `/users` | `users:read` | Working |
+| GET | `/users/:id` | `users:read` | Working |
+| POST | `/users/invite` | `users:invite` | Working |
+| PUT | `/users/:id` | `users:update` | Working |
+| PUT | `/users/:id/clinics` | `users:update` | Working |
+| DELETE | `/users/:id` | `users:delete` | Working |
+
+### Clinics (5 endpoints)
+
+| Method | Path | Permission | Status |
+|--------|------|-----------|--------|
+| GET | `/clinics` | `clinics:read` | Working |
+| GET | `/clinics/:id` | `clinics:read` | Working |
+| POST | `/clinics` | `clinics:create` | Working |
+| PUT | `/clinics/:id` | `clinics:update` | Working |
+| DELETE | `/clinics/:id` | `clinics:delete` | Working |
+
+### Plans (4 endpoints)
+
+| Method | Path | Permission | Status |
+|--------|------|-----------|--------|
+| GET | `/plans` | Authenticated | Working |
+| GET | `/plans/:id` | Authenticated | Working |
+| POST | `/plans` | `platform:plans.manage` | Working |
+| PUT | `/plans/:id` | `platform:plans.manage` | Working |
+
+### Patients (12 endpoints)
+
+| Method | Path | Permission | Status |
+|--------|------|-----------|--------|
+| GET | `/patients` | `patients:read` | Working |
+| GET | `/patients/search` | `patients:read` | Working |
+| POST | `/patients` | `patients:create` | Working |
+| GET | `/patients/:id` | `patients:read` | Working |
+| PUT | `/patients/:id` | `patients:update` | Working |
+| DELETE | `/patients/:id` | `patients:delete` | Working |
+| GET | `/patients/:id/medical-history` | `patients:read` | Working |
+| PUT | `/patients/:id/medical-history` | `patients:update` | Working |
+| GET | `/patients/:id/notes` | `patients:read` | Working |
+| POST | `/patients/:id/notes` | `patients:update` | Working |
+| PUT | `/patients/:id/notes/:noteId` | `patients:update` | Working |
+| DELETE | `/patients/:id/notes/:noteId` | `patients:update` | Working |
+
+### Treatments — Catalog (6 endpoints)
+
+| Method | Path | Permission | Status |
+|--------|------|-----------|--------|
+| GET | `/treatments` | `treatments:read` | Working |
+| GET | `/treatments/categories` | `treatments:read` | Working |
+| POST | `/treatments` | `treatments:manage` | Working |
+| GET | `/treatments/:id` | `treatments:read` | Working |
+| PUT | `/treatments/:id` | `treatments:manage` | Working |
+| DELETE | `/treatments/:id` | `treatments:manage` | Working |
+
+### Treatments — Plans (7 endpoints)
+
+| Method | Path | Permission | Status |
+|--------|------|-----------|--------|
+| GET | `/patients/:patientId/treatment-plans` | `patients:read` | Working |
+| POST | `/patients/:patientId/treatment-plans` | `treatment_plans:manage` | Working |
+| GET | `/treatment-plans/:id` | `patients:read` | Working |
+| PUT | `/treatment-plans/:id` | `treatment_plans:manage` | Working |
+| DELETE | `/treatment-plans/:id` | `treatment_plans:manage` | Working |
+| POST | `/treatment-plans/:id/items` | `treatment_plans:manage` | Working |
+| PUT | `/treatment-plans/:id/items/:itemId` | `treatment_plans:manage` | Working |
+| DELETE | `/treatment-plans/:id/items/:itemId` | `treatment_plans:manage` | Working |
+
+### Agents (5 endpoints)
+
+| Method | Path | Permission | Status |
+|--------|------|-----------|--------|
+| GET | `/agents` | `agents:read` | Working |
+| GET | `/agents/:id` | `agents:read` | Working |
+| POST | `/agents` | `agents:manage` | Working |
+| PUT | `/agents/:id` | `agents:manage` | Working |
+| POST | `/agents/:id/toggle` | `agents:manage` | Working |
+
+### Phone Numbers (6 endpoints)
+
+| Method | Path | Permission | Status |
+|--------|------|-----------|--------|
+| GET | `/phone-numbers` | `phone_numbers:read` | Working |
+| GET | `/phone-numbers/:id` | `phone_numbers:read` | Working |
+| POST | `/phone-numbers` | `phone_numbers:manage` | Working |
+| PUT | `/phone-numbers/:id` | `phone_numbers:manage` | Working |
+| PUT | `/phone-numbers/:id/schedule` | `phone_numbers:manage` | Working |
+| DELETE | `/phone-numbers/:id` | `phone_numbers:manage` | Working |
+
+### Calls (3 endpoints)
+
+| Method | Path | Permission | Status |
+|--------|------|-----------|--------|
+| GET | `/calls` | `calls:read` | Working |
+| GET | `/calls/stats` | `calls:read` | Working |
+| GET | `/calls/:id` | `calls:read` | Working |
+
+### Leads (5 endpoints)
+
+| Method | Path | Permission | Status |
+|--------|------|-----------|--------|
+| GET | `/leads` | `leads:read` | Working |
+| GET | `/leads/today` | `leads:read` | Working |
+| GET | `/leads/export` | `leads:export` | Working |
+| GET | `/leads/:id` | `leads:read` | Working |
+| PATCH | `/leads/:id` | `leads:update` | Working |
+
+### Billing (5 endpoints)
+
+| Method | Path | Permission | Status |
+|--------|------|-----------|--------|
+| GET | `/billing/usage` | `billing:read` | Working |
+| GET | `/billing/daily-trend` | `billing:read` | Working |
+| GET | `/billing/snapshots` | `billing:read` | Working |
+| GET | `/billing/history` | `billing:read` | Working |
+| POST | `/billing/payments` | `billing:manage` | Working |
+
+### WhatsApp (11 endpoints)
+
+| Method | Path | Permission | Status |
+|--------|------|-----------|--------|
+| GET | `/whatsapp/chats` | `chats:read` | Working |
+| GET | `/whatsapp/chats/:id` | `chats:read` | Working |
+| GET | `/whatsapp/chats/:id/messages` | `chats:read` | Working |
+| POST | `/whatsapp/chats/:id/takeover` | `chats:takeover` | Working |
+| POST | `/whatsapp/chats/:id/messages` | `chats:send` | Working |
+| POST | `/whatsapp/chats/:id/release` | `chats:takeover` | Working |
+| POST | `/whatsapp/chats/:id/resolve` | `chats:resolve` | Working |
+| GET | `/whatsapp/stats` | `chats:read` | Working |
+| GET | `/whatsapp/blacklist` | `chats:config` | Working |
+| POST | `/whatsapp/blacklist` | `chats:config` | Working |
+| DELETE | `/whatsapp/blacklist/:phone` | `chats:config` | Working |
+
+### Google Calendar (5 endpoints)
+
+| Method | Path | Permission | Status |
+|--------|------|-----------|--------|
+| GET | `/google-calendar/auth-url` | `calendar:manage` | Working |
+| GET | `/google-calendar/callback` | Public (browser redirect) | Working |
+| POST | `/google-calendar/disconnect` | `calendar:manage` | Working |
+| GET | `/google-calendar/calendars` | `calendar:read` | Working |
+| PUT | `/google-calendar/calendar` | `calendar:manage` | Working |
+
+### Outbound Campaigns (13 endpoints)
+
+| Method | Path | Permission | Status |
+|--------|------|-----------|--------|
+| GET | `/outbound-campaigns` | `campaigns:read` | Working |
+| GET | `/outbound-campaigns/:id` | `campaigns:read` | Working |
+| POST | `/outbound-campaigns` | `campaigns:manage` | Working |
+| PUT | `/outbound-campaigns/:id` | `campaigns:manage` | Working |
+| DELETE | `/outbound-campaigns/:id` | `campaigns:manage` | Working |
+| POST | `/outbound-campaigns/:id/entries` | `campaigns:manage` | Working |
+| DELETE | `/outbound-campaigns/:id/entries` | `campaigns:manage` | Working |
+| POST | `/outbound-campaigns/:id/start` | `campaigns:manage` | Working |
+| POST | `/outbound-campaigns/:id/pause` | `campaigns:manage` | Working |
+| POST | `/outbound-campaigns/:id/resume` | `campaigns:manage` | Working |
+| POST | `/outbound-campaigns/:id/stop` | `campaigns:manage` | Working |
+| POST | `/outbound-campaigns/:id/retry` | `campaigns:manage` | Working |
+| GET | `/outbound-campaigns/:id/results` | `campaigns:read` | Working |
+| GET | `/outbound-campaigns/:id/export` | `campaigns:export` | Working |
+
+### Appointment Validation (8 endpoints)
+
+| Method | Path | Permission | Status |
+|--------|------|-----------|--------|
+| GET | `/appointment-validation` | `validation:read` | Working |
+| GET | `/appointment-validation/:id` | `validation:read` | Working |
+| POST | `/appointment-validation` | `validation:manage` | Working |
+| POST | `/appointment-validation/:id/submit` | `validation:manage` | Working |
+| POST | `/appointment-validation/:id/cancel` | `validation:manage` | Working |
+| POST | `/appointment-validation/:id/retry` | `validation:manage` | Working |
+| POST | `/appointment-validation/:id/entries/:entryId/retry` | `validation:manage` | Working |
+| GET | `/appointment-validation/:id/export` | `validation:export` | Working |
+
+### Webhooks (4 endpoints)
+
+| Method | Path | Permission | Status |
+|--------|------|-----------|--------|
+| POST | `/webhooks/elevenlabs` | Public (webhook) | Working (enqueues to BullMQ) |
+| POST | `/webhooks/elevenlabs/tools/:toolName` | API Key (`x-api-key`) | Stub (returns `not_implemented`) |
+| GET | `/webhooks/meta` | Public (`hub.challenge` verification) | Working |
+| POST | `/webhooks/meta` | Public (HMAC-verified) | Working (emits events) |
+
+### Platform (6 endpoints)
+
+| Method | Path | Permission | Status |
+|--------|------|-----------|--------|
+| GET | `/platform/tenants` | `platform:tenants.list` | Working |
+| POST | `/platform/tenants` | `platform:tenants.create` | Working |
+| GET | `/platform/tenants/:id` | `platform:tenants.read` | Working |
+| PUT | `/platform/tenants/:id` | `platform:tenants.update` | Working |
+| PUT | `/platform/tenants/:id/deactivate` | `platform:tenants.update` | Working |
+| PUT | `/platform/tenants/:id/reactivate` | `platform:tenants.update` | Working |
+
+### Admin (2 endpoints)
+
+| Method | Path | Permission | Status |
+|--------|------|-----------|--------|
+| GET | `/admin/system/health` | `platform:plans.manage` | Working |
+| GET | `/admin/system/usage` | `platform:plans.manage` | Working |
+
+### Logs (4 endpoints)
+
+| Method | Path | Permission | Status |
+|--------|------|-----------|--------|
+| GET | `/admin/logs` | `audit:read` | Working |
+| GET | `/admin/logs/stats` | `audit:read` | Working |
+| DELETE | `/admin/logs` | Superadmin only | Working |
+| GET | `/admin/logs/request/:requestId` | `audit:read` | Working |
+
+### Audit Logs (3 endpoints)
+
+| Method | Path | Permission | Status |
+|--------|------|-----------|--------|
+| GET | `/audit-logs` | `audit:read` | Working |
+| GET | `/audit-logs/entity/:entity/:entityId` | `audit:read` | Working |
+| GET | `/audit-logs/user/:userId` | `audit:read` | Working |
+
+---
+
+## Database Schema
+
+- **44 Prisma models** (1677 lines in `prisma/schema.prisma`)
+- **31 enums**
+- Tables removed from original design: `whatsapp_contact_profiles` (#19), `whatsapp_recipients` (#35)
+- Tables added for new CRM domain: `patients`, `patient_medical_histories`, `patient_documents`, `patient_notes`, `treatments`, `treatment_plans`, `treatment_plan_items`, `doctor_profiles`, `patient_photo_sets`, `patient_photos`, `examination_records`
+
+---
+
+## Security
+
+| Feature | Status |
+|---------|--------|
+| Opaque tokens (client never sees JWT) | Working |
+| Redis session storage | Working |
+| bcrypt password hashing (12 rounds) | Working |
+| AES-256-GCM encryption (5 keys) | Working |
+| Tenant-scoped queries (Prisma middleware) | Structure ready, middleware TODO |
+| RBAC with 40+ permissions | Working |
+| Clinic-scoped access | Working |
+| Rate limiting | Working |
+| Helmet security headers | Working |
+| CORS whitelist | Working |
+| Webhook HMAC verification | Working (Meta) |
+| Message encryption | Working |
+| Patient PII encryption | Working |
+| 2FA | Not planned for launch |
+
+---
+
+## BullMQ Queues (18)
+
+| # | Queue Name | Purpose | Processor Status |
+|---|-----------|---------|-----------------|
+| 1 | `whatsapp-grace` | Grace period expiry | Stub |
+| 2 | `whatsapp-message-buffer` | Message debounce | Stub |
+| 3 | `whatsapp-session-cleanup` | Inactive session sweep | Stub |
+| 4 | `whatsapp-cost-sweep` | ElevenLabs cost fetch | Stub |
+| 5 | `whatsapp-operator-expiry` | Expire operator requests | Stub |
+| 6 | `whatsapp-profile-update` | Patient AI summary update | Stub |
+| 7 | `whatsapp-session-labels` | Sentiment/category generation | Stub |
