fix: use npm instead of bun for Windows desktop build

Bun on Windows fails to install native modules like @electron/node-gyp

.docker/docker-compose.yml

@@ -1,37 +0,0 @@
-version: "3"
-
-services:
-  pgsql:
-    image: postgres:17
-    restart: unless-stopped
-    environment:
-      POSTGRES_USER: optima
-      POSTGRES_PASSWORD: 123web123
-      POSTGRES_DB: optima
-    volumes:
-      - ./postgres:/var/lib/postgresql/data
-    ports:
-      - 5432:5432
-
-  redis:
-    image: redis:6.2-alpine
-    restart: always
-    ports:
-      - "6379:6379"
-    command: redis-server --save 20 1 --loglevel warning --requirepass iamatotallysecurepassworddonttestmebrox
-    volumes:
-      - ./redis:/data
-
-  adminer:
-    image: adminer
-    restart: unless-stopped
-    ports:
-      - 8080:8080
-    depends_on:
-      - pgsql
-  redisinsight:
-    image: redis/redisinsight:latest
-    container_name: redisinsight
-    ports:
-      - "5540:5540"
-    restart: unless-stopped

.dockerignore

@@ -0,0 +1,16 @@
+node_modules
+.svelte-kit
+build
+out
+.vite
+.env
+.env.*
+*.dmg
+*.zip
+e2e
+electron
+forge.config.ts
+forge.env.d.ts
+vite.main.config.ts
+vite.preload.config.ts
+playwright.config.ts

.github/act-event.json

@@ -1,6 +0,0 @@
-{
-  "action": "created",
-  "release": {
-    "tag_name": "v0.0.0-test"
-  }
-}

.github/copilot-instructions.md

@@ -1,227 +1,157 @@
-# Copilot / AI Agent Instructions for optima-api
+# Copilot Instructions for ttscm-ui
 
-Purpose: make AI coding agents immediately productive in this repository by describing architecture, conventions, workflows, and helpful code pointers.
+## Project Overview
 
----
+**ttscm-ui** is an Electron desktop application built with **SvelteKit**, TypeScript, and Vite. It connects to the Optima API for credential and company management. The app uses standard SvelteKit routing for single-page navigation and bun for package management with patches applied to SvelteKit.
 
-## Big picture
+## Architecture Layers
 
-This is a TypeScript API service (runs on **Bun**) using the **Hono** framework. The HTTP surface is implemented in `src/api` where small route-handler files are mounted on a versioned router in `src/api/server.ts` (see the `/v1` mount). The typical request flow is:
+### Electron Architecture
 
-```
-server.ts → routers/<domain>Router.ts → api/<domain>/*.ts (route handlers) → managers/<domain>.ts → controllers (domain models) / modules / generated/prisma
+- **`electron/main.ts`**: Main process—creates/manages windows, handles file system access. Loads preload script and serves the renderer.
+- **`electron/preload.ts`**: Currently empty bridge between main and renderer processes. Extend here to expose secure IPC handlers if needed.
+- **`forge.config.ts`**: Electron Forge configuration with Vite plugin for building main, preload, and renderer targets.
+
+### Frontend (SvelteKit)
+
+- **`src/routes/`**: SvelteKit file-based routing with standard pathname router.
+  - `(auth)` group: Authentication pages (login)
+  - `(secure)` group: Protected pages requiring auth
+- **`src/lib/`**: Reusable modules
+  - `optima-api/`: API client abstraction with modular endpoints (auth, companies, credentials, etc.)
+  - `axios.ts`: Base axios instance with `PUBLIC_API_URL` env variable
+- **`src/components/`**: Reusable Svelte components (modals, spinners, error boundaries)
+
+### API Communication
+
+The `$lib/index.ts` exports `optima` object aggregating all API modules. Example:
+
+```typescript
+export const optima = {
+  auth: (await import("./optima-api/modules/auth")).auth,
+  company: (await import("./optima-api/modules/companies")).company,
+  // etc.
+};
 ```
 
-Keep each layer focused:
+Each module (e.g., `auth.ts`) exports functions that call the API using a custom axios instance.
 
-- **Route handler files** (`src/api/<domain>/*.ts`) — define individual endpoints using the `createRoute()` utility, handle request validation with Zod, call managers, and return `apiResponse.*` results.
-- **Routers** (`src/api/routers/*`) — aggregate route handler files from a domain's `index.ts` and re-mount them under a single prefix. Mounted in `src/api/server.ts`.
-- **Managers** (`src/managers/*`) — thin domain/persistence layers that wrap `generated/prisma` calls and other I/O. Managers instantiate and return **controller** instances as domain objects.
-- **Controllers** (`src/controllers/*`) — **domain model classes** (e.g., `CompanyController`, `CredentialController`, `UserController`) that encapsulate entity state and domain methods. They are NOT request handlers. Managers create and return controller instances.
-- **Modules** (`src/modules/*`) — shared utilities, external API clients (ConnectWise, UniFi, Microsoft), credential helpers, permission utilities, and tools.
+## Key Conventions
 
----
+### Routing
 
-## Runtime / tooling
+- **Use standard SvelteKit routing with `/` prefix** (e.g., `href="/credentials"`)
+- Routes in `src/routes/` map to `/path` at runtime
+- Do NOT use hash-based routing (`#/` routes)
 
-The project runs on **Bun** exclusively — **always use `bun` commands, never `npm`, `npx`, or `yarn`**. DB tooling uses **Prisma**; the generated client lives under `generated/prisma` (do NOT edit generated files). Test preloads are configured in `bunfig.toml` so bare `bun test` works. Key scripts in `package.json`:
+### API Module Pattern
 
-- `dev` — `NODE_ENV=development bun --watch src/index.ts` (start dev server with hot reload)
-- `test` — `bun test` (runs all tests with preload from `bunfig.toml`)
-- `db:gen` — `prisma generate`
-- `db:push` — `prisma migrate dev --skip-generate`
-- `utils:dev` — `docker compose -f .docker/docker-compose.yml up --build`
-- `utils:gen_private_keys` — `bun ./utils/genPrivateKeys`
-- `utils:create_admin_role` — `bun ./utils/createAdminRole`
-- `utils:assign_user_role` — `bun ./utils/assignUserRole`
+Create API modules in `src/lib/optima-api/modules/` following this pattern:
 
-## Data layer
-
-Prisma schema is at `prisma/schema.prisma`. The app imports the generated Prisma client from `generated/prisma/client.ts` (or `generated/prisma/browser.ts` for browser type contexts). The shared `prisma` instance is exported from `src/constants.ts`. Always run `bun run db:gen` after updating `schema.prisma`.
-
-## Shared constants (`src/constants.ts`)
-
-This file exports critical shared instances used across the codebase:
-
-- `prisma` — the PrismaClient instance (via `@prisma/adapter-pg`)
-- `PORT`, session/token durations, private/public keys for JWT signing
-- `msalClient` — Microsoft MSAL client for OAuth
-- `connectWiseApi` — Axios instance for ConnectWise API
-- `unifi` — `UnifiClient` instance for UniFi controller interaction
-
----
-
-## Route handler pattern (`createRoute`)
-
-Every route handler file uses the `createRoute()` utility from `src/modules/api-utils/createRoute.ts`. It creates a self-contained Hono sub-app for a single endpoint:
-
-```ts
-export default createRoute(
-  "get", // HTTP method
-  ["/companies"], // path(s)
-  async (c) => {
-    /* handler */
-  }, // request handler
-  authMiddleware({ permissions: ["company.fetch.many"] }), // middleware (spread)
-);
+```typescript
+// Example: credentials.ts
+export const credential = {
+  async fetchCredentials(api: AxiosInstance) {
+    // Implementation
+  },
+};
 ```
 
-Route files live in `src/api/<domain>/*.ts`. Each domain folder has an `index.ts` that re-exports all route modules. Router files (`src/api/routers/<domain>Router.ts`) import from the domain's index and auto-mount all routes:
+Export as a named object, then import/aggregate in `src/lib/index.ts`.
 
-```ts
-import * as companyRoutes from "../companies";
-const companyRouter = new Hono();
-Object.values(companyRoutes).map((r) => companyRouter.route("/", r));
-export default companyRouter;
+### Environment Variables
+
+- `PUBLIC_API_URL`: API base URL, used in `src/lib/optima-api/axios.ts`
+- Prefixed with `PUBLIC_` to be accessible in client code
+
+### File Organization
+
+- Components go in `src/components/` (e.g., modals, spinners)
+- Page-specific logic in `src/routes/[route]/+page.svelte` and `+page.server.ts`
+- Styles in `src/styles/` with Tailwind CSS + TailwindCSS vite plugin
+- Tests colocated: `*.spec.ts` or `*.test.ts` next to source files
+
+## Development Workflow
+
+### Installation & Setup
+
+```bash
+bun install
 ```
 
-`src/api/server.ts` then mounts each router under `/v1`:
+Uses bun with SvelteKit patches (see `patches/` directory).
 
-```ts
-v1.route("/company", require("./routers/companyRouter").default);
+### Running in Development
+
+```bash
+bun start
 ```
 
-## Routing & domain organization
+Electron Forge + Vite handles dev server and hot module replacement (HMR). Dev tools open automatically. Main window loads `/login` first.
 
-The `server.ts` file mounts these routers under `/v1`:
+### Building & Packaging
 
-- `/teapot` — health check
-- `/auth` — Microsoft OAuth flow (`src/api/auth/*`)
-- `/user` — user routes (`src/api/user/*`) including `@me` sub-routes
-- `/company` — company routes (`src/api/companies/*`)
-- `/credential` — credential routes (`src/api/credentials/*`)
-- `/credential-type` — credential type routes (`src/api/credential-types/*`)
-- `/role` — role management (`src/api/roles/*`)
-- `/permissions` — permission node queries (`src/api/permissions/*`)
-- `/unifi` — UniFi integration (`src/api/unifi/*` with `sites/` and `site/` sub-folders)
+- **Build for production**: `bun run package` → outputs to `out/` directory
+- **Create distributable**: `bun run make` → creates installers (configure in `forge.config.ts`)
+- **Check types & lint**: `bun run check` (runs svelte-kit sync + svelte-check)
 
----
+### Testing
 
-## API layout & conventions (how to add a new endpoint)
+#### Unit Tests (Vitest)
 
-1. **Add route handler files**: Create `src/api/<domain>/<action>.ts` files, each exporting a default `createRoute(...)` call. Validate input with Zod inside the handler, call managers for business logic, and return responses via `apiResponse.*`.
-2. **Add domain index**: Create `src/api/<domain>/index.ts` that re-exports all route modules from the folder.
-3. **Add router**: Create `src/api/routers/<domain>Router.ts` that imports all routes from the domain's index and mounts them. Mount it in `src/api/server.ts` under `v1`.
-4. **Add manager**: Create `src/managers/<domains>.ts` (plural filename) for persistence/domain logic. Use the `prisma` instance from `src/constants.ts`; do not import Prisma directly in route handlers. Managers should instantiate and return controller instances when the domain warrants it.
-5. **Add controller** (if needed): Create `src/controllers/<Domain>Controller.ts` (singular filename) as a **class** that encapsulates entity state, domain methods, and a `toJson()` serializer. Controllers are domain model objects — they do NOT handle HTTP requests.
-6. **Add modules/types**: If needed, add helpers to `src/modules/*` and runtime types to `src/types/*`.
-7. **Middleware & auth**: Use `authMiddleware()` from `src/api/middleware/authorization.ts` as the last argument to `createRoute()`. It accepts `{ permissions?: string[], scopes?: string[], forbiddenAuthTypes?: string[] }`. Follow existing token/session patterns from `src/controllers/SessionController.ts` and `src/Errors/*`.
-8. **Error handling**: Throw repository-specific errors from `src/Errors/*` (include `status`, `name`, `message`, optional `cause`) and let `src/api/server.ts` map them via `apiResponse.error`.
-9. **Naming conventions**: plural manager filenames (`companies.ts`), singular controller class names (`CompanyController.ts`), descriptive route handler filenames (`fetchAll.ts`, `create.ts`, `update.ts`).
+```bash
+bun run test:unit
+```
 
----
+- Client tests: `src/**/*.svelte.{test,spec}.{js,ts}` (jsdom environment)
+- Server tests: `src/**/*.{test,spec}.{js,ts}` excluding svelte tests (node environment)
+- Setup: `vitest-setup-client.ts` mocks `window.matchMedia` for Svelte 5 + jsdom compatibility
 
-## Examples & notable files
+#### E2E Tests (Playwright)
 
-- `src/api/server.ts` — mounts `v1`, registers `cors`, central `onError` handler and `notFound` response.
-- `src/api/companies/fetchAll.ts` — canonical example of a route handler file using `createRoute()`, `authMiddleware()`, managers, and `apiResponse`.
-- `src/api/credentials/create.ts` — example of Zod validation inside a route handler.
-- `src/api/routers/companyRouter.ts` — canonical router that auto-mounts all route modules from a domain folder.
-- `src/api/user/@me/*` — nested sub-route example (user's own profile endpoints).
-- `src/controllers/CompanyController.ts` — example domain model class with methods like `refreshFromCW()`, `fetchCwData()`, and `toJson()`.
-- `src/controllers/CredentialController.ts` — example of a richer domain model class with field validation, secure value handling, and sub-credential support.
-- `src/managers/companies.ts` — example manager calling Prisma and returning `CompanyController` instances.
-- `src/modules/api-utils/createRoute.ts` — the `createRoute()` utility used by every route handler.
-- `src/modules/cw-utils/*` — external ConnectWise API integrations; keep interfaces stable and return domain objects consumed by managers.
-- `src/modules/unifi-api/UnifiClient.ts` — UniFi controller API client class with methods for sites, WLANs, devices, networks, etc.
-- `src/modules/credentials/*` — credential field validation, secure value encryption/decryption, and type definitions.
-- `src/constants.ts` — shared instances (`prisma`, API clients, keys, durations).
+```bash
+bun run test:e2e
+```
 
----
+- Tests in `e2e/` directory
+- Config: `playwright.config.ts` (builds and previews before testing)
 
-## Validation & errors
+#### Run All Tests
 
-Zod is used for input validation **inside route handler files** (not controllers). Zod errors are handled centrally in `src/api/server.ts` via `apiResponse.zodError`. Application errors use custom error classes in `src/Errors/*` (e.g., `AuthenticationError.ts`, `GenericError.ts`, `AuthorizationError.ts`, `InsufficientPermission.ts`). When creating errors, follow the shape used in existing errors (include `status`, `name`, `message`, and optional `cause`).
+```bash
+bun run test
+```
 
-## Response pattern
+Runs unit tests first, then e2e.
 
-Use the `apiResponse` helpers in `src/modules/api-utils/apiResponse.ts` for formatting all HTTP responses:
+## Critical Integration Points
 
-- `apiResponse.successful(message, data?, meta?)` — 200
-- `apiResponse.created(message, data?)` — 201
-- `apiResponse.error(err)` — reads `status` from the error
-- `apiResponse.internalError()` — 500
-- `apiResponse.zodError(err)` — 400
+### IPC (Electron Main ↔ Renderer)
 
-## Auth & external integrations
+**Status**: Preload script is currently empty. If file system access is needed, define IPC handlers in `electron/main.ts` and expose them via `electron/preload.ts` to renderer process.
 
-Microsoft OAuth flow is under `src/api/auth/*` and `src/modules/fetchMicrosoftUser.ts`. If touching authentication, follow existing redirect/refresh patterns in `src/api/auth` and preserve token-refresh semantics.
+### API Authentication
 
-## ConnectWise integration
+- Auth flow starts in `src/lib/optima-api/modules/auth.ts` with `fetchAuthRedirectUri()`
+- TODO: Enforce auth checks on every page change (see `src/lib/index.ts` comment)
 
-Utilities for ConnectWise interactions live in `src/modules/cw-utils/*` (e.g., `configurations/fetchCompanyConfigurations.ts`, `fetchCompany.ts`, `fetchAllCompanies.ts`). These modules call external APIs via the `connectWiseApi` Axios instance from `src/constants.ts` and return domain data; preserve the module contracts (input types and returned shapes) when refactoring.
+### Build Artifacts
 
-## UniFi integration
+- **Dev server URL**: `MAIN_WINDOW_VITE_DEV_SERVER_URL` (injected by Electron Forge)
+- **Output**: Rendered app built to `.vite/renderer/main_window/` (configured in `svelte.config.js`)
 
-The `UnifiClient` class in `src/modules/unifi-api/UnifiClient.ts` wraps all UniFi controller API interactions (login, sites, WLANs, devices, networks, AP groups, WLAN groups, speed profiles, PPSKs). The shared instance is exported from `src/constants.ts` as `unifi`. UniFi route handlers live in `src/api/unifi/` with `sites/` (multi-site operations) and `site/` (single-site operations) sub-folders.
+## Common Patterns & Gotchas
 
-## Generated files and CI
+1. **Standard Routing**: Use standard SvelteKit routing with `/` prefix (e.g., `href="/credentials"`) — do NOT use hash-based routing
+2. **SvelteKit Patches**: Project patches SvelteKit in `patches/` to work around issues. When updating SvelteKit, verify patches still apply.
+3. **Async Components**: Svelte 5 has `experimental.async: true` enabled; be aware of async component patterns.
+4. **Tailwind**: Uses `@tailwindcss/vite` plugin; configure utilities in tailwind config if needed.
+5. **API Error Handling**: API modules throw errors with descriptive messages. Use `$lib/errorHandler.ts` for consistent error formatting.
 
-`generated/` is a build artifact. Do not modify. When updating Prisma models, run `npm run db:gen` and commit changes to `generated/prisma` only if that's the established workflow.
+## Useful Entry Points for Navigation
 
----
-
-## Coding conventions & patterns specific to this repo
-
-- Prefer the existing layered architecture: route handlers → managers → controllers (domain models) / modules.
-- Use the `createRoute()` utility for all route handler files.
-- Use the `apiResponse` helpers for all HTTP responses.
-- Throw or propagate repository-specific custom errors (from `src/Errors/*`) rather than returning bare objects.
-- Keep TypeScript types in `src/types/*` and use Zod for runtime checks inside route handlers.
-- **Avoid `else` statements** — prefer ternary operators, early returns, or other control flow patterns. Only use `else` if there is absolutely no other way.
-- ES module syntax (`export default`, `import`) is used throughout. The `require()` calls in `server.ts` are for lazy loading but all modules use `export default`.
-
----
-
-## Local dev / quick checks
-
-- Start dev server: `bun run dev`
-- Run tests: `bun test`
-- Regenerate Prisma client: `bun run db:gen`
-- Apply DB migrations locally: `bun run db:push`
-- Docker dev utilities: `bun run utils:dev`
-- Generate private keys: `bun run utils:gen_private_keys`
-- Create admin role: `bun run utils:create_admin_role`
-- Assign user role: `bun run utils:assign_user_role`
-
-## When editing generated or infra files
-
-If you need to change `generated/prisma/*` (rare), explain why in the PR and show commands used to regenerate.
-
----
-
-## Documentation sync (IMPORTANT)
-
-Whenever you add, remove, or modify API routes or permission nodes, you **must** update all three of the following files to keep them in sync:
-
-1. `src/types/PermissionNodes.ts` — the single source of truth for all permission node definitions, categories, descriptions, and `usedIn` references.
-2. `PERMISSIONS.md` — human-readable documentation of all permission nodes; must strictly reflect the data in `PermissionNodes.ts`.
-3. `API_ROUTES.md` — comprehensive documentation of all API routes, including method, path, auth requirements, permissions, request/response examples.
-
-Additionally, whenever you add, remove, or modify **caching logic** (TTL algorithms, cache key patterns, background refresh mechanics, retry settings, or invalidation behavior), you **must** update:
-
-4. `CACHING.md` — comprehensive documentation of the Redis-backed opportunity cache, TTL algorithms, background refresh mechanics, retry logic, and debugging tools.
-
-Always verify that new routes have their required permissions listed in `PermissionNodes.ts`, that `PERMISSIONS.md` tables match the TS file exactly, that `API_ROUTES.md` includes full documentation for every mounted route, and that `CACHING.md` accurately reflects any caching changes. Run through all relevant files at the end of any route, permission, or caching change to catch discrepancies.
-
----
-
-## Field-level permission gating (`processObjectValuePerms`)
-
-Some routes use `processObjectValuePerms` from `src/modules/permission-utils/processObjectPermissions.ts` to filter response objects on a per-field basis. When this pattern is used, every key of the response object becomes a permission node in the form `<scope>.<field>` (e.g., `unifi.site.wifi.read.passphrase`). Only fields whose corresponding permission the user holds are included in the response.
-
-There is also `processObjectPermMap` in the same file, which returns a `Record<key, boolean>` indicating which fields the user has permission for (useful for UI gating).
-
-**When documenting a route that uses field-level gating, you must:**
-
-1. Note in `API_ROUTES.md` that the route uses field-level gating, explain the behaviour, and list every `<scope>.<field>` permission node in a collapsible table.
-2. Add a `unifi.site.wifi.read`-style parent permission node in `PermissionNodes.ts` with a `fieldLevelPermissions` array listing every `<scope>.<field>` node.
-3. Add matching rows/notes to `PERMISSIONS.md` including the full list of field-level nodes.
-
-**Current routes using field-level gating:**
-
-- `GET /v1/unifi/site/:id/wifi` — scope `unifi.site.wifi.read`, gates every field on the `WlanConf` object.
-
----
-
-If anything here is unclear or you'd like more examples (e.g., a walk-through adding a route handler + manager + controller), tell me which area to expand and I'll iterate.
+- **Frontend Layout**: [src/routes/+layout.svelte](src/routes/+layout.svelte) (main shell, sidebar, header)
+- **API Abstraction**: [src/lib/optima-api/axios.ts](src/lib/optima-api/axios.ts) (base client)
+- **API Modules**: [src/lib/optima-api/modules/](src/lib/optima-api/modules/) (auth, companies, credentials, etc.)
+- **App Entry**: [src/app.html](src/app.html)
+- **Electron Main**: [electron/main.ts](electron/main.ts)

.github/workflows/build-and-publish.yaml

@@ -5,30 +5,8 @@ on:
     types: [created]
 
 jobs:
-  test:
-    name: Test
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout source code
-        uses: actions/checkout@v4
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: "1.3.6"
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile
-
-      - name: Generate Prisma client
-        run: DATABASE_URL="postgresql://dummy:dummy@localhost:5432/dummy" bunx prisma generate
-
-      - name: Run tests
-        run: bun test --preload ./tests/setup.ts
-
-  build:
-    name: Build
-    needs: [test]
+  build-server:
+    name: Build Server Image
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -44,54 +22,88 @@ jobs:
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Build and push the Docker image
-        uses: docker/build-push-action@v6
-        with:
-          push: true
-          target: runtime
-          tags: |
-            ghcr.io/project-optima/ttscm-api:latest
-            ghcr.io/project-optima/ttscm-api:${{ github.event.release.tag_name }}
-
-      - name: Build and push the migration image
-        uses: docker/build-push-action@v6
-        with:
-          push: true
-          target: migration
-          tags: |
-            ghcr.io/project-optima/ttscm-api-migrate:latest
-            ghcr.io/project-optima/ttscm-api-migrate:${{ github.event.release.tag_name }}
-
-  migrate:
-    name: Run Migrations
-    needs: [build]
-    runs-on: ubuntu-latest
-    steps:
-      - name: Set the Kubernetes context
-        uses: azure/k8s-set-context@v2
-        with:
-          method: kubeconfig
-          kubeconfig: ${{ secrets.KUBECONFIG }}
-
       - name: Checkout source code
         uses: actions/checkout@v4
 
-      - name: Delete previous migration job if exists
-        run: kubectl delete job -n optima -l app=prisma-migrate --ignore-not-found
+      - name: Build and push the Docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          build-args: |
+            PUBLIC_API_URL=https://opt-api.osdci.net
+          tags: |
+            ghcr.io/project-optima/ttscm-ui:latest
+            ghcr.io/project-optima/ttscm-ui:${{ github.event.release.tag_name }}
 
-      - name: Apply migration job
-        run: |
-          TAG=${{ github.event.release.tag_name }}
-          sed "s/RELEASE_TAG/${TAG}/g" kubernetes/migration-job.yaml | kubectl apply -f -
+  build-desktop-macos:
+    name: Build Desktop (macOS)
+    runs-on: macos-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout source code
+        uses: actions/checkout@v4
 
-      - name: Wait for migration to complete
-        run: |
-          TAG=${{ github.event.release.tag_name }}
-          kubectl wait --for=condition=complete --timeout=120s -n optima job/prisma-migrate-${TAG}
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Install bun
+        uses: oven-sh/setup-bun@v2
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Rebuild native modules
+        run: npm rebuild
+
+      - name: Build macOS distributables
+        run: bun run make:macos
+        env:
+          PUBLIC_API_URL: https://opt-api.osdci.net
+
+      - name: Upload macOS artifacts to release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: |
+            out/make/**/*.dmg
+            out/make/**/*.zip
+
+  build-desktop-windows:
+    name: Build Desktop (Windows)
+    runs-on: windows-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout source code
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Build Windows distributables
+        run: npm run make -- --platform win32
+        env:
+          PUBLIC_API_URL: https://opt-api.osdci.net
+
+      - name: Upload Windows artifacts to release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: |
+            out/make/**/*.exe
+            out/make/**/*.nupkg
+            out/make/**/*.msi
 
   deploy:
     name: Deploy
-    needs: [migrate]
+    needs: [build-server]
     runs-on: ubuntu-latest
     steps:
       - name: Set the Kubernetes context
@@ -122,4 +134,4 @@ jobs:
             kubernetes/deployment.yaml
             kubernetes/ingress.yaml
           images: |
-            ghcr.io/project-optima/ttscm-api:${{ github.event.release.tag_name }}
+            ghcr.io/project-optima/ttscm-ui:${{ github.event.release.tag_name }}

.github/workflows/tests.yaml

@@ -1,27 +0,0 @@
-name: Tests
-
-on:
-  push:
-    branches: ["**"]
-
-jobs:
-  test:
-    name: Test
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout source code
-        uses: actions/checkout@v4
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: "1.3.6"
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile
-
-      - name: Generate Prisma client
-        run: DATABASE_URL="postgresql://dummy:dummy@localhost:5432/dummy" bunx prisma generate
-
-      - name: Run tests
-        run: bun test --preload ./tests/setup.ts

.gitignore

@@ -1,154 +1,29 @@
-# Logs
-logs
-*.log
-*.jsonl
-cw-api-logs/
-npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
-lerna-debug.log*
+test-results
+node_modules
 
-# Diagnostic reports (https://nodejs.org/api/report.html)
-report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
+# Output
+.output
+.vercel
+.netlify
+.wrangler
+/.svelte-kit
+/build
 
-# Runtime data
-pids
-*.pid
-*.seed
-*.pid.lock
+# OS
+.DS_Store
+Thumbs.db
 
-# Directory for instrumented libs generated by jscoverage/JSCover
-lib-cov
-
-# Coverage directory used by tools like istanbul
-coverage
-*.lcov
-
-# nyc test coverage
-.nyc_output
-
-# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files)
-.grunt
-
-# Bower dependency directory (https://bower.io/)
-bower_components
-
-# node-waf configuration
-.lock-wscript
-
-# Compiled binary addons (https://nodejs.org/api/addons.html)
-build/Release
-
-# Dependency directories
-node_modules/
-jspm_packages/
-
-# Snowpack dependency directory (https://snowpack.dev/)
-web_modules/
-
-# TypeScript cache
-*.tsbuildinfo
-
-# Optional npm cache directory
-.npm
-
-# Optional eslint cache
-.eslintcache
-
-# Optional stylelint cache
-.stylelintcache
-
-# Optional REPL history
-.node_repl_history
-
-# Output of 'npm pack'
-*.tgz
-
-# Yarn Integrity file
-.yarn-integrity
-
-# dotenv environment variable files
+# Env
 .env
 .env.*
 !.env.example
+!.env.test
 
-# parcel-bundler cache (https://parceljs.org/)
-.cache
-.parcel-cache
-
-# Next.js build output
-.next
-out
-
-# Nuxt.js build / generate output
-.nuxt
-dist
-
-# Gatsby files
-.cache/
-# Comment in the public line in if your project uses Gatsby and not Next.js
-# https://nextjs.org/blog/next-9-1#public-directory-support
-# public
-
-# vuepress build output
-.vuepress/dist
-
-# vuepress v2.x temp and cache directory
-.temp
-.cache
-
-# Sveltekit cache directory
-.svelte-kit/
-
-# vitepress build output
-**/.vitepress/dist
-
-# vitepress cache directory
-**/.vitepress/cache
-
-# Docusaurus cache and generated files
-.docusaurus
-
-# Serverless directories
-.serverless/
-
-# FuseBox cache
-.fusebox/
-
-# DynamoDB Local files
-.dynamodb/
-
-# Firebase cache directory
-.firebase/
-
-# TernJS port file
-.tern-port
-
-# Stores VSCode versions used for testing VSCode extensions
-.vscode-test
-
-# yarn v3
-.pnp.*
-.yarn/*
-!.yarn/patches
-!.yarn/plugins
-!.yarn/releases
-!.yarn/sdks
-!.yarn/versions
-
-# Vite logs files
+# Vite
 vite.config.js.timestamp-*
 vite.config.ts.timestamp-*
+.vite
 
-.permissions.key
-.refreshToken.key
-.secureValues.key
-.accessToken.key
-
-public-keys/
-production-keys/
-
-microsoft-oauth.json
-
-.docker/postgres
-.docker/redis
+out
+tailwindcss-*.log
+pnpm-lock.yaml

.npmrc

@@ -0,0 +1,2 @@
+engine-strict=true
+node-linker=hoisted

.vscode/settings.json

@@ -1,5 +0,0 @@
-{
-  "chat.tools.terminal.autoApprove": {
-    "bun": true
-  }
-}

CACHING.md

@@ -1,384 +0,0 @@
-# Caching Architecture
-
-This document describes the caching layer used in the Optima API, covering the Redis-backed opportunity cache, TTL algorithms, background refresh mechanics, retry logic, and debugging tools.
-
----
-
-## Overview
-
-The API caches expensive ConnectWise (CW) API responses in **Redis** to reduce latency and avoid CW rate limits. The primary cache layer is the **opportunity cache** (`src/modules/cache/opportunityCache.ts`), which proactively warms data for all non-closed opportunities on a background interval.
-
-The API also maintains a Redis-backed **sales member metrics cache** (`src/modules/cache/salesOpportunityMetricsCache.ts`) refreshed every 5 minutes. It precomputes per-member dashboard/reporting figures (pipeline revenue, won/lost counts, win rate, avg days to close, and related metrics) for fast reads from `/v1/sales/opportunities/metrics`.
-
-### Key design principles
-
-- **Adaptive TTLs** — cache durations are computed dynamically based on how "hot" an opportunity is (recently updated = shorter TTL = fresher data).
-- **Background refresh** — a 20-minute interval scans all open opportunities and re-fetches only expired cache keys.
-- **Bounded concurrency** — CW API calls are throttled via thunk-based batching to prevent overwhelming the upstream API.
-- **Graceful degradation** — transient CW errors (timeouts, network failures) are caught, logged, and retried on the next cycle rather than crashing the process.
-- **Priority ordering** — most recently updated opportunities are refreshed first so active deals get fresh data before stale ones.
-
----
-
-## What is cached
-
-Each non-closed opportunity can have up to 7 cached payloads in Redis:
-
-| Cache Key Pattern                   | Data                                 | Source                                                                |
-| ----------------------------------- | ------------------------------------ | --------------------------------------------------------------------- |
-| `opp:cw-data:{cwOpportunityId}`     | Raw CW opportunity response          | `GET /sales/opportunities/:id`                                        |
-| `opp:activities:{cwOpportunityId}`  | CW activities array                  | `GET /sales/activities?conditions=opportunity/id=:id`                 |
-| `opp:notes:{cwOpportunityId}`       | CW notes array                       | `GET /sales/opportunities/:id/notes`                                  |
-| `opp:contacts:{cwOpportunityId}`    | CW contacts array                    | `GET /sales/opportunities/:id/contacts`                               |
-| `opp:products:{cwOpportunityId}`    | Forecast + procurement products blob | `GET /sales/opportunities/:id/forecast` + `GET /procurement/products` |
-| `opp:company-cw:{cw_CompanyId}`     | Hydrated company + contacts blob     | `GET /company/companies/:id` + contacts endpoints                     |
-| `opp:site:{cwCompanyId}:{cwSiteId}` | Company site data                    | `GET /company/companies/:id/sites/:siteId`                            |
-
-Inventory-adjustment-driven catalog sync adds a targeted product cache:
-
-| Cache Key Pattern        | Data                                                       | Source                                                                                       |
-| ------------------------ | ---------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
-| `catalog:item:cw:{cwId}` | Full CW catalog item + computed `onHand` + DB row snapshot | `GET /procurement/adjustments` + `GET /procurement/catalog/:id` + catalog inventory endpoint |
-
-Sales opportunity metrics caching adds member-focused keys:
-
-| Cache Key Pattern                     | Data                                   | Source                                                                                |
-| ------------------------------------- | -------------------------------------- | ------------------------------------------------------------------------------------- |
-| `sales:metrics:members:all`           | Envelope of all active-member metrics  | Precomputed from active CW members + assigned opportunities + products cache/CW fetch |
-| `sales:metrics:member:{cwIdentifier}` | One member's computed metrics snapshot | Same as above                                                                         |
-| `sales:metrics:oppRevenue:{cwOppId}`  | Per-opportunity computed revenue blob  | Metrics refresh lookups (products cache-first, then manager/controller fallback)      |
-
----
-
-## TTL Algorithms
-
-Three algorithms compute cache TTLs. All share the same input signals:
-
-- `closedFlag` — whether the opportunity is closed
-- `closedDate` — when it was closed
-- `expectedCloseDate` — projected close date (forward-looking signal)
-- `lastUpdated` — last CW modification date (backward-looking signal)
-
-### Primary TTL (`computeCacheTTL`)
-
-**File:** `src/modules/algorithms/computeCacheTTL.ts`
-
-Used for: opportunity CW data, activities, company CW data.
-
-| #   | Condition                                               | TTL        | Human        |
-| --- | ------------------------------------------------------- | ---------- | ------------ |
-| 1a  | Closed > 30 days ago                                    | `null`     | Do not cache |
-| 1b  | Closed within 30 days                                   | 900,000 ms | 15 minutes   |
-| 2   | `expectedCloseDate` or `lastUpdated` within **5 days**  | 30,000 ms  | 30 seconds   |
-| 3   | `expectedCloseDate` or `lastUpdated` within **14 days** | 60,000 ms  | 60 seconds   |
-| 4   | Everything else                                         | 900,000 ms | 15 minutes   |
-
-Rules are evaluated top-to-bottom; first match wins.
-
-### Sub-Resource TTL (`computeSubResourceCacheTTL`)
-
-**File:** `src/modules/algorithms/computeSubResourceCacheTTL.ts`
-
-Used for: notes, contacts.
-
-| #   | Condition             | TTL        | Human        |
-| --- | --------------------- | ---------- | ------------ |
-| 1a  | Closed > 30 days ago  | `null`     | Do not cache |
-| 1b  | Closed within 30 days | 300,000 ms | 5 minutes    |
-| 2   | Within **5 days**     | 60,000 ms  | 60 seconds   |
-| 3   | Within **14 days**    | 120,000 ms | 2 minutes    |
-| 4   | Everything else       | 300,000 ms | 5 minutes    |
-
-### Products TTL (`computeProductsCacheTTL`)
-
-**File:** `src/modules/algorithms/computeProductsCacheTTL.ts`
-
-Used for: forecast + procurement products.
-
-| #   | Condition                                   | TTL          | Human      |
-| --- | ------------------------------------------- | ------------ | ---------- |
-| 1   | Status is Won/Lost/Pending Won/Pending Lost | `null`       | No cache   |
-| 2   | Main cache TTL is `null`                    | `null`       | No cache   |
-| 3   | `lastUpdated` within **3 days**             | 15,000 ms    | 15 seconds |
-| 4   | Everything else                             | 1,200,000 ms | 20 minutes |
-
-Products on terminal-status opportunities are never proactively cached. Non-hot products use a **lazy on-demand** cache — they're fetched when requested and cached for 20 minutes.
-
-### Site TTL
-
-Sites use a fixed TTL of **20 minutes** (1,200,000 ms). Site/address data rarely changes. Sites are **not** proactively warmed by the background refresh — they are populated lazily on the first detail-view request.
-
----
-
-## Background Refresh
-
-**Function:** `refreshOpportunityCache()` in `src/modules/cache/opportunityCache.ts`
-
-**Interval:** Every 20 minutes, triggered from `src/index.ts`.
-
-### Refresh cycle
-
-1. **Query DB** — fetch all non-closed opportunities + recently closed (within 30 days), ordered by `cwLastUpdated DESC` (most recently active first).
-2. **Batch EXISTS check** — use a single Redis pipeline to check which cache keys already exist (5 EXISTS commands per opportunity: oppCwData, activities, notes, contacts, products).
-3. **Build thunk list** — for each opportunity with missing keys, push a **thunk** (lazy function) into the task list. No HTTP requests fire at this point.
-4. **Execute with bounded concurrency** — process thunks in batches of `CONCURRENCY` (currently **6**), with a `BATCH_DELAY_MS` (currently **250ms**) pause between batches. Each thunk is only invoked inside the batch loop.
-5. **Emit events** — `cache:opportunities:refresh:started` and `cache:opportunities:refresh:completed` events are emitted for the event debugger.
-
-### Inventory-adjustment listener cycle
-
-**Function:** `listenInventoryAdjustments()` in `src/modules/cw-utils/procurement/listenInventoryAdjustments.ts`
-
-**Interval:** Every 60 seconds, triggered from `src/index.ts`.
-
-1. Fetch `GET /procurement/adjustments?pageSize=1000`.
-2. Build a normalized snapshot of tracked inventory rows (`cwCatalogId`, `onHand`, `inventory`) per adjustment.
-3. Compare to previous snapshot; extract only changed product IDs.
-4. For each changed product ID, fetch fresh CW catalog item + current on-hand.
-5. Upsert `CatalogItem` in Postgres and write Redis key `catalog:item:cw:{cwId}` with a 20-minute TTL.
-
-Guardrails to prevent request storms:
-
-- Diffing is computed at **product state** level (grouped by `cwCatalogId`), not raw adjustment-row churn.
-- Per-cycle syncs are capped (`CW_ADJUSTMENT_SYNC_MAX_PER_CYCLE`, default `50`).
-- Product resync cooldown is enforced (`CW_ADJUSTMENT_SYNC_COOLDOWN_MS`, default `600000` ms / 10 min).
-
-This avoids full-catalog sweeps for small inventory movements and updates only the products implicated by adjustments.
-
-### Full procurement catalog refresh
-
-**Function:** `refreshCatalog()` in `src/modules/cw-utils/procurement/refreshCatalog.ts`
-
-**Interval:** Every 30 minutes, triggered from `src/index.ts`.
-
-The full catalog cache/DB sync uses the same slow-parallel thunk strategy as opportunity cache refreshes:
-
-- Build arrays of thunk tasks (`() => Promise<void>`) for CW item fetches, inventory fetches, and DB upserts.
-- Execute with bounded concurrency (`CONCURRENCY=6`).
-- Pause between batches (`BATCH_DELAY_MS=250`) to avoid CW burst pressure.
-- Log task failures and retry naturally on the next cycle.
-
-This keeps full-catalog refresh conservative while inventory-adjustment listener handles near-real-time targeted updates.
-
-### Full inventory sweep fallback
-
-`refreshInventory()` remains as a safety net but is intentionally infrequent:
-
-- Runs every **6 hours** from `src/index.ts` (no startup-time full sweep).
-- Uses the same slow-parallel pattern (`CONCURRENCY=6`, `BATCH_DELAY_MS=250`) to avoid burst traffic.
-
-Most on-hand freshness now comes from the 60-second adjustment listener plus 30-minute full catalog refresh.
-
-### Concurrency control
-
-The thunk pattern is critical. Previously, tasks were pushed as already-executing promises (`refreshTasks.push(fetchAndCache(...))`), which meant all HTTP requests fired simultaneously regardless of the batching loop. The fix was changing the array type from `Promise<void>[]` to `(() => Promise<void>)[]` so requests only start when explicitly invoked: `batch.map((fn) => fn())`.
-
-### Current tuning
-
-| Parameter        | Value      | Effect                                     |
-| ---------------- | ---------- | ------------------------------------------ |
-| `CONCURRENCY`    | 6          | Max simultaneous CW API requests per batch |
-| `BATCH_DELAY_MS` | 250        | Milliseconds between batches               |
-| Refresh interval | 20 minutes | How often the full sweep runs              |
-
-At these settings, a full sweep of ~500 expired keys completes in ~1-2 minutes with zero CW errors and ~230ms median latency.
-
-### Sales metrics refresh job
-
-**Function:** `refreshSalesOpportunityMetricsCache()` in `src/modules/cache/salesOpportunityMetricsCache.ts`
-
-**Interval:** Every 5 minutes, triggered from `src/index.ts`.
-
-**Startup behavior:** On app startup, the refresh is invoked once with `forceColdLoad=true`, which clears metrics-owned Redis keys and bypasses metrics/product cache reuse for that initial rebuild. Subsequent interval runs use the normal warm path.
-
-Refresh flow:
-
-1. Fetch all active CW members (`inactiveFlag=false`).
-  Source: local `CwMember` table (kept in sync by the existing members refresh job).
-2. Query DB opportunities assigned to those members (primary or secondary rep), scoped to open opportunities plus YTD-closed opportunities.
-3. For each opportunity, compute revenue cache-first from `sales:metrics:oppRevenue:{cwOppId}` then `opp:products:{cwOpportunityId}`, and fallback through the manager/controller path (`opportunities.fetchRecord(...).fetchProducts()`) on miss.
-4. Aggregate member metrics (pipeline revenue, won/lost MTD+YTD counts, avg days to close, weighted pipeline, win/loss rates, and related KPIs).
-5. Write per-opportunity revenue blobs plus all-member and per-member snapshots to Redis with a 10-minute TTL.
-
-Safety controls:
-
-- **Single-flight lock** prevents overlapping refresh runs if a prior run is still in progress.
-- **Per-opportunity timeout guard** ensures slow CW product lookups degrade to zero-revenue fallback instead of stalling the full refresh.
-- **Force-cold-load mode** clears `sales:metrics:*` runtime state owned by the metrics cache before rebuilding startup data.
-
-This cache-first model prioritizes metrics-owned opportunity revenue keys first, then opportunity product cache entries, and only reaches CW when needed.
-
----
-
-## Retry Logic (`withCwRetry`)
-
-**File:** `src/modules/cw-utils/withCwRetry.ts`
-
-Wraps CW API calls with exponential backoff retry on transient errors.
-
-### Retryable errors
-
-- `ECONNABORTED` (timeout)
-- `ECONNRESET`
-- `ETIMEDOUT`
-- `ECONNREFUSED`
-- `ERR_NETWORK`
-- `ENETUNREACH`
-- HTTP 5xx server errors
-
-### Default configuration
-
-| Parameter     | Default | Description                                                 |
-| ------------- | ------- | ----------------------------------------------------------- |
-| `maxAttempts` | 3       | Total attempts including the first                          |
-| `baseDelayMs` | 1,000   | Delay before first retry (doubles each retry: 1s → 2s → 4s) |
-| `label`       | —       | Optional tag for log messages                               |
-
-### Usage
-
-```ts
-import { withCwRetry } from "./withCwRetry";
-
-const response = await withCwRetry(
-  () => connectWiseApi.get(`/company/companies/${id}`),
-  { label: `fetchCompany#${id}`, maxAttempts: 3, baseDelayMs: 1_500 },
-);
-```
-
-Non-transient errors (404, 400, etc.) are re-thrown immediately without retry.
-
----
-
-## CW API Logger
-
-**File:** `src/modules/cw-utils/cwApiLogger.ts`
-
-Axios interceptor that logs every CW API call to a JSONL file. Logging is **opt-in** — set the `LOG_CW_API` environment variable to enable it. Each process start creates a new timestamped file in the `cw-api-logs/` directory (e.g., `cw-api-logs/2026-03-02T14-30-05.123Z.jsonl`).
-
-### Enabling logging
-
-```bash
-# Via the dev:log shorthand script
-bun run dev:log
-
-# Or manually with any command
-LOG_CW_API=1 bun run dev
-```
-
-### Log entry fields
-
-| Field        | Type              | Description                         |
-| ------------ | ----------------- | ----------------------------------- |
-| `timestamp`  | string (ISO-8601) | When the request completed          |
-| `method`     | string            | HTTP method                         |
-| `url`        | string            | Request URL (relative or absolute)  |
-| `baseURL`    | string            | Axios baseURL                       |
-| `status`     | number \| null    | HTTP status (null on network error) |
-| `durationMs` | number            | Wall-clock time in milliseconds     |
-| `error`      | string \| null    | Error code + message, if any        |
-| `timeout`    | number            | Configured timeout in ms            |
-
-### Analysis
-
-Run the analyzer script to analyze the most recent log file:
-
-```bash
-bun run utils:analyze_cw
-```
-
-Or specify a particular file:
-
-```bash
-python3 debug-scripts/analyze-cw-calls.py cw-api-logs/2026-03-02T14-30-05.123Z.jsonl
-```
-
-This executes `debug-scripts/analyze-cw-calls.py` which produces:
-
-- Overview (total calls, error rate, time span)
-- Duration statistics (min, max, mean, p50, p90, p95, p99, distribution histogram)
-- Error breakdown by type and endpoint
-- Top 20 slowest calls
-- Per-endpoint stats (count, errors, mean, p50, p95, max, total time)
-- Timeline (per-minute throughput and errors)
-- Concurrency hotspot detection
-- Summary with recommendations
-
-To clear all logs:
-
-```bash
-rm -rf cw-api-logs/
-```
-
----
-
-## Cache Invalidation
-
-Mutation endpoints invalidate the relevant cache keys so the next read fetches fresh data from CW:
-
-| Mutation                       | Cache invalidated                                                |
-| ------------------------------ | ---------------------------------------------------------------- |
-| Create/update/delete note      | `opp:notes:{cwOpportunityId}` via `invalidateNotesCache()`       |
-| Create/update/delete contact   | `opp:contacts:{cwOpportunityId}` via `invalidateContactsCache()` |
-| Add/update/resequence products | `opp:products:{cwOpportunityId}` via `invalidateProductsCache()` |
-| Refresh opportunity            | All keys for that opportunity (via re-fetch)                     |
-
----
-
-## ConnectWise API Configuration
-
-The shared Axios instance (`connectWiseApi`) is configured in `src/constants.ts`:
-
-| Setting   | Value                                                | Purpose                        |
-| --------- | ---------------------------------------------------- | ------------------------------ |
-| `baseURL` | `https://ttscw.totaltech.net/v4_6_release/apis/3.0/` | CW API base                    |
-| `timeout` | 30,000 ms (30s)                                      | Per-request timeout            |
-| Logger    | `attachCwApiLogger()`                                | Writes to `cw-api-calls.jsonl` |
-
----
-
-## Architecture diagram
-
-```
-src/index.ts
-  │
-  ├─ setInterval(refreshOpportunityCache, 20m)
-  │
-  └─► src/modules/cache/opportunityCache.ts
-        │
-        ├─ prisma.opportunity.findMany(orderBy: cwLastUpdated DESC)
-        ├─ redis.pipeline().exists(...)  ← batch key check
-        │
-        ├─ Build thunk list (lazy functions)
-        │
-        └─ Execute thunks with CONCURRENCY=6, DELAY=250ms
-             │
-             ├─► fetchAndCacheOppCwData()      ─► opportunityCw.fetch()
-             ├─► fetchAndCacheActivities()     ─► activityCw.fetchByOpportunityDirect()
-             ├─► fetchAndCacheNotes()          ─► opportunityCw.fetchNotes()
-             ├─► fetchAndCacheContacts()       ─► opportunityCw.fetchContacts()
-             ├─► fetchAndCacheProducts()       ─► opportunityCw.fetchProducts() + fetchProcurementProducts()
-             ├─► fetchAndCacheCompanyCwData()  ─► fetchCwCompanyById() + contacts
-             └─► fetchAndCacheSite()           ─► fetchCompanySite() (lazy only)
-                   │
-                   └─► connectWiseApi.get(...)  ← withCwRetry + cwApiLogger interceptors
-                         │
-                         └─► Redis SET with computed TTL
-```
-
----
-
-## File reference
-
-| File                                                             | Purpose                                                       |
-| ---------------------------------------------------------------- | ------------------------------------------------------------- |
-| `src/modules/cache/opportunityCache.ts`                          | Cache read/write helpers, background refresh logic            |
-| `src/modules/algorithms/computeCacheTTL.ts`                      | Primary adaptive TTL algorithm                                |
-| `src/modules/algorithms/computeSubResourceCacheTTL.ts`           | Sub-resource (notes, contacts) TTL algorithm                  |
-| `src/modules/algorithms/computeProductsCacheTTL.ts`              | Products TTL algorithm                                        |
-| `src/modules/cw-utils/withCwRetry.ts`                            | Retry wrapper with exponential backoff                        |
-| `src/modules/cw-utils/cwApiLogger.ts`                            | Axios interceptor for JSONL call logging                      |
-| `src/modules/cw-utils/fetchCompany.ts`                           | Company fetch with retry                                      |
-| `src/modules/cw-utils/procurement/listenInventoryAdjustments.ts` | Adjustment listener for targeted catalog-item cache + DB sync |
-| `src/modules/cache/salesOpportunityMetricsCache.ts`              | 5-minute active-member opportunity metrics cache              |
-| `src/constants.ts`                                               | CW Axios instance config (timeout, logger)                    |
-| `src/index.ts`                                                   | Refresh interval registration                                 |
-| `debug-scripts/analyze-cw-calls.py`                              | CW API call analysis script                                   |

Dockerfile

@@ -1,73 +1,32 @@
-# ---- Stage 1: Install dependencies ----
-FROM oven/bun:1 AS deps
+FROM oven/bun:latest AS base
 
 WORKDIR /app
 
+# Install dependencies
 COPY package.json bun.lock ./
-RUN bun install --frozen-lockfile --production
-
-# ---- Stage 2: Build ----
-FROM oven/bun:1 AS build
-
-WORKDIR /app
-
-# Copy dependency manifests and install all deps (including dev)
-COPY package.json bun.lock ./
+COPY patches ./patches
 RUN bun install --frozen-lockfile
 
-# Copy source code and supporting files
-COPY src/ src/
-COPY prisma/ prisma/
-COPY prisma.config.ts tsconfig.json ./
+# Build the SvelteKit app with adapter-node
+COPY . .
 
-# Generate Prisma client (dummy URL — generate only needs the schema, not a real DB)
-RUN DATABASE_URL="postgresql://dummy:dummy@localhost:5432/dummy" bunx prisma generate
+ARG PUBLIC_API_URL=https://opt-api.osdci.net
+ENV PUBLIC_API_URL=$PUBLIC_API_URL
 
-# Compile to a standalone executable
-RUN NODE_ENV=production bun build src/index.ts \
-  --compile \
-  --minify \
-  --target=bun-linux-x64 \
-  --outfile=server
+RUN bun run build:server
 
-# ---- Stage 3: Production image ----
-FROM ubuntu:22.04 AS runtime
+# Production image
+FROM node:22-alpine AS production
 
 WORKDIR /app
 
-# Install minimal runtime dependencies (CA certs for HTTPS calls)
-RUN apt-get update && \
-    apt-get install -y --no-install-recommends ca-certificates && \
-    rm -rf /var/lib/apt/lists/*
-
-# Copy the compiled binary from the build stage
-COPY --from=build /app/server ./server
-
-# Copy Prisma artifacts needed at runtime
-COPY --from=build /app/generated/ ./generated/
-COPY --from=build /app/prisma/ ./prisma/
-COPY --from=build /app/prisma.config.ts ./prisma.config.ts
-
-# Copy production node_modules (Prisma adapter needs native bindings)
-COPY --from=deps /app/node_modules/ ./node_modules/
+COPY --from=base /app/build ./build
+COPY --from=base /app/package.json ./
 
 ENV NODE_ENV=production
+ENV PORT=3000
+ENV ORIGIN=https://optima.osdci.net
+
 EXPOSE 3000
 
-CMD ["./server"]
-
-# ---- Stage 4: Migration runner ----
-FROM oven/bun:1 AS migration
-
-WORKDIR /app
-
-COPY package.json bun.lock ./
-RUN bun install --frozen-lockfile
-
-COPY prisma/ prisma/
-COPY prisma.config.ts ./
-
-COPY prisma/migrate-entrypoint.sh ./prisma/migrate-entrypoint.sh
-RUN chmod +x prisma/migrate-entrypoint.sh
-
-CMD ["sh", "prisma/migrate-entrypoint.sh"]
+CMD ["node", "build/index.js"]

Opportunity Activity.md

@@ -1,148 +0,0 @@
-setInternalReview - The quote is ready to be review before it is ready to be sent.
-setInternalApproved - The quote has been approved and is ready to be sent out.
-setQuoteSent - The Quote has been sent to the customer.
-setQuoteConfirmed - The quote has been recieved by the customer.
-setRevisionNeeded - The quote needs to be revised and is set to stage revision
-setFinalized - This locks any non-admins from modifying the quote saying that is the final iteration of the quote.
-convert - This converts the quote to a ticket. It will also update all the necessary fields.
-
-addTime(activityId, user: string)
-
-fetchProducts
-updateProduct
-addProduct
-
-fetchNotes
-addNotes(note: string, user: string)
-
-# Cat/SubCat/Bucket
-
-## Ecosystems vs Categories
-
-## Ecosystem Tree
-
-- Networking
-  - Manufacturer: Ubiquiti
-    - Category: Technology
-    - Subcategory: Network-\*
-  - Manufacturer: TP-Link
-    - Category: Technology
-    - Subcategory: Network-\*
-- Video Surveillance
-  - Manufacturer: Uniview
-    - Category: Field
-    - Subcategory: Surveillance-\*
-  - Manufacturer: Hikvision
-    - Category: Field
-    - Subcategory: Surveillance-\*
-  - Manufacturer: Alarm.com
-    - Category: Field
-    - Subcategory: Surveillance-\*
-- Burg/Alarm
-  - Manufacturer: Qolsys
-    - Category: Field
-    - Subcategory: AlarmBurg-\*
-  - DSC
-    - Category: Field
-    - Subcategory: AlarmBurg-\*
-
-## Category Tree
-
-- Technology
-  - GeneralEquip
-  - Home Entertainment
-  - Monitor
-  - Printers
-  - Storage
-  - Network
-    - Network-Other
-    - Network-Router
-    - Network-Switch
-    - Network-Wireless
-  - Computer
-    - Computer-Components
-    - Computer-Desktop
-    - Computer-Laptop
-  - Recurring
-    - Recurring - Online
-    - Recurring - Other
-    - Recurring - Protection
-    - Recurring - Telephone
-  - Telephone
-    - Tele-HSet-Digital
-    - Tele-HSet-IP
-    - Tele-HSet-SLT
-    - Tele-Misc
-    - Tele-Paging
-    - Tele-SystemCards
-    - Tele-Systems
-- General
-  - Batteries
-  - Battery Backups
-  - BulkWire
-  - Cables
-    - Cables-Adapters
-    - Cables-HDMI
-    - Cables-Network
-    - Cables-Other
-    - Cables-USB
-    - Cables-VGA
-  - Elec Cords & Adapters
-  - Enclosures
-  - PowerSupply
-  - RackEquip
-    - RackEquip-Rack
-    - RackEquip-Shelves
-- Field
-  - Conduit
-  - Electric
-  - GateControl
-  - Locksets
-  - Other
-  - Relays
-  - AccessControl
-    - AccessControl-Controllers
-    - AccessControl-Credential
-    - AccessControl-LockDevices
-    - AccessControl-Other
-    - AccessControl-Readers
-    - AccessControl-VideoEntry
-  - AlarmBurg
-    - AlarmBurg-Communicators
-    - AlarmBurg-Keypads
-    - AlarmBurg-Modules
-    - AlarmBurg-Other
-    - AlarmBurg-Panels
-    - AlarmBurg-Sensors
-      - AlarmBurg-Sensors-Wireless
-      - AlarmBurg-Sensors-Wired
-    - AlarmBurg-Siren
-  - AlarmFire
-    - AlarmFire-Communicators
-    - AlarmFire-Devices
-    - AlarmFire-Modules
-    - AlarmFire-Other
-    - AlarmFire-Panels
-    - AlarmFire-Sensors
-  - Automation
-    - Automation-General
-    - Automation-HVAC
-    - Automation-Lights
-    - Automation-Locks
-    - Automation-Thermostat
-  - AV
-    - AV-Adapters&Cables
-    - AV-Components
-    - AV-Mounts
-    - AV-Other
-    - AV-Speakers
-    - AV-Television
-  - StrCbl?
-    - StrCbl-Jacks
-    - StrCbl-PatchPanel
-    - StrCbl-Plates
-  - Surveillance
-    - Surveillance-Accs
-    - Surveillance-CamerasAnalog
-    - Surveillance-CamerasIP
-    - Surveillance-NVR

PERMISSIONS.md

@@ -1,459 +0,0 @@
-# Permission Nodes
-
-This document lists all known permission nodes in the optima-api application, categorized by resource type.
-
-## Permission System Overview
-
-The permission system uses a dot-notation format: `resource.action[.modifier]`
-
-### Special Tokens
-
-The permission validator supports special tokens for flexible permission management:
-
-- **Asterisk (\*)**: Matches the token and all following tokens (e.g., `credential.*` grants all credential permissions)
-- **Question Mark (?)**: Matches only the specific token (single character wildcard)
-- **Inclusive List ([a,b,c])**: Matches only the tokens in the list
-- **Exclusive List (<a,b,c>)**: Matches all tokens except those in the list
-
-### Global Permissions
-
-- `*` - Full access to all resources and actions (typically assigned to administrator role)
-
-## Permission Nodes by Resource
-
-### Company Permissions
-
-| Permission Node                | Description                                                             | Used In                                                                              |
-| ------------------------------ | ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------ |
-| `company.fetch`                | Fetch a single company                                                  | [src/api/companies/[id]/fetch.ts](src/api/companies/[id]/fetch.ts)                   |
-| `company.fetch.address`        | View company address information (requires `company.fetch` as well)     | [src/api/companies/[id]/fetch.ts](src/api/companies/[id]/fetch.ts)                   |
-| `company.fetch.contacts`       | View all company contacts (requires `company.fetch` as well)            | [src/api/companies/[id]/fetch.ts](src/api/companies/[id]/fetch.ts)                   |
-| `company.fetch.many`           | Fetch multiple companies                                                | [src/api/companies/fetchAll.ts](src/api/companies/fetchAll.ts)                       |
-| `company.fetch.configurations` | Fetch company configurations (requires `company.fetch` as well)         | [src/api/companies/[id]/configurations.ts](src/api/companies/[id]/configurations.ts) |
-| `company.fetch.sites`          | Fetch company sites from ConnectWise (requires `company.fetch` as well) | [src/api/companies/[id]/sites.ts](src/api/companies/[id]/sites.ts)                   |
-
-### Credential Permissions
-
-| Permission Node                     | Description                                                                            | Used In                                                                                                                                                              |
-| ----------------------------------- | -------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `credential.create`                 | Create a new credential                                                                | [src/api/credentials/create.ts](src/api/credentials/create.ts)                                                                                                       |
-| `credential.fetch`                  | Fetch a single credential                                                              | [src/api/credentials/fetch.ts](src/api/credentials/fetch.ts)                                                                                                         |
-| `credential.fetch.many`             | Fetch multiple credentials                                                             | [src/api/credentials/fetchByCompany.ts](src/api/credentials/fetchByCompany.ts)                                                                                       |
-| `credential.update`                 | Update a credential                                                                    | [src/api/credentials/update.ts](src/api/credentials/update.ts)                                                                                                       |
-| `credential.delete`                 | Delete a credential                                                                    | [src/api/credentials/delete.ts](src/api/credentials/delete.ts)                                                                                                       |
-| `credential.fields.fetch`           | Fetch credential fields (requires `credential.fetch` as well)                          | [src/api/credentials/fetchFields.ts](src/api/credentials/fetchFields.ts)                                                                                             |
-| `credential.fields.update`          | Update credential fields (requires `credential.update` as well)                        | [src/api/credentials/updateFields.ts](src/api/credentials/updateFields.ts)                                                                                           |
-| `credential.secure_values.read`     | Read secure values of a credential (requires `credential.fetch` as well)               | [src/api/credentials/readSecureValues.ts](src/api/credentials/readSecureValues.ts), [src/api/credentials/readSecureValue.ts](src/api/credentials/readSecureValue.ts) |
-| `credential.sub_credentials.fetch`  | Fetch sub-credentials of a parent credential (requires `credential.fetch` as well)     | [src/api/credentials/fetchSubCredentials.ts](src/api/credentials/fetchSubCredentials.ts)                                                                             |
-| `credential.sub_credentials.create` | Create a sub-credential on a parent credential (requires `credential.fetch` as well)   | [src/api/credentials/addSubCredential.ts](src/api/credentials/addSubCredential.ts)                                                                                   |
-| `credential.sub_credentials.delete` | Remove a sub-credential from a parent credential (requires `credential.fetch` as well) | [src/api/credentials/removeSubCredential.ts](src/api/credentials/removeSubCredential.ts)                                                                             |
-
-### Credential Type Permissions
-
-| Permission Node              | Description                     | Used In                                                                      |
-| ---------------------------- | ------------------------------- | ---------------------------------------------------------------------------- |
-| `credential_type.create`     | Create a new credential type    | [src/api/credential-types/create.ts](src/api/credential-types/create.ts)     |
-| `credential_type.fetch`      | Fetch a single credential type  | [src/api/credential-types/fetch.ts](src/api/credential-types/fetch.ts)       |
-| `credential_type.fetch.many` | Fetch multiple credential types | [src/api/credential-types/fetchAll.ts](src/api/credential-types/fetchAll.ts) |
-| `credential_type.update`     | Update a credential type        | [src/api/credential-types/update.ts](src/api/credential-types/update.ts)     |
-| `credential_type.delete`     | Delete a credential type        | [src/api/credential-types/delete.ts](src/api/credential-types/delete.ts)     |
-
-### Role Permissions
-
-| Permission Node | Description                                       | Used In                                                                                                                                                                                          | Dependencies |
-| --------------- | ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------ |
-| `role.create`   | Create a new role                                 | [src/api/roles/create.ts](src/api/roles/create.ts)                                                                                                                                               |              |
-| `role.read`     | Fetch a single role or view role information      | [src/api/roles/fetch.ts](src/api/roles/fetch.ts)                                                                                                                                                 |              |
-| `role.list`     | Fetch all roles                                   | [src/api/roles/fetchAll.ts](src/api/roles/fetchAll.ts)                                                                                                                                           | `role.read`  |
-| `role.modify`   | Update role properties or manage role permissions | [src/api/roles/update.ts](src/api/roles/update.ts), [src/api/roles/addPermissions.ts](src/api/roles/addPermissions.ts), [src/api/roles/removePermissions.ts](src/api/roles/removePermissions.ts) |              |
-| `role.delete`   | Delete a role                                     | [src/api/roles/delete.ts](src/api/roles/delete.ts)                                                                                                                                               |              |
-| `user.read`     | View users assigned to a role                     | [src/api/roles/getUsers.ts](src/api/roles/getUsers.ts)                                                                                                                                           | `role.read`  |
-
-### User Permissions
-
-| Permission Node          | Description                                       | Used In                                                                                                                                                                      | Dependencies       |
-| ------------------------ | ------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------ |
-| `user.read`              | Read user information                             | [src/api/user/@me/fetch.ts](src/api/user/@me/fetch.ts)                                                                                                                       |                    |
-| `user.write`             | Update user information                           | [src/api/user/@me/update.ts](src/api/user/@me/update.ts)                                                                                                                     |                    |
-| `user.read.other`        | Read other users' information                     | [src/api/user/fetch.ts](src/api/user/fetch.ts), [src/api/user/fetchRoles.ts](src/api/user/fetchRoles.ts), [src/api/user/checkPermission.ts](src/api/user/checkPermission.ts) |                    |
-| `user.list.other`        | List all users                                    | [src/api/user/fetchAll.ts](src/api/user/fetchAll.ts)                                                                                                                         | `user.read.other`  |
-| `user.write.other`       | Update other users' information                   | [src/api/user/update.ts](src/api/user/update.ts)                                                                                                                             |                    |
-| `user.roles.other`       | Modify roles assigned to other users              | [src/api/user/update.ts](src/api/user/update.ts)                                                                                                                             | `user.write.other` |
-| `user.permissions.other` | Modify direct permissions assigned to other users | [src/api/user/update.ts](src/api/user/update.ts)                                                                                                                             | `user.write.other` |
-| `user.delete.other`      | Delete other users                                | [src/api/user/delete.ts](src/api/user/delete.ts)                                                                                                                             |                    |
-
-### Permission Routes
-
-Permissions required for accessing the permission node definitions API.
-
-| Permission Node | Description                                      | Used In                                                                          |
-| --------------- | ------------------------------------------------ | -------------------------------------------------------------------------------- |
-| `role.read`     | Fetch all permission nodes organized by category | [src/api/permissions/fetchAll.ts](src/api/permissions/fetchAll.ts)               |
-| `role.read`     | Fetch a flat list of all permission nodes        | [src/api/permissions/fetchNodes.ts](src/api/permissions/fetchNodes.ts)           |
-| `role.read`     | Fetch permission nodes by category               | [src/api/permissions/fetchByCategory.ts](src/api/permissions/fetchByCategory.ts) |
-
-### UI Navigation Permissions
-
-Permissions for controlling navigation visibility on the frontend.
-
-| Permission Node        | Description                                                          | Usage Pattern                                     |
-| ---------------------- | -------------------------------------------------------------------- | ------------------------------------------------- |
-| `ui.navigation.*.view` | View specific navigation sections (e.g., `ui.navigation.admin.view`) | Control which navigation menu items are displayed |
-
-### Admin UI Permissions
-
-Admin-specific UI permissions that control visibility and data loading for admin sub-tabs.
-
-| Permission Node               | Description                                      | Usage Pattern                              |
-| ----------------------------- | ------------------------------------------------ | ------------------------------------------ |
-| `admin.users.view`            | Show the Users tab and load user data            | Show/hide users tab, allow user list fetch |
-| `admin.roles.view`            | Show the Roles tab and load role data            | Show/hide roles tab, allow role list fetch |
-| `admin.credential-types.view` | Show the Credential Types tab and load type data | Show/hide types tab, allow type list fetch |
-
-#### Notes on UI Permissions
-
-- **Client-side validation is not secure**: Always enforce permissions on the API level. UI permissions only control visibility and user experience.
-- **Combine with API permissions**: A user with an admin UI permission should also have the corresponding API permission (e.g., `role.list`) to actually load data.
-- **Use wildcards for flexibility**: Grant `ui.navigation.*.view` to allow all navigation sections.
-
-### Procurement Permissions
-
-| Permission Node                         | Description                                                                  | Used In                                                                                                                                                                                                                                                                    | Dependencies                |
-| --------------------------------------- | ---------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------- |
-| `procurement.catalog.fetch`             | Fetch a single catalog item                                                  | [src/api/procurement/[id]/fetch.ts](src/api/procurement/[id]/fetch.ts)                                                                                                                                                                                                     |                             |
-| `procurement.catalog.fetch.many`        | Fetch multiple catalog items, count, categories/ecosystems, or filter values | [src/api/procurement/fetchAll.ts](src/api/procurement/fetchAll.ts), [src/api/procurement/count.ts](src/api/procurement/count.ts), [src/api/procurement/categories.ts](src/api/procurement/categories.ts), [src/api/procurement/filters.ts](src/api/procurement/filters.ts) |                             |
-| `procurement.catalog.inventory.refresh` | Refresh on-hand inventory for a catalog item from ConnectWise                | [src/api/procurement/[id]/refreshInventory.ts](src/api/procurement/[id]/refreshInventory.ts)                                                                                                                                                                               | `procurement.catalog.fetch` |
-| `procurement.catalog.link`              | Link or unlink catalog items to each other                                   | [src/api/procurement/[id]/link.ts](src/api/procurement/[id]/link.ts), [src/api/procurement/[id]/unlink.ts](src/api/procurement/[id]/unlink.ts)                                                                                                                             | `procurement.catalog.fetch` |
-
-### ConnectWise Routes
-
-`GET /v1/cw/members` requires only authentication (any logged-in user) and does **not** require a specific permission node.
-
-`POST /v1/cw/callback/:secret/:resource` is intentionally unauthenticated for inbound ConnectWise callbacks and does **not** require a permission node.
-
-| Permission Node | Description                                                                     | Used In                                                  | Dependencies |
-| --------------- | ------------------------------------------------------------------------------- | -------------------------------------------------------- | ------------ |
-| _None_          | Fetch CW members (auth only)                                                    | [src/api/cw/fetchMembers.ts](src/api/cw/fetchMembers.ts) | N/A          |
-| _None_          | Inbound callback route; secured operationally (network controls / source trust) | [src/api/cw/callback.ts](src/api/cw/callback.ts)         | N/A          |
-
-### Sales Permissions
-
-Permissions for accessing and managing sales opportunities. Opportunities are synced from ConnectWise and stored locally; sub-resources (products, notes, contacts) are fetched live from CW.
-
-**WebSocket note:** The `/secure` socket event chain `opp:live_quote_preview` and `opp:live_quote_preview:<id>:data` is gated by `sales.opportunity.fetch`.
-
-| Permission Node                                 | Description                                                                                                                                                  | Used In                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | Dependencies                   |
-| ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------ |
-| `sales.opportunity.fetch`                       | Fetch a single opportunity and its CW sub-resources (products, notes, contacts)                                                                              | [src/api/sales/opportunities/[id]/fetch.ts](src/api/sales/opportunities/[id]/fetch.ts), [src/api/sales/opportunities/[id]/products/fetchAll.ts](src/api/sales/opportunities/[id]/products/fetchAll.ts), [src/api/sales/opportunities/[id]/notes/fetchAll.ts](src/api/sales/opportunities/[id]/notes/fetchAll.ts), [src/api/sales/opportunities/[id]/notes/fetch.ts](src/api/sales/opportunities/[id]/notes/fetch.ts), [src/api/sales/opportunities/[id]/contacts/fetchAll.ts](src/api/sales/opportunities/[id]/contacts/fetchAll.ts), [src/api/sockets/events/liveQuotePreview.ts](src/api/sockets/events/liveQuotePreview.ts) |                                |
-| `sales.opportunity.fetch.many`                  | Fetch multiple opportunities (paginated/searchable), count, or opportunity types                                                                             | [src/api/sales/opportunities/fetchAll.ts](src/api/sales/opportunities/fetchAll.ts), [src/api/sales/opportunities/count.ts](src/api/sales/opportunities/count.ts), [src/api/sales/opportunities/fetchTypes.ts](src/api/sales/opportunities/fetchTypes.ts)                                                                                                                                                                                                                                                                                                                                                                       |                                |
-| `sales.opportunity.fetch.@me`                   | View the personal sales dashboard showing opportunities assigned to the current user                                                                         | UI-only (client-side gate)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                |
-| `sales.opportunity.fetch.all`                   | View all opportunities across all users (All Opportunities tab and View All button in the sales dashboard)                                                   | UI-only (client-side gate)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `sales.opportunity.fetch.many` |
-| `sales.opportunity.metrics.all`                 | Allow `scope=all` on sales opportunity metrics endpoint to read cached metrics for all active members                                                        | [src/api/sales/opportunities/metrics.ts](src/api/sales/opportunities/metrics.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `sales.opportunity.fetch.many` |
-| `sales.opportunity.metrics.identifier.override` | Allow `identifier=<cwIdentifier>` override on sales opportunity metrics endpoint for querying another member                                                 | [src/api/sales/opportunities/metrics.ts](src/api/sales/opportunities/metrics.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `sales.opportunity.fetch.many` |
-| `sales.opportunity.refresh`                     | Refresh a single opportunity's local data from ConnectWise                                                                                                   | [src/api/sales/opportunities/[id]/refresh.ts](src/api/sales/opportunities/[id]/refresh.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `sales.opportunity.fetch`      |
-| `sales.opportunity.update`                      | Update an opportunity's fields (rating, sales rep, company, contact, site, description, etc.) in ConnectWise                                                 | [src/api/sales/opportunities/[id]/update.ts](src/api/sales/opportunities/[id]/update.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `sales.opportunity.fetch`      |
-| `sales.opportunity.create`                      | Create a new opportunity in ConnectWise                                                                                                                      | [src/api/sales/opportunities/create.ts](src/api/sales/opportunities/create.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |                                |
-| `sales.opportunity.delete`                      | Delete an opportunity from ConnectWise and the local database                                                                                                | [src/api/sales/opportunities/[id]/delete.ts](src/api/sales/opportunities/[id]/delete.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `sales.opportunity.fetch`      |
-| `sales.opportunity.note.create`                 | Create a new note on an opportunity                                                                                                                          | [src/api/sales/opportunities/[id]/notes/create.ts](src/api/sales/opportunities/[id]/notes/create.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `sales.opportunity.fetch`      |
-| `sales.opportunity.note.update`                 | Update an existing note on an opportunity                                                                                                                    | [src/api/sales/opportunities/[id]/notes/update.ts](src/api/sales/opportunities/[id]/notes/update.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `sales.opportunity.fetch`      |
-| `sales.opportunity.note.delete`                 | Delete a note from an opportunity                                                                                                                            | [src/api/sales/opportunities/[id]/notes/delete.ts](src/api/sales/opportunities/[id]/notes/delete.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `sales.opportunity.fetch`      |
-| `sales.opportunity.product.update`              | Update products (forecast items) on an opportunity, including resequencing                                                                                   | [src/api/sales/opportunities/[id]/products/resequence.ts](src/api/sales/opportunities/[id]/products/resequence.ts), [src/api/sales/opportunities/[id]/products/update.ts](src/api/sales/opportunities/[id]/products/update.ts), [src/api/sales/opportunities/[id]/products/cancel.ts](src/api/sales/opportunities/[id]/products/cancel.ts)                                                                                                                                                                                                                                                                                     | `sales.opportunity.fetch`      |
-| `sales.opportunity.product.delete`              | Delete a product (forecast item) from an opportunity                                                                                                         | [src/api/sales/opportunities/[id]/products/delete.ts](src/api/sales/opportunities/[id]/products/delete.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `sales.opportunity.fetch`      |
-| `sales.opportunity.product.add`                 | Add a new product (forecast item) to an opportunity. Individual fields gated by `sales.opportunity.product.field.<field>` permissions.                       | [src/api/sales/opportunities/[id]/products/add.ts](src/api/sales/opportunities/[id]/products/add.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `sales.opportunity.fetch`      |
-| `sales.opportunity.product.add.specialOrder`    | Add one or more "SPECIAL ORDER" products via the dedicated special-order route.                                                                              | [src/api/sales/opportunities/[id]/products/addSpecialOrder.ts](src/api/sales/opportunities/[id]/products/addSpecialOrder.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `sales.opportunity.fetch`      |
-| `sales.opportunity.product.add.labor`           | Add labor products via the dedicated labor route with Field/Tech catalog selection and labor pricing inputs.                                                 | [src/api/sales/opportunities/[id]/products/addLabor.ts](src/api/sales/opportunities/[id]/products/addLabor.ts), [src/api/sales/opportunities/[id]/products/laborOptions.ts](src/api/sales/opportunities/[id]/products/laborOptions.ts)                                                                                                                                                                                                                                                                                                                                                                                         | `sales.opportunity.fetch`      |
-| `sales.opportunity.quote.fetch`                 | Fetch all committed quotes for an opportunity.                                                                                                               | [src/api/sales/opportunities/[id]/quotes/fetchAll.ts](src/api/sales/opportunities/[id]/quotes/fetchAll.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `sales.opportunity.fetch`      |
-| `sales.opportunity.quote.commit`                | Generate and store a finalized quote PDF for an opportunity with regeneration metadata and creator attribution.                                              | [src/api/sales/opportunities/[id]/quotes/commit.ts](src/api/sales/opportunities/[id]/quotes/commit.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `sales.opportunity.fetch`      |
-| `sales.opportunity.quote.preview`               | Generate a preview-stamped quote PDF for an opportunity without storing it.                                                                                  | [src/api/sales/opportunities/[id]/quotes/preview.ts](src/api/sales/opportunities/[id]/quotes/preview.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `sales.opportunity.fetch`      |
-| `sales.opportunity.quote.download`              | Download a committed quote PDF. Each download is recorded with timestamp and user info.                                                                      | [src/api/sales/opportunities/[id]/quotes/download.ts](src/api/sales/opportunities/[id]/quotes/download.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `sales.opportunity.fetch`      |
-| `sales.opportunity.quote.fetch_downloads`       | Fetch download/print history for all quotes on an opportunity. Admin-level permission.                                                                       | [src/api/sales/opportunities/[id]/quotes/fetchDownloads.ts](src/api/sales/opportunities/[id]/quotes/fetchDownloads.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `sales.opportunity.fetch`      |
-| `sales.opportunity.view_margin`                 | View margin and markup data on opportunity products. Controls visibility of margin %, markup %, and related progress bars in the UI.                         | UI-only (client-side gate)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `sales.opportunity.fetch`      |
-| `sales.opportunity.view_cost`                   | View cost data on opportunity products. Controls visibility of unit cost, total cost, and recurring cost in the UI.                                          | UI-only (client-side gate)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `sales.opportunity.fetch`      |
-| `sales.opportunity.view_profit`                 | View profit data on opportunity products. Controls visibility of profit values in the UI.                                                                    | UI-only (client-side gate)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `sales.opportunity.fetch`      |
-| `sales.opportunity.workflow`                    | Execute opportunity workflow actions (status transitions, review decisions, quote sending, etc.). Base gate for the workflow dispatch endpoint.              | [dispatch.ts](src/api/sales/opportunities/[id]/workflow/dispatch.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `sales.opportunity.fetch`      |
-| `sales.opportunity.finalize`                    | Finalize an opportunity as Won or Lost. Without this permission, win/lose actions route to PendingWon/PendingLost instead.                                   | [src/workflows/wf.opportunity.ts](src/workflows/wf.opportunity.ts), [dispatch.ts](src/api/sales/opportunities/[id]/workflow/dispatch.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `sales.opportunity.workflow`   |
-| `sales.opportunity.cancel`                      | Cancel an opportunity. Required to transition any eligible opportunity to the Canceled status.                                                               | [src/workflows/wf.opportunity.ts](src/workflows/wf.opportunity.ts), [dispatch.ts](src/api/sales/opportunities/[id]/workflow/dispatch.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `sales.opportunity.workflow`   |
-| `sales.opportunity.review`                      | Submit an opportunity for internal review. Required to transition an opportunity into the InternalReview status.                                             | [src/workflows/wf.opportunity.ts](src/workflows/wf.opportunity.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | `sales.opportunity.workflow`   |
-| `sales.opportunity.send`                        | Send a quote to the customer. Required to transition an opportunity to QuoteSent (and compound transitions like immediate won/lost/confirmed).               | [src/workflows/wf.opportunity.ts](src/workflows/wf.opportunity.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | `sales.opportunity.workflow`   |
-| `sales.opportunity.reopen`                      | Re-open a cancelled opportunity. Required to transition an opportunity from Canceled back to Active.                                                         | [src/workflows/wf.opportunity.ts](src/workflows/wf.opportunity.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | `sales.opportunity.workflow`   |
-| `sales.opportunity.win`                         | Mark an opportunity as won (or pending won). Gates the win button in the UI. Required for finalize(won), sendQuote(won), and transitionToPending(won).       | [src/workflows/wf.opportunity.ts](src/workflows/wf.opportunity.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | `sales.opportunity.workflow`   |
-| `sales.opportunity.lose`                        | Mark an opportunity as lost (or pending lost). Gates the lose button in the UI. Required for finalize(lost), sendQuote(lost), and transitionToPending(lost). | [src/workflows/wf.opportunity.ts](src/workflows/wf.opportunity.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | `sales.opportunity.workflow`   |
-| `sales.isRepresentative`                        | Designates the user as a sales representative; used for reporting and filtering purposes.                                                                    | _(not yet used in routes)_                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                |
-
-<details>
-<summary><strong>Field-level permissions for <code>sales.opportunity.product.add</code></strong></summary>
-
-Each submitted field is gated by a `sales.opportunity.product.field.<field>` permission node. Only fields the user has permission for are forwarded to ConnectWise.
-
-| Field Permission Node                                 | Description                                              |
-| ----------------------------------------------------- | -------------------------------------------------------- |
-| `sales.opportunity.product.field.catalogItem`         | Set the catalog item reference                           |
-| `sales.opportunity.product.field.forecastDescription` | Set the forecast description                             |
-| `sales.opportunity.product.field.productDescription`  | Set the product description                              |
-| `sales.opportunity.product.field.quantity`            | Set the quantity                                         |
-| `sales.opportunity.product.field.status`              | Set the status reference                                 |
-| `sales.opportunity.product.field.productClass`        | Set the product class (e.g. Product, Service, Agreement) |
-| `sales.opportunity.product.field.forecastType`        | Set the forecast type                                    |
-| `sales.opportunity.product.field.revenue`             | Set the revenue amount                                   |
-| `sales.opportunity.product.field.cost`                | Set the cost amount                                      |
-| `sales.opportunity.product.field.includeFlag`         | Set the include flag                                     |
-| `sales.opportunity.product.field.linkFlag`            | Set the link flag                                        |
-| `sales.opportunity.product.field.recurringFlag`       | Set the recurring flag                                   |
-| `sales.opportunity.product.field.taxableFlag`         | Set the taxable flag                                     |
-| `sales.opportunity.product.field.recurringRevenue`    | Set the recurring revenue amount                         |
-| `sales.opportunity.product.field.recurringCost`       | Set the recurring cost amount                            |
-| `sales.opportunity.product.field.cycles`              | Set the number of recurring cycles                       |
-| `sales.opportunity.product.field.sequenceNumber`      | Set the sequence number (display order)                  |
-
-</details>
-
-### UniFi Permissions
-
-Permissions for accessing and managing UniFi network infrastructure. The `unifi.access` permission is a gate permission required for **all** UniFi routes.
-
-| Permission Node                | Description                                                                       | Used In                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | Dependencies                                              |
-| ------------------------------ | --------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------- |
-| `unifi.access`                 | Gate permission for the entire UniFi API — required for all                       | [src/api/unifi/sites/fetchAll.ts](src/api/unifi/sites/fetchAll.ts), [src/api/unifi/sites/sync.ts](src/api/unifi/sites/sync.ts), [src/api/unifi/site/fetch.ts](src/api/unifi/site/fetch.ts), [src/api/unifi/site/overview.ts](src/api/unifi/site/overview.ts), [src/api/unifi/site/devices.ts](src/api/unifi/site/devices.ts), [src/api/unifi/site/wifi/fetchAll.ts](src/api/unifi/site/wifi/fetchAll.ts), [src/api/unifi/site/wifi/update.ts](src/api/unifi/site/wifi/update.ts), [src/api/unifi/site/networks.ts](src/api/unifi/site/networks.ts), [src/api/unifi/site/link.ts](src/api/unifi/site/link.ts), [src/api/unifi/site/unlink.ts](src/api/unifi/site/unlink.ts), [src/api/companies/[id]/unifiSites.ts](src/api/companies/[id]/unifiSites.ts), [src/api/unifi/sites/create.ts](src/api/unifi/sites/create.ts) |                                                           |
-| `unifi.sites.create`           | Create a new site on the UniFi controller                                         | [src/api/unifi/sites/create.ts](src/api/unifi/sites/create.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `unifi.access`                                            |
-| `unifi.sites.fetch`            | Fetch a single UniFi site                                                         | [src/api/unifi/site/fetch.ts](src/api/unifi/site/fetch.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `unifi.access`                                            |
-| `unifi.sites.fetch.many`       | Fetch all UniFi sites                                                             | [src/api/unifi/sites/fetchAll.ts](src/api/unifi/sites/fetchAll.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `unifi.access`                                            |
-| `unifi.sites.sync`             | Sync sites from the UniFi controller into the database                            | [src/api/unifi/sites/sync.ts](src/api/unifi/sites/sync.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `unifi.access`                                            |
-| `unifi.sites.link`             | Link or unlink a UniFi site to/from a company                                     | [src/api/unifi/site/link.ts](src/api/unifi/site/link.ts), [src/api/unifi/site/unlink.ts](src/api/unifi/site/unlink.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `unifi.access`                                            |
-| `unifi.site.overview`          | View live site overview from the UniFi controller                                 | [src/api/unifi/site/overview.ts](src/api/unifi/site/overview.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `unifi.access`                                            |
-| `unifi.site.devices`           | View live device list from the UniFi controller                                   | [src/api/unifi/site/devices.ts](src/api/unifi/site/devices.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `unifi.access`                                            |
-| `unifi.site.wifi`              | View WiFi networks (WLANs) from the UniFi controller                              | [src/api/unifi/site/wifi/fetchAll.ts](src/api/unifi/site/wifi/fetchAll.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `unifi.access`                                            |
-| `unifi.site.wifi.read`         | Field-level gate for WiFi response data (see note below)                          | [src/api/unifi/site/wifi/fetchAll.ts](src/api/unifi/site/wifi/fetchAll.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `unifi.access`, `unifi.site.wifi`                         |
-| `unifi.site.wifi.read.<field>` | Read a specific field from WiFi response (e.g. `unifi.site.wifi.read.passphrase`) | [src/api/unifi/site/wifi/fetchAll.ts](src/api/unifi/site/wifi/fetchAll.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `unifi.access`, `unifi.site.wifi`, `unifi.site.wifi.read` |
-| `unifi.site.wifi.update`       | Update a WiFi network on the UniFi controller                                     | [src/api/unifi/site/wifi/update.ts](src/api/unifi/site/wifi/update.ts)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | `unifi.access`, `unifi.site.wifi`                         |
-
-#### Field-Level Permission Gating (`unifi.site.wifi.read`)
-
-The WiFi fetch route uses `processObjectValuePerms` to filter each WLAN object on a per-field basis. For every key on the `WlanConf` response object, the system checks `unifi.site.wifi.read.<key>`. Only fields the user has permission for are included in the response. Use `unifi.site.wifi.read.*` to grant access to all fields.
-
-**Available field-level nodes:**
-
-`unifi.site.wifi.read.id`, `unifi.site.wifi.read.name`, `unifi.site.wifi.read.siteId`, `unifi.site.wifi.read.enabled`, `unifi.site.wifi.read.security`, `unifi.site.wifi.read.wpaMode`, `unifi.site.wifi.read.wpaEnc`, `unifi.site.wifi.read.wpa3Support`, `unifi.site.wifi.read.wpa3Transition`, `unifi.site.wifi.read.wpa3FastRoaming`, `unifi.site.wifi.read.wpa3Enhanced192`, `unifi.site.wifi.read.passphrase`, `unifi.site.wifi.read.passphraseAutogenerated`, `unifi.site.wifi.read.hideSSID`, `unifi.site.wifi.read.isGuest`, `unifi.site.wifi.read.band`, `unifi.site.wifi.read.bands`, `unifi.site.wifi.read.networkconfId`, `unifi.site.wifi.read.usergroupId`, `unifi.site.wifi.read.apGroupIds`, `unifi.site.wifi.read.apGroupMode`, `unifi.site.wifi.read.pmfMode`, `unifi.site.wifi.read.groupRekey`, `unifi.site.wifi.read.dtimMode`, `unifi.site.wifi.read.dtimNg`, `unifi.site.wifi.read.dtimNa`, `unifi.site.wifi.read.dtim6e`, `unifi.site.wifi.read.l2Isolation`, `unifi.site.wifi.read.fastRoamingEnabled`, `unifi.site.wifi.read.bssTransition`, `unifi.site.wifi.read.uapsdEnabled`, `unifi.site.wifi.read.iappEnabled`, `unifi.site.wifi.read.proxyArp`, `unifi.site.wifi.read.mcastenhanceEnabled`, `unifi.site.wifi.read.macFilterEnabled`, `unifi.site.wifi.read.macFilterPolicy`, `unifi.site.wifi.read.macFilterList`, `unifi.site.wifi.read.radiusDasEnabled`, `unifi.site.wifi.read.radiusMacAuthEnabled`, `unifi.site.wifi.read.radiusMacaclFormat`, `unifi.site.wifi.read.minrateSettingPreference`, `unifi.site.wifi.read.minrateNgEnabled`, `unifi.site.wifi.read.minrateNgDataRateKbps`, `unifi.site.wifi.read.minrateNgAdvertisingRates`, `unifi.site.wifi.read.minrateNaEnabled`, `unifi.site.wifi.read.minrateNaDataRateKbps`, `unifi.site.wifi.read.minrateNaAdvertisingRates`, `unifi.site.wifi.read.settingPreference`, `unifi.site.wifi.read.no2ghzOui`, `unifi.site.wifi.read.privatePreSharedKeysEnabled`, `unifi.site.wifi.read.privatePreSharedKeys`, `unifi.site.wifi.read.saeGroups`, `unifi.site.wifi.read.saePsk`, `unifi.site.wifi.read.schedule`, `unifi.site.wifi.read.scheduleWithDuration`, `unifi.site.wifi.read.bcFilterList`, `unifi.site.wifi.read.externalId`
-| `unifi.site.networks` | View network configurations from the UniFi controller | [src/api/unifi/site/networks.ts](src/api/unifi/site/networks.ts) | `unifi.access` |
-| `unifi.site.wlan-groups` | View WLAN groups (AP broadcasting groups) from the UniFi controller for a site | [src/api/unifi/site/wlanGroups.ts](src/api/unifi/site/wlanGroups.ts), [src/api/unifi/site/wlanGroupsCreate.ts](src/api/unifi/site/wlanGroupsCreate.ts) | `unifi.access` |
-| `unifi.site.wlan-groups.create` | Create a new WLAN group (AP broadcasting group) on the UniFi controller | [src/api/unifi/site/wlanGroupsCreate.ts](src/api/unifi/site/wlanGroupsCreate.ts) | `unifi.access`, `unifi.site.wlan-groups` |
-| `unifi.site.access-points` | View access points (UAPs only) from the UniFi controller for a site | [src/api/unifi/site/accessPoints.ts](src/api/unifi/site/accessPoints.ts) | `unifi.access` |
-| `unifi.site.ap-groups` | View AP groups — shows which APs are grouped together for SSID broadcasting | [src/api/unifi/site/apGroups.ts](src/api/unifi/site/apGroups.ts) | `unifi.access` |
-| `unifi.site.wifi-limits` | View WiFi SSID limits per AP per radio band | [src/api/unifi/site/wifiLimits.ts](src/api/unifi/site/wifiLimits.ts) | `unifi.access` |
-| `unifi.site.speed-profiles` | View speed limit profiles (user groups) from the UniFi controller | [src/api/unifi/site/speedProfilesFetchAll.ts](src/api/unifi/site/speedProfilesFetchAll.ts), [src/api/unifi/site/speedProfilesCreate.ts](src/api/unifi/site/speedProfilesCreate.ts) | `unifi.access` |
-| `unifi.site.speed-profiles.create` | Create a new speed limit profile (user group) on the UniFi controller | [src/api/unifi/site/speedProfilesCreate.ts](src/api/unifi/site/speedProfilesCreate.ts) | `unifi.access`, `unifi.site.speed-profiles` |
-| `unifi.site.wifi.ppsk` | View private pre-shared keys (PPSKs) for a specific WiFi network | [src/api/unifi/site/wifi/ppskFetchAll.ts](src/api/unifi/site/wifi/ppskFetchAll.ts), [src/api/unifi/site/wifi/ppskCreate.ts](src/api/unifi/site/wifi/ppskCreate.ts) | `unifi.access`, `unifi.site.wifi` |
-| `unifi.site.wifi.ppsk.create` | Create a private pre-shared key on a specific WiFi network | [src/api/unifi/site/wifi/ppskCreate.ts](src/api/unifi/site/wifi/ppskCreate.ts) | `unifi.access`, `unifi.site.wifi`, `unifi.site.wifi.ppsk` |
-
----
-
-## Object Type Permissions (Field-Level Gating)
-
-All fetch and fetchAll routes gate response object keys using `processObjectValuePerms`. For each object type, only fields whose corresponding `<scope>.<field>` permission the user holds are included in the response. Grant `<scope>.*` to allow all fields on that object type.
-
-### Company (`obj.company`)
-
-| Field Permission            | Description                               |
-| --------------------------- | ----------------------------------------- |
-| `obj.company.id`            | View company ID                           |
-| `obj.company.name`          | View company name                         |
-| `obj.company.cw_Identifier` | View ConnectWise identifier               |
-| `obj.company.cw_CompanyId`  | View ConnectWise company ID               |
-| `obj.company.cw_Data`       | View ConnectWise data (address, contacts) |
-| `obj.company.createdAt`     | View creation timestamp                   |
-| `obj.company.updatedAt`     | View last-updated timestamp               |
-
-**Used in:** [src/api/companies/[id]/fetch.ts](src/api/companies/[id]/fetch.ts), [src/api/companies/fetchAll.ts](src/api/companies/fetchAll.ts)
-
-### Credential (`obj.credential`)
-
-| Field Permission                   | Description                   |
-| ---------------------------------- | ----------------------------- |
-| `obj.credential.id`                | View credential ID            |
-| `obj.credential.name`              | View credential name          |
-| `obj.credential.notes`             | View credential notes         |
-| `obj.credential.typeId`            | View credential type ID       |
-| `obj.credential.companyId`         | View linked company ID        |
-| `obj.credential.subCredentialOfId` | View parent credential ID     |
-| `obj.credential.fields`            | View credential field values  |
-| `obj.credential.type`              | View credential type object   |
-| `obj.credential.company`           | View linked company object    |
-| `obj.credential.subCredentials`    | View sub-credentials array    |
-| `obj.credential.secureFieldIds`    | View secure field identifiers |
-| `obj.credential.createdAt`         | View creation timestamp       |
-| `obj.credential.updatedAt`         | View last-updated timestamp   |
-
-**Used in:** [src/api/credentials/fetch.ts](src/api/credentials/fetch.ts), [src/api/credentials/fetchByCompany.ts](src/api/credentials/fetchByCompany.ts), [src/api/credentials/fetchSubCredentials.ts](src/api/credentials/fetchSubCredentials.ts), [src/api/credential-types/fetchCredentials.ts](src/api/credential-types/fetchCredentials.ts)
-
-### Credential Type (`obj.credentialType`)
-
-| Field Permission                     | Description                               |
-| ------------------------------------ | ----------------------------------------- |
-| `obj.credentialType.id`              | View credential type ID                   |
-| `obj.credentialType.name`            | View credential type name                 |
-| `obj.credentialType.permissionScope` | View permission scope                     |
-| `obj.credentialType.icon`            | View icon                                 |
-| `obj.credentialType.fields`          | View field definitions                    |
-| `obj.credentialType.credentialCount` | View count of credentials using this type |
-| `obj.credentialType.createdAt`       | View creation timestamp                   |
-| `obj.credentialType.updatedAt`       | View last-updated timestamp               |
-
-**Used in:** [src/api/credential-types/fetch.ts](src/api/credential-types/fetch.ts), [src/api/credential-types/fetchAll.ts](src/api/credential-types/fetchAll.ts)
-
-### User (`obj.user`)
-
-| Field Permission       | Description                      |
-| ---------------------- | -------------------------------- |
-| `obj.user.id`          | View user ID                     |
-| `obj.user.name`        | View user display name           |
-| `obj.user.roles`       | View assigned role monikers      |
-| `obj.user.permissions` | View aggregated permission nodes |
-| `obj.user.login`       | View login identifier            |
-| `obj.user.email`       | View email address               |
-| `obj.user.image`       | View profile image URL           |
-| `obj.user.createdAt`   | View creation timestamp          |
-| `obj.user.updatedAt`   | View last-updated timestamp      |
-
-**Used in:** [src/api/user/@me/fetch.ts](src/api/user/@me/fetch.ts), [src/api/user/fetch.ts](src/api/user/fetch.ts), [src/api/user/fetchAll.ts](src/api/user/fetchAll.ts), [src/api/roles/getUsers.ts](src/api/roles/getUsers.ts)
-
-### Role (`obj.role`)
-
-| Field Permission       | Description                      |
-| ---------------------- | -------------------------------- |
-| `obj.role.id`          | View role ID                     |
-| `obj.role.title`       | View role title                  |
-| `obj.role.moniker`     | View role moniker                |
-| `obj.role.permissions` | View role permission nodes       |
-| `obj.role.users`       | View users assigned to this role |
-| `obj.role.createdAt`   | View creation timestamp          |
-| `obj.role.updatedAt`   | View last-updated timestamp      |
-
-**Used in:** [src/api/roles/fetch.ts](src/api/roles/fetch.ts), [src/api/roles/fetchAll.ts](src/api/roles/fetchAll.ts), [src/api/user/fetchRoles.ts](src/api/user/fetchRoles.ts)
-
-### Catalog Item (`obj.catalogItem`)
-
-| Field Permission                      | Description                      |
-| ------------------------------------- | -------------------------------- |
-| `obj.catalogItem.id`                  | View catalog item ID             |
-| `obj.catalogItem.cwCatalogId`         | View ConnectWise catalog ID      |
-| `obj.catalogItem.identifier`          | View item identifier             |
-| `obj.catalogItem.name`                | View item name                   |
-| `obj.catalogItem.description`         | View description                 |
-| `obj.catalogItem.customerDescription` | View customer-facing description |
-| `obj.catalogItem.internalNotes`       | View internal notes              |
-| `obj.catalogItem.manufacturer`        | View manufacturer name           |
-| `obj.catalogItem.manufactureCwId`     | View manufacturer ConnectWise ID |
-| `obj.catalogItem.partNumber`          | View part number                 |
-| `obj.catalogItem.vendorName`          | View vendor name                 |
-| `obj.catalogItem.vendorSku`           | View vendor SKU                  |
-| `obj.catalogItem.vendorCwId`          | View vendor ConnectWise ID       |
-| `obj.catalogItem.price`               | View price                       |
-| `obj.catalogItem.cost`                | View cost                        |
-| `obj.catalogItem.inactive`            | View inactive flag               |
-| `obj.catalogItem.salesTaxable`        | View sales-taxable flag          |
-| `obj.catalogItem.onHand`              | View on-hand inventory count     |
-| `obj.catalogItem.cwLastUpdated`       | View CW last-updated timestamp   |
-| `obj.catalogItem.linkedItems`         | View linked catalog items        |
-| `obj.catalogItem.createdAt`           | View creation timestamp          |
-| `obj.catalogItem.updatedAt`           | View last-updated timestamp      |
-
-**Used in:** [src/api/procurement/fetchAll.ts](src/api/procurement/fetchAll.ts), [src/api/procurement/[id]/fetch.ts](src/api/procurement/[id]/fetch.ts), [src/api/procurement/[id]/fetchLinked.ts](src/api/procurement/[id]/fetchLinked.ts)
-
-### Opportunity (`obj.opportunity`)
-
-| Field Permission                     | Description                     |
-| ------------------------------------ | ------------------------------- |
-| `obj.opportunity.id`                 | View opportunity ID             |
-| `obj.opportunity.cwOpportunityId`    | View ConnectWise opportunity ID |
-| `obj.opportunity.name`               | View opportunity name           |
-| `obj.opportunity.notes`              | View notes                      |
-| `obj.opportunity.type`               | View opportunity type           |
-| `obj.opportunity.stage`              | View stage                      |
-| `obj.opportunity.status`             | View status                     |
-| `obj.opportunity.priority`           | View priority                   |
-| `obj.opportunity.rating`             | View rating                     |
-| `obj.opportunity.source`             | View source                     |
-| `obj.opportunity.campaign`           | View campaign                   |
-| `obj.opportunity.primarySalesRep`    | View primary sales rep          |
-| `obj.opportunity.secondarySalesRep`  | View secondary sales rep        |
-| `obj.opportunity.company`            | View company                    |
-| `obj.opportunity.contact`            | View contact                    |
-| `obj.opportunity.site`               | View site                       |
-| `obj.opportunity.customerPO`         | View customer PO                |
-| `obj.opportunity.totalSalesTax`      | View total sales tax            |
-| `obj.opportunity.probability`        | View probability percentage     |
-| `obj.opportunity.location`           | View location                   |
-| `obj.opportunity.department`         | View department                 |
-| `obj.opportunity.expectedCloseDate`  | View expected close date        |
-| `obj.opportunity.pipelineChangeDate` | View pipeline change date       |
-| `obj.opportunity.dateBecameLead`     | View date became lead           |
-| `obj.opportunity.closedDate`         | View closed date                |
-| `obj.opportunity.closedFlag`         | View closed flag                |
-| `obj.opportunity.closedBy`           | View closed-by member           |
-| `obj.opportunity.companyId`          | View linked company ID          |
-| `obj.opportunity.cwLastUpdated`      | View CW last-updated timestamp  |
-| `obj.opportunity.createdAt`          | View creation timestamp         |
-| `obj.opportunity.updatedAt`          | View last-updated timestamp     |
-
-**Used in:** [src/api/sales/fetchAll.ts](src/api/sales/fetchAll.ts), [src/api/sales/[id]/fetch.ts](src/api/sales/[id]/fetch.ts)
-
-### UniFi Site (`obj.unifiSite`)
-
-| Field Permission          | Description                   |
-| ------------------------- | ----------------------------- |
-| `obj.unifiSite.id`        | View site internal ID         |
-| `obj.unifiSite.name`      | View site name                |
-| `obj.unifiSite.siteId`    | View UniFi controller site ID |
-| `obj.unifiSite.companyId` | View linked company ID        |
-| `obj.unifiSite.company`   | View linked company object    |
-| `obj.unifiSite.createdAt` | View creation timestamp       |
-| `obj.unifiSite.updatedAt` | View last-updated timestamp   |
-
-**Used in:** [src/api/unifi/sites/fetchAll.ts](src/api/unifi/sites/fetchAll.ts), [src/api/unifi/site/fetch.ts](src/api/unifi/site/fetch.ts), [src/api/companies/[id]/unifiSites.ts](src/api/companies/[id]/unifiSites.ts)
-
-### WiFi Network (`unifi.site.wifi.read`)
-
-See **UniFi Permissions > Field-Level Permission Gating** above for the full list of `unifi.site.wifi.read.<field>` nodes.
-
----
-
-## Permission Issuers
-
-Permissions can be issued by different sources:
-
-- `roles` - Permissions granted through role assignment
-- `user` - Permissions granted directly to a user
-- `api_key` - Permissions associated with an API key
-
-## Permission Validation
-
-The authorization middleware ([src/api/middleware/authorization.ts](src/api/middleware/authorization.ts)) enforces permissions by:
-
-1. Extracting the authorization header (Bearer token or API Key)
-2. Validating the session/token
-3. Checking if the user has all required permissions for the route
-4. Throwing an `InsufficentPermission` error (403) if any required permission is missing
-
-## Usage Example
-
-```typescript
-// Require single permission
-authMiddleware({ permissions: ["credential.fetch"] })
-
-// Require multiple permissions (all must be satisfied)
-authMiddleware({
-  permissions: ["credential.fetch", "credential.secure_values.read"]
-})
-
-// Administrator role with wildcard permission
-{
-  moniker: "administrator",
-  permissions: ["*"]  // Grants all permissions
-}
-```
-
-## Notes
-
-- Multiple permissions in a single route require **all** permissions to be satisfied (AND logic)
-- The `*` wildcard permission grants access to everything in the application
-- Permissions are signed using JWT with a private key for integrity
-- Permission validation supports pattern matching for flexible permission management

README.md

@@ -1,2 +1,116 @@
-# ttsci-api
-The Api for the TTS Credentials Manager
+# SveltronKit
+
+A minimal template for building Electron apps with SvelteKit.
+
+Includes native support for Typscript and uses Electron's official recommended Electron Forge for packaging.
+
+Everything you can do in SvelteKit, you can do in SveltronKit; meaning that you can use component
+libraries like [Shadcn-Svelte](https://next.shadcn-svelte.com/).
+
+> [!IMPORTANT]
+> This template uses SvelteKit's [hash router](https://svelte.dev/docs/kit/configuration#router) to
+> create a single-page app. The only difference you'll have to look out for is to start all your routed
+> links with `#/` instead of `/`.
+
+## Dependencies & Frameworks
+
+- [SvelteKit](https://kit.svelte.dev/)
+- [Electron](https://www.electronjs.org/)
+- [Electron Forge](https://www.electronforge.io/)
+- [TypeScript](https://www.typescriptlang.org/)
+- [TailwindCSS](https://tailwindcss.com/)
+
+> [!NOTE]
+> I've included TailwindCSS in this template because I use it in my own projects, but you can remove
+> it easily if you don't want it.
+
+## Getting Started
+
+> [!WARNING]
+> This project uses [`bun`](https://bun.sh/) and uses [patching](https://bun.sh/docs/install/patch) to work
+> around some issues with SvelteKit. When this [PR](https://github.com/sveltejs/kit/pull/13812) merges,
+> you can remove the patching and use the latest version of SvelteKit.
+
+Start by installing the dependencies:
+
+```
+bun install
+```
+
+**Development:**
+
+```
+bun start
+```
+
+[Electron Forge](https://www.electronforge.io/) with the [Vite plugin](https://www.electronforge.io/plugins/vite)
+will take care of running the development server and building the app for you. You don't need to run
+`vite dev` or `vite build` yourself. This also means that it supports hot module replacement (HMR).
+
+**Production:**
+
+```
+bun run package
+```
+
+This will build the app and you can find the output in the `out` directory. You can run the production
+app by opening the `.app` file in the `out` directory. This will not create your app's installer
+for distribution though.
+
+To create a distributable installer, you can use:
+
+```
+bun run make
+```
+
+This will create a distributable installer for your app. You can configure this in the `makers` section
+in `forge.config.ts`. Reference the [makers documentation](https://www.electronforge.io/makers) for more
+information.
+
+# Electron Crash Course
+
+> [!NOTE]
+> This is a super simplified version of the Electron documentation meant to give you a general idea
+> of how Electron works and how each file corresponds to responsibilities in Electron. For a more
+> accurate description of how Electron works, you can refer to the [official documentation](https://www.electronjs.org/docs).
+
+I found that most of the problems I encountered when setting up Electron were because I didn't know
+how Electron works and that the documentation was too dense to get up to speed with, so I'll include
+a crash course here. _I will be making a lot of analogies to web development_ as it seems like a lot
+of people who are new to Electron come from web development.
+
+Because everything in Electron is client based, you'll need to host your own server if you want to
+access any sensitive logic like a database or authentication, etc.
+
+## main.ts
+
+This file defines what the main process will do. The process runs your app. It's the one that
+creates and manages windows and also has permissions to access the file system. You also define
+"_signals_"/"_endpoints_", through IPC, that let the renderer process (browser that runs your app)
+can "_call_" to interact with the file system.
+
+By default, Electron will block off file system access to the renderer process as a security measure,
+which is the reason why you need to use IPC to interact with the file system.
+
+## preload.ts
+
+Think about this as a "bridge" or a "network"/"proxy" between the main process and the renderer process.
+You specify what functions that the renderer process can call and these functions will usually be
+interacting with the file system through the main process.
+
+## renderer
+
+The renderer process is the browser that runs your app. Just treat this like another SvelteKit app.
+
+## Overview
+
+```mermaid
+flowchart LR
+  subgraph main[Main Process]
+    electron
+  end
+  subgraph renderer[Renderer Process]
+    browser
+  end
+  electron <-- preload --> renderer
+```

bruno/optima/Check User Permission.bru

@@ -1,21 +0,0 @@
-meta {
-  name: Check User Permission
-  type: http
-  seq: 3
-}
-
-post {
-  url: {{baseUrl}}/v1/user/@me/check-permission
-  body: json
-  auth: none
-}
-
-headers {
-  Content-Type: application/json
-}
-
-body:json {
-  {
-    "permissions": ["user.read", "company.create", "credential.write"]
-  }
-}

bruno/optima/Fetch Company Pages.bru

@@ -1,15 +0,0 @@
-meta {
-  name: Fetch Company Pages.
-  type: http
-  seq: 2
-}
-
-get {
-  url: 
-  body: none
-  auth: inherit
-}
-
-settings {
-  encodeUrl: true
-}

bruno/optima/Teapot.bru

@@ -1,15 +0,0 @@
-meta {
-  name: Teapot
-  type: http
-  seq: 1
-}
-
-get {
-  url: http://localhost:3000/v1/teapot
-  body: none
-  auth: inherit
-}
-
-settings {
-  encodeUrl: true
-}

bruno/optima/bruno.json

@@ -1,9 +0,0 @@
-{
-  "version": "1",
-  "name": "optima",
-  "type": "collection",
-  "ignore": [
-    "node_modules",
-    ".git"
-  ]
-}

bruno/ttscm/bruno.json

@@ -1,6 +0,0 @@
-{
-  "version": "1",
-  "name": "optima",
-  "type": "collection",
-  "ignore": ["node_modules", ".git"]
-}

bunfig.toml

@@ -1,2 +0,0 @@
-[test]
-preload = ["./tests/setup.ts"]

debug-scripts/analyze-cw-calls.py

@@ -1,307 +0,0 @@
-#!/usr/bin/env python3
-"""
-Analyze ConnectWise API call logs.
-
-Looks for the most recent log file in cw-api-logs/ by default,
-or accepts an explicit path as an argument.
-
-Usage:
-    python3 analyze-cw-calls.py                          # latest file in cw-api-logs/
-    python3 analyze-cw-calls.py cw-api-logs/specific.jsonl
-"""
-
-import json
-import sys
-import os
-import glob
-import statistics
-from collections import Counter, defaultdict
-from datetime import datetime, timedelta
-
-# ── Colours ──────────────────────────────────────────────────────────────────
-
-RED = "\033[91m"
-GREEN = "\033[92m"
-YELLOW = "\033[93m"
-CYAN = "\033[96m"
-BOLD = "\033[1m"
-DIM = "\033[2m"
-RESET = "\033[0m"
-
-def colour_duration(ms: float) -> str:
-    if ms >= 10_000:
-        return f"{RED}{ms:,.0f}ms{RESET}"
-    if ms >= 5_000:
-        return f"{YELLOW}{ms:,.0f}ms{RESET}"
-    return f"{GREEN}{ms:,.0f}ms{RESET}"
-
-def header(title: str) -> str:
-    return f"\n{BOLD}{CYAN}{'─' * 60}\n  {title}\n{'─' * 60}{RESET}"
-
-# ── Resolve log file ────────────────────────────────────────────────────────
-
-def find_latest_log() -> str:
-    """Find the most recent .jsonl file in cw-api-logs/."""
-    log_dir = os.path.join(os.getcwd(), "cw-api-logs")
-    files = sorted(glob.glob(os.path.join(log_dir, "*.jsonl")))
-    if not files:
-        print(f"{RED}No log files found in cw-api-logs/{RESET}")
-        print(f"Run {BOLD}bun run dev:log{RESET} to start logging CW API calls.")
-        sys.exit(1)
-    return files[-1]
-
-if len(sys.argv) > 1:
-    log_path = sys.argv[1]
-else:
-    log_path = find_latest_log()
-
-print(f"{DIM}Reading: {log_path}{RESET}")
-
-entries = []
-parse_errors = 0
-with open(log_path) as f:
-    for line in f:
-        line = line.strip()
-        if not line:
-            continue
-        try:
-            entries.append(json.loads(line))
-        except json.JSONDecodeError:
-            parse_errors += 1
-
-if not entries:
-    print("No entries found. Check the log file path.")
-    sys.exit(1)
-
-# ── Derived fields ───────────────────────────────────────────────────────────
-
-durations = [e["durationMs"] for e in entries]
-errors = [e for e in entries if e.get("error")]
-successes = [e for e in entries if not e.get("error")]
-timestamps = [datetime.fromisoformat(e["timestamp"].replace("Z", "+00:00")) for e in entries]
-
-time_span = (timestamps[-1] - timestamps[0]) if len(timestamps) > 1 else timedelta(0)
-
-# Normalise the URL to a route pattern for grouping
-def normalise_url(url: str) -> str:
-    parts = url.split("?")[0].rstrip("/").split("/")
-    normalised = []
-    for p in parts:
-        if p.isdigit():
-            normalised.append(":id")
-        else:
-            normalised.append(p)
-    return "/".join(normalised)
-
-# ── 1. Overview ──────────────────────────────────────────────────────────────
-
-print(header("OVERVIEW"))
-print(f"  Log file        : {log_path}")
-print(f"  Total calls     : {BOLD}{len(entries):,}{RESET}")
-print(f"  Successes       : {GREEN}{len(successes):,}{RESET}")
-print(f"  Failures        : {RED}{len(errors):,}{RESET}  ({len(errors)/len(entries)*100:.1f}%)")
-print(f"  Time span       : {time_span}")
-if time_span.total_seconds() > 0:
-    rps = len(entries) / time_span.total_seconds()
-    print(f"  Avg req/sec     : {rps:.2f}")
-if parse_errors:
-    print(f"  Parse errors    : {YELLOW}{parse_errors}{RESET}")
-
-# ── 2. Duration stats ───────────────────────────────────────────────────────
-
-print(header("DURATION STATS (all calls)"))
-sorted_dur = sorted(durations)
-p50 = sorted_dur[len(sorted_dur) * 50 // 100]
-p90 = sorted_dur[len(sorted_dur) * 90 // 100]
-p95 = sorted_dur[len(sorted_dur) * 95 // 100]
-p99 = sorted_dur[len(sorted_dur) * 99 // 100]
-
-print(f"  Min             : {colour_duration(min(durations))}")
-print(f"  Max             : {colour_duration(max(durations))}")
-print(f"  Mean            : {colour_duration(statistics.mean(durations))}")
-print(f"  Median (p50)    : {colour_duration(p50)}")
-print(f"  p90             : {colour_duration(p90)}")
-print(f"  p95             : {colour_duration(p95)}")
-print(f"  p99             : {colour_duration(p99)}")
-print(f"  Std dev         : {statistics.stdev(durations):,.0f}ms" if len(durations) > 1 else "")
-
-# Duration buckets
-buckets = {"<500ms": 0, "500ms-1s": 0, "1-3s": 0, "3-5s": 0, "5-10s": 0, "10-20s": 0, "20s+": 0}
-for d in durations:
-    if d < 500: buckets["<500ms"] += 1
-    elif d < 1000: buckets["500ms-1s"] += 1
-    elif d < 3000: buckets["1-3s"] += 1
-    elif d < 5000: buckets["3-5s"] += 1
-    elif d < 10000: buckets["5-10s"] += 1
-    elif d < 20000: buckets["10-20s"] += 1
-    else: buckets["20s+"] += 1
-
-print(f"\n  {BOLD}Distribution:{RESET}")
-max_bar = 40
-max_count = max(buckets.values()) if buckets else 1
-for label, count in buckets.items():
-    bar_len = int(count / max_count * max_bar) if max_count else 0
-    pct = count / len(durations) * 100
-    bar = "█" * bar_len
-    clr = GREEN if "500" in label or "<" in label else (YELLOW if "1-3" in label or "3-5" in label else RED)
-    print(f"  {label:>10s}  {clr}{bar}{RESET} {count:>5,} ({pct:5.1f}%)")
-
-# ── 3. Errors breakdown ─────────────────────────────────────────────────────
-
-print(header("ERROR BREAKDOWN"))
-if not errors:
-    print(f"  {GREEN}No errors! 🎉{RESET}")
-else:
-    error_codes = Counter()
-    for e in errors:
-        err_str = e.get("error", "unknown")
-        code = err_str.split(":")[0] if ":" in err_str else err_str
-        error_codes[code] += 1
-
-    for code, count in error_codes.most_common():
-        print(f"  {RED}{code:<30s}{RESET}  {count:>5,}  ({count/len(entries)*100:.1f}%)")
-
-    # Errored URLs
-    errored_urls = Counter(normalise_url(e["url"]) for e in errors)
-    print(f"\n  {BOLD}Top errored endpoints:{RESET}")
-    for url, count in errored_urls.most_common(10):
-        print(f"    {count:>5,}  {url}")
-
-# ── 4. Slowest individual calls ─────────────────────────────────────────────
-
-print(header("TOP 20 SLOWEST CALLS"))
-slowest = sorted(entries, key=lambda e: e["durationMs"], reverse=True)[:20]
-for i, e in enumerate(slowest, 1):
-    status = e.get("status") or f"{RED}ERR{RESET}"
-    err_tag = f"  {RED}[{e['error'].split(':')[0]}]{RESET}" if e.get("error") else ""
-    print(f"  {i:>2}. {colour_duration(e['durationMs']):>20s}  {e['method']:>4s} {e['url'][:60]:<60s}  {DIM}{status}{RESET}{err_tag}")
-
-# ── 5. Per-endpoint stats ───────────────────────────────────────────────────
-
-print(header("PER-ENDPOINT STATS (by route pattern)"))
-by_route = defaultdict(list)
-for e in entries:
-    route = normalise_url(e["url"])
-    by_route[route].append(e)
-
-# Sort by total time spent descending (most impactful)
-route_stats = []
-for route, calls in by_route.items():
-    durs = [c["durationMs"] for c in calls]
-    errs = sum(1 for c in calls if c.get("error"))
-    sorted_d = sorted(durs)
-    route_stats.append({
-        "route": route,
-        "count": len(calls),
-        "errors": errs,
-        "total_ms": sum(durs),
-        "mean": statistics.mean(durs),
-        "p50": sorted_d[len(sorted_d) * 50 // 100],
-        "p95": sorted_d[len(sorted_d) * 95 // 100],
-        "max": max(durs),
-    })
-
-route_stats.sort(key=lambda r: r["total_ms"], reverse=True)
-
-print(f"  {'Route':<55s} {'Count':>6s} {'Errs':>5s} {'Mean':>8s} {'p50':>8s} {'p95':>8s} {'Max':>8s} {'Total':>10s}")
-print(f"  {'─' * 55} {'─' * 6} {'─' * 5} {'─' * 8} {'─' * 8} {'─' * 8} {'─' * 8} {'─' * 10}")
-for r in route_stats[:25]:
-    err_str = f"{RED}{r['errors']}{RESET}" if r['errors'] else f"{DIM}0{RESET}"
-    print(
-        f"  {r['route']:<55s} {r['count']:>6,} {err_str:>14s} "
-        f"{r['mean']:>7,.0f}ms {r['p50']:>7,.0f}ms {r['p95']:>7,.0f}ms "
-        f"{r['max']:>7,.0f}ms {r['total_ms']/1000:>8,.1f}s"
-    )
-
-# ── 6. HTTP method breakdown ────────────────────────────────────────────────
-
-print(header("BY HTTP METHOD"))
-by_method = defaultdict(list)
-for e in entries:
-    by_method[e["method"]].append(e["durationMs"])
-
-print(f"  {'Method':<8s} {'Count':>7s} {'Mean':>9s} {'p95':>9s} {'Max':>9s}")
-print(f"  {'─' * 8} {'─' * 7} {'─' * 9} {'─' * 9} {'─' * 9}")
-for method in sorted(by_method.keys()):
-    durs = by_method[method]
-    sd = sorted(durs)
-    print(
-        f"  {method:<8s} {len(durs):>7,} "
-        f"{statistics.mean(durs):>8,.0f}ms "
-        f"{sd[len(sd)*95//100]:>8,.0f}ms "
-        f"{max(durs):>8,.0f}ms"
-    )
-
-# ── 7. Timeline (calls per minute) ──────────────────────────────────────────
-
-if time_span.total_seconds() > 60:
-    print(header("TIMELINE (per-minute throughput & errors)"))
-    by_minute = defaultdict(lambda: {"count": 0, "errors": 0, "dur_sum": 0})
-    for e in entries:
-        ts = e["timestamp"][:16]  # YYYY-MM-DDTHH:MM
-        by_minute[ts]["count"] += 1
-        by_minute[ts]["dur_sum"] += e["durationMs"]
-        if e.get("error"):
-            by_minute[ts]["errors"] += 1
-
-    for minute in sorted(by_minute.keys()):
-        m = by_minute[minute]
-        avg = m["dur_sum"] / m["count"] if m["count"] else 0
-        err_part = f"  {RED}({m['errors']} errs){RESET}" if m["errors"] else ""
-        bar = "▓" * min(m["count"] // 5, 50)
-        avg_clr = colour_duration(avg)
-        print(f"  {minute}  {m['count']:>5,} reqs  avg {avg_clr:>20s}  {bar}{err_part}")
-
-# ── 8. Concurrency hotspots ─────────────────────────────────────────────────
-
-print(header("CONCURRENCY HOTSPOTS (calls starting within 100ms of each other)"))
-ts_ms = [int(t.timestamp() * 1000) for t in timestamps]
-bursts = []
-i = 0
-while i < len(ts_ms):
-    j = i
-    while j < len(ts_ms) - 1 and ts_ms[j + 1] - ts_ms[j] < 100:
-        j += 1
-    burst_size = j - i + 1
-    if burst_size >= 5:
-        burst_entries = entries[i:j + 1]
-        avg_dur = statistics.mean(e["durationMs"] for e in burst_entries)
-        bursts.append((burst_size, entries[i]["timestamp"], avg_dur, burst_entries))
-    i = j + 1
-
-bursts.sort(key=lambda b: b[0], reverse=True)
-if bursts:
-    print(f"  Found {len(bursts)} burst(s) of ≥5 concurrent requests\n")
-    for size, ts, avg, _ in bursts[:10]:
-        print(f"  {YELLOW}{size:>3} concurrent{RESET}  at {ts}  avg {colour_duration(avg)}")
-else:
-    print(f"  {GREEN}No major concurrency bursts detected.{RESET}")
-
-# ── 9. Summary / recommendations ────────────────────────────────────────────
-
-print(header("SUMMARY"))
-err_rate = len(errors) / len(entries) * 100
-slow_5s = sum(1 for d in durations if d >= 5000)
-slow_pct = slow_5s / len(entries) * 100
-
-if err_rate > 5:
-    print(f"  {RED}⚠  Error rate is {err_rate:.1f}% — CW API is struggling{RESET}")
-elif err_rate > 1:
-    print(f"  {YELLOW}⚠  Error rate is {err_rate:.1f}% — some instability{RESET}")
-else:
-    print(f"  {GREEN}✓  Error rate is {err_rate:.1f}% — acceptable{RESET}")
-
-if slow_pct > 10:
-    print(f"  {RED}⚠  {slow_5s:,} calls ({slow_pct:.1f}%) took >5s — CW is slow or rate-limiting{RESET}")
-elif slow_pct > 2:
-    print(f"  {YELLOW}⚠  {slow_5s:,} calls ({slow_pct:.1f}%) took >5s{RESET}")
-else:
-    print(f"  {GREEN}✓  Only {slow_5s:,} calls ({slow_pct:.1f}%) over 5s{RESET}")
-
-if bursts:
-    max_burst = max(b[0] for b in bursts)
-    print(f"  {YELLOW}⚠  Max concurrency burst: {max_burst} simultaneous requests — consider lowering CONCURRENCY{RESET}")
-
-total_time_s = sum(durations) / 1000
-print(f"\n  Total wall-clock time spent waiting on CW: {BOLD}{total_time_s:,.1f}s{RESET} ({total_time_s/60:,.1f} min)")
-print()

debug-scripts/analyze_webhook_log.py

@@ -1,441 +0,0 @@
-#!/usr/bin/env python3
-
-import argparse
-import json
-from collections import Counter, defaultdict
-from dataclasses import dataclass
-from datetime import datetime, timezone
-from pathlib import Path
-from typing import Any
-
-
-def parse_iso(value: str | None) -> datetime | None:
-    if not value:
-        return None
-    normalized = value.replace("Z", "+00:00")
-    try:
-        return datetime.fromisoformat(normalized)
-    except ValueError:
-        return None
-
-
-def first_non_empty(*values: Any) -> str:
-    for value in values:
-        if value is None:
-            continue
-        if isinstance(value, str) and value.strip() == "":
-            continue
-        return str(value)
-    return "unknown"
-
-
-def top_lines(counter: Counter[str], limit: int) -> list[str]:
-    return [f"{k}: {v}" for k, v in counter.most_common(limit)]
-
-
-def fmt_pct(part: int, total: int) -> str:
-    if total == 0:
-        return "0.0%"
-    return f"{(part / total) * 100:.1f}%"
-
-
-def human_duration(start: datetime | None, end: datetime | None) -> str:
-    if start is None or end is None:
-        return "unknown"
-
-    delta = end - start
-    total_seconds = int(delta.total_seconds())
-    hours, remainder = divmod(total_seconds, 3600)
-    minutes, seconds = divmod(remainder, 60)
-    return f"{hours}h {minutes}m {seconds}s"
-
-
-def truncate(value: str, max_len: int = 90) -> str:
-    if len(value) <= max_len:
-        return value
-    return value[: max_len - 1] + "…"
-
-
-def add_section(lines: list[str], title: str) -> None:
-    lines.append("")
-    lines.append(title)
-    lines.append("-" * len(title))
-
-
-def supports_color(enabled: bool) -> bool:
-    return enabled
-
-
-def paint(text: str, code: str, use_color: bool) -> str:
-    if not use_color:
-        return text
-    return f"\033[{code}m{text}\033[0m"
-
-
-def good_bad_neutral(value: str, state: str, use_color: bool) -> str:
-    if state == "good":
-        return paint(value, "32", use_color)
-    if state == "bad":
-        return paint(value, "31", use_color)
-    return paint(value, "36", use_color)
-
-
-def add_ranked_counter(
-    lines: list[str],
-    title: str,
-    counter: Counter[str],
-    top_n: int,
-    total: int,
-    truncate_labels: bool = False,
-) -> None:
-    lines.append(f"• {title}")
-    items = counter.most_common(top_n)
-    if not items:
-        lines.append("  (no data)")
-        return
-
-    for index, (key, count) in enumerate(items, start=1):
-        label = truncate(key) if truncate_labels else key
-        lines.append(f"  {index:>2}. {label:<90} {count:>4}  {fmt_pct(count, total):>6}")
-
-
-def stream_row_summary(row: dict[str, Any], use_color: bool, max_path: int) -> str:
-    request = row.get("request") or {}
-    response = row.get("response") or {}
-    body_parsed = request.get("bodyParsed") or {}
-    entity_parsed = request.get("entityParsed") or {}
-    summary = request.get("summary") or {}
-
-    timestamp = parse_iso(row.get("timestamp"))
-    time_label = timestamp.astimezone(timezone.utc).strftime("%H:%M:%S") if timestamp else "--:--:--"
-
-    method = first_non_empty(request.get("method"))
-    path = first_non_empty(request.get("path"))
-    endpoint = path.split("?", 1)[0]
-    status_code = first_non_empty(response.get("status"))
-
-    event_type = first_non_empty(body_parsed.get("Type"), summary.get("type"))
-    action = first_non_empty(
-        body_parsed.get("Action"),
-        summary.get("action"),
-        request.get("query", {}).get("params", {}).get("action"),
-    )
-    item_id = first_non_empty(body_parsed.get("ID"), summary.get("id"), request.get("query", {}).get("inferredId"))
-    actor = first_non_empty(
-        request.get("query", {}).get("params", {}).get("memberId"),
-        summary.get("entityUpdatedBy"),
-        entity_parsed.get("UpdatedBy"),
-    )
-    entity_status = first_non_empty(entity_parsed.get("StatusName"), summary.get("entityStatus"))
-
-    endpoint_label = truncate(endpoint, max_path)
-    status_state = "good" if status_code.startswith("2") else "bad"
-    status_colored = good_bad_neutral(status_code, status_state, use_color)
-    event_colored = paint(f"{event_type}.{action}", "36", use_color)
-    endpoint_colored = paint(endpoint_label, "94", use_color)
-
-    return (
-        f"[{time_label}] {method:<4} {endpoint_colored:<20} "
-        f"{status_colored:>3}  {event_colored:<22} "
-        f"id={item_id:<7} actor={truncate(actor, 16):<16} status={truncate(entity_status, 22)}"
-    )
-
-
-def endpoint_stream_summary(log_path: Path, use_color: bool, max_path: int) -> str:
-    lines: list[str] = []
-    lines.append(paint("ENDPOINT STREAM (chronological)", "1;95", use_color))
-    lines.append(paint("────────────────────────────────────────────────────────────────────────────────────────────", "90", use_color))
-
-    count = 0
-    invalid = 0
-    with log_path.open("r", encoding="utf-8") as handle:
-        for raw_line in handle:
-            line = raw_line.strip()
-            if not line:
-                continue
-
-            try:
-                row = json.loads(line)
-            except json.JSONDecodeError:
-                invalid += 1
-                continue
-
-            lines.append(stream_row_summary(row, use_color=use_color, max_path=max_path))
-            count += 1
-
-    lines.append(paint("────────────────────────────────────────────────────────────────────────────────────────────", "90", use_color))
-    lines.append(
-        f"events={count}  invalid={good_bad_neutral(str(invalid), 'good' if invalid == 0 else 'bad', use_color)}"
-    )
-    return "\n".join(lines)
-
-
-@dataclass
-class LogStats:
-    total_rows: int = 0
-    parsed_rows: int = 0
-    invalid_rows: int = 0
-    earliest: datetime | None = None
-    latest: datetime | None = None
-
-    methods: Counter[str] = None  # type: ignore[assignment]
-    paths: Counter[str] = None  # type: ignore[assignment]
-    endpoint_roots: Counter[str] = None  # type: ignore[assignment]
-    response_statuses: Counter[str] = None  # type: ignore[assignment]
-    event_types: Counter[str] = None  # type: ignore[assignment]
-    actions: Counter[str] = None  # type: ignore[assignment]
-    type_action_combo: Counter[str] = None  # type: ignore[assignment]
-    company_ids: Counter[str] = None  # type: ignore[assignment]
-
-    source_members: Counter[str] = None  # type: ignore[assignment]
-    actor_members: Counter[str] = None  # type: ignore[assignment]
-    entity_updated_by: Counter[str] = None  # type: ignore[assignment]
-
-    requests_by_hour: Counter[str] = None  # type: ignore[assignment]
-    requests_by_minute: Counter[str] = None  # type: ignore[assignment]
-    endpoint_by_hour: dict[str, Counter[str]] = None  # type: ignore[assignment]
-
-    def __post_init__(self) -> None:
-        self.methods = Counter()
-        self.paths = Counter()
-        self.endpoint_roots = Counter()
-        self.response_statuses = Counter()
-        self.event_types = Counter()
-        self.actions = Counter()
-        self.type_action_combo = Counter()
-        self.company_ids = Counter()
-
-        self.source_members = Counter()
-        self.actor_members = Counter()
-        self.entity_updated_by = Counter()
-
-        self.requests_by_hour = Counter()
-        self.requests_by_minute = Counter()
-        self.endpoint_by_hour = defaultdict(Counter)
-
-    def add_timestamp(self, timestamp: datetime | None) -> None:
-        if timestamp is None:
-            return
-
-        self.earliest = timestamp if self.earliest is None else min(self.earliest, timestamp)
-        self.latest = timestamp if self.latest is None else max(self.latest, timestamp)
-
-        hour_bucket = timestamp.astimezone(timezone.utc).strftime("%Y-%m-%d %H:00 UTC")
-        minute_bucket = timestamp.astimezone(timezone.utc).strftime("%Y-%m-%d %H:%M UTC")
-        self.requests_by_hour[hour_bucket] += 1
-        self.requests_by_minute[minute_bucket] += 1
-
-    def summarize(self, top_n: int, busiest_n: int, use_color: bool) -> str:
-        duration_line = human_duration(self.earliest, self.latest)
-        time_range_line = "unknown"
-        if self.earliest and self.latest:
-            time_range_line = f"{self.earliest.isoformat()} → {self.latest.isoformat()}"
-
-        total_requests = self.parsed_rows
-        success_count = self.response_statuses.get("200", 0)
-        success_pct = fmt_pct(success_count, sum(self.response_statuses.values()))
-        invalid_state = "good" if self.invalid_rows == 0 else "bad"
-
-        top_endpoints = self.endpoint_roots.most_common(2)
-        top_users = self.actor_members.most_common(3)
-        top_minutes = self.requests_by_minute.most_common(busiest_n)
-
-        lines: list[str] = []
-        lines.append(paint("WEBHOOK SNAPSHOT", "1;95", use_color))
-        lines.append(paint("────────────────────────────────────────────────────────", "90", use_color))
-        lines.append(
-            "  "
-            + paint("Rows", "1;97", use_color)
-            + f": {self.total_rows:<4}  "
-            + paint("Parsed", "1;97", use_color)
-            + f": {self.parsed_rows:<4}  "
-            + paint("Invalid", "1;97", use_color)
-            + f": {good_bad_neutral(str(self.invalid_rows), invalid_state, use_color)}"
-        )
-        lines.append(
-            "  "
-            + paint("Window", "1;97", use_color)
-            + f": {duration_line:<12} "
-            + paint("Success", "1;97", use_color)
-            + f": {good_bad_neutral(success_pct, 'good' if success_count else 'neutral', use_color)}"
-        )
-        lines.append("  " + paint("UTC Range", "1;97", use_color) + f": {time_range_line}")
-
-        lines.append("")
-        lines.append(paint("Top Endpoints", "1;94", use_color))
-        if top_endpoints:
-            for endpoint, count in top_endpoints:
-                lines.append(f"  • {endpoint:<14} {count:>4} ({fmt_pct(count, total_requests)})")
-        if not top_endpoints:
-            lines.append("  • (no data)")
-
-        lines.append("")
-        lines.append(paint("Most Active Users (query memberId)", "1;94", use_color))
-        if top_users:
-            for user, count in top_users:
-                lines.append(f"  • {user:<18} {count:>4} ({fmt_pct(count, total_requests)})")
-        if not top_users:
-            lines.append("  • (no data)")
-
-        lines.append("")
-        lines.append(paint("Busiest Minutes", "1;94", use_color))
-        if top_minutes:
-            for minute, count in top_minutes:
-                lines.append(f"  • {minute:<22} {count:>3}")
-        if not top_minutes:
-            lines.append("  • (no data)")
-
-        lines.append("")
-        lines.append(paint("Request Mix", "1;94", use_color))
-        method_line = ", ".join([f"{k}:{v}" for k, v in self.methods.most_common(3)]) or "(no data)"
-        event_line = ", ".join([f"{k}:{v}" for k, v in self.event_types.most_common(3)]) or "(no data)"
-        action_line = ", ".join([f"{k}:{v}" for k, v in self.actions.most_common(3)]) or "(no data)"
-        lines.append(f"  • Methods : {method_line}")
-        lines.append(f"  • Types   : {event_line}")
-        lines.append(f"  • Actions : {action_line}")
-
-        lines.append("")
-        lines.append(paint("Status Codes", "1;94", use_color))
-        if self.response_statuses:
-            status_total = sum(self.response_statuses.values())
-            for status, count in self.response_statuses.most_common(5):
-                state = "good" if status.startswith("2") else "bad"
-                status_label = good_bad_neutral(status, state, use_color)
-                lines.append(f"  • {status_label}: {count} ({fmt_pct(count, status_total)})")
-        if not self.response_statuses:
-            lines.append("  • (no data)")
-
-        return "\n".join(lines)
-
-
-def update_stats(stats: LogStats, row: dict[str, Any]) -> None:
-    timestamp = parse_iso(row.get("timestamp"))
-    stats.add_timestamp(timestamp)
-
-    request = row.get("request") or {}
-    response = row.get("response") or {}
-    body_parsed = request.get("bodyParsed") or {}
-    entity_parsed = request.get("entityParsed") or {}
-
-    method = first_non_empty(request.get("method"))
-    path = first_non_empty(request.get("path"))
-    endpoint_root = path.split("?", 1)[0]
-    status = first_non_empty(response.get("status"))
-
-    event_type = first_non_empty(
-        body_parsed.get("Type"),
-        request.get("summary", {}).get("type"),
-    )
-    action = first_non_empty(
-        body_parsed.get("Action"),
-        request.get("summary", {}).get("action"),
-        request.get("query", {}).get("params", {}).get("action"),
-    )
-    combo = f"{event_type}:{action}"
-
-    source_member = first_non_empty(
-        body_parsed.get("MemberId"),
-        request.get("summary", {}).get("memberId"),
-    )
-    actor_member = first_non_empty(
-        request.get("query", {}).get("params", {}).get("memberId"),
-        request.get("summary", {}).get("entityUpdatedBy"),
-    )
-    updated_by = first_non_empty(
-        entity_parsed.get("UpdatedBy"),
-        request.get("summary", {}).get("entityUpdatedBy"),
-    )
-    company_id = first_non_empty(body_parsed.get("CompanyId"), request.get("headers", {}).get("companyname"))
-
-    stats.methods[method] += 1
-    stats.paths[path] += 1
-    stats.endpoint_roots[endpoint_root] += 1
-    stats.response_statuses[status] += 1
-    stats.event_types[event_type] += 1
-    stats.actions[action] += 1
-    stats.type_action_combo[combo] += 1
-    stats.company_ids[company_id] += 1
-
-    stats.source_members[source_member] += 1
-    stats.actor_members[actor_member] += 1
-    stats.entity_updated_by[updated_by] += 1
-
-    if timestamp:
-        bucket = timestamp.astimezone(timezone.utc).strftime("%Y-%m-%d %H:00 UTC")
-        stats.endpoint_by_hour[endpoint_root][bucket] += 1
-
-
-def analyze_file(log_path: Path) -> LogStats:
-    stats = LogStats()
-
-    with log_path.open("r", encoding="utf-8") as handle:
-        for raw_line in handle:
-            line = raw_line.strip()
-            if not line:
-                continue
-
-            stats.total_rows += 1
-            try:
-                row = json.loads(line)
-            except json.JSONDecodeError:
-                stats.invalid_rows += 1
-                continue
-
-            stats.parsed_rows += 1
-            update_stats(stats, row)
-
-    return stats
-
-
-def main() -> None:
-    parser = argparse.ArgumentParser(
-        description="Analyze webhook JSONL logs by users, time, and request types."
-    )
-    parser.add_argument("log_file", help="Path to JSONL log file")
-    parser.add_argument("--top", type=int, default=10, help="Top N entries per section (default: 10)")
-    parser.add_argument(
-        "--busiest-minutes",
-        type=int,
-        default=5,
-        help="How many top minute buckets to show (default: 5)",
-    )
-    parser.add_argument(
-        "--no-color",
-        action="store_true",
-        help="Disable ANSI colors",
-    )
-    parser.add_argument(
-        "--endpoint-stream",
-        action="store_true",
-        help="Show chronological one-line summary per webhook, similar to live test webserver logs",
-    )
-    parser.add_argument(
-        "--max-path",
-        type=int,
-        default=18,
-        help="Max endpoint width in stream mode before truncation (default: 18)",
-    )
-    args = parser.parse_args()
-
-    log_path = Path(args.log_file)
-    if not log_path.exists() or not log_path.is_file():
-        raise SystemExit(f"Log file not found: {log_path}")
-
-    use_color = supports_color(not args.no_color)
-
-    if args.endpoint_stream:
-        print(endpoint_stream_summary(log_path, use_color=use_color, max_path=max(args.max_path, 10)))
-        return
-
-    stats = analyze_file(log_path)
-    print(
-        stats.summarize(
-            top_n=max(args.top, 1),
-            busiest_n=max(args.busiest_minutes, 1),
-            use_color=use_color,
-        )
-    )
-
-
-if __name__ == "__main__":
-    main()

debug-scripts/generate_log_report.py

@@ -1,900 +0,0 @@
-#!/usr/bin/env python3
-"""
-Generate a print-friendly PDF report from the latest test-webserver log file.
-
-Usage:
-    python3 generate_log_report.py [optional_log_file_path]
-
-If no path is given, the script finds the latest test-webserver-*.jsonl
-file in ../cw-api-logs/.
-"""
-
-import json
-import os
-import sys
-import glob
-from datetime import datetime, timezone
-from collections import Counter, defaultdict
-
-from reportlab.lib import colors
-from reportlab.lib.pagesizes import LETTER
-from reportlab.lib.styles import getSampleStyleSheet, ParagraphStyle
-from reportlab.lib.units import inch
-from reportlab.lib.enums import TA_CENTER, TA_LEFT
-from reportlab.platypus import (
-    SimpleDocTemplate,
-    Paragraph,
-    Spacer,
-    Table,
-    TableStyle,
-    PageBreak,
-    HRFlowable,
-    KeepTogether,
-)
-from reportlab.graphics.shapes import Drawing, String
-from reportlab.graphics.charts.piecharts import Pie
-from reportlab.graphics.charts.barcharts import VerticalBarChart
-
-# ─── Print-friendly color palette ─────────────────────────────────────────────
-# Minimal ink: white backgrounds, thin borders, dark text, subtle accents
-HEADER_BG    = colors.HexColor("#2c3e50")   # Dark header (used sparingly)
-ACCENT       = colors.HexColor("#2980b9")   # Muted blue
-ACCENT_2     = colors.HexColor("#27ae60")   # Muted green
-ACCENT_3     = colors.HexColor("#8e44ad")   # Muted purple
-WHITE        = colors.white
-GRAY_50      = colors.HexColor("#fafafa")
-GRAY_100     = colors.HexColor("#f5f5f5")
-GRAY_200     = colors.HexColor("#e0e0e0")
-GRAY_400     = colors.HexColor("#bdbdbd")
-GRAY_600     = colors.HexColor("#757575")
-GRAY_800     = colors.HexColor("#424242")
-GRAY_900     = colors.HexColor("#212121")
-
-# Pie/chart fills — muted, distinguishable in B&W too
-PIE_COLORS = [
-    colors.HexColor("#5b9bd5"),  # steel blue
-    colors.HexColor("#ed7d31"),  # soft orange
-    colors.HexColor("#a5a5a5"),  # gray
-    colors.HexColor("#ffc000"),  # amber
-    colors.HexColor("#70ad47"),  # olive green
-    colors.HexColor("#4472c4"),  # darker blue
-    colors.HexColor("#c55a11"),  # brown
-    colors.HexColor("#7030a0"),  # purple
-]
-
-# ─── Helpers ──────────────────────────────────────────────────────────────────
-
-def find_latest_log(base_dir):
-    pattern = os.path.join(base_dir, "test-webserver-*.jsonl")
-    files = sorted(glob.glob(pattern))
-    if not files:
-        raise FileNotFoundError(f"No test-webserver log files found in {base_dir}")
-    return files[-1]
-
-
-def parse_log(path):
-    entries = []
-    with open(path, "r") as f:
-        for line in f:
-            line = line.strip()
-            if not line:
-                continue
-            try:
-                entries.append(json.loads(line))
-            except json.JSONDecodeError:
-                continue
-    return entries
-
-
-def fmt_ts(iso_str):
-    try:
-        dt = datetime.fromisoformat(iso_str.replace("Z", "+00:00"))
-        return dt.strftime("%Y-%m-%d %H:%M:%S UTC")
-    except Exception:
-        return str(iso_str)
-
-
-def duration_str(seconds):
-    if seconds < 60:
-        return f"{seconds:.1f}s"
-    minutes = seconds / 60
-    if minutes < 60:
-        return f"{minutes:.1f}m"
-    hours = minutes / 60
-    return f"{hours:.1f}h"
-
-
-def truncate(s, max_len=50):
-    s = str(s)
-    return s if len(s) <= max_len else s[: max_len - 3] + "..."
-
-
-def resolve_actor(entry):
-    """
-    Derive the actor exactly like testWebserver.ts does:
-      entityUpdatedBy ?? query.params.memberId ?? summary.memberId ?? "-"
-    The summary is already stored in request.summary in the log.
-    """
-    req = entry.get("request", {})
-    summary = req.get("summary") or {}
-    query = req.get("query") or {}
-    params = query.get("params") or {}
-
-    return str(
-        summary.get("entityUpdatedBy")
-        or params.get("memberId")
-        or summary.get("memberId")
-        or "-"
-    )
-
-
-# ─── Analysis ─────────────────────────────────────────────────────────────────
-
-def analyze(entries):
-    stats = {}
-
-    timestamps = []
-    for e in entries:
-        ts = e.get("timestamp")
-        if ts:
-            try:
-                timestamps.append(datetime.fromisoformat(ts.replace("Z", "+00:00")))
-            except Exception:
-                pass
-
-    timestamps.sort()
-    stats["total_entries"] = len(entries)
-    stats["first_ts"] = timestamps[0] if timestamps else None
-    stats["last_ts"] = timestamps[-1] if timestamps else None
-    stats["duration_seconds"] = (
-        (timestamps[-1] - timestamps[0]).total_seconds() if len(timestamps) >= 2 else 0
-    )
-
-    # Global counters
-    methods = Counter()
-    paths = Counter()
-    statuses = Counter()
-    actions = Counter()
-    types = Counter()
-    actors = Counter()
-    companies = Counter()
-    entity_ids = set()
-    stages = Counter()
-    ratings = Counter()
-    hourly_buckets = Counter()
-    minute_buckets = Counter()
-
-    for e in entries:
-        req = e.get("request", {})
-        resp = e.get("response", {})
-        bp = req.get("bodyParsed") or {}
-        entity = req.get("entityParsed") or bp.get("Entity") or {}
-
-        methods[req.get("method", "?")] += 1
-        raw_path = req.get("path", "?").split("?")[0]
-        paths[raw_path] += 1
-        statuses[resp.get("status", "?")] += 1
-        actions[bp.get("Action", "?")] += 1
-        types[bp.get("Type", "?")] += 1
-
-        actor = resolve_actor(e)
-        actors[actor] += 1
-
-        if isinstance(entity, dict):
-            cn = entity.get("CompanyName")
-            if cn:
-                companies[cn] += 1
-            eid = entity.get("Id")
-            if eid is not None:
-                entity_ids.add(eid)
-            stage = entity.get("StageName")
-            if stage:
-                stages[stage] += 1
-            rating = entity.get("Rating")
-            if rating:
-                ratings[rating] += 1
-
-        ts_str = e.get("timestamp")
-        if ts_str:
-            try:
-                dt = datetime.fromisoformat(ts_str.replace("Z", "+00:00"))
-                hourly_buckets[dt.strftime("%H:00")] += 1
-                minute_buckets[dt.strftime("%H:%M")] += 1
-            except Exception:
-                pass
-
-    # ── Per-actor deep stats ──
-    actor_details = defaultdict(lambda: {
-        "count": 0,
-        "actions": Counter(),
-        "types": Counter(),
-        "companies": Counter(),
-        "entity_ids": set(),
-        "stages": Counter(),
-        "ratings": Counter(),
-        "timestamps": [],
-        "statuses": Counter(),
-        "paths": Counter(),
-        "member_ids": Counter(),
-        "sales_reps": Counter(),
-        "total_estimated": 0.0,
-    })
-
-    for e in entries:
-        req = e.get("request", {})
-        resp = e.get("response", {})
-        bp = req.get("bodyParsed") or {}
-        entity = req.get("entityParsed") or bp.get("Entity") or {}
-        summary = req.get("summary") or {}
-
-        actor = resolve_actor(e)
-        ad = actor_details[actor]
-        ad["count"] += 1
-        ad["actions"][bp.get("Action", "?")] += 1
-        ad["types"][bp.get("Type", "?")] += 1
-        ad["statuses"][resp.get("status", "?")] += 1
-        raw_path = req.get("path", "?").split("?")[0]
-        ad["paths"][raw_path] += 1
-
-        # Track which MemberIds triggered callbacks for this actor
-        mid = bp.get("MemberId")
-        if mid:
-            ad["member_ids"][mid] += 1
-
-        ts_str = e.get("timestamp")
-        if ts_str:
-            try:
-                ad["timestamps"].append(datetime.fromisoformat(ts_str.replace("Z", "+00:00")))
-            except Exception:
-                pass
-
-        if isinstance(entity, dict):
-            cn = entity.get("CompanyName")
-            if cn:
-                ad["companies"][cn] += 1
-            eid = entity.get("Id")
-            if eid is not None:
-                ad["entity_ids"].add(eid)
-            stage = entity.get("StageName")
-            if stage:
-                ad["stages"][stage] += 1
-            rating = entity.get("Rating")
-            if rating:
-                ad["ratings"][rating] += 1
-            et = entity.get("EstimatedTotal")
-            if et is not None:
-                ad["total_estimated"] += float(et)
-            pr = entity.get("PrimarySalesRep")
-            if pr:
-                ad["sales_reps"][pr] += 1
-
-    # Compute per-actor derived stats
-    for aid, ad in actor_details.items():
-        ad["timestamps"].sort()
-        if len(ad["timestamps"]) >= 2:
-            dur = (ad["timestamps"][-1] - ad["timestamps"][0]).total_seconds()
-            ad["duration_seconds"] = dur
-            ad["events_per_minute"] = ad["count"] / (dur / 60) if dur > 0 else ad["count"]
-        else:
-            ad["duration_seconds"] = 0
-            ad["events_per_minute"] = ad["count"]
-        ad["first_ts"] = ad["timestamps"][0] if ad["timestamps"] else None
-        ad["last_ts"] = ad["timestamps"][-1] if ad["timestamps"] else None
-
-    stats["actor_details"] = dict(actor_details)
-    stats["methods"] = methods
-    stats["paths"] = paths
-    stats["statuses"] = statuses
-    stats["actions"] = actions
-    stats["types"] = types
-    stats["actors"] = actors
-    stats["companies"] = companies
-    stats["entity_ids"] = entity_ids
-    stats["stages"] = stages
-    stats["ratings"] = ratings
-    stats["hourly_buckets"] = hourly_buckets
-    stats["minute_buckets"] = minute_buckets
-
-    if stats["duration_seconds"] > 0:
-        stats["events_per_minute"] = len(entries) / (stats["duration_seconds"] / 60)
-    else:
-        stats["events_per_minute"] = len(entries)
-
-    return stats
-
-
-# ─── PDF building ─────────────────────────────────────────────────────────────
-
-def build_styles():
-    ss = getSampleStyleSheet()
-    ss.add(ParagraphStyle(
-        "ReportTitle", parent=ss["Title"], fontSize=24, textColor=WHITE,
-        spaceAfter=4, fontName="Helvetica-Bold", alignment=TA_CENTER,
-    ))
-    ss.add(ParagraphStyle(
-        "ReportSubtitle", parent=ss["Normal"], fontSize=11, textColor=GRAY_400,
-        spaceAfter=2, fontName="Helvetica", alignment=TA_CENTER,
-    ))
-    ss.add(ParagraphStyle(
-        "SectionHeader", parent=ss["Heading1"], fontSize=16, textColor=GRAY_900,
-        spaceBefore=14, spaceAfter=6, fontName="Helvetica-Bold",
-    ))
-    ss.add(ParagraphStyle(
-        "SubHeader", parent=ss["Heading2"], fontSize=12, textColor=GRAY_800,
-        spaceBefore=10, spaceAfter=4, fontName="Helvetica-Bold",
-    ))
-    ss.add(ParagraphStyle(
-        "BodyText2", parent=ss["Normal"], fontSize=9, textColor=GRAY_800,
-        spaceAfter=3, fontName="Helvetica", leading=13,
-    ))
-    ss.add(ParagraphStyle(
-        "SmallGray", parent=ss["Normal"], fontSize=8, textColor=GRAY_600,
-        spaceAfter=2, fontName="Helvetica",
-    ))
-    ss.add(ParagraphStyle(
-        "KPIValue", parent=ss["Normal"], fontSize=20, textColor=GRAY_900,
-        fontName="Helvetica-Bold", alignment=TA_CENTER, leading=24,
-    ))
-    ss.add(ParagraphStyle(
-        "KPILabel", parent=ss["Normal"], fontSize=8, textColor=GRAY_600,
-        fontName="Helvetica", alignment=TA_CENTER, spaceAfter=2,
-    ))
-    ss.add(ParagraphStyle(
-        "BannerText", parent=ss["Normal"], fontSize=9, textColor=WHITE,
-        fontName="Helvetica-Bold", spaceAfter=1,
-    ))
-    return ss
-
-
-def make_header_banner(ss, log_path, stats):
-    elements = []
-    fname = os.path.basename(log_path)
-    banner_data = [[
-        Paragraph("Webhook Log Report", ss["ReportTitle"]),
-    ], [
-        Paragraph(fname, ss["ReportSubtitle"]),
-    ], [
-        Paragraph(
-            f"Generated {datetime.now(timezone.utc).strftime('%Y-%m-%d %H:%M UTC')}",
-            ss["ReportSubtitle"],
-        ),
-    ]]
-    banner = Table(banner_data, colWidths=[7.0 * inch])
-    banner.setStyle(TableStyle([
-        ("BACKGROUND", (0, 0), (-1, -1), HEADER_BG),
-        ("ALIGN", (0, 0), (-1, -1), "CENTER"),
-        ("TOPPADDING", (0, 0), (0, 0), 20),
-        ("BOTTOMPADDING", (0, -1), (-1, -1), 16),
-        ("LEFTPADDING", (0, 0), (-1, -1), 20),
-        ("RIGHTPADDING", (0, 0), (-1, -1), 20),
-    ]))
-    elements.append(banner)
-    elements.append(Spacer(1, 14))
-    return elements
-
-
-def make_kpi_card(label, value):
-    ss = build_styles()
-    card_data = [[
-        Paragraph(str(value), ss["KPIValue"]),
-    ], [
-        Paragraph(label, ss["KPILabel"]),
-    ]]
-    card = Table(card_data, colWidths=[1.6 * inch], rowHeights=[28, 16])
-    card.setStyle(TableStyle([
-        ("BACKGROUND", (0, 0), (-1, -1), GRAY_100),
-        ("ALIGN", (0, 0), (-1, -1), "CENTER"),
-        ("VALIGN", (0, 0), (-1, -1), "MIDDLE"),
-        ("TOPPADDING", (0, 0), (-1, -1), 6),
-        ("BOTTOMPADDING", (0, 0), (-1, -1), 4),
-        ("BOX", (0, 0), (-1, -1), 0.5, GRAY_200),
-    ]))
-    return card
-
-
-def make_kpi_row(cards_data):
-    cards = [make_kpi_card(label, value) for label, value in cards_data]
-    row = Table([cards], colWidths=[1.75 * inch] * len(cards))
-    row.setStyle(TableStyle([
-        ("ALIGN", (0, 0), (-1, -1), "CENTER"),
-        ("VALIGN", (0, 0), (-1, -1), "TOP"),
-    ]))
-    return row
-
-
-def make_table(title, counter, ss, max_rows=15):
-    """Generic table from a Counter — light styling for print."""
-    elements = []
-    elements.append(Paragraph(title, ss["SubHeader"]))
-
-    items = counter.most_common(max_rows)
-    if not items:
-        elements.append(Paragraph("<i>No data</i>", ss["BodyText2"]))
-        return elements
-
-    total = sum(counter.values())
-    header = ["Item", "Count", "%"]
-    rows = [header]
-    for name, count in items:
-        pct = (count / total * 100) if total else 0
-        rows.append([truncate(str(name), 45), f"{count:,}", f"{pct:.1f}%"])
-
-    t = Table(rows, colWidths=[3.6 * inch, 1.0 * inch, 0.8 * inch])
-    t.setStyle(TableStyle([
-        ("BACKGROUND", (0, 0), (-1, 0), GRAY_800),
-        ("TEXTCOLOR", (0, 0), (-1, 0), WHITE),
-        ("FONTNAME", (0, 0), (-1, 0), "Helvetica-Bold"),
-        ("FONTSIZE", (0, 0), (-1, 0), 9),
-        ("FONTSIZE", (0, 1), (-1, -1), 9),
-        ("FONTNAME", (0, 1), (-1, -1), "Helvetica"),
-        ("BOTTOMPADDING", (0, 0), (-1, 0), 6),
-        ("TOPPADDING", (0, 0), (-1, 0), 6),
-        ("GRID", (0, 0), (-1, -1), 0.4, GRAY_200),
-        ("ROWBACKGROUNDS", (0, 1), (-1, -1), [WHITE, GRAY_50]),
-        ("ALIGN", (1, 0), (2, -1), "CENTER"),
-        ("VALIGN", (0, 0), (-1, -1), "MIDDLE"),
-        ("LEFTPADDING", (0, 0), (-1, -1), 8),
-        ("RIGHTPADDING", (0, 0), (-1, -1), 8),
-        ("TOPPADDING", (0, 1), (-1, -1), 3),
-        ("BOTTOMPADDING", (0, 1), (-1, -1), 3),
-    ]))
-    elements.append(t)
-    return elements
-
-
-def make_pie_chart(title, counter, width=280, height=190):
-    items = counter.most_common(8)
-    if not items:
-        return Spacer(1, 1)
-
-    d = Drawing(width, height)
-    d.add(String(width / 2, height - 12, title,
-                 fontSize=10, fontName="Helvetica-Bold",
-                 fillColor=GRAY_900, textAnchor="middle"))
-
-    pie = Pie()
-    pie.x = 50
-    pie.y = 10
-    pie.width = 110
-    pie.height = 110
-    pie.data = [v for _, v in items]
-    pie.labels = [truncate(str(k), 18) for k, _ in items]
-    pie.sideLabels = True
-    pie.slices.strokeWidth = 0.5
-    pie.slices.strokeColor = WHITE
-
-    for i in range(len(items)):
-        pie.slices[i].fillColor = PIE_COLORS[i % len(PIE_COLORS)]
-        pie.slices[i].fontName = "Helvetica"
-        pie.slices[i].fontSize = 7
-        pie.slices[i].labelRadius = 1.35
-
-    d.add(pie)
-    return d
-
-
-def make_timeline_chart(minute_buckets, width=500, height=150):
-    if not minute_buckets:
-        return Spacer(1, 1)
-
-    sorted_keys = sorted(minute_buckets.keys())
-    if len(sorted_keys) > 40:
-        step = max(1, len(sorted_keys) // 40)
-        sampled_keys = sorted_keys[::step]
-    else:
-        sampled_keys = sorted_keys
-
-    values = [minute_buckets[k] for k in sampled_keys]
-
-    d = Drawing(width, height)
-    d.add(String(width / 2, height - 10, "Event Timeline (by minute)",
-                 fontSize=10, fontName="Helvetica-Bold",
-                 fillColor=GRAY_900, textAnchor="middle"))
-
-    chart = VerticalBarChart()
-    chart.x = 50
-    chart.y = 25
-    chart.width = width - 80
-    chart.height = height - 50
-    chart.data = [values]
-    chart.categoryAxis.categoryNames = sampled_keys
-    chart.categoryAxis.labels.angle = 45
-    chart.categoryAxis.labels.fontSize = 6
-    chart.categoryAxis.labels.fontName = "Helvetica"
-    chart.categoryAxis.labels.dy = -5
-    chart.valueAxis.labels.fontSize = 7
-    chart.valueAxis.labels.fontName = "Helvetica"
-    chart.valueAxis.valueMin = 0
-    chart.bars[0].fillColor = GRAY_600
-    chart.bars[0].strokeColor = None
-    chart.barWidth = max(2, int((width - 100) / len(values) * 0.7))
-
-    d.add(chart)
-    return d
-
-
-def build_actor_activity_section(stats, ss):
-    """Per-actor deep-dive. Actor = entityUpdatedBy ?? query.memberId ?? summary.memberId."""
-    elements = []
-    elements.append(PageBreak())
-    elements.append(Paragraph("Actor Activity Deep Dive", ss["SectionHeader"]))
-    elements.append(HRFlowable(width="100%", thickness=1, color=GRAY_400, spaceAfter=4))
-    elements.append(Paragraph(
-        'The <b>actor</b> is resolved as: <i>entityUpdatedBy → query.memberId → summary.memberId</i>. '
-        'This is the person or system that caused the change in ConnectWise.',
-        ss["SmallGray"],
-    ))
-    elements.append(Spacer(1, 10))
-
-    actor_details = stats.get("actor_details", {})
-    if not actor_details:
-        elements.append(Paragraph("<i>No actor data available.</i>", ss["BodyText2"]))
-        return elements
-
-    sorted_actors = sorted(actor_details.items(), key=lambda x: -x[1]["count"])
-
-    # Actor distribution pie chart
-    actor_counter = Counter({aid: ad["count"] for aid, ad in sorted_actors})
-    elements.append(make_pie_chart("Events by Actor", actor_counter, width=350, height=210))
-    elements.append(Spacer(1, 10))
-
-    for idx, (aid, ad) in enumerate(sorted_actors):
-        # Actor header — slim dark bar
-        banner_data = [[
-            Paragraph(
-                f'<font size="12"><b>{aid}</b></font>'
-                f'&nbsp;&nbsp;&nbsp;'
-                f'<font size="9" color="#cccccc">{ad["count"]:,} events</font>',
-                ss["BannerText"],
-            ),
-        ]]
-        banner = Table(banner_data, colWidths=[7.0 * inch])
-        banner.setStyle(TableStyle([
-            ("BACKGROUND", (0, 0), (-1, -1), HEADER_BG),
-            ("TOPPADDING", (0, 0), (-1, -1), 7),
-            ("BOTTOMPADDING", (0, 0), (-1, -1), 7),
-            ("LEFTPADDING", (0, 0), (-1, -1), 12),
-        ]))
-        elements.append(banner)
-
-        # KPI row
-        kpi = make_kpi_row([
-            ("Events", f"{ad['count']:,}"),
-            ("Entities", f"{len(ad['entity_ids']):,}"),
-            ("Companies", f"{len(ad['companies']):,}"),
-            ("Evts/Min", f"{ad['events_per_minute']:.1f}"),
-        ])
-        elements.append(kpi)
-        elements.append(Spacer(1, 4))
-
-        # Info grid
-        first_str = ad["first_ts"].strftime("%Y-%m-%d %H:%M:%S") if ad["first_ts"] else "—"
-        last_str = ad["last_ts"].strftime("%Y-%m-%d %H:%M:%S") if ad["last_ts"] else "—"
-        dur = duration_str(ad["duration_seconds"])
-        est = ad["total_estimated"]
-
-        mid_str = ", ".join(f"{k} ({v})" for k, v in ad["member_ids"].most_common(5)) if ad["member_ids"] else "—"
-        sr_str = ", ".join(f"{k} ({v})" for k, v in ad["sales_reps"].most_common(5)) if ad["sales_reps"] else "—"
-
-        info_rows = [
-            [
-                Paragraph('<font color="#757575">First Event</font>', ss["BodyText2"]),
-                Paragraph(f'<b>{first_str}</b>', ss["BodyText2"]),
-                Paragraph('<font color="#757575">Last Event</font>', ss["BodyText2"]),
-                Paragraph(f'<b>{last_str}</b>', ss["BodyText2"]),
-            ],
-            [
-                Paragraph('<font color="#757575">Active Duration</font>', ss["BodyText2"]),
-                Paragraph(f'<b>{dur}</b>', ss["BodyText2"]),
-                Paragraph('<font color="#757575">Total Est. Value</font>', ss["BodyText2"]),
-                Paragraph(f'<b>${est:,.2f}</b>', ss["BodyText2"]),
-            ],
-            [
-                Paragraph('<font color="#757575">Callback Members</font>', ss["BodyText2"]),
-                Paragraph(f'{truncate(mid_str, 40)}', ss["BodyText2"]),
-                Paragraph('<font color="#757575">Sales Reps</font>', ss["BodyText2"]),
-                Paragraph(f'{truncate(sr_str, 40)}', ss["BodyText2"]),
-            ],
-        ]
-        info_table = Table(info_rows, colWidths=[1.3 * inch, 2.1 * inch, 1.3 * inch, 2.1 * inch])
-        info_table.setStyle(TableStyle([
-            ("BACKGROUND", (0, 0), (-1, -1), GRAY_50),
-            ("TOPPADDING", (0, 0), (-1, -1), 4),
-            ("BOTTOMPADDING", (0, 0), (-1, -1), 4),
-            ("LEFTPADDING", (0, 0), (-1, -1), 8),
-            ("GRID", (0, 0), (-1, -1), 0.3, GRAY_200),
-        ]))
-        elements.append(info_table)
-        elements.append(Spacer(1, 6))
-
-        # Breakdown tables
-        if ad["types"]:
-            elements.extend(make_table(f"{aid} — Entity Types", ad["types"], ss, max_rows=8))
-            elements.append(Spacer(1, 6))
-
-        if ad["companies"]:
-            elements.extend(make_table(f"{aid} — Companies", ad["companies"], ss, max_rows=10))
-            elements.append(Spacer(1, 6))
-
-        if ad["stages"]:
-            elements.extend(make_table(f"{aid} — Stages", ad["stages"], ss, max_rows=8))
-            elements.append(Spacer(1, 6))
-
-        if ad["ratings"]:
-            elements.extend(make_table(f"{aid} — Ratings", ad["ratings"], ss, max_rows=8))
-            elements.append(Spacer(1, 6))
-
-        # Entity IDs
-        if ad["entity_ids"]:
-            id_list = sorted(ad["entity_ids"])
-            id_str = ", ".join(str(i) for i in id_list[:30])
-            if len(id_list) > 30:
-                id_str += f" ... (+{len(id_list) - 30} more)"
-            elements.append(Paragraph(f"{aid} — Entity IDs Touched", ss["SubHeader"]))
-            elements.append(Paragraph(f'<font size="8">{id_str}</font>', ss["BodyText2"]))
-            elements.append(Spacer(1, 6))
-
-        # Divider
-        if idx < len(sorted_actors) - 1:
-            elements.append(Spacer(1, 4))
-            elements.append(HRFlowable(width="100%", thickness=0.5, color=GRAY_200, spaceAfter=4))
-            elements.append(Spacer(1, 4))
-
-    return elements
-
-
-def build_summary_log_table(entries, ss, max_rows=30):
-    elements = []
-    elements.append(PageBreak())
-    elements.append(Paragraph("Event Summary", ss["SectionHeader"]))
-    elements.append(HRFlowable(width="100%", thickness=1, color=GRAY_400, spaceAfter=6))
-    elements.append(Paragraph(
-        f"Aggregated view of {len(entries):,} webhook events — grouped by entity.",
-        ss["SmallGray"],
-    ))
-    elements.append(Spacer(1, 8))
-
-    entity_groups = defaultdict(lambda: {
-        "count": 0, "name": "—", "company": "—",
-        "actions": Counter(), "actors": set(),
-        "est_total": None,
-    })
-
-    for e in entries:
-        req = e.get("request", {})
-        bp = req.get("bodyParsed") or {}
-        entity = req.get("entityParsed") or bp.get("Entity") or {}
-        if not isinstance(entity, dict):
-            continue
-        eid = entity.get("Id")
-        if eid is None:
-            continue
-
-        eg = entity_groups[eid]
-        eg["count"] += 1
-        eg["name"] = entity.get("OpportunityName") or entity.get("CompanyName") or eg["name"]
-        eg["company"] = entity.get("CompanyName") or eg["company"]
-        eg["actions"][bp.get("Action", "?")] += 1
-        actor = resolve_actor(e)
-        eg["actors"].add(actor)
-        et = entity.get("EstimatedTotal")
-        if et is not None:
-            eg["est_total"] = et
-
-    sorted_entities = sorted(entity_groups.items(), key=lambda x: -x[1]["count"])
-
-    header = ["ID", "Entity Name", "Company", "Events", "Actions", "Actors", "Est. Total"]
-    rows = [header]
-
-    for eid, eg in sorted_entities[:max_rows]:
-        actions_str = ", ".join(f"{a}({c})" for a, c in eg["actions"].most_common(3))
-        actors_str = ", ".join(sorted(eg["actors"]))
-        total_str = f"${eg['est_total']:,.2f}" if eg["est_total"] is not None else "—"
-        rows.append([
-            str(eid),
-            truncate(eg["name"], 28),
-            truncate(eg["company"], 18),
-            f"{eg['count']:,}",
-            truncate(actions_str, 24),
-            truncate(actors_str, 18),
-            total_str,
-        ])
-
-    t = Table(rows, colWidths=[0.45 * inch, 1.7 * inch, 1.1 * inch, 0.55 * inch, 1.2 * inch, 1.0 * inch, 0.8 * inch])
-    t.setStyle(TableStyle([
-        ("BACKGROUND", (0, 0), (-1, 0), GRAY_800),
-        ("TEXTCOLOR", (0, 0), (-1, 0), WHITE),
-        ("FONTNAME", (0, 0), (-1, 0), "Helvetica-Bold"),
-        ("FONTSIZE", (0, 0), (-1, 0), 8),
-        ("FONTSIZE", (0, 1), (-1, -1), 8),
-        ("FONTNAME", (0, 1), (-1, -1), "Helvetica"),
-        ("GRID", (0, 0), (-1, -1), 0.3, GRAY_200),
-        ("ROWBACKGROUNDS", (0, 1), (-1, -1), [WHITE, GRAY_50]),
-        ("ALIGN", (0, 0), (0, -1), "CENTER"),
-        ("ALIGN", (3, 0), (3, -1), "CENTER"),
-        ("VALIGN", (0, 0), (-1, -1), "MIDDLE"),
-        ("LEFTPADDING", (0, 0), (-1, -1), 5),
-        ("RIGHTPADDING", (0, 0), (-1, -1), 5),
-        ("TOPPADDING", (0, 1), (-1, -1), 2),
-        ("BOTTOMPADDING", (0, 1), (-1, -1), 2),
-    ]))
-    elements.append(t)
-
-    if len(sorted_entities) > max_rows:
-        elements.append(Spacer(1, 4))
-        elements.append(Paragraph(
-            f'Showing top {max_rows} of {len(sorted_entities)} entities.',
-            ss["SmallGray"],
-        ))
-
-    return elements
-
-
-def add_page_number(canvas, doc):
-    canvas.saveState()
-    canvas.setFillColor(GRAY_800)
-    canvas.rect(0, 0, LETTER[0], 22, fill=1, stroke=0)
-    canvas.setFillColor(WHITE)
-    canvas.setFont("Helvetica", 7)
-    canvas.drawCentredString(LETTER[0] / 2, 8, f"Page {doc.page}")
-    canvas.setFillColor(GRAY_400)
-    canvas.setFont("Helvetica", 7)
-    canvas.drawString(30, 8, "Optima API · Webhook Log Report")
-    canvas.drawRightString(LETTER[0] - 30, 8, datetime.now(timezone.utc).strftime("%Y-%m-%d"))
-    canvas.restoreState()
-
-
-# ─── Main ─────────────────────────────────────────────────────────────────────
-
-def main():
-    script_dir = os.path.dirname(os.path.abspath(__file__))
-    log_dir = os.path.join(script_dir, "..", "cw-api-logs")
-
-    if len(sys.argv) > 1:
-        log_path = sys.argv[1]
-    else:
-        log_path = find_latest_log(log_dir)
-
-    print(f"📄 Reading log: {log_path}")
-    entries = parse_log(log_path)
-    print(f"   → {len(entries)} entries parsed")
-
-    stats = analyze(entries)
-    ss = build_styles()
-
-    log_basename = os.path.splitext(os.path.basename(log_path))[0]
-    out_path = os.path.join(script_dir, "..", "cw-api-logs", f"{log_basename}-report.pdf")
-
-    doc = SimpleDocTemplate(
-        out_path,
-        pagesize=LETTER,
-        leftMargin=0.6 * inch,
-        rightMargin=0.6 * inch,
-        topMargin=0.5 * inch,
-        bottomMargin=0.5 * inch,
-    )
-
-    elements = []
-
-    # ── Title Banner ──
-    elements.extend(make_header_banner(ss, log_path, stats))
-
-    # ── Overview ──
-    elements.append(Paragraph("Overview", ss["SectionHeader"]))
-    elements.append(HRFlowable(width="100%", thickness=1, color=GRAY_400, spaceAfter=10))
-
-    elements.append(make_kpi_row([
-        ("Total Events", f"{stats['total_entries']:,}"),
-        ("Unique Entities", f"{len(stats['entity_ids']):,}"),
-        ("Companies", f"{len(stats['companies']):,}"),
-        ("Duration", duration_str(stats["duration_seconds"])),
-    ]))
-    elements.append(Spacer(1, 8))
-    elements.append(make_kpi_row([
-        ("Events / Min", f"{stats['events_per_minute']:.1f}"),
-        ("HTTP Methods", f"{len(stats['methods']):,}"),
-        ("Action Types", f"{len(stats['actions']):,}"),
-        ("Actors", f"{len(stats['actors']):,}"),
-    ]))
-    elements.append(Spacer(1, 12))
-
-    # Time range
-    if stats["first_ts"] and stats["last_ts"]:
-        info = [
-            [
-                Paragraph('<font color="#757575">First Event</font>', ss["BodyText2"]),
-                Paragraph(f'<b>{stats["first_ts"].strftime("%Y-%m-%d %H:%M:%S UTC")}</b>', ss["BodyText2"]),
-                Paragraph('<font color="#757575">Last Event</font>', ss["BodyText2"]),
-                Paragraph(f'<b>{stats["last_ts"].strftime("%Y-%m-%d %H:%M:%S UTC")}</b>', ss["BodyText2"]),
-            ]
-        ]
-        ti = Table(info, colWidths=[1.2 * inch, 2.4 * inch, 1.2 * inch, 2.4 * inch])
-        ti.setStyle(TableStyle([
-            ("BACKGROUND", (0, 0), (-1, -1), GRAY_50),
-            ("TOPPADDING", (0, 0), (-1, -1), 5),
-            ("BOTTOMPADDING", (0, 0), (-1, -1), 5),
-            ("LEFTPADDING", (0, 0), (-1, -1), 8),
-            ("BOX", (0, 0), (-1, -1), 0.4, GRAY_200),
-        ]))
-        elements.append(ti)
-        elements.append(Spacer(1, 14))
-
-    # ── Charts ──
-    elements.append(Paragraph("Visual Breakdown", ss["SectionHeader"]))
-    elements.append(HRFlowable(width="100%", thickness=1, color=GRAY_400, spaceAfter=10))
-
-    elements.append(make_timeline_chart(stats["minute_buckets"]))
-    elements.append(Spacer(1, 12))
-
-    pie_row = [[
-        make_pie_chart("By Action", stats["actions"]),
-        make_pie_chart("By Type", stats["types"]),
-    ]]
-    pt = Table(pie_row, colWidths=[3.5 * inch, 3.5 * inch])
-    pt.setStyle(TableStyle([
-        ("ALIGN", (0, 0), (-1, -1), "CENTER"),
-        ("VALIGN", (0, 0), (-1, -1), "TOP"),
-    ]))
-    elements.append(pt)
-    elements.append(Spacer(1, 6))
-
-    if len(stats["stages"]) > 1 or len(stats["ratings"]) > 1:
-        pie_row2 = [[
-            make_pie_chart("By Stage", stats["stages"]),
-            make_pie_chart("By Rating", stats["ratings"]),
-        ]]
-        pt2 = Table(pie_row2, colWidths=[3.5 * inch, 3.5 * inch])
-        pt2.setStyle(TableStyle([
-            ("ALIGN", (0, 0), (-1, -1), "CENTER"),
-            ("VALIGN", (0, 0), (-1, -1), "TOP"),
-        ]))
-        elements.append(pt2)
-
-    # Actor pie chart
-    elements.append(Spacer(1, 6))
-    elements.append(make_pie_chart("By Actor", stats["actors"], width=350, height=210))
-
-    # ── General Information ──
-    elements.append(PageBreak())
-    elements.append(Paragraph("General Information", ss["SectionHeader"]))
-    elements.append(HRFlowable(width="100%", thickness=1, color=GRAY_400, spaceAfter=10))
-
-    elements.extend(make_table("Response Status Codes", stats["statuses"], ss))
-    elements.append(Spacer(1, 10))
-    elements.extend(make_table("HTTP Methods", stats["methods"], ss))
-    elements.append(Spacer(1, 10))
-    elements.extend(make_table("Webhook Actions", stats["actions"], ss))
-    elements.append(Spacer(1, 10))
-    elements.extend(make_table("Entity Types", stats["types"], ss))
-    elements.append(Spacer(1, 10))
-    elements.extend(make_table("Request Paths", stats["paths"], ss))
-    elements.append(Spacer(1, 10))
-    elements.extend(make_table("Actors", stats["actors"], ss))
-    elements.append(Spacer(1, 10))
-
-    if stats["companies"]:
-        elements.extend(make_table("Companies", stats["companies"], ss))
-        elements.append(Spacer(1, 10))
-    if stats["stages"]:
-        elements.extend(make_table("Opportunity Stages", stats["stages"], ss))
-        elements.append(Spacer(1, 10))
-    if stats["ratings"]:
-        elements.extend(make_table("Opportunity Ratings", stats["ratings"], ss))
-        elements.append(Spacer(1, 10))
-
-    elements.extend(make_table("Hourly Distribution", stats["hourly_buckets"], ss))
-
-    # ── Actor Deep Dive ──
-    elements.extend(build_actor_activity_section(stats, ss))
-
-    # ── Entity Summary ──
-    elements.extend(build_summary_log_table(entries, ss, max_rows=30))
-
-    # Build
-    doc.build(elements, onFirstPage=add_page_number, onLaterPages=add_page_number)
-    print(f"✅ Report generated: {out_path}")
-    print(f"   File size: {os.path.getsize(out_path) / 1024:.1f} KB")
-
-
-if __name__ == "__main__":
-    main()

e2e/demo.test.ts

@@ -0,0 +1,6 @@
+import { expect, test } from '@playwright/test';
+
+test('home page has expected h1', async ({ page }) => {
+	await page.goto('/');
+	await expect(page.locator('h1')).toBeVisible();
+});

electron/main.ts

@@ -0,0 +1,54 @@
+import { app, BrowserWindow } from "electron";
+import path from "node:path";
+import started from "electron-squirrel-startup";
+
+// Handle creating/removing shortcuts on Windows when installing/uninstalling.
+if (started) {
+  app.quit();
+}
+
+const PRODUCTION_URL = "https://optima.osdci.net";
+
+const createWindow = () => {
+  const mainWindow = new BrowserWindow({
+    width: 1200,
+    height: 800,
+    webPreferences: {
+      preload: path.join(import.meta.dirname, "preload.js"),
+    },
+  });
+
+  if (MAIN_WINDOW_VITE_DEV_SERVER_URL) {
+    mainWindow.loadURL(`${MAIN_WINDOW_VITE_DEV_SERVER_URL}/login`);
+    mainWindow.webContents.on("did-frame-finish-load", () => {
+      mainWindow.webContents.openDevTools({ mode: "detach" });
+    });
+  } else {
+    mainWindow.loadURL(PRODUCTION_URL);
+  }
+};
+
+// This method will be called when Electron has finished
+// initialization and is ready to create browser windows.
+// Some APIs can only be used after this event occurs.
+app.on("ready", createWindow);
+
+// Quit when all windows are closed, except on macOS. There, it's common
+// for applications and their menu bar to stay active until the user quits
+// explicitly with Cmd + Q.
+app.on("window-all-closed", () => {
+  if (process.platform !== "darwin") {
+    app.quit();
+  }
+});
+
+app.on("activate", () => {
+  // On OS X it's common to re-create a window in the app when the
+  // dock icon is clicked and there are no other windows open.
+  if (BrowserWindow.getAllWindows().length === 0) {
+    createWindow();
+  }
+});
+
+// In this file you can include the rest of your app's specific main process
+// code. You can also put them in separate files and import them here.

