Release v1.14.0

.env.example

@@ -18,6 +18,10 @@ RESEND_FROM_EMAIL=
 # Signing secret for the Resend webhook's endpoint (Resend dashboard → the webhook).
 RESEND_WEBHOOK_SECRET=
 
+# Shared secret Vercel Cron sends as `Authorization: Bearer <value>` — verified
+# by the manager-digest cron routes (app/api/cron/manager-{daily,weekly}-digest).
+CRON_SECRET=
+
 # Dev-bypass login (see lib/utils.ts#isBypassAllowed) is disabled by default
 # on any host, including production deployments not on Vercel. This repo's
 # `dev` script is plain `next dev --turbopack` (no Vercel CLI), so VERCEL_ENV

CLAUDE.md

@@ -17,6 +17,7 @@ Next.js 16 (App Router, React 19) · Prisma 7 · Tailwind CSS 4 · shadcn/ui (Ra
 - **IMPORTANT: routes under `app/api/` are forbidden except for the ones allowlisted here.** Mutations are Server Actions; a route earns a line below only when it needs something an action cannot have, and a new route is a rule change that appends to this list.
   - `app/api/auth/[...path]/route.ts` — Better Auth needs a reachable HTTP endpoint.
   - `app/api/webhooks/resend/route.ts` — Resend signs the **raw** request body, which a server action never sees.
+  - `app/api/cron/manager-daily-digest/route.ts` and `app/api/cron/manager-weekly-digest/route.ts` — Vercel Cron needs an HTTP trigger on a schedule, which a server action cannot have. **Each route runs exactly the one digest its path names — these are not a job runner; a third job needs its own route, its own line, and its own justification.**
 - **Mutations are Server Actions** in `prisma/actions/`, each with `'use server'`, an auth check, and zod validation. They return **`void` / the relevant data on success, `{ error }` for a user-facing failure, and `throw` for unexpected ones — never `{ ok }`** (`docs/ENGINEERING.md` §4). Decision test: _would you show this exact sentence to the user, and can they act on it?_ **yes → `{ error }`, no → throw**.
 - **Data fetching is server-side** — server components call data-fetching functions in `prisma/data/`; Prisma never runs in a client component. **Avoid `useEffect`** — almost every use is a mistake here, and an empty-deps `useEffect` is essentially never right.
 - **Default to server components**; add `'use client'` only for interactivity/hooks/browser APIs, on the smallest leaf possible.

README.md

@@ -30,15 +30,16 @@ cp .env.example .env.local
 
 Open `.env.local` and fill in the required variables:
 
-| Variable                | Description                                                                                                                                                                                 |
-| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `DATABASE_URL`          | Postgres connection string (pooled). Local Docker: `postgresql://admin:admin@localhost:5432/aplio`                                                                                          |
-| `DIRECT_URL`            | Direct (non-pooled) connection string. Local Docker: same as `DATABASE_URL`                                                                                                                 |
-| `BETTER_AUTH_SECRET`    | Signs session cookies. At least 32 characters: `openssl rand -base64 32`                                                                                                                    |
-| `BETTER_AUTH_URL`       | Production only, pinned to the real domain. Preview/local derive it from `VERCEL_URL`, else `http://localhost:3000`. Also governs the absolute URLs (logo, sign-in link) in outgoing email. |
-| `RESEND_API_KEY`        | Resend API key for transactional email delivery                                                                                                                                             |
-| `RESEND_FROM_EMAIL`     | Verified sender address in Resend (e.g. `noreply@yourdomain.com`)                                                                                                                           |
-| `RESEND_WEBHOOK_SECRET` | Signing secret for the Resend webhook that reports delivery events (Resend dashboard → the webhook)                                                                                         |
+| Variable                | Description                                                                                                                                                                                              |
+| ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `DATABASE_URL`          | Postgres connection string (pooled). Local Docker: `postgresql://admin:admin@localhost:5432/aplio`                                                                                                       |
+| `DIRECT_URL`            | Direct (non-pooled) connection string. Local Docker: same as `DATABASE_URL`                                                                                                                              |
+| `BETTER_AUTH_SECRET`    | Signs session cookies. At least 32 characters: `openssl rand -base64 32`                                                                                                                                 |
+| `BETTER_AUTH_URL`       | Production only, pinned to the real domain. Preview/local derive it from `VERCEL_URL`, else `http://localhost:3000`. Also governs the absolute URLs (logo, sign-in link) in outgoing email.              |
+| `RESEND_API_KEY`        | Resend API key for transactional email delivery                                                                                                                                                          |
+| `RESEND_FROM_EMAIL`     | Verified sender address in Resend (e.g. `noreply@yourdomain.com`)                                                                                                                                        |
+| `RESEND_WEBHOOK_SECRET` | Signing secret for the Resend webhook that reports delivery events (Resend dashboard → the webhook)                                                                                                      |
+| `CRON_SECRET`           | Bearer secret Vercel Cron sends as `Authorization: Bearer …`; verified by the manager-digest cron routes. Set it in the Vercel project env (`openssl rand -base64 32`) or both routes reject every call. |
 
 > **Note:** Prisma CLI commands (`prisma:migrate`, `prisma:seed`) read from `.env`; Next.js reads `.env.local`. Both files are gitignored. For local development you can keep the same values in both.
 

app/api/cron/manager-daily-digest/route.ts

@@ -0,0 +1,11 @@
+import { rejectUnauthorizedCron } from '@/lib/cron';
+import { dispatchDailyManagerDigests } from '@/lib/email/manager-digests';
+
+export const maxDuration = 300;
+
+export async function GET(request: Request): Promise<Response> {
+  const denied = rejectUnauthorizedCron(request);
+  if (denied) return denