Initial Commit

openspec/changes/enterprise-api-plugin-contacts/proposal.md

@@ -0,0 +1,78 @@
+# OpenSpec Change: enterprise-api-plugin-contacts
+
+- **Change ID**: enterprise-api-plugin-contacts
+- **Package**: `@suaveplan/api-plugin-contacts`
+- **Category**: api/comms
+- **Target path**: `api/comms/api-plugin-contacts`
+- **Status**: PROPOSED
+- **Date**: 2026-04-24
+- **Reference spec**: `/mnt/s/web/suaveplan/enterprise/api-plugin-contacts.md`
+
+---
+
+## Summary
+
+Deliver `@suaveplan/api-plugin-contacts` on the genesis branch from scratch at enterprise quality. Contact book plugin: contact CRUD, custom fields (arbitrary key/value), tags, lists, import/export (CSV via `@suaveplan/password-formats` CSV pattern), deduplication via `@suaveplan/dedup`, domain normalization via `@suaveplan/domain-normalizer`, GDPR consent tracking, and per-contact suppression status. Routes under `/contacts`. Per-table SurrealQL. Typed bus events: `contacts:created`, `contacts:merged`, `contacts:deleted`.
+
+---
+
+## Available workspace deps on genesis
+
+| Package | Role |
+|---|---|
+| `@suaveplan/api` (`workspace:^`) | `definePlugin` |
+| `@suaveplan/api-shared` (`workspace:^`) | Helpers |
+| `@suaveplan/api-plugin-auth` (`workspace:^`) | `requireAuth` |
+| `@suaveplan/api-plugin-database` (`workspace:^`) | SurrealDB |
+| `@suaveplan/dedup` (`workspace:^`) | Duplicate detection + merge |
+| `@suaveplan/domain-normalizer` (`workspace:^`) | Email domain normalization |
+| `@suaveplan/suppression` (`workspace:^`) | Per-contact suppression |
+| `@suaveplan/data-masking` (`workspace:^`) | PII masking on export |
+| `@suaveplan/events` (`workspace:^`) | Event bus |
+| `@suaveplan/error` (`workspace:^`) | `ContactsError` hierarchy |
+| `@suaveplan/rate-limiter` (`workspace:^`) | Rate limits |
+| `hono` + `@hono/zod-openapi` + `zod` | Routes |
+| `@opentelemetry/api` | OTel |
+
+---
+
+## Public API surface
+
+```ts
+function createContactsPlugin(config?: ContactsPluginConfig): PluginDescriptor
+// Services: ContactService, ListService, ImportService, ExportService, DeduplicationService
+// Routes: /contacts, /contacts/:id, /contacts/import, /contacts/export,
+//         /contacts/lists, /contacts/lists/:id, /contacts/:id/suppress
+```
+
+### Error codes
+
+```ts
+type ContactsErrorCode =
+  | "CONTACTS_NOT_FOUND"
+  | "CONTACTS_DUPLICATE"
+  | "CONTACTS_LIST_NOT_FOUND"
+  | "CONTACTS_IMPORT_FAILED"
+  | "CONTACTS_EXPORT_FAILED"
+```
+
+---
+
+## File layout
+
+```text
+api/comms/api-plugin-contacts/
+  package.json  tsconfig.json  vitest.config.ts
+  surql/ (contact, contact_custom_field, contact_tag, contact_list, contact_list_member, gdpr_consent tables)
+  src/
+    index.ts  events.ts  types/  errors/
+    services/contact/  services/list/  services/import/  services/export/  services/deduplication/
+    routes/contacts/  routes/lists/
+  tests/integration.test.ts
+```
+
+---
+
+## Impact
+
+Prerequisites: `@suaveplan/api`, `@suaveplan/api-plugin-auth`, `@suaveplan/api-plugin-database`, `@suaveplan/dedup`, `@suaveplan/domain-normalizer`, `@suaveplan/suppression`, `@suaveplan/data-masking`.

openspec/changes/enterprise-api-plugin-contacts/tasks.md

@@ -0,0 +1,58 @@
+# Tasks: enterprise-api-plugin-contacts
+
+**Change ID**: enterprise-api-plugin-contacts
+**Package**: `@suaveplan/api-plugin-contacts`
+**Target path**: `api/comms/api-plugin-contacts`
+**Prerequisite packages on Verdaccio**: `@suaveplan/api`, `@suaveplan/api-shared`, `@suaveplan/api-plugin-auth`, `@suaveplan/api-plugin-database`, `@suaveplan/dedup`, `@suaveplan/domain-normalizer`, `@suaveplan/suppression`, `@suaveplan/data-masking`, `@suaveplan/events`, `@suaveplan/rate-limiter`, `@suaveplan/error`
+
+---
+
+## 0. Pre-flight (non-negotiable)
+
+- [ ] 0.1 Confirm clean working tree (`git status` reports nothing) and no in-flight worktrees with uncommitted work (`git worktree list` then `git status` in each)
+- [ ] 0.2 If any worktrees exist under `.claude/worktrees/`, account for each one: still-active agent, work-pending-merge, or stale-and-prune. Stale worktrees MUST be removed (`git worktree remove`) before opening a new one — code that has been lost twice on main is the failure mode this guards against.
+- [ ] 0.3 Confirm the package set in `MANIFEST.md` matches `find packages -maxdepth 3 -name package.json` count. Drift here means a prior change archived without regenerating the manifest.
+
+## 1. Scaffold + types + errors + events
+
+- [ ] Create `api/comms/api-plugin-contacts/`; `package.json` v0.0.0; standard tooling.
+- [ ] Types: `Contact`, `ContactCustomField`, `ContactTag`, `ContactList`, `GdprConsent`, `ContactsPluginConfig` (Zod).
+- [ ] Errors: 5-code union + metadata + registration. Test + doc.
+- [ ] Events: `ContactsEventMap` (contacts:created, contacts:updated, contacts:merged, contacts:deleted).
+
+---
+
+## 2. SurrealQL
+
+- [ ] `contact.surql`, `contact_custom_field.surql`, `contact_tag.surql`, `contact_list.surql`, `contact_list_member.surql`, `gdpr_consent.surql`. tenantId indexes; email unique index per tenant.
+
+---
+
+## 3. Services (each `.test.ts` + `.md`)
+
+- [ ] **ContactService**: `createContact` (email normalised via `@suaveplan/domain-normalizer`), `updateContact`, `deleteContact`, `getContact`, `listContacts` (filterable by tag/list/suppression status).
+- [ ] **ListService**: `createList`, `updateList`, `deleteList`, `addContactToList`, `removeContactFromList`, `listLists`.
+- [ ] **ImportService**: parse CSV; normalise emails; check dedup via `@suaveplan/dedup`; bulk upsert; return import summary.
+- [ ] **ExportService**: query contacts; mask PII fields via `@suaveplan/data-masking`; export to CSV.
+- [ ] **DeduplicationService**: `findDuplicates(contactId)`, `mergeContacts(sourceId, targetId)`. Emit `contacts:merged`; update suppression records.
+
+---
+
+## 4. Routes
+
+- [ ] `GET/POST /contacts`, `GET/PATCH/DELETE /contacts/:id` — `requireAuth`.
+- [ ] `POST /contacts/import` — `requireAuth` + rate-limit.
+- [ ] `GET /contacts/export` — `requireAuth`.
+- [ ] `POST /contacts/:id/suppress`, `DELETE /contacts/:id/suppress` — `requireAuth` + audit.
+- [ ] `GET/POST /contacts/lists`, `PATCH/DELETE /contacts/lists/:id` — `requireAuth`.
+- [ ] Route `.test.ts` + `.md`.
+
+---
+
+## 5. Plugin factory + integration tests + publish
+
+- [ ] `createContactsPlugin`: `definePlugin`, `dependencies: ["database", "auth"]`, `migrationsPath: "./surql"`.
+- [ ] Integration: create contacts → import CSV → dedup merge → export masked CSV (real SurrealDB).
+- [ ] `bunx turbo lint typecheck test --filter=@suaveplan/api-plugin-contacts` — green; 100% coverage.
+- [ ] `bun scripts/publish.ts --package @suaveplan/api-plugin-contacts`.
+- [ ] Archive → `openspec/archive/2026-04-24-enterprise-api-plugin-contacts/`.