forge.config.ts

@@ -0,0 +1,61 @@
+import type { ForgeConfig } from "@electron-forge/shared-types";
+import { MakerSquirrel } from "@electron-forge/maker-squirrel";
+import { MakerZIP } from "@electron-forge/maker-zip";
+import { MakerDMG } from "@electron-forge/maker-dmg";
+import { MakerDeb } from "@electron-forge/maker-deb";
+import { MakerRpm } from "@electron-forge/maker-rpm";
+import { VitePlugin } from "@electron-forge/plugin-vite";
+import { FusesPlugin } from "@electron-forge/plugin-fuses";
+import { FuseV1Options, FuseVersion } from "@electron/fuses";
+
+const config: ForgeConfig = {
+  packagerConfig: {
+    asar: true,
+  },
+  rebuildConfig: {},
+  makers: [
+    new MakerSquirrel({}),
+    new MakerZIP({}, ["darwin"]),
+    new MakerDMG({}),
+    new MakerRpm({}),
+    new MakerDeb({}),
+  ],
+  plugins: [
+    new VitePlugin({
+      // `build` can specify multiple entry builds, which can be Main process, Preload scripts, Worker process, etc.
+      // If you are familiar with Vite configuration, it will look really familiar.
+      build: [
+        {
+          // `entry` is just an alias for `build.lib.entry` in the corresponding file of `config`.
+          entry: "electron/main.ts",
+          config: "vite.main.config.ts",
+          target: "main",
+        },
+        {
+          entry: "electron/preload.ts",
+          config: "vite.preload.config.ts",
+          target: "preload",
+        },
+      ],
+      renderer: [
+        {
+          name: "main_window",
+          config: "vite.config.ts",
+        },
+      ],
+    }),
+    // Fuses are used to enable/disable various Electron functionality
+    // at package time, before code signing the application
+    new FusesPlugin({
+      version: FuseVersion.V1,
+      [FuseV1Options.RunAsNode]: false,
+      [FuseV1Options.EnableCookieEncryption]: true,
+      [FuseV1Options.EnableNodeOptionsEnvironmentVariable]: false,
+      [FuseV1Options.EnableNodeCliInspectArguments]: false,
+      [FuseV1Options.EnableEmbeddedAsarIntegrityValidation]: true,
+      [FuseV1Options.OnlyLoadAppFromAsar]: true,
+    }),
+  ],
+};
+
+export default config;

forge.env.d.ts

@@ -0,0 +1 @@
+/// <reference types="@electron-forge/plugin-vite/forge-vite-env" />

generated/prisma/browser.ts

@@ -1,79 +0,0 @@
-
-/* !!! This is code generated by Prisma. Do not edit directly. !!! */
-/* eslint-disable */
-// biome-ignore-all lint: generated file
-// @ts-nocheck 
-/*
- * This file should be your main import to use Prisma-related types and utilities in a browser. 
- * Use it to get access to models, enums, and input types.
- * 
- * This file does not contain a `PrismaClient` class, nor several other helpers that are intended as server-side only.
- * See `client.ts` for the standard, server-side entry point.
- *
- * 🟢 You can import this file directly.
- */
-
-import * as Prisma from './internal/prismaNamespaceBrowser.ts'
-export { Prisma }
-export * as $Enums from './enums.ts'
-export * from './enums.ts';
-/**
- * Model Session
- * 
- */
-export type Session = Prisma.SessionModel
-/**
- * Model User
- * 
- */
-export type User = Prisma.UserModel
-/**
- * Model Role
- * 
- */
-export type Role = Prisma.RoleModel
-/**
- * Model UnifiSite
- * 
- */
-export type UnifiSite = Prisma.UnifiSiteModel
-/**
- * Model Company
- * 
- */
-export type Company = Prisma.CompanyModel
-/**
- * Model CatalogItem
- * 
- */
-export type CatalogItem = Prisma.CatalogItemModel
-/**
- * Model Opportunity
- * 
- */
-export type Opportunity = Prisma.OpportunityModel
-/**
- * Model CredentialType
- * 
- */
-export type CredentialType = Prisma.CredentialTypeModel
-/**
- * Model SecureValue
- * 
- */
-export type SecureValue = Prisma.SecureValueModel
-/**
- * Model Credential
- * 
- */
-export type Credential = Prisma.CredentialModel
-/**
- * Model GeneratedQuotes
- * 
- */
-export type GeneratedQuotes = Prisma.GeneratedQuotesModel
-/**
- * Model CwMember
- * 
- */
-export type CwMember = Prisma.CwMemberModel

generated/prisma/client.ts

@@ -1,101 +0,0 @@
-
-/* !!! This is code generated by Prisma. Do not edit directly. !!! */
-/* eslint-disable */
-// biome-ignore-all lint: generated file
-// @ts-nocheck 
-/*
- * This file should be your main import to use Prisma. Through it you get access to all the models, enums, and input types.
- * If you're looking for something you can import in the client-side of your application, please refer to the `browser.ts` file instead.
- *
- * 🟢 You can import this file directly.
- */
-
-import * as process from 'node:process'
-import * as path from 'node:path'
-import { fileURLToPath } from 'node:url'
-globalThis['__dirname'] = path.dirname(fileURLToPath(import.meta.url))
-
-import * as runtime from "@prisma/client/runtime/client"
-import * as $Enums from "./enums.ts"
-import * as $Class from "./internal/class.ts"
-import * as Prisma from "./internal/prismaNamespace.ts"
-
-export * as $Enums from './enums.ts'
-export * from "./enums.ts"
-/**
- * ## Prisma Client
- * 
- * Type-safe database client for TypeScript
- * @example
- * ```
- * const prisma = new PrismaClient()
- * // Fetch zero or more Sessions
- * const sessions = await prisma.session.findMany()
- * ```
- * 
- * Read more in our [docs](https://pris.ly/d/client).
- */
-export const PrismaClient = $Class.getPrismaClientClass()
-export type PrismaClient<LogOpts extends Prisma.LogLevel = never, OmitOpts extends Prisma.PrismaClientOptions["omit"] = Prisma.PrismaClientOptions["omit"], ExtArgs extends runtime.Types.Extensions.InternalArgs = runtime.Types.Extensions.DefaultArgs> = $Class.PrismaClient<LogOpts, OmitOpts, ExtArgs>
-export { Prisma }
-
-/**
- * Model Session
- * 
- */
-export type Session = Prisma.SessionModel
-/**
- * Model User
- * 
- */
-export type User = Prisma.UserModel
-/**
- * Model Role
- * 
- */
-export type Role = Prisma.RoleModel
-/**
- * Model UnifiSite
- * 
- */
-export type UnifiSite = Prisma.UnifiSiteModel
-/**
- * Model Company
- * 
- */
-export type Company = Prisma.CompanyModel
-/**
- * Model CatalogItem
- * 
- */
-export type CatalogItem = Prisma.CatalogItemModel
-/**
- * Model Opportunity
- * 
- */
-export type Opportunity = Prisma.OpportunityModel
-/**
- * Model CredentialType
- * 
- */
-export type CredentialType = Prisma.CredentialTypeModel
-/**
- * Model SecureValue
- * 
- */
-export type SecureValue = Prisma.SecureValueModel
-/**
- * Model Credential
- * 
- */
-export type Credential = Prisma.CredentialModel
-/**
- * Model GeneratedQuotes
- * 
- */
-export type GeneratedQuotes = Prisma.GeneratedQuotesModel
-/**
- * Model CwMember
- * 
- */
-export type CwMember = Prisma.CwMemberModel

generated/prisma/commonInputTypes.ts

@@ -1,558 +0,0 @@
-
-/* !!! This is code generated by Prisma. Do not edit directly. !!! */
-/* eslint-disable */
-// biome-ignore-all lint: generated file
-// @ts-nocheck 
-/*
- * This file exports various common sort, input & filter types that are not directly linked to a particular model.
- *
- * 🟢 You can import this file directly.
- */
-
-import type * as runtime from "@prisma/client/runtime/client"
-import * as $Enums from "./enums.ts"
-import type * as Prisma from "./internal/prismaNamespace.ts"
-
-
-export type StringFilter<$PrismaModel = never> = {
-  equals?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  in?: string[] | Prisma.ListStringFieldRefInput<$PrismaModel>
-  notIn?: string[] | Prisma.ListStringFieldRefInput<$PrismaModel>
-  lt?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  lte?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  gt?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  gte?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  contains?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  startsWith?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  endsWith?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  mode?: Prisma.QueryMode
-  not?: Prisma.NestedStringFilter<$PrismaModel> | string
-}
-
-export type DateTimeFilter<$PrismaModel = never> = {
-  equals?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  in?: Date[] | string[] | Prisma.ListDateTimeFieldRefInput<$PrismaModel>
-  notIn?: Date[] | string[] | Prisma.ListDateTimeFieldRefInput<$PrismaModel>
-  lt?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  lte?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  gt?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  gte?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  not?: Prisma.NestedDateTimeFilter<$PrismaModel> | Date | string
-}
-
-export type BoolFilter<$PrismaModel = never> = {
-  equals?: boolean | Prisma.BooleanFieldRefInput<$PrismaModel>
-  not?: Prisma.NestedBoolFilter<$PrismaModel> | boolean
-}
-
-export type DateTimeNullableFilter<$PrismaModel = never> = {
-  equals?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel> | null
-  in?: Date[] | string[] | Prisma.ListDateTimeFieldRefInput<$PrismaModel> | null
-  notIn?: Date[] | string[] | Prisma.ListDateTimeFieldRefInput<$PrismaModel> | null
-  lt?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  lte?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  gt?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  gte?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  not?: Prisma.NestedDateTimeNullableFilter<$PrismaModel> | Date | string | null
-}
-
-export type SortOrderInput = {
-  sort: Prisma.SortOrder
-  nulls?: Prisma.NullsOrder
-}
-
-export type StringWithAggregatesFilter<$PrismaModel = never> = {
-  equals?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  in?: string[] | Prisma.ListStringFieldRefInput<$PrismaModel>
-  notIn?: string[] | Prisma.ListStringFieldRefInput<$PrismaModel>
-  lt?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  lte?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  gt?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  gte?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  contains?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  startsWith?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  endsWith?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  mode?: Prisma.QueryMode
-  not?: Prisma.NestedStringWithAggregatesFilter<$PrismaModel> | string
-  _count?: Prisma.NestedIntFilter<$PrismaModel>
-  _min?: Prisma.NestedStringFilter<$PrismaModel>
-  _max?: Prisma.NestedStringFilter<$PrismaModel>
-}
-
-export type DateTimeWithAggregatesFilter<$PrismaModel = never> = {
-  equals?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  in?: Date[] | string[] | Prisma.ListDateTimeFieldRefInput<$PrismaModel>
-  notIn?: Date[] | string[] | Prisma.ListDateTimeFieldRefInput<$PrismaModel>
-  lt?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  lte?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  gt?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  gte?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  not?: Prisma.NestedDateTimeWithAggregatesFilter<$PrismaModel> | Date | string
-  _count?: Prisma.NestedIntFilter<$PrismaModel>
-  _min?: Prisma.NestedDateTimeFilter<$PrismaModel>
-  _max?: Prisma.NestedDateTimeFilter<$PrismaModel>
-}
-
-export type BoolWithAggregatesFilter<$PrismaModel = never> = {
-  equals?: boolean | Prisma.BooleanFieldRefInput<$PrismaModel>
-  not?: Prisma.NestedBoolWithAggregatesFilter<$PrismaModel> | boolean
-  _count?: Prisma.NestedIntFilter<$PrismaModel>
-  _min?: Prisma.NestedBoolFilter<$PrismaModel>
-  _max?: Prisma.NestedBoolFilter<$PrismaModel>
-}
-
-export type DateTimeNullableWithAggregatesFilter<$PrismaModel = never> = {
-  equals?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel> | null
-  in?: Date[] | string[] | Prisma.ListDateTimeFieldRefInput<$PrismaModel> | null
-  notIn?: Date[] | string[] | Prisma.ListDateTimeFieldRefInput<$PrismaModel> | null
-  lt?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  lte?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  gt?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  gte?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  not?: Prisma.NestedDateTimeNullableWithAggregatesFilter<$PrismaModel> | Date | string | null
-  _count?: Prisma.NestedIntNullableFilter<$PrismaModel>
-  _min?: Prisma.NestedDateTimeNullableFilter<$PrismaModel>
-  _max?: Prisma.NestedDateTimeNullableFilter<$PrismaModel>
-}
-
-export type StringNullableFilter<$PrismaModel = never> = {
-  equals?: string | Prisma.StringFieldRefInput<$PrismaModel> | null
-  in?: string[] | Prisma.ListStringFieldRefInput<$PrismaModel> | null
-  notIn?: string[] | Prisma.ListStringFieldRefInput<$PrismaModel> | null
-  lt?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  lte?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  gt?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  gte?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  contains?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  startsWith?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  endsWith?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  mode?: Prisma.QueryMode
-  not?: Prisma.NestedStringNullableFilter<$PrismaModel> | string | null
-}
-
-export type StringNullableWithAggregatesFilter<$PrismaModel = never> = {
-  equals?: string | Prisma.StringFieldRefInput<$PrismaModel> | null
-  in?: string[] | Prisma.ListStringFieldRefInput<$PrismaModel> | null
-  notIn?: string[] | Prisma.ListStringFieldRefInput<$PrismaModel> | null
-  lt?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  lte?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  gt?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  gte?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  contains?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  startsWith?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  endsWith?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  mode?: Prisma.QueryMode
-  not?: Prisma.NestedStringNullableWithAggregatesFilter<$PrismaModel> | string | null
-  _count?: Prisma.NestedIntNullableFilter<$PrismaModel>
-  _min?: Prisma.NestedStringNullableFilter<$PrismaModel>
-  _max?: Prisma.NestedStringNullableFilter<$PrismaModel>
-}
-
-export type IntFilter<$PrismaModel = never> = {
-  equals?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  in?: number[] | Prisma.ListIntFieldRefInput<$PrismaModel>
-  notIn?: number[] | Prisma.ListIntFieldRefInput<$PrismaModel>
-  lt?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  lte?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  gt?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  gte?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  not?: Prisma.NestedIntFilter<$PrismaModel> | number
-}
-
-export type IntWithAggregatesFilter<$PrismaModel = never> = {
-  equals?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  in?: number[] | Prisma.ListIntFieldRefInput<$PrismaModel>
-  notIn?: number[] | Prisma.ListIntFieldRefInput<$PrismaModel>
-  lt?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  lte?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  gt?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  gte?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  not?: Prisma.NestedIntWithAggregatesFilter<$PrismaModel> | number
-  _count?: Prisma.NestedIntFilter<$PrismaModel>
-  _avg?: Prisma.NestedFloatFilter<$PrismaModel>
-  _sum?: Prisma.NestedIntFilter<$PrismaModel>
-  _min?: Prisma.NestedIntFilter<$PrismaModel>
-  _max?: Prisma.NestedIntFilter<$PrismaModel>
-}
-
-export type IntNullableFilter<$PrismaModel = never> = {
-  equals?: number | Prisma.IntFieldRefInput<$PrismaModel> | null
-  in?: number[] | Prisma.ListIntFieldRefInput<$PrismaModel> | null
-  notIn?: number[] | Prisma.ListIntFieldRefInput<$PrismaModel> | null
-  lt?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  lte?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  gt?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  gte?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  not?: Prisma.NestedIntNullableFilter<$PrismaModel> | number | null
-}
-
-export type FloatFilter<$PrismaModel = never> = {
-  equals?: number | Prisma.FloatFieldRefInput<$PrismaModel>
-  in?: number[] | Prisma.ListFloatFieldRefInput<$PrismaModel>
-  notIn?: number[] | Prisma.ListFloatFieldRefInput<$PrismaModel>
-  lt?: number | Prisma.FloatFieldRefInput<$PrismaModel>
-  lte?: number | Prisma.FloatFieldRefInput<$PrismaModel>
-  gt?: number | Prisma.FloatFieldRefInput<$PrismaModel>
-  gte?: number | Prisma.FloatFieldRefInput<$PrismaModel>
-  not?: Prisma.NestedFloatFilter<$PrismaModel> | number
-}
-
-export type IntNullableWithAggregatesFilter<$PrismaModel = never> = {
-  equals?: number | Prisma.IntFieldRefInput<$PrismaModel> | null
-  in?: number[] | Prisma.ListIntFieldRefInput<$PrismaModel> | null
-  notIn?: number[] | Prisma.ListIntFieldRefInput<$PrismaModel> | null
-  lt?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  lte?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  gt?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  gte?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  not?: Prisma.NestedIntNullableWithAggregatesFilter<$PrismaModel> | number | null
-  _count?: Prisma.NestedIntNullableFilter<$PrismaModel>
-  _avg?: Prisma.NestedFloatNullableFilter<$PrismaModel>
-  _sum?: Prisma.NestedIntNullableFilter<$PrismaModel>
-  _min?: Prisma.NestedIntNullableFilter<$PrismaModel>
-  _max?: Prisma.NestedIntNullableFilter<$PrismaModel>
-}
-
-export type FloatWithAggregatesFilter<$PrismaModel = never> = {
-  equals?: number | Prisma.FloatFieldRefInput<$PrismaModel>
-  in?: number[] | Prisma.ListFloatFieldRefInput<$PrismaModel>
-  notIn?: number[] | Prisma.ListFloatFieldRefInput<$PrismaModel>
-  lt?: number | Prisma.FloatFieldRefInput<$PrismaModel>
-  lte?: number | Prisma.FloatFieldRefInput<$PrismaModel>
-  gt?: number | Prisma.FloatFieldRefInput<$PrismaModel>
-  gte?: number | Prisma.FloatFieldRefInput<$PrismaModel>
-  not?: Prisma.NestedFloatWithAggregatesFilter<$PrismaModel> | number
-  _count?: Prisma.NestedIntFilter<$PrismaModel>
-  _avg?: Prisma.NestedFloatFilter<$PrismaModel>
-  _sum?: Prisma.NestedFloatFilter<$PrismaModel>
-  _min?: Prisma.NestedFloatFilter<$PrismaModel>
-  _max?: Prisma.NestedFloatFilter<$PrismaModel>
-}
-
-export type JsonFilter<$PrismaModel = never> =
-| Prisma.PatchUndefined<
-    Prisma.Either<Required<JsonFilterBase<$PrismaModel>>, Exclude<keyof Required<JsonFilterBase<$PrismaModel>>, 'path'>>,
-    Required<JsonFilterBase<$PrismaModel>>
-  >
-| Prisma.OptionalFlat<Omit<Required<JsonFilterBase<$PrismaModel>>, 'path'>>
-
-export type JsonFilterBase<$PrismaModel = never> = {
-  equals?: runtime.InputJsonValue | Prisma.JsonFieldRefInput<$PrismaModel> | Prisma.JsonNullValueFilter
-  path?: string[]
-  mode?: Prisma.QueryMode | Prisma.EnumQueryModeFieldRefInput<$PrismaModel>
-  string_contains?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  string_starts_with?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  string_ends_with?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  array_starts_with?: runtime.InputJsonValue | Prisma.JsonFieldRefInput<$PrismaModel> | null
-  array_ends_with?: runtime.InputJsonValue | Prisma.JsonFieldRefInput<$PrismaModel> | null
-  array_contains?: runtime.InputJsonValue | Prisma.JsonFieldRefInput<$PrismaModel> | null
-  lt?: runtime.InputJsonValue | Prisma.JsonFieldRefInput<$PrismaModel>
-  lte?: runtime.InputJsonValue | Prisma.JsonFieldRefInput<$PrismaModel>
-  gt?: runtime.InputJsonValue | Prisma.JsonFieldRefInput<$PrismaModel>
-  gte?: runtime.InputJsonValue | Prisma.JsonFieldRefInput<$PrismaModel>
-  not?: runtime.InputJsonValue | Prisma.JsonFieldRefInput<$PrismaModel> | Prisma.JsonNullValueFilter
-}
-
-export type JsonWithAggregatesFilter<$PrismaModel = never> =
-| Prisma.PatchUndefined<
-    Prisma.Either<Required<JsonWithAggregatesFilterBase<$PrismaModel>>, Exclude<keyof Required<JsonWithAggregatesFilterBase<$PrismaModel>>, 'path'>>,
-    Required<JsonWithAggregatesFilterBase<$PrismaModel>>
-  >
-| Prisma.OptionalFlat<Omit<Required<JsonWithAggregatesFilterBase<$PrismaModel>>, 'path'>>
-
-export type JsonWithAggregatesFilterBase<$PrismaModel = never> = {
-  equals?: runtime.InputJsonValue | Prisma.JsonFieldRefInput<$PrismaModel> | Prisma.JsonNullValueFilter
-  path?: string[]
-  mode?: Prisma.QueryMode | Prisma.EnumQueryModeFieldRefInput<$PrismaModel>
-  string_contains?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  string_starts_with?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  string_ends_with?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  array_starts_with?: runtime.InputJsonValue | Prisma.JsonFieldRefInput<$PrismaModel> | null
-  array_ends_with?: runtime.InputJsonValue | Prisma.JsonFieldRefInput<$PrismaModel> | null
-  array_contains?: runtime.InputJsonValue | Prisma.JsonFieldRefInput<$PrismaModel> | null
-  lt?: runtime.InputJsonValue | Prisma.JsonFieldRefInput<$PrismaModel>
-  lte?: runtime.InputJsonValue | Prisma.JsonFieldRefInput<$PrismaModel>
-  gt?: runtime.InputJsonValue | Prisma.JsonFieldRefInput<$PrismaModel>
-  gte?: runtime.InputJsonValue | Prisma.JsonFieldRefInput<$PrismaModel>
-  not?: runtime.InputJsonValue | Prisma.JsonFieldRefInput<$PrismaModel> | Prisma.JsonNullValueFilter
-  _count?: Prisma.NestedIntFilter<$PrismaModel>
-  _min?: Prisma.NestedJsonFilter<$PrismaModel>
-  _max?: Prisma.NestedJsonFilter<$PrismaModel>
-}
-
-export type BytesFilter<$PrismaModel = never> = {
-  equals?: runtime.Bytes | Prisma.BytesFieldRefInput<$PrismaModel>
-  in?: runtime.Bytes[] | Prisma.ListBytesFieldRefInput<$PrismaModel>
-  notIn?: runtime.Bytes[] | Prisma.ListBytesFieldRefInput<$PrismaModel>
-  not?: Prisma.NestedBytesFilter<$PrismaModel> | runtime.Bytes
-}
-
-export type BytesWithAggregatesFilter<$PrismaModel = never> = {
-  equals?: runtime.Bytes | Prisma.BytesFieldRefInput<$PrismaModel>
-  in?: runtime.Bytes[] | Prisma.ListBytesFieldRefInput<$PrismaModel>
-  notIn?: runtime.Bytes[] | Prisma.ListBytesFieldRefInput<$PrismaModel>
-  not?: Prisma.NestedBytesWithAggregatesFilter<$PrismaModel> | runtime.Bytes
-  _count?: Prisma.NestedIntFilter<$PrismaModel>
-  _min?: Prisma.NestedBytesFilter<$PrismaModel>
-  _max?: Prisma.NestedBytesFilter<$PrismaModel>
-}
-
-export type NestedStringFilter<$PrismaModel = never> = {
-  equals?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  in?: string[] | Prisma.ListStringFieldRefInput<$PrismaModel>
-  notIn?: string[] | Prisma.ListStringFieldRefInput<$PrismaModel>
-  lt?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  lte?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  gt?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  gte?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  contains?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  startsWith?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  endsWith?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  not?: Prisma.NestedStringFilter<$PrismaModel> | string
-}
-
-export type NestedDateTimeFilter<$PrismaModel = never> = {
-  equals?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  in?: Date[] | string[] | Prisma.ListDateTimeFieldRefInput<$PrismaModel>
-  notIn?: Date[] | string[] | Prisma.ListDateTimeFieldRefInput<$PrismaModel>
-  lt?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  lte?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  gt?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  gte?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  not?: Prisma.NestedDateTimeFilter<$PrismaModel> | Date | string
-}
-
-export type NestedBoolFilter<$PrismaModel = never> = {
-  equals?: boolean | Prisma.BooleanFieldRefInput<$PrismaModel>
-  not?: Prisma.NestedBoolFilter<$PrismaModel> | boolean
-}
-
-export type NestedDateTimeNullableFilter<$PrismaModel = never> = {
-  equals?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel> | null
-  in?: Date[] | string[] | Prisma.ListDateTimeFieldRefInput<$PrismaModel> | null
-  notIn?: Date[] | string[] | Prisma.ListDateTimeFieldRefInput<$PrismaModel> | null
-  lt?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  lte?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  gt?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  gte?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  not?: Prisma.NestedDateTimeNullableFilter<$PrismaModel> | Date | string | null
-}
-
-export type NestedStringWithAggregatesFilter<$PrismaModel = never> = {
-  equals?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  in?: string[] | Prisma.ListStringFieldRefInput<$PrismaModel>
-  notIn?: string[] | Prisma.ListStringFieldRefInput<$PrismaModel>
-  lt?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  lte?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  gt?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  gte?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  contains?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  startsWith?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  endsWith?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  not?: Prisma.NestedStringWithAggregatesFilter<$PrismaModel> | string
-  _count?: Prisma.NestedIntFilter<$PrismaModel>
-  _min?: Prisma.NestedStringFilter<$PrismaModel>
-  _max?: Prisma.NestedStringFilter<$PrismaModel>
-}
-
-export type NestedIntFilter<$PrismaModel = never> = {
-  equals?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  in?: number[] | Prisma.ListIntFieldRefInput<$PrismaModel>
-  notIn?: number[] | Prisma.ListIntFieldRefInput<$PrismaModel>
-  lt?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  lte?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  gt?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  gte?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  not?: Prisma.NestedIntFilter<$PrismaModel> | number
-}
-
-export type NestedDateTimeWithAggregatesFilter<$PrismaModel = never> = {
-  equals?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  in?: Date[] | string[] | Prisma.ListDateTimeFieldRefInput<$PrismaModel>
-  notIn?: Date[] | string[] | Prisma.ListDateTimeFieldRefInput<$PrismaModel>
-  lt?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  lte?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  gt?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  gte?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  not?: Prisma.NestedDateTimeWithAggregatesFilter<$PrismaModel> | Date | string
-  _count?: Prisma.NestedIntFilter<$PrismaModel>
-  _min?: Prisma.NestedDateTimeFilter<$PrismaModel>
-  _max?: Prisma.NestedDateTimeFilter<$PrismaModel>
-}
-
-export type NestedBoolWithAggregatesFilter<$PrismaModel = never> = {
-  equals?: boolean | Prisma.BooleanFieldRefInput<$PrismaModel>
-  not?: Prisma.NestedBoolWithAggregatesFilter<$PrismaModel> | boolean
-  _count?: Prisma.NestedIntFilter<$PrismaModel>
-  _min?: Prisma.NestedBoolFilter<$PrismaModel>
-  _max?: Prisma.NestedBoolFilter<$PrismaModel>
-}
-
-export type NestedDateTimeNullableWithAggregatesFilter<$PrismaModel = never> = {
-  equals?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel> | null
-  in?: Date[] | string[] | Prisma.ListDateTimeFieldRefInput<$PrismaModel> | null
-  notIn?: Date[] | string[] | Prisma.ListDateTimeFieldRefInput<$PrismaModel> | null
-  lt?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  lte?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  gt?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  gte?: Date | string | Prisma.DateTimeFieldRefInput<$PrismaModel>
-  not?: Prisma.NestedDateTimeNullableWithAggregatesFilter<$PrismaModel> | Date | string | null
-  _count?: Prisma.NestedIntNullableFilter<$PrismaModel>
-  _min?: Prisma.NestedDateTimeNullableFilter<$PrismaModel>
-  _max?: Prisma.NestedDateTimeNullableFilter<$PrismaModel>
-}
-
-export type NestedIntNullableFilter<$PrismaModel = never> = {
-  equals?: number | Prisma.IntFieldRefInput<$PrismaModel> | null
-  in?: number[] | Prisma.ListIntFieldRefInput<$PrismaModel> | null
-  notIn?: number[] | Prisma.ListIntFieldRefInput<$PrismaModel> | null
-  lt?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  lte?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  gt?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  gte?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  not?: Prisma.NestedIntNullableFilter<$PrismaModel> | number | null
-}
-
-export type NestedStringNullableFilter<$PrismaModel = never> = {
-  equals?: string | Prisma.StringFieldRefInput<$PrismaModel> | null
-  in?: string[] | Prisma.ListStringFieldRefInput<$PrismaModel> | null
-  notIn?: string[] | Prisma.ListStringFieldRefInput<$PrismaModel> | null
-  lt?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  lte?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  gt?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  gte?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  contains?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  startsWith?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  endsWith?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  not?: Prisma.NestedStringNullableFilter<$PrismaModel> | string | null
-}
-
-export type NestedStringNullableWithAggregatesFilter<$PrismaModel = never> = {
-  equals?: string | Prisma.StringFieldRefInput<$PrismaModel> | null
-  in?: string[] | Prisma.ListStringFieldRefInput<$PrismaModel> | null
-  notIn?: string[] | Prisma.ListStringFieldRefInput<$PrismaModel> | null
-  lt?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  lte?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  gt?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  gte?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  contains?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  startsWith?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  endsWith?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  not?: Prisma.NestedStringNullableWithAggregatesFilter<$PrismaModel> | string | null
-  _count?: Prisma.NestedIntNullableFilter<$PrismaModel>
-  _min?: Prisma.NestedStringNullableFilter<$PrismaModel>
-  _max?: Prisma.NestedStringNullableFilter<$PrismaModel>
-}
-
-export type NestedIntWithAggregatesFilter<$PrismaModel = never> = {
-  equals?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  in?: number[] | Prisma.ListIntFieldRefInput<$PrismaModel>
-  notIn?: number[] | Prisma.ListIntFieldRefInput<$PrismaModel>
-  lt?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  lte?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  gt?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  gte?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  not?: Prisma.NestedIntWithAggregatesFilter<$PrismaModel> | number
-  _count?: Prisma.NestedIntFilter<$PrismaModel>
-  _avg?: Prisma.NestedFloatFilter<$PrismaModel>
-  _sum?: Prisma.NestedIntFilter<$PrismaModel>
-  _min?: Prisma.NestedIntFilter<$PrismaModel>
-  _max?: Prisma.NestedIntFilter<$PrismaModel>
-}
-
-export type NestedFloatFilter<$PrismaModel = never> = {
-  equals?: number | Prisma.FloatFieldRefInput<$PrismaModel>
-  in?: number[] | Prisma.ListFloatFieldRefInput<$PrismaModel>
-  notIn?: number[] | Prisma.ListFloatFieldRefInput<$PrismaModel>
-  lt?: number | Prisma.FloatFieldRefInput<$PrismaModel>
-  lte?: number | Prisma.FloatFieldRefInput<$PrismaModel>
-  gt?: number | Prisma.FloatFieldRefInput<$PrismaModel>
-  gte?: number | Prisma.FloatFieldRefInput<$PrismaModel>
-  not?: Prisma.NestedFloatFilter<$PrismaModel> | number
-}
-
-export type NestedIntNullableWithAggregatesFilter<$PrismaModel = never> = {
-  equals?: number | Prisma.IntFieldRefInput<$PrismaModel> | null
-  in?: number[] | Prisma.ListIntFieldRefInput<$PrismaModel> | null
-  notIn?: number[] | Prisma.ListIntFieldRefInput<$PrismaModel> | null
-  lt?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  lte?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  gt?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  gte?: number | Prisma.IntFieldRefInput<$PrismaModel>
-  not?: Prisma.NestedIntNullableWithAggregatesFilter<$PrismaModel> | number | null
-  _count?: Prisma.NestedIntNullableFilter<$PrismaModel>
-  _avg?: Prisma.NestedFloatNullableFilter<$PrismaModel>
-  _sum?: Prisma.NestedIntNullableFilter<$PrismaModel>
-  _min?: Prisma.NestedIntNullableFilter<$PrismaModel>
-  _max?: Prisma.NestedIntNullableFilter<$PrismaModel>
-}
-
-export type NestedFloatNullableFilter<$PrismaModel = never> = {
-  equals?: number | Prisma.FloatFieldRefInput<$PrismaModel> | null
-  in?: number[] | Prisma.ListFloatFieldRefInput<$PrismaModel> | null
-  notIn?: number[] | Prisma.ListFloatFieldRefInput<$PrismaModel> | null
-  lt?: number | Prisma.FloatFieldRefInput<$PrismaModel>
-  lte?: number | Prisma.FloatFieldRefInput<$PrismaModel>
-  gt?: number | Prisma.FloatFieldRefInput<$PrismaModel>
-  gte?: number | Prisma.FloatFieldRefInput<$PrismaModel>
-  not?: Prisma.NestedFloatNullableFilter<$PrismaModel> | number | null
-}
-
-export type NestedFloatWithAggregatesFilter<$PrismaModel = never> = {
-  equals?: number | Prisma.FloatFieldRefInput<$PrismaModel>
-  in?: number[] | Prisma.ListFloatFieldRefInput<$PrismaModel>
-  notIn?: number[] | Prisma.ListFloatFieldRefInput<$PrismaModel>
-  lt?: number | Prisma.FloatFieldRefInput<$PrismaModel>
-  lte?: number | Prisma.FloatFieldRefInput<$PrismaModel>
-  gt?: number | Prisma.FloatFieldRefInput<$PrismaModel>
-  gte?: number | Prisma.FloatFieldRefInput<$PrismaModel>
-  not?: Prisma.NestedFloatWithAggregatesFilter<$PrismaModel> | number
-  _count?: Prisma.NestedIntFilter<$PrismaModel>
-  _avg?: Prisma.NestedFloatFilter<$PrismaModel>
-  _sum?: Prisma.NestedFloatFilter<$PrismaModel>
-  _min?: Prisma.NestedFloatFilter<$PrismaModel>
-  _max?: Prisma.NestedFloatFilter<$PrismaModel>
-}
-
-export type NestedJsonFilter<$PrismaModel = never> =
-| Prisma.PatchUndefined<
-    Prisma.Either<Required<NestedJsonFilterBase<$PrismaModel>>, Exclude<keyof Required<NestedJsonFilterBase<$PrismaModel>>, 'path'>>,
-    Required<NestedJsonFilterBase<$PrismaModel>>
-  >
-| Prisma.OptionalFlat<Omit<Required<NestedJsonFilterBase<$PrismaModel>>, 'path'>>
-
-export type NestedJsonFilterBase<$PrismaModel = never> = {
-  equals?: runtime.InputJsonValue | Prisma.JsonFieldRefInput<$PrismaModel> | Prisma.JsonNullValueFilter
-  path?: string[]
-  mode?: Prisma.QueryMode | Prisma.EnumQueryModeFieldRefInput<$PrismaModel>
-  string_contains?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  string_starts_with?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  string_ends_with?: string | Prisma.StringFieldRefInput<$PrismaModel>
-  array_starts_with?: runtime.InputJsonValue | Prisma.JsonFieldRefInput<$PrismaModel> | null
-  array_ends_with?: runtime.InputJsonValue | Prisma.JsonFieldRefInput<$PrismaModel> | null
-  array_contains?: runtime.InputJsonValue | Prisma.JsonFieldRefInput<$PrismaModel> | null
-  lt?: runtime.InputJsonValue | Prisma.JsonFieldRefInput<$PrismaModel>
-  lte?: runtime.InputJsonValue | Prisma.JsonFieldRefInput<$PrismaModel>
-  gt?: runtime.InputJsonValue | Prisma.JsonFieldRefInput<$PrismaModel>
-  gte?: runtime.InputJsonValue | Prisma.JsonFieldRefInput<$PrismaModel>
-  not?: runtime.InputJsonValue | Prisma.JsonFieldRefInput<$PrismaModel> | Prisma.JsonNullValueFilter
-}
-
-export type NestedBytesFilter<$PrismaModel = never> = {
-  equals?: runtime.Bytes | Prisma.BytesFieldRefInput<$PrismaModel>
-  in?: runtime.Bytes[] | Prisma.ListBytesFieldRefInput<$PrismaModel>
-  notIn?: runtime.Bytes[] | Prisma.ListBytesFieldRefInput<$PrismaModel>
-  not?: Prisma.NestedBytesFilter<$PrismaModel> | runtime.Bytes
-}
-
-export type NestedBytesWithAggregatesFilter<$PrismaModel = never> = {
-  equals?: runtime.Bytes | Prisma.BytesFieldRefInput<$PrismaModel>
-  in?: runtime.Bytes[] | Prisma.ListBytesFieldRefInput<$PrismaModel>
-  notIn?: runtime.Bytes[] | Prisma.ListBytesFieldRefInput<$PrismaModel>
-  not?: Prisma.NestedBytesWithAggregatesFilter<$PrismaModel> | runtime.Bytes
-  _count?: Prisma.NestedIntFilter<$PrismaModel>
-  _min?: Prisma.NestedBytesFilter<$PrismaModel>
-  _max?: Prisma.NestedBytesFilter<$PrismaModel>
-}
-
-