+| 8 | `whatsapp-message-cleanup` | Auto-delete old messages | Stub |
+| 9 | `elevenlabs-webhook` | Post-call processing | Stub |
+| 10 | `elevenlabs-tools` | Tool call processing | Stub |
+| 11 | `billing-snapshot` | Period snapshot | Registered (no processor yet) |
+| 12 | `billing-alerts` | Usage alerts | Registered (no processor yet) |
+| 13 | `appointment-validation-dispatch` | Batch call dispatch | Stub |
+| 14 | `appointment-validation-sync` | Status sync | Stub |
+| 15 | `appointment-reminder` | Pre-appointment reminders | Registered (no processor yet) |
+| 16 | `inbound-call-schedule-sync` | Phone schedule sync | Registered (no processor yet) |
+| 17 | `log-cleanup` | Delete old logs | Registered (no processor yet) |
+| 18 | `webhook-outgoing` | Tenant webhook delivery | Registered (no processor yet) |
+
+---
+
+## AI Tools (13)
+
+| Tool | Feature Flag | Channels | Status |
+|------|-------------|----------|--------|
+| `check_availability` | `google_calendar` | whatsapp, voice_call, instagram | TODO |
+| `reserve_slot` | `google_calendar` | whatsapp, voice_call, instagram | TODO |
+| `list_reservations` | `google_calendar` | whatsapp, voice_call, instagram | TODO |
+| `cancel_reservation` | `google_calendar` | whatsapp, voice_call, instagram | TODO |
+| `reschedule_reservation` | `google_calendar` | whatsapp, voice_call, instagram | TODO |
+| `forward_to_operator` | `operator_workflow` | whatsapp | TODO |
+| `forward_conversation` | `operator_workflow` | whatsapp | TODO |
+| `send_example_photo` | `operator_workflow` | whatsapp | TODO |
+| `check_patient_history` | -- | whatsapp, voice_call, instagram | TODO |
+| `call_patient` | `outbound_calls` | whatsapp | TODO |
+| `confirm_appointment_validation` | `appointment_validation` | voice_call | TODO |
+| `request_payment` | `tektippay` | whatsapp, instagram | Stub (TekTipPay not implemented) |
+| `send_sms` | `sms` | whatsapp, voice_call, instagram | Stub (NetGSM not implemented) |
+
+---
+
+## What's TODO
+
+### Priority 1 -- Core functionality gaps
+
+- WhatsApp AI engine (ElevenLabs WebSocket connection, message buffering, grace period logic)
+- BullMQ processor implementations (all 8 WhatsApp processors)
+- Operator workflow forwarding (REF code generation, media forwarding via Meta API)
+- Tool handler implementations (calendar tools, patient history, operator tools)
+- Prisma tenant-scoping middleware (auto-inject WHERE tenantId)
+- Real-time WebSocket gateway (Socket.IO for dashboard live updates)
+
+### Priority 2 -- Integration completions
+
+- ElevenLabs WebSocket text-only chat integration
+- Meta Business API webhook message processing (normalize payload, route to WhatsApp engine)
+- Google Calendar sync (our calendar -> Google, bidirectional)
+- Appointment reminder BullMQ processor
+- Message auto-deletion BullMQ processor
+
+### Priority 3 -- Polish
+
+- Billing snapshot and alert BullMQ processors
+- Outbound campaign dispatch processor
+- Appointment validation dispatch + sync processors
+- Log cleanup processor
+- Error handling standardization
+- Request context (AsyncLocalStorage for correlation IDs)
+- Audit trail integration on all mutating endpoints
+
+### Not planned for launch
+
+- 2FA (TOTP)
+- NetGSM SMS (stub)
+- TekTipPay payments (stub)
+- Baileys WhatsApp bridge
+- Patient financial ledger
+- Patient portal
+
+---
+
+## Encryption Keys
+
+| Key | Env Variable | Protects |
+|-----|-------------|----------|
+| Google tokens | `GOOGLE_TOKEN_ENCRYPTION_KEY` | Google Calendar OAuth refresh tokens |
+| Meta tokens | `META_TOKEN_ENCRYPTION_KEY` | Meta Business API access tokens |
+| Messages | `MESSAGE_ENCRYPTION_KEY` | Chat messages, operator request text/responses |
+| Patient PII | `PATIENT_PII_ENCRYPTION_KEY` | TC Kimlik, medical history, exam records, clinical notes |
+| Patient summaries | `PATIENT_SUMMARY_ENCRYPTION_KEY` | AI-generated patient summaries |
+
+All keys: 32-byte hex. Generate with `openssl rand -hex 32`.