generated/prisma/enums.ts

@@ -1,15 +0,0 @@
-
-/* !!! This is code generated by Prisma. Do not edit directly. !!! */
-/* eslint-disable */
-// biome-ignore-all lint: generated file
-// @ts-nocheck 
-/*
-* This file exports all enum related types from the schema.
-*
-* 🟢 You can import this file directly.
-*/
-
-
-
-// This file is empty because there are no enums in the schema.
-export {}

generated/prisma/internal/prismaNamespaceBrowser.ts

@@ -1,350 +0,0 @@
-
-/* !!! This is code generated by Prisma. Do not edit directly. !!! */
-/* eslint-disable */
-// biome-ignore-all lint: generated file
-// @ts-nocheck 
-/*
- * WARNING: This is an internal file that is subject to change!
- *
- * 🛑 Under no circumstances should you import this file directly! 🛑
- *
- * All exports from this file are wrapped under a `Prisma` namespace object in the browser.ts file.
- * While this enables partial backward compatibility, it is not part of the stable public API.
- *
- * If you are looking for your Models, Enums, and Input Types, please import them from the respective
- * model files in the `model` directory!
- */
-
-import * as runtime from "@prisma/client/runtime/index-browser"
-
-export type * from '../models.ts'
-export type * from './prismaNamespace.ts'
-
-export const Decimal = runtime.Decimal
-
-
-export const NullTypes = {
-  DbNull: runtime.NullTypes.DbNull as (new (secret: never) => typeof runtime.DbNull),
-  JsonNull: runtime.NullTypes.JsonNull as (new (secret: never) => typeof runtime.JsonNull),
-  AnyNull: runtime.NullTypes.AnyNull as (new (secret: never) => typeof runtime.AnyNull),
-}
-/**
- * Helper for filtering JSON entries that have `null` on the database (empty on the db)
- *
- * @see https://www.prisma.io/docs/concepts/components/prisma-client/working-with-fields/working-with-json-fields#filtering-on-a-json-field
- */
-export const DbNull = runtime.DbNull
-
-/**
- * Helper for filtering JSON entries that have JSON `null` values (not empty on the db)
- *
- * @see https://www.prisma.io/docs/concepts/components/prisma-client/working-with-fields/working-with-json-fields#filtering-on-a-json-field
- */
-export const JsonNull = runtime.JsonNull
-
-/**
- * Helper for filtering JSON entries that are `Prisma.DbNull` or `Prisma.JsonNull`
- *
- * @see https://www.prisma.io/docs/concepts/components/prisma-client/working-with-fields/working-with-json-fields#filtering-on-a-json-field
- */
-export const AnyNull = runtime.AnyNull
-
-
-export const ModelName = {
-  Session: 'Session',
-  User: 'User',
-  Role: 'Role',
-  UnifiSite: 'UnifiSite',
-  Company: 'Company',
-  CatalogItem: 'CatalogItem',
-  Opportunity: 'Opportunity',
-  CredentialType: 'CredentialType',
-  SecureValue: 'SecureValue',
-  Credential: 'Credential',
-  GeneratedQuotes: 'GeneratedQuotes',
-  CwMember: 'CwMember'
-} as const
-
-export type ModelName = (typeof ModelName)[keyof typeof ModelName]
-
-/*
- * Enums
- */
-
-export const TransactionIsolationLevel = runtime.makeStrictEnum({
-  ReadUncommitted: 'ReadUncommitted',
-  ReadCommitted: 'ReadCommitted',
-  RepeatableRead: 'RepeatableRead',
-  Serializable: 'Serializable'
-} as const)
-
-export type TransactionIsolationLevel = (typeof TransactionIsolationLevel)[keyof typeof TransactionIsolationLevel]
-
-
-export const SessionScalarFieldEnum = {
-  id: 'id',
-  sessionKey: 'sessionKey',
-  userId: 'userId',
-  expires: 'expires',
-  refreshTokenGenerated: 'refreshTokenGenerated',
-  refreshedAt: 'refreshedAt',
-  invalidatedAt: 'invalidatedAt'
-} as const
-
-export type SessionScalarFieldEnum = (typeof SessionScalarFieldEnum)[keyof typeof SessionScalarFieldEnum]
-
-
-export const UserScalarFieldEnum = {
-  id: 'id',
-  permissions: 'permissions',
-  login: 'login',
-  name: 'name',
-  email: 'email',
-  emailVerified: 'emailVerified',
-  image: 'image',
-  cwIdentifier: 'cwIdentifier',
-  userId: 'userId',
-  token: 'token',
-  createdAt: 'createdAt',
-  updatedAt: 'updatedAt'
-} as const
-
-export type UserScalarFieldEnum = (typeof UserScalarFieldEnum)[keyof typeof UserScalarFieldEnum]
-
-
-export const RoleScalarFieldEnum = {
-  id: 'id',
-  title: 'title',
-  moniker: 'moniker',
-  permissions: 'permissions',
-  createdAt: 'createdAt',
-  updatedAt: 'updatedAt'
-} as const
-
-export type RoleScalarFieldEnum = (typeof RoleScalarFieldEnum)[keyof typeof RoleScalarFieldEnum]
-
-
-export const UnifiSiteScalarFieldEnum = {
-  id: 'id',
-  name: 'name',
-  siteId: 'siteId',
-  companyId: 'companyId',
-  createdAt: 'createdAt',
-  updatedAt: 'updatedAt'
-} as const
-
-export type UnifiSiteScalarFieldEnum = (typeof UnifiSiteScalarFieldEnum)[keyof typeof UnifiSiteScalarFieldEnum]
-
-
-export const CompanyScalarFieldEnum = {
-  id: 'id',
-  name: 'name',
-  cw_CompanyId: 'cw_CompanyId',
-  cw_Identifier: 'cw_Identifier',
-  createdAt: 'createdAt',
-  updatedAt: 'updatedAt'
-} as const
-
-export type CompanyScalarFieldEnum = (typeof CompanyScalarFieldEnum)[keyof typeof CompanyScalarFieldEnum]
-
-
-export const CatalogItemScalarFieldEnum = {
-  id: 'id',
-  cwCatalogId: 'cwCatalogId',
-  identifier: 'identifier',
-  name: 'name',
-  description: 'description',
-  customerDescription: 'customerDescription',
-  internalNotes: 'internalNotes',
-  category: 'category',
-  categoryCwId: 'categoryCwId',
-  subcategory: 'subcategory',
-  subcategoryCwId: 'subcategoryCwId',
-  manufacturer: 'manufacturer',
-  manufactureCwId: 'manufactureCwId',
-  partNumber: 'partNumber',
-  vendorName: 'vendorName',
-  vendorSku: 'vendorSku',
-  vendorCwId: 'vendorCwId',
-  price: 'price',
-  cost: 'cost',
-  inactive: 'inactive',
-  salesTaxable: 'salesTaxable',
-  onHand: 'onHand',
-  cwLastUpdated: 'cwLastUpdated',
-  createdAt: 'createdAt',
-  updatedAt: 'updatedAt'
-} as const
-
-export type CatalogItemScalarFieldEnum = (typeof CatalogItemScalarFieldEnum)[keyof typeof CatalogItemScalarFieldEnum]
-
-
-export const OpportunityScalarFieldEnum = {
-  id: 'id',
-  cwOpportunityId: 'cwOpportunityId',
-  name: 'name',
-  notes: 'notes',
-  typeName: 'typeName',
-  typeCwId: 'typeCwId',
-  stageName: 'stageName',
-  stageCwId: 'stageCwId',
-  statusName: 'statusName',
-  statusCwId: 'statusCwId',
-  priorityName: 'priorityName',
-  priorityCwId: 'priorityCwId',
-  ratingName: 'ratingName',
-  ratingCwId: 'ratingCwId',
-  source: 'source',
-  campaignName: 'campaignName',
-  campaignCwId: 'campaignCwId',
-  primarySalesRepName: 'primarySalesRepName',
-  primarySalesRepIdentifier: 'primarySalesRepIdentifier',
-  primarySalesRepCwId: 'primarySalesRepCwId',
-  secondarySalesRepName: 'secondarySalesRepName',
-  secondarySalesRepIdentifier: 'secondarySalesRepIdentifier',
-  secondarySalesRepCwId: 'secondarySalesRepCwId',
-  companyCwId: 'companyCwId',
-  companyName: 'companyName',
-  contactCwId: 'contactCwId',
-  contactName: 'contactName',
-  siteCwId: 'siteCwId',
-  siteName: 'siteName',
-  customerPO: 'customerPO',
-  totalSalesTax: 'totalSalesTax',
-  probability: 'probability',
-  locationName: 'locationName',
-  locationCwId: 'locationCwId',
-  departmentName: 'departmentName',
-  departmentCwId: 'departmentCwId',
-  expectedCloseDate: 'expectedCloseDate',
-  pipelineChangeDate: 'pipelineChangeDate',
-  dateBecameLead: 'dateBecameLead',
-  closedDate: 'closedDate',
-  closedFlag: 'closedFlag',
-  closedByName: 'closedByName',
-  closedByCwId: 'closedByCwId',
-  companyId: 'companyId',
-  productSequence: 'productSequence',
-  cwLastUpdated: 'cwLastUpdated',
-  cwDateEntered: 'cwDateEntered',
-  createdAt: 'createdAt',
-  updatedAt: 'updatedAt'
-} as const
-
-export type OpportunityScalarFieldEnum = (typeof OpportunityScalarFieldEnum)[keyof typeof OpportunityScalarFieldEnum]
-
-
-export const CredentialTypeScalarFieldEnum = {
-  id: 'id',
-  name: 'name',
-  permissionScope: 'permissionScope',
-  icon: 'icon',
-  fields: 'fields',
-  createdAt: 'createdAt',
-  updatedAt: 'updatedAt'
-} as const
-
-export type CredentialTypeScalarFieldEnum = (typeof CredentialTypeScalarFieldEnum)[keyof typeof CredentialTypeScalarFieldEnum]
-
-
-export const SecureValueScalarFieldEnum = {
-  id: 'id',
-  name: 'name',
-  content: 'content',
-  hash: 'hash',
-  credentialId: 'credentialId',
-  createdAt: 'createdAt',
-  updatedAt: 'updatedAt'
-} as const
-
-export type SecureValueScalarFieldEnum = (typeof SecureValueScalarFieldEnum)[keyof typeof SecureValueScalarFieldEnum]
-
-
-export const CredentialScalarFieldEnum = {
-  id: 'id',
-  name: 'name',
-  notes: 'notes',
-  subCredentialOfId: 'subCredentialOfId',
-  typeId: 'typeId',
-  fields: 'fields',
-  companyId: 'companyId',
-  createdAt: 'createdAt',
-  updatedAt: 'updatedAt'
-} as const
-
-export type CredentialScalarFieldEnum = (typeof CredentialScalarFieldEnum)[keyof typeof CredentialScalarFieldEnum]
-
-
-export const GeneratedQuotesScalarFieldEnum = {
-  id: 'id',
-  quoteRegenData: 'quoteRegenData',
-  quoteRegenParams: 'quoteRegenParams',
-  quoteRegenHash: 'quoteRegenHash',
-  downloads: 'downloads',
-  quoteFile: 'quoteFile',
-  quoteFileName: 'quoteFileName',
-  opportunityId: 'opportunityId',
-  createdById: 'createdById',
-  createdAt: 'createdAt',
-  updatedAt: 'updatedAt'
-} as const
-
-export type GeneratedQuotesScalarFieldEnum = (typeof GeneratedQuotesScalarFieldEnum)[keyof typeof GeneratedQuotesScalarFieldEnum]
-
-
-export const CwMemberScalarFieldEnum = {
-  id: 'id',
-  cwMemberId: 'cwMemberId',
-  identifier: 'identifier',
-  firstName: 'firstName',
-  lastName: 'lastName',
-  officeEmail: 'officeEmail',
-  inactiveFlag: 'inactiveFlag',
-  apiKey: 'apiKey',
-  cwLastUpdated: 'cwLastUpdated',
-  createdAt: 'createdAt',
-  updatedAt: 'updatedAt'
-} as const
-
-export type CwMemberScalarFieldEnum = (typeof CwMemberScalarFieldEnum)[keyof typeof CwMemberScalarFieldEnum]
-
-
-export const SortOrder = {
-  asc: 'asc',
-  desc: 'desc'
-} as const
-
-export type SortOrder = (typeof SortOrder)[keyof typeof SortOrder]
-
-
-export const JsonNullValueInput = {
-  JsonNull: JsonNull
-} as const
-
-export type JsonNullValueInput = (typeof JsonNullValueInput)[keyof typeof JsonNullValueInput]
-
-
-export const QueryMode = {
-  default: 'default',
-  insensitive: 'insensitive'
-} as const
-
-export type QueryMode = (typeof QueryMode)[keyof typeof QueryMode]
-
-
-export const NullsOrder = {
-  first: 'first',
-  last: 'last'
-} as const
-
-export type NullsOrder = (typeof NullsOrder)[keyof typeof NullsOrder]
-
-
-export const JsonNullValueFilter = {
-  DbNull: DbNull,
-  JsonNull: JsonNull,
-  AnyNull: AnyNull
-} as const
-
-export type JsonNullValueFilter = (typeof JsonNullValueFilter)[keyof typeof JsonNullValueFilter]
-

generated/prisma/models.ts

@@ -1,23 +0,0 @@
-
-/* !!! This is code generated by Prisma. Do not edit directly. !!! */
-/* eslint-disable */
-// biome-ignore-all lint: generated file
-// @ts-nocheck 
-/*
- * This is a barrel export file for all models and their related types.
- *
- * 🟢 You can import this file directly.
- */
-export type * from './models/Session.ts'
-export type * from './models/User.ts'
-export type * from './models/Role.ts'
-export type * from './models/UnifiSite.ts'
-export type * from './models/Company.ts'
-export type * from './models/CatalogItem.ts'
-export type * from './models/Opportunity.ts'
-export type * from './models/CredentialType.ts'
-export type * from './models/SecureValue.ts'
-export type * from './models/Credential.ts'
-export type * from './models/GeneratedQuotes.ts'
-export type * from './models/CwMember.ts'
-export type * from './commonInputTypes.ts'

kubernetes/deployment.yaml

@@ -1,27 +1,29 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: optima-api
+  name: optima-ui
   namespace: optima
 spec:
   selector:
     matchLabels:
-      app: optima-api
+      app: optima-ui
   replicas: 1
   template:
     metadata:
       labels:
-        app: optima-api
+        app: optima-ui
     spec:
       containers:
-        - name: optima-api
-          image: ghcr.io/project-optima/ttscm-api:latest
+        - name: optima-ui
+          image: ghcr.io/project-optima/ttscm-ui:latest
           imagePullPolicy: Always
-          envFrom:
-            - secretRef:
-                name: api-env-secret
-            - secretRef:
-                name: optima-keys-secret
+          env:
+            - name: PUBLIC_API_URL
+              value: "https://opt-api.osdci.net"
+            - name: ORIGIN
+              value: "https://optima.osdci.net"
+            - name: PORT
+              value: "3000"
           ports:
             - containerPort: 3000
       imagePullSecrets:

kubernetes/ingress.yaml

@@ -1,7 +1,7 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: optima-api-ingress
+  name: optima-ui-ingress
   namespace: optima
   annotations:
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
@@ -9,31 +9,31 @@ metadata:
 spec:
   tls:
     - hosts:
-        - opt-api.osdci.net
+        - optima.osdci.net
       secretName: osdci-net-cert
   rules:
-    - host: opt-api.osdci.net
+    - host: optima.osdci.net
       http:
         paths:
           - path: /
             pathType: Prefix
             backend:
               service:
-                name: optima-api
+                name: optima-ui
                 port:
                   number: 3000
 ---
 apiVersion: v1
 kind: Service
 metadata:
-  name: optima-api
+  name: optima-ui
   namespace: optima
   labels:
-    app: optima-api
+    app: optima-ui
 spec:
   type: ClusterIP
   ports:
     - port: 3000
       protocol: TCP
   selector:
-    app: optima-api
+    app: optima-ui

kubernetes/migration-job.yaml

@@ -1,23 +0,0 @@
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: prisma-migrate-RELEASE_TAG
-  namespace: optima
-  labels:
-    app: prisma-migrate
-spec:
-  backoffLimit: 3
-  ttlSecondsAfterFinished: 300
-  template:
-    spec:
-      containers:
-        - name: migrate
-          image: ghcr.io/project-optima/ttscm-api-migrate:RELEASE_TAG
-          envFrom:
-            - secretRef:
-                name: api-env-secret
-            - secretRef:
-                name: optima-keys-secret
-      restartPolicy: Never
-      imagePullSecrets:
-        - name: github-container-registry

package.json

@@ -1,58 +1,73 @@
 {
-  "name": "tts-optima-api",
-  "homepage": "https://totaltech.net",
-  "version": "v0.1.0",
-  "author": {
-    "name": "Jackson Roberts",
-    "email": "jackson.roberts@totaltech.net",
-    "url": "https://totaltech.net"
-  },
-  "module": "src/index.ts",
-  "type": "module",
+  "name": "electron-svelte",
+  "productName": "electron-svelte",
+  "description": "Electron Svelte",
   "private": true,
-  "devDependencies": {
-    "@types/bun": "latest",
-    "@types/jsonwebtoken": "^9.0.10"
-  },
-  "peerDependencies": {
-    "typescript": "^5"
+  "version": "0.0.1",
+  "type": "module",
+  "main": ".vite/build/main.js",
+  "author": {
+    "name": "Pandoks_",
+    "email": "35944715+Pandoks@users.noreply.github.com"
   },
   "scripts": {
-    "dev": "NODE_ENV=development bun --watch src/index.ts",
-    "dev:log": "LOG_CW_API=1 NODE_ENV=development bun --watch src/index.ts",
-    "test": "bun test --preload ./tests/setup.ts",
-    "db:gen": "prisma generate",
-    "db:push": "prisma migrate dev --skip-generate",
-    "db:deploy": "prisma migrate deploy",
-    "utils:dev": "docker compose -f .docker/docker-compose.yml up --build",
-    "utils:gen_private_keys": "bun ./utils/genPrivateKeys",
-    "utils:create_admin_role": "bun ./utils/createAdminRole",
-    "utils:assign_user_role": "bun ./utils/assignUserRole",
-    "utils:test_webserver": "bun ./utils/testWebserver.ts",
-    "utils:test_adjustments_poll": "bun ./utils/testAdjustmentsPoll.ts",
-    "utils:analyze_cw": "python3 debug-scripts/analyze-cw-calls.py",
-    "db:check": "bunx prisma migrate diff --from-migrations prisma/migrations --to-schema prisma/schema.prisma --shadow-database-url $DATABASE_URL --exit-code"
+    "prepare": "svelte-kit sync || echo ''",
+    "check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
+    "check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
+    "test:unit": "vitest",
+    "test": "bun run test:unit -- --run && bun run test:e2e",
+    "test:e2e": "playwright test",
+    "start": "electron-forge start",
+    "package": "electron-forge package",
+    "make": "electron-forge make",
+    "make:macos": "electron-forge make --platform darwin",
+    "build:server": "vite build",
+    "publish": "electron-forge publish"
+  },
+  "devDependencies": {
+    "@electron-forge/cli": "^7.11.1",
+    "@electron-forge/maker-deb": "^7.11.1",
+    "@electron-forge/maker-dmg": "^7.11.1",
+    "@electron-forge/maker-rpm": "^7.11.1",
+    "@electron-forge/maker-squirrel": "^7.11.1",
+    "@electron-forge/maker-zip": "^7.11.1",
+    "@electron-forge/plugin-auto-unpack-natives": "^7.11.1",
+    "@electron-forge/plugin-fuses": "^7.11.1",
+    "@electron-forge/plugin-vite": "^7.11.1",
+    "@electron/fuses": "^1.8.0",
+    "@playwright/test": "^1.58.0",
+    "@sveltejs/adapter-node": "^5.5.3",
+    "@sveltejs/adapter-static": "^3.0.10",
+    "@sveltejs/kit": "^2.50.1",
+    "@sveltejs/vite-plugin-svelte": "^5.1.1",
+    "@tailwindcss/forms": "^0.5.11",
+    "@tailwindcss/typography": "^0.5.19",
+    "@tailwindcss/vite": "^4.1.18",
+    "@testing-library/jest-dom": "^6.9.1",
+    "@testing-library/svelte": "^5.3.1",
+    "@types/electron-squirrel-startup": "^1.0.2",
+    "@types/node": "^22.19.7",
+    "electron": "^36.9.5",
+    "jsdom": "^26.1.0",
+    "svelte": "^5.48.2",
+    "svelte-check": "^4.3.5",
+    "tailwindcss": "^4.1.18",
+    "typescript": "^5.9.3",
+    "vite": "^6.4.1",
+    "vitest": "^3.2.4"
   },
   "dependencies": {
-    "@azure/msal-node": "^5.0.2",
-    "@discordjs/collection": "^2.1.1",
-    "@duxcore/eventra": "^1.1.0",
-    "@prisma/adapter-pg": "^7.3.0",
-    "@prisma/client": "^7.3.0",
-    "@socket.io/bun-engine": "^0.1.0",
     "axios": "^1.13.3",
-    "blakets": "^0.1.12",
-    "cors": "^2.8.6",
-    "cuid": "^3.0.0",
-    "hono": "^4.11.5",
-    "ioredis": "^5.10.0",
-    "jsonwebtoken": "^9.0.3",
-    "keypair": "^1.0.4",
-    "pdf-lib": "^1.17.1",
-    "pdfmake": "^0.3.5",
-    "prisma": "^7.3.0",
-    "socket.io": "^4.8.3",
-    "zod": "^4.3.6",
-    "zon": "^1.0.3"
+    "dotenv": "^17.2.3",
+    "electron-squirrel-startup": "^1.0.1",
+    "socket.io-client": "^4.8.3"
+  },
+  "trustedDependencies": [
+    "esbuild",
+    "electron",
+    "electron-winstaller"
+  ],
+  "patchedDependencies": {
+    "@sveltejs/kit": "patches/@sveltejs__kit.patch"
   }
 }

patches/@sveltejs__kit.patch

@@ -0,0 +1,26 @@
+diff --git a/src/exports/vite/index.js b/src/exports/vite/index.js
+index e23cf2b833fc0a04287d34328b97bf64c7916f0d..81b6f30f3a5f2c8d3d0337777e141e549c4a5f98 100644
+--- a/src/exports/vite/index.js
++++ b/src/exports/vite/index.js
+@@ -473,7 +473,7 @@ Tips:
+ 				// for internal use only. it's published as $app/paths externally
+ 				// we use this alias so that we won't collide with user aliases
+ 				case sveltekit_paths: {
+-					const { assets, base } = svelte_config.kit.paths;
++					const { assets, base, relative } = svelte_config.kit.paths;
+ 
+ 					// use the values defined in `global`, but fall back to hard-coded values
+ 					// for the sake of things like Vitest which may import this module
+@@ -488,10 +488,10 @@ Tips:
+ 
+ 					return dedent`
+ 						export let base = ${s(base)};
+-						export let assets = ${assets ? s(assets) : 'base'};
++						export let assets = ${relative ? "'.' + " : ''}${assets ? s(assets) : 'base'};
+ 						export const app_dir = ${s(kit.appDir)};
+ 
+-						export const relative = ${svelte_config.kit.paths.relative};
++						export const relative = ${relative};
+ 
+ 						const initial = { base, assets };
+ 

playwright.config.ts

@@ -0,0 +1,9 @@
+import { defineConfig } from '@playwright/test';
+
+export default defineConfig({
+	webServer: {
+		command: 'npm run build && npm run preview',
+		port: 4173
+	},
+	testDir: 'e2e'
+});

prisma.config.ts

@@ -1,12 +0,0 @@
-import 'dotenv/config'
-import { defineConfig, env } from 'prisma/config'
-
-export default defineConfig({
-  schema: 'prisma/schema.prisma',
-  migrations: {
-    path: 'prisma/migrations',
-  },
-  datasource: {
-    url: env('DATABASE_URL'),
-  },
-})

prisma/migrate-entrypoint.sh

@@ -1,23 +0,0 @@
-#!/bin/sh
-set -e
-
-# ---------------------------------------------------------------------------
-# 1. Resolve any previously failed migrations so deploy can proceed.
-#    Only migrations explicitly marked as "Failed" in the status output are
-#    resolved. We grep for lines containing "Failed" and extract the name.
-# ---------------------------------------------------------------------------
-echo "[migrate] Checking for failed migrations..."
-STATUS_OUTPUT=$(bunx prisma migrate status 2>&1 || true)
-echo "$STATUS_OUTPUT"
-
-# Only resolve migrations whose status line explicitly says "Failed"
-echo "$STATUS_OUTPUT" | grep -i "failed" | grep -oE '[0-9]{14}_[a-zA-Z_]+' | while read -r MIGRATION; do
-  echo "[migrate] Resolving failed migration: $MIGRATION"
-  bunx prisma migrate resolve --rolled-back "$MIGRATION" || true
-done
-
-# ---------------------------------------------------------------------------
-# 2. Deploy all pending migrations from the migrations directory.
-# ---------------------------------------------------------------------------
-echo "[migrate] Running prisma migrate deploy..."
-bunx prisma migrate deploy

prisma/migrations/20260125205653/migration.sql

@@ -1,76 +0,0 @@
--- CreateTable
-CREATE TABLE "Session" (
-    "id" TEXT NOT NULL,
-    "sessionKey" TEXT NOT NULL,
-    "userId" TEXT NOT NULL,
-    "expires" TIMESTAMP(3) NOT NULL,
-    "refreshTokenGenerated" BOOLEAN NOT NULL DEFAULT false,
-    "refreshedAt" TIMESTAMP(3),
-    "invalidatedAt" TIMESTAMP(3),
-
-    CONSTRAINT "Session_pkey" PRIMARY KEY ("id")
-);
-
--- CreateTable
-CREATE TABLE "User" (
-    "id" TEXT NOT NULL,
-    "permissions" TEXT,
-    "login" TEXT NOT NULL,
-    "name" TEXT,
-    "email" TEXT NOT NULL,
-    "emailVerified" TIMESTAMP(3),
-    "image" TEXT,
-    "userId" TEXT NOT NULL,
-    "token" TEXT,
-    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "updatedAt" TIMESTAMP(3) NOT NULL,
-
-    CONSTRAINT "User_pkey" PRIMARY KEY ("id")
-);
-
--- CreateTable
-CREATE TABLE "Role" (
-    "id" TEXT NOT NULL,
-    "title" TEXT NOT NULL,
-    "moniker" TEXT NOT NULL,
-    "permissions" TEXT NOT NULL,
-    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "updatedAt" TIMESTAMP(3) NOT NULL,
-
-    CONSTRAINT "Role_pkey" PRIMARY KEY ("id")
-);
-
--- CreateTable
-CREATE TABLE "_RoleToUser" (
-    "A" TEXT NOT NULL,
-    "B" TEXT NOT NULL,
-
-    CONSTRAINT "_RoleToUser_AB_pkey" PRIMARY KEY ("A","B")
-);
-
--- CreateIndex
-CREATE UNIQUE INDEX "Session_sessionKey_key" ON "Session"("sessionKey");
-
--- CreateIndex
-CREATE UNIQUE INDEX "User_login_key" ON "User"("login");
-
--- CreateIndex
-CREATE UNIQUE INDEX "User_email_key" ON "User"("email");
-
--- CreateIndex
-CREATE UNIQUE INDEX "User_userId_key" ON "User"("userId");
-
--- CreateIndex
-CREATE UNIQUE INDEX "Role_moniker_key" ON "Role"("moniker");
-
--- CreateIndex
-CREATE INDEX "_RoleToUser_B_index" ON "_RoleToUser"("B");
-
--- AddForeignKey
-ALTER TABLE "Session" ADD CONSTRAINT "Session_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-
--- AddForeignKey
-ALTER TABLE "_RoleToUser" ADD CONSTRAINT "_RoleToUser_A_fkey" FOREIGN KEY ("A") REFERENCES "Role"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-
--- AddForeignKey
-ALTER TABLE "_RoleToUser" ADD CONSTRAINT "_RoleToUser_B_fkey" FOREIGN KEY ("B") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE CASCADE;

prisma/migrations/20260220182446_add_sub_credentials_self_relation/migration.sql

@@ -1,73 +0,0 @@
--- CreateTable
-CREATE TABLE "Company" (
-    "id" TEXT NOT NULL,
-    "name" TEXT NOT NULL,
-    "cw_CompanyId" INTEGER NOT NULL,
-    "cw_Identifier" TEXT NOT NULL,
-    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "updatedAt" TIMESTAMP(3) NOT NULL,
-
-    CONSTRAINT "Company_pkey" PRIMARY KEY ("id")
-);
-
--- CreateTable
-CREATE TABLE "CredentialType" (
-    "id" TEXT NOT NULL,
-    "name" TEXT NOT NULL,
-    "permissionScope" TEXT NOT NULL,
-    "icon" TEXT,
-    "fields" JSONB NOT NULL,
-    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "updatedAt" TIMESTAMP(3) NOT NULL,
-
-    CONSTRAINT "CredentialType_pkey" PRIMARY KEY ("id")
-);
-
--- CreateTable
-CREATE TABLE "SecureValue" (
-    "id" TEXT NOT NULL,
-    "name" TEXT NOT NULL,
-    "content" TEXT NOT NULL,
-    "hash" TEXT NOT NULL,
-    "credentialId" TEXT NOT NULL,
-    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "updatedAt" TIMESTAMP(3) NOT NULL,
-
-    CONSTRAINT "SecureValue_pkey" PRIMARY KEY ("id")
-);
-
--- CreateTable
-CREATE TABLE "Credential" (
-    "id" TEXT NOT NULL,
-    "name" TEXT NOT NULL,
-    "notes" TEXT,
-    "subCredentialOfId" TEXT,
-    "typeId" TEXT NOT NULL,
-    "fields" JSONB NOT NULL,
-    "companyId" TEXT NOT NULL,
-    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "updatedAt" TIMESTAMP(3) NOT NULL,
-
-    CONSTRAINT "Credential_pkey" PRIMARY KEY ("id")
-);
-
--- CreateIndex
-CREATE UNIQUE INDEX "Company_cw_CompanyId_key" ON "Company"("cw_CompanyId");
-
--- CreateIndex
-CREATE UNIQUE INDEX "Company_cw_Identifier_key" ON "Company"("cw_Identifier");
-
--- CreateIndex
-CREATE UNIQUE INDEX "CredentialType_name_key" ON "CredentialType"("name");
-
--- AddForeignKey
-ALTER TABLE "SecureValue" ADD CONSTRAINT "SecureValue_credentialId_fkey" FOREIGN KEY ("credentialId") REFERENCES "Credential"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-
--- AddForeignKey
-ALTER TABLE "Credential" ADD CONSTRAINT "Credential_subCredentialOfId_fkey" FOREIGN KEY ("subCredentialOfId") REFERENCES "Credential"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-
--- AddForeignKey
-ALTER TABLE "Credential" ADD CONSTRAINT "Credential_typeId_fkey" FOREIGN KEY ("typeId") REFERENCES "CredentialType"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-
--- AddForeignKey
-ALTER TABLE "Credential" ADD CONSTRAINT "Credential_companyId_fkey" FOREIGN KEY ("companyId") REFERENCES "Company"("id") ON DELETE CASCADE ON UPDATE CASCADE;

prisma/migrations/20260226042803_add_catalog_item/migration.sql

@@ -1,63 +0,0 @@
--- CreateTable
-CREATE TABLE "UnifiSite" (
-    "id" TEXT NOT NULL,
-    "name" TEXT NOT NULL,
-    "siteId" TEXT NOT NULL,
-    "companyId" TEXT,
-    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "updatedAt" TIMESTAMP(3) NOT NULL,
-
-    CONSTRAINT "UnifiSite_pkey" PRIMARY KEY ("id")
-);
-
--- CreateTable
-CREATE TABLE "CatalogItem" (
-    "id" TEXT NOT NULL,
-    "cwCatalogId" INTEGER NOT NULL,
-    "name" TEXT NOT NULL,
-    "description" TEXT,
-    "customerDescription" TEXT,
-    "internalNotes" TEXT,
-    "manufacturer" TEXT,
-    "manufactureCwId" INTEGER,
-    "partNumber" TEXT,
-    "vendorName" TEXT,
-    "vendorSku" TEXT,
-    "vendorCwId" INTEGER,
-    "price" DOUBLE PRECISION NOT NULL,
-    "cost" DOUBLE PRECISION NOT NULL,
-    "inactive" BOOLEAN NOT NULL DEFAULT false,
-    "salesTaxable" BOOLEAN NOT NULL DEFAULT true,
-    "onHand" INTEGER NOT NULL DEFAULT 0,
-    "cwLastUpdated" TIMESTAMP(3),
-    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "updatedAt" TIMESTAMP(3) NOT NULL,
-
-    CONSTRAINT "CatalogItem_pkey" PRIMARY KEY ("id")
-);
-
--- CreateTable
-CREATE TABLE "_LinkedItems" (
-    "A" TEXT NOT NULL,
-    "B" TEXT NOT NULL,
-
-    CONSTRAINT "_LinkedItems_AB_pkey" PRIMARY KEY ("A","B")
-);
-
--- CreateIndex
-CREATE UNIQUE INDEX "UnifiSite_siteId_key" ON "UnifiSite"("siteId");
-
--- CreateIndex
-CREATE UNIQUE INDEX "CatalogItem_cwCatalogId_key" ON "CatalogItem"("cwCatalogId");
-
--- CreateIndex
-CREATE INDEX "_LinkedItems_B_index" ON "_LinkedItems"("B");
-
--- AddForeignKey
-ALTER TABLE "UnifiSite" ADD CONSTRAINT "UnifiSite_companyId_fkey" FOREIGN KEY ("companyId") REFERENCES "Company"("id") ON DELETE SET NULL ON UPDATE CASCADE;
-
--- AddForeignKey
-ALTER TABLE "_LinkedItems" ADD CONSTRAINT "_LinkedItems_A_fkey" FOREIGN KEY ("A") REFERENCES "CatalogItem"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-
--- AddForeignKey
-ALTER TABLE "_LinkedItems" ADD CONSTRAINT "_LinkedItems_B_fkey" FOREIGN KEY ("B") REFERENCES "CatalogItem"("id") ON DELETE CASCADE ON UPDATE CASCADE;

prisma/migrations/20260226050000_add_opportunity/migration.sql

@@ -1,57 +0,0 @@
--- CreateTable
-CREATE TABLE "Opportunity" (
-    "id" TEXT NOT NULL,
-    "cwOpportunityId" INTEGER NOT NULL,
-    "name" TEXT NOT NULL,
-    "notes" TEXT,
-    "typeName" TEXT,
-    "typeCwId" INTEGER,
-    "stageName" TEXT,
-    "stageCwId" INTEGER,
-    "statusName" TEXT,
-    "statusCwId" INTEGER,
-    "priorityName" TEXT,
-    "priorityCwId" INTEGER,
-    "ratingName" TEXT,
-    "ratingCwId" INTEGER,
-    "source" TEXT,
-    "campaignName" TEXT,
-    "campaignCwId" INTEGER,
-    "primarySalesRepName" TEXT,
-    "primarySalesRepIdentifier" TEXT,
-    "primarySalesRepCwId" INTEGER,
-    "secondarySalesRepName" TEXT,
-    "secondarySalesRepIdentifier" TEXT,
-    "secondarySalesRepCwId" INTEGER,
-    "companyCwId" INTEGER,
-    "companyName" TEXT,
-    "contactCwId" INTEGER,
-    "contactName" TEXT,
-    "siteCwId" INTEGER,
-    "siteName" TEXT,
-    "customerPO" TEXT,
-    "totalSalesTax" DOUBLE PRECISION NOT NULL DEFAULT 0,
-    "locationName" TEXT,
-    "locationCwId" INTEGER,
-    "departmentName" TEXT,
-    "departmentCwId" INTEGER,
-    "expectedCloseDate" TIMESTAMP(3),
-    "pipelineChangeDate" TIMESTAMP(3),
-    "dateBecameLead" TIMESTAMP(3),
-    "closedDate" TIMESTAMP(3),
-    "closedFlag" BOOLEAN NOT NULL DEFAULT false,
-    "closedByName" TEXT,
-    "closedByCwId" INTEGER,
-    "companyId" TEXT,
-    "cwLastUpdated" TIMESTAMP(3),
-    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "updatedAt" TIMESTAMP(3) NOT NULL,
-
-    CONSTRAINT "Opportunity_pkey" PRIMARY KEY ("id")
-);
-
--- CreateIndex
-CREATE UNIQUE INDEX "Opportunity_cwOpportunityId_key" ON "Opportunity"("cwOpportunityId");
-
--- AddForeignKey
-ALTER TABLE "Opportunity" ADD CONSTRAINT "Opportunity_companyId_fkey" FOREIGN KEY ("companyId") REFERENCES "Company"("id") ON DELETE SET NULL ON UPDATE CASCADE;

prisma/migrations/20260228000000_add_catalog_item_identifier/migration.sql

@@ -1,5 +0,0 @@
--- AlterTable
-ALTER TABLE "CatalogItem" ADD COLUMN "identifier" TEXT;
-
--- CreateIndex
-CREATE UNIQUE INDEX "CatalogItem_identifier_key" ON "CatalogItem"("identifier");

prisma/migrations/20260302000000_add_missing_columns/migration.sql

@@ -1,11 +0,0 @@
--- AlterTable: User
-ALTER TABLE "User" ADD COLUMN "cwIdentifier" TEXT;
-
--- AlterTable: CatalogItem
-ALTER TABLE "CatalogItem" ADD COLUMN "category" TEXT;
-ALTER TABLE "CatalogItem" ADD COLUMN "categoryCwId" INTEGER;
-ALTER TABLE "CatalogItem" ADD COLUMN "subcategory" TEXT;
-ALTER TABLE "CatalogItem" ADD COLUMN "subcategoryCwId" INTEGER;
-
--- AlterTable: Opportunity
-ALTER TABLE "Opportunity" ADD COLUMN "productSequence" INTEGER[] DEFAULT ARRAY[]::INTEGER[];

prisma/migrations/20260305012604_store_generated_pdf_bytes/migration.sql

@@ -1,9 +0,0 @@
--- CreateTable
-CREATE TABLE "GeneratedQuotes" (
-    "id" TEXT NOT NULL,
-    "quoteFile" BYTEA NOT NULL,
-    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "updatedAt" TIMESTAMP(3) NOT NULL,
-
-    CONSTRAINT "GeneratedQuotes_pkey" PRIMARY KEY ("id")
-);

prisma/migrations/20260305013723_expand_generated_quotes_model/migration.sql

@@ -1,19 +0,0 @@
-/*
-  Warnings:
-
-  - Added the required column `opportunityId` to the `GeneratedQuotes` table without a default value. This is not possible if the table is not empty.
-  - Added the required column `quoteFileName` to the `GeneratedQuotes` table without a default value. This is not possible if the table is not empty.
-  - Added the required column `quoteRegenData` to the `GeneratedQuotes` table without a default value. This is not possible if the table is not empty.
-
-*/
--- AlterTable
-ALTER TABLE "GeneratedQuotes" ADD COLUMN     "createdById" TEXT,
-ADD COLUMN     "opportunityId" TEXT NOT NULL,
-ADD COLUMN     "quoteFileName" TEXT NOT NULL,
-ADD COLUMN     "quoteRegenData" JSONB NOT NULL;
-
--- AddForeignKey
-ALTER TABLE "GeneratedQuotes" ADD CONSTRAINT "GeneratedQuotes_opportunityId_fkey" FOREIGN KEY ("opportunityId") REFERENCES "Opportunity"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-
--- AddForeignKey
-ALTER TABLE "GeneratedQuotes" ADD CONSTRAINT "GeneratedQuotes_createdById_fkey" FOREIGN KEY ("createdById") REFERENCES "User"("id") ON DELETE SET NULL ON UPDATE CASCADE;

prisma/migrations/20260307000000_add_opportunity_probability/migration.sql

@@ -1,2 +0,0 @@
--- AlterTable: Opportunity
-ALTER TABLE "Opportunity" ADD COLUMN "probability" DOUBLE PRECISION NOT NULL DEFAULT 0;

prisma/migrations/20260307010000_add_missing_generated_quotes_columns/migration.sql

@@ -1,10 +0,0 @@
--- AlterTable: GeneratedQuotes — add columns missing from prior db push
-ALTER TABLE "GeneratedQuotes" ADD COLUMN "quoteRegenParams" JSONB NOT NULL DEFAULT '{}';
-ALTER TABLE "GeneratedQuotes" ADD COLUMN "quoteRegenHash" TEXT NOT NULL DEFAULT '';
-ALTER TABLE "GeneratedQuotes" ADD COLUMN "downloads" JSONB NOT NULL DEFAULT '[]';
-
--- AlterTable: GeneratedQuotes — set default on existing quoteRegenData column
-ALTER TABLE "GeneratedQuotes" ALTER COLUMN "quoteRegenData" SET DEFAULT '{}';
-
--- CreateIndex
-CREATE UNIQUE INDEX "GeneratedQuotes_quoteRegenHash_key" ON "GeneratedQuotes"("quoteRegenHash");

prisma/migrations/20260309000000_add_cw_member_table/migration.sql

@@ -1,22 +0,0 @@
--- CreateTable
-CREATE TABLE "CwMember" (
-    "id" TEXT NOT NULL,
-    "cwMemberId" INTEGER NOT NULL,
-    "identifier" TEXT NOT NULL,
-    "firstName" TEXT NOT NULL,
-    "lastName" TEXT NOT NULL,
-    "officeEmail" TEXT,
-    "inactiveFlag" BOOLEAN NOT NULL DEFAULT false,
-    "apiKey" TEXT,
-    "cwLastUpdated" TIMESTAMP(3),
-    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "updatedAt" TIMESTAMP(3) NOT NULL,
-
-    CONSTRAINT "CwMember_pkey" PRIMARY KEY ("id")
-);
-
--- CreateIndex
-CREATE UNIQUE INDEX "CwMember_cwMemberId_key" ON "CwMember"("cwMemberId");
-
--- CreateIndex
-CREATE UNIQUE INDEX "CwMember_identifier_key" ON "CwMember"("identifier");

prisma/migrations/20260316031915_add_cw_date_entered/migration.sql

@@ -1,2 +0,0 @@
--- AlterTable
-ALTER TABLE "Opportunity" ADD COLUMN     "cwDateEntered" TIMESTAMP(3);

prisma/migrations/migration_lock.toml

@@ -1,3 +0,0 @@
-# Please do not edit this file manually
-# It should be added in your version-control system (e.g., Git)
-provider = "postgresql"

prisma/schema.prisma

@@ -1,290 +0,0 @@
-// This is your Prisma schema file,
-// learn more about it in the docs: https://pris.ly/d/prisma-schema
-
-// Looking for ways to speed up your queries, or scale easily with your serverless or edge functions?
-// Try Prisma Accelerate: https://pris.ly/cli/accelerate-init
-
-generator client {
-  provider = "prisma-client"
-  output   = "../generated/prisma"
-}
-
-datasource db {
-  provider = "postgresql"
-}
-
-model Session {
-  id                    String    @id @default(uuid())
-  sessionKey            String    @unique @default(cuid())
-  userId                String
-  expires               DateTime
-  refreshTokenGenerated Boolean   @default(false)
-  refreshedAt           DateTime?
-  invalidatedAt         DateTime?
-  user                  User      @relation(fields: [userId], references: [id], onDelete: Cascade)
-}
-
-model User {
-  id            String    @id @default(cuid())
-  roles         Role[]
-  permissions   String?
-  login         String    @unique
-  name          String?
-  email         String    @unique
-  emailVerified DateTime?
-  image         String?
-
-  cwIdentifier String?
-
-  userId String  @unique
-  token  String?
-
-  sessions Session[]
-
-  createdAt       DateTime          @default(now())
-  updatedAt       DateTime          @updatedAt
-  generatedQuotes GeneratedQuotes[]
-}
-
-model Role {
-  id      String @id @default(uuid())
-  title   String
-  moniker String @unique // e.g. admin, super_admin, moderator
-
-  permissions String
-  users       User[]
-
-  createdAt DateTime @default(now())
-  updatedAt DateTime @updatedAt
-}
-
-model UnifiSite {
-  id   String @id @default(cuid())
-  name String
-
-  siteId String @unique
-
-  companyId String?
-  company   Company? @relation(fields: [companyId], references: [id])
-
-  createdAt DateTime @default(now())
-  updatedAt DateTime @updatedAt
-}
-
-model Company {
-  id   String @id @default(cuid())
-  name String
-
-  cw_CompanyId  Int    @unique
-  cw_Identifier String @unique
-
-  credentials   Credential[]
-  unifiSites    UnifiSite[]
-  opportunities Opportunity[]
-
-  createdAt DateTime @default(now())
-  updatedAt DateTime @updatedAt
-}
-
-model CatalogItem {
-  id                  String  @id @default(cuid())
-  cwCatalogId         Int     @unique
-  identifier          String? @unique
-  name                String
-  description         String?
-  customerDescription String?
-  internalNotes       String?
-
-  linkedItems CatalogItem[] @relation("LinkedItems")
-  linkedTo    CatalogItem[] @relation("LinkedItems")
-
-  category        String?
-  categoryCwId    Int?
-  subcategory     String?
-  subcategoryCwId Int?
-
-  manufacturer    String?
-  manufactureCwId Int?
-
-  partNumber String?
-
-  vendorName String?
-  vendorSku  String?
-  vendorCwId Int?
-
-  price Float
-  cost  Float
-
-  inactive     Boolean @default(false)
-  salesTaxable Boolean @default(true)
-
-  onHand        Int       @default(0)
-  cwLastUpdated DateTime?
-
-  createdAt DateTime @default(now())
-  updatedAt DateTime @updatedAt
-}
-
-model Opportunity {
-  id              String  @id @default(cuid())
-  cwOpportunityId Int     @unique
-  name            String
-  notes           String?
-
-  generatedQuotes GeneratedQuotes[]
-
-  // Stage / status / priority / type / rating stored as JSON references
-  // so we don't need separate lookup tables for CW enums
-  typeName     String?
-  typeCwId     Int?
-  stageName    String?
-  stageCwId    Int?
-  statusName   String?
-  statusCwId   Int?
-  priorityName String?
-  priorityCwId Int?
-  ratingName   String?
-  ratingCwId   Int?
-  source       String?
-  campaignName String?
-  campaignCwId Int?
-
-  // Sales rep references
-  primarySalesRepName         String?
-  primarySalesRepIdentifier   String?
-  primarySalesRepCwId         Int?
-  secondarySalesRepName       String?
-  secondarySalesRepIdentifier String?
-  secondarySalesRepCwId       Int?
-
-  // Company / contact / site
-  companyCwId Int?
-  companyName String?
-  contactCwId Int?
-  contactName String?
-  siteCwId    Int?
-  siteName    String?
-  customerPO  String?
-
-  // Financials
-  totalSalesTax Float @default(0)
-  probability   Float @default(0)
-
-  // Location / department
-  locationName   String?
-  locationCwId   Int?
-  departmentName String?
-  departmentCwId Int?
-
-  // Dates
-  expectedCloseDate  DateTime?
-  pipelineChangeDate DateTime?
-  dateBecameLead     DateTime?
-  closedDate         DateTime?
-  closedFlag         Boolean   @default(false)
-  closedByName       String?
-  closedByCwId       Int?
-
-  // Internal relation to Company (optional, linked by cwCompanyId)
-  companyId String?
-  company   Company? @relation(fields: [companyId], references: [id])
-
-  // Local product sequence — array of CW forecast item IDs in display order.
-  // When present, fetchProducts() uses this order instead of CW sequenceNumber.
-  productSequence Int[] @default([])
-
-  cwLastUpdated DateTime?
-  cwDateEntered DateTime?
-
-  createdAt DateTime @default(now())
-  updatedAt DateTime @updatedAt
-}
-
-model CredentialType {
-  id   String @id @default(cuid())
-  name String @unique
-
-  permissionScope String
-  icon            String?
-  fields          Json
-
-  credentials Credential[]
-
-  createdAt DateTime @default(now())
-  updatedAt DateTime @updatedAt
-}
-
-model SecureValue {
-  id   String @id @default(cuid())
-  name String
-
-  content String // Encrypted content
-  hash    String // Hash of the original content for integrity verification and Search
-
-  credentialId String
-  credential   Credential @relation(fields: [credentialId], references: [id], onDelete: Cascade)
-
-  createdAt DateTime @default(now())
-  updatedAt DateTime @updatedAt
-}
-
-model Credential {
-  id                String       @id @default(cuid())
-  name              String
-  notes             String?
-  subCredentialOfId String?
-  subCredentialOf   Credential?  @relation("SubCredentials", fields: [subCredentialOfId], references: [id], onDelete: Cascade)
-  subCredentials    Credential[] @relation("SubCredentials")
-
-  typeId String
-  type   CredentialType @relation(fields: [typeId], references: [id], onDelete: Cascade)
-
-  fields Json
-
-  companyId String
-  company   Company @relation(fields: [companyId], references: [id], onDelete: Cascade)
-
-  securevalues SecureValue[]
-
-  createdAt DateTime @default(now())
-  updatedAt DateTime @updatedAt
-}
-
-model GeneratedQuotes {
-  id String @id @default(uuid())
-
-  quoteRegenData   Json   @default("{}") // Store any additional data needed for quote regeneration, such as product details, pricing, etc.
-  quoteRegenParams Json   @default("{}") // Store parameters used for quote regeneration, such as template ID, formatting options, etc.
-  quoteRegenHash   String @unique @default("")
-
-  downloads Json @default("[]") // Array of download records with timestamp and user info
-
-  quoteFile     Bytes
-  quoteFileName String
-
-  opportunityId String
-  opportunity   Opportunity @relation(fields: [opportunityId], references: [id], onDelete: Cascade)
-
-  createdById String?
-  createdBy   User?   @relation(fields: [createdById], references: [id], onDelete: SetNull)
-
-  createdAt DateTime @default(now())
-  updatedAt DateTime @updatedAt
-}
-
-model CwMember {
-  id String @id @default(cuid())
-
-  cwMemberId   Int     @unique
-  identifier   String  @unique
-  firstName    String
-  lastName     String
-  officeEmail  String?
-  inactiveFlag Boolean @default(false)
-
-  apiKey String?
-
-  cwLastUpdated DateTime?
-  createdAt     DateTime  @default(now())
-  updatedAt     DateTime  @updatedAt
-}

src/Errors/AuthenticationError.ts

@@ -1,8 +0,0 @@
-export default class AuthenticationError extends Error {
-  constructor(message: string, cause?: string) {
-    super();
-    this.name = "AuthenticationError";
-    this.message = message;
-    this.cause = cause;
-  }
-}

src/Errors/AuthorizationError.ts

@@ -1,11 +0,0 @@
-export default class AuthorizationError extends Error {
-  public status: number;
-
-  constructor(message: string, cause?: string, status?: number) {
-    super();
-    this.name = "AuthorizationError";
-    this.status = status ?? 401;
-    this.message = message;
-    this.cause = cause;
-  }
-}

src/Errors/BodyError.ts

@@ -1,8 +0,0 @@
-export default class BodyError extends Error {
-  constructor(message: string, cause?: string) {
-    super();
-    this.name = "BodyError";
-    this.message = message;
-    this.cause = cause;
-  }
-}

src/Errors/ExpiredAccessTokenError.ts

@@ -1,8 +0,0 @@
-export default class ExpiredAccessTokenError extends Error {
-  constructor(cause?: string) {
-    super();
-    this.name = "ExpiredAccessTokenError";
-    this.message = "The provided access token has expired.";
-    this.cause = cause;
-  }
-}

src/Errors/ExpiredRefreshTokenError.ts

@@ -1,8 +0,0 @@
-export default class ExpiredRefreshTokenError extends Error {
-  constructor(cause?: string) {
-    super();
-    this.name = "ExpiredRefreshTokenError";
-    this.message = "The provided refresh token has expired.";
-    this.cause = cause;
-  }
-}

src/Errors/GenericError.ts

@@ -1,16 +0,0 @@
-export default class GenericError extends Error {
-  public status: number;
-
-  constructor(info: {
-    name: string;
-    message: string;
-    cause?: string;
-    status?: number;
-  }) {
-    super();
-    this.name = info.name;
-    this.status = info.status ?? 400;
-    this.message = info.message;
-    this.cause = info.cause;
-  }
-}

src/Errors/InsufficientPermission.ts

@@ -1,11 +0,0 @@
-export default class InsufficientPermission extends Error {
-  public status: number;
-
-  constructor(message: string, cause?: string) {
-    super();
-    this.name = "InsufficientPermission";
-    this.status = 403;
-    this.message = message;
-    this.cause = cause;
-  }
-}

src/Errors/MissingBodyValue.ts

@@ -1,9 +0,0 @@
-export default class MissingBodyValue extends Error {
-  constructor(valueName: string) {
-    super();
-    this.name = "MissingBodyValue";
-    this.message = `Value '${valueName}' is missing from the body.`;
-    this.cause =
-      "A value that was required by the body of this request is missing.";
-  }
-}

src/Errors/PermissionsVerificationError.ts

@@ -1,8 +0,0 @@
-export default class PermissionsVerificationError extends Error {
-  constructor(message: string, cause?: string) {
-    super();
-    this.name = "PermissionsVerificationError";
-    this.message = message;
-    this.cause = cause;
-  }
-}

src/Errors/RoleError.ts

@@ -1,8 +0,0 @@
-export default class RoleError extends Error {
-  constructor(message: string, cause?: string) {
-    super();
-    this.name = "RoleError";
-    this.message = message;
-    this.cause = cause;
-  }
-}

src/Errors/SessionError.ts

@@ -1,8 +0,0 @@
-export default class SessionError extends Error {
-  constructor(message: string, cause?: string) {
-    super();
-    this.name = "SessionError";
-    this.message = message;
-    this.cause = cause;
-  }
-}

src/Errors/SessionTokenError.ts

@@ -1,8 +0,0 @@
-export default class SessionTokenError extends Error {
-  constructor(message: string, cause?: string) {
-    super();
-    this.name = "SessionTokenError";
-    this.message = message;
-    this.cause = cause;
-  }
-}

src/Errors/UserError.ts

@@ -1,8 +0,0 @@
-export default class UserError extends Error {
-  constructor(message: string, cause?: string) {
-    super();
-    this.name = "UserError";
-    this.message = message;
-    this.cause = cause;
-  }
-}

src/api/auth/index.ts

@@ -1,3 +0,0 @@
-export { default as redirect } from "./redirect";
-export { default as refresh } from "./refresh";
-export { default as uri } from "./uri";

src/api/auth/redirect.ts

@@ -1,39 +0,0 @@
-import { Hono } from "hono/tiny";
-import { createRoute } from "../../modules/api-utils/createRoute";
-import * as msal from "@azure/msal-node";
-import { API_BASE_URL, io, msalClient } from "../../constants";
-import { users } from "../../managers/users";
-
-/* /v1/auth/redirect */
-export default createRoute("get", ["/redirect"], async (c) => {
-  c.status(200);
-
-  const tokenRequest: msal.AuthorizationCodeRequest = {
-    code: c.req.query().code as string,
-    scopes: ["user.read"],
-    redirectUri: `${API_BASE_URL}/v1/auth/redirect`,
-  };
-
-  const authResult = await msalClient.acquireTokenByCode(tokenRequest);
-  const callbackKey = c.req.query().state as string;
-  const tokens = await users.authenticate(authResult);
-
-  io.of(`/auth_callback`).emit(`auth:login:callback:${callbackKey}`, {
-    accessToken: tokens.accessToken,
-    refreshToken: tokens.refreshToken,
-  });
-
-  // Close the window because duh
-  return c.html(
-    `<script>
-      window.close();
-    </script>`,
-  );
-
-  return c.json({
-    status: 200,
-    message: "Auth Redirect Endpoint",
-    data: authResult,
-    successful: true,
-  });
-});

src/api/auth/refresh.ts

@@ -1,26 +0,0 @@
-import { Hono } from "hono/tiny";
-import { createRoute } from "../../modules/api-utils/createRoute";
-import { sessions } from "../../managers/sessions";
-
-/* /v1/auth/refresh */
-export default createRoute("post", ["/refresh"], async (c) => {
-  c.status(201);
-
-  const refreshToken = c.req.header("x-refresh-token") || "";
-
-  const session = await sessions.fetch({
-    refreshToken: refreshToken,
-  });
-
-  const newAccessToken = await session.refresh(refreshToken);
-
-  return c.json({
-    status: 201,
-    message: "Token refreshed successfully!",
-    data: {
-      accessToken: newAccessToken,
-      refreshToken,
-    },
-    successful: true,
-  });
-});

src/api/auth/uri.ts

@@ -1,23 +0,0 @@
-import { Hono } from "hono/tiny";
-import { createRoute } from "../../modules/api-utils/createRoute";
-import { API_BASE_URL } from "../../constants";
-import cuid from "cuid";
-
-/* /v1/auth/uri */
-export default createRoute("get", ["/uri"], (c) => {
-  c.status(200);
-
-  const callbackKey = cuid();
-  const redirectUri = encodeURIComponent(`${API_BASE_URL}/v1/auth/redirect`);
-  const msUri = `https://login.microsoftonline.com/${process.env.MICROSOFT_TENANT_ID}/oauth2/v2.0/authorize?client_id=${process.env.MICROSOFT_CLIENT_ID}&response_type=code&redirect_uri=${redirectUri}&scope=openid+User.Read&state=${callbackKey}&prompt=login`;
-
-  return c.json({
-    status: 200,
-    message: "Successfully fetch Auth URI",
-    data: {
-      uri: msUri,
-      callbackKey: callbackKey,
-    },
-    successful: true,
-  });
-});

src/api/companies/[id]/configurations.ts

@@ -1,26 +0,0 @@
-import { Hono } from "hono/tiny";
-import { createRoute } from "../../../modules/api-utils/createRoute";
-import { companies } from "../../../managers/companies";
-import { apiResponse } from "../../../modules/api-utils/apiResponse";
-import { ContentfulStatusCode } from "hono/utils/http-status";
-import { authMiddleware } from "../../middleware/authorization";
-
-/* /v1/company/companies/[id]/configurations */
-export default createRoute(
-  "get",
-  ["/companies/:identifier/configurations"],
-
-  async (c) => {
-    const company = await companies.fetch(c.req.param("identifier"));
-    const configurations = await company.fetchConfigurations();
-
-    const response = apiResponse.successful(
-      "Company Configurations Fetched Successfully!",
-      configurations,
-    );
-    return c.json(response, response.status as ContentfulStatusCode);
-  },
-  authMiddleware({
-    permissions: ["company.fetch", "company.fetch.configurations"],
-  }),
-);

src/api/companies/[id]/fetch.ts

@@ -1,64 +0,0 @@
-import { Hono } from "hono/tiny";
-import { createRoute } from "../../../modules/api-utils/createRoute";
-import { companies } from "../../../managers/companies";
-import { apiResponse } from "../../../modules/api-utils/apiResponse";
-import { ContentfulStatusCode } from "hono/utils/http-status";
-import { authMiddleware } from "../../middleware/authorization";
-import GenericError from "../../../Errors/GenericError";
-import { processObjectValuePerms } from "../../../modules/permission-utils/processObjectPermissions";
-
-/* /v1/company/companies/[id] */
-export default createRoute(
-  "get",
-  ["/companies/:identifier"],
-
-  async (c) => {
-    const company = await companies.fetch(c.req.param("identifier"));
-    const includeAddress = c.req.query("includeAddress") === "true";
-    const includePrimaryContact =
-      c.req.query("includePrimaryContact") === "true";
-    const includeAllContacts = c.req.query("includeAllContacts") === "true";
-
-    // Check for address-specific permission if includeAddress is requested
-    if (includeAddress) {
-      const user = c.get("user");
-      if (!user || !(await user.hasPermission("company.fetch.address"))) {
-        throw new GenericError({
-          name: "InsufficientPermission",
-          message: "You do not have permission to view company addresses.",
-          status: 403,
-        });
-      }
-    }
-
-    // Check for contacts permission if includeAllContacts is requested
-    if (includeAllContacts) {
-      const user = c.get("user");
-      if (!user || !(await user.hasPermission("company.fetch.contacts"))) {
-        throw new GenericError({
-          name: "InsufficientPermission",
-          message: "You do not have permission to view company contacts.",
-          status: 403,
-        });
-      }
-    }
-
-    const companyData = company.toJson({
-      includeAddress,
-      includePrimaryContact,
-      includeAllContacts,
-    });
-    const gatedData = await processObjectValuePerms(
-      companyData,
-      "obj.company",
-      c.get("user"),
-    );
-
-    const response = apiResponse.successful(
-      "Company Fetched Successfully!",
-      gatedData,
-    );
-    return c.json(response, response.status as ContentfulStatusCode);
-  },
-  authMiddleware({ permissions: ["company.fetch"] }),
-);

src/api/companies/[id]/sites.ts

@@ -1,25 +0,0 @@
-import { createRoute } from "../../../modules/api-utils/createRoute";
-import { companies } from "../../../managers/companies";
-import { apiResponse } from "../../../modules/api-utils/apiResponse";
-import { ContentfulStatusCode } from "hono/utils/http-status";
-import { authMiddleware } from "../../middleware/authorization";
-
-/* /v1/company/companies/[id]/sites */
-export default createRoute(
-  "get",
-  ["/companies/:identifier/sites"],
-
-  async (c) => {
-    const company = await companies.fetch(c.req.param("identifier"));
-    const sites = await company.fetchSites();
-
-    const response = apiResponse.successful(
-      "Company Sites Fetched Successfully!",
-      sites,
-    );
-    return c.json(response, response.status as ContentfulStatusCode);
-  },
-  authMiddleware({
-    permissions: ["company.fetch", "company.fetch.sites"],
-  }),
-);

src/api/companies/[id]/unifiSites.ts

@@ -1,32 +0,0 @@
-import { createRoute } from "../../../modules/api-utils/createRoute";
-import { unifiSites } from "../../../managers/unifiSites";
-import { companies } from "../../../managers/companies";
-import { apiResponse } from "../../../modules/api-utils/apiResponse";
-import { ContentfulStatusCode } from "hono/utils/http-status";
-import { authMiddleware } from "../../middleware/authorization";
-import { processObjectValuePerms } from "../../../modules/permission-utils/processObjectPermissions";
-
-/* GET /v1/company/companies/:identifier/unifi/sites */
-export default createRoute(
-  "get",
-  ["/companies/:identifier/unifi/sites"],
-  async (c) => {
-    const company = await companies.fetch(c.req.param("identifier"));
-    const sites = await unifiSites.fetchByCompany(company.id);
-
-    const gatedData = await Promise.all(
-      sites.map((site) =>
-        processObjectValuePerms(site, "obj.unifiSite", c.get("user")),
-      ),
-    );
-
-    const response = apiResponse.successful(
-      "Company UniFi Sites Fetched Successfully!",
-      gatedData,
-    );
-    return c.json(response, response.status as ContentfulStatusCode);
-  },
-  authMiddleware({
-    permissions: ["unifi.access", "company.fetch"],
-  }),
-);

src/api/companies/count.ts

@@ -1,25 +0,0 @@
-import { Hono } from "hono/tiny";
-import { createRoute } from "../../modules/api-utils/createRoute";
-import { companies } from "../../managers/companies";
-import { apiResponse } from "../../modules/api-utils/apiResponse";
-import { ContentfulStatusCode } from "hono/utils/http-status";
-import { authMiddleware } from "../middleware/authorization";
-
-/* /v1/company/count */
-export default createRoute(
-  "get",
-  ["/count"],
-  async (c) => {
-    const count = await companies.count();
-
-    const response = apiResponse.successful(
-      "Company count fetched successfully!",
-      {
-        count,
-      },
-    );
-
-    return c.json(response, response.status as ContentfulStatusCode);
-  },
-  authMiddleware({ permissions: ["company.fetch.many"] }),
-);

src/api/companies/fetchAll.ts

@@ -1,50 +0,0 @@
-import { Hono } from "hono/tiny";
-import { createRoute } from "../../modules/api-utils/createRoute";
-import { companies } from "../../managers/companies";
-import { apiResponse } from "../../modules/api-utils/apiResponse";
-import { ContentfulStatusCode } from "hono/utils/http-status";
-import { authMiddleware } from "../middleware/authorization";
-import { processObjectValuePerms } from "../../modules/permission-utils/processObjectPermissions";
-
-/* /v1/company/companies */
-export default createRoute(
-  "get",
-  ["/companies"],
-  async (c) => {
-    const page = new Number(c.req.query("page") ?? 1) as number;
-    const rpp = new Number(c.req.query("rpp") ?? 30) as number; // Records Per Page
-    const search = c.req.query("search") as string;
-
-    const data = search
-      ? await companies.search(search, page, rpp)
-      : await companies.fetchPages(page, rpp);
-
-    const companyQty = search
-      ? (await companies.search(search, 1, 999999)).length
-      : await companies.count();
-
-    const gatedData = await Promise.all(
-      data.map((item) =>
-        processObjectValuePerms(item, "obj.company", c.get("user")),
-      ),
-    );
-
-    let response = apiResponse.successful(
-      "Companies Fetched Successfully!",
-      gatedData,
-      {
-        pagination: {
-          previousPage: page == 1 ? null : page - 1, // Previous Page
-          currentPage: page, // Current Page
-          nextPage: page >= companyQty / rpp ? null : page + 1, // Next Page
-          totalPages: Math.ceil(companyQty / rpp), // Total Number of Pages
-          totalRecords: companyQty, // Total Number of Records
-          listedRecords: rpp, // Total Number of Records being recieved at time of request.
-        },
-      },
-    );
-
-    return c.json(response, response.status as ContentfulStatusCode);
-  },
-  authMiddleware({ permissions: ["company.fetch.many"] }),
-);

src/api/companies/index.ts

@@ -1,8 +0,0 @@
-import { default as fetchAll } from "./fetchAll";
-import { default as fetch } from "./[id]/fetch";
-import { default as configurations } from "./[id]/configurations";
-import { default as sites } from "./[id]/sites";
-import { default as unifiSites } from "./[id]/unifiSites";
-import { default as count } from "./count";
-
-export { configurations, count, fetch, fetchAll, sites, unifiSites };

src/api/credential-types/create.ts

@@ -1,49 +0,0 @@
-import { Hono } from "hono/tiny";
-import { createRoute } from "../../modules/api-utils/createRoute";
-import { credentialTypes } from "../../managers/credentialTypes";
-import { apiResponse } from "../../modules/api-utils/apiResponse";
-import { ContentfulStatusCode } from "hono/utils/http-status";
-import { authMiddleware } from "../middleware/authorization";
-import { z } from "zod";
-import { ValueType } from "../../modules/credentials/credentialTypeDefs";
-
-/* /v1/credential-type */
-export default createRoute(
-  "post",
-  ["/"],
-
-  async (c) => {
-    const body = await c.req.json();
-
-    const fieldSchema: z.ZodType<any> = z.lazy(() =>
-      z.object({
-        id: z.string(),
-        name: z.string(),
-        required: z.boolean(),
-        secure: z.boolean(),
-        valueType: z.enum(Object.values(ValueType)),
-        subFields: z.array(fieldSchema).optional(),
-      }),
-    );
-
-    const schema = z.object({
-      name: z.string().min(1, "Name is required"),
-      permissionScope: z.string().min(1, "Permission scope is required"),
-      icon: z.string().optional(),
-      fields: z.array(fieldSchema),
-    });
-
-    const data = schema.parse(body);
-
-    console.log("Creating Credential Type with data:", data);
-
-    const credentialType = await credentialTypes.create(data as any);
-
-    const response = apiResponse.created(
-      "Credential Type Created Successfully!",
-      credentialType.toJson(),
-    );
-    return c.json(response, response.status as ContentfulStatusCode);
-  },
-  authMiddleware({ permissions: ["credential_type.create"] }),
-);

src/api/credential-types/delete.ts

@@ -1,23 +0,0 @@
-import { Hono } from "hono/tiny";
-import { createRoute } from "../../modules/api-utils/createRoute";
-import { credentialTypes } from "../../managers/credentialTypes";
-import { apiResponse } from "../../modules/api-utils/apiResponse";
-import { ContentfulStatusCode } from "hono/utils/http-status";
-import { authMiddleware } from "../middleware/authorization";
-
-/* /v1/credential-type/:id */
-export default createRoute(
-  "delete",
-  ["/:id"],
-
-  async (c) => {
-    await credentialTypes.delete(c.req.param("id"));
-
-    const response = apiResponse.successful(
-      "Credential Type Deleted Successfully!",
-      null,
-    );
-    return c.json(response, response.status as ContentfulStatusCode);
-  },
-  authMiddleware({ permissions: ["credential_type.delete"] }),
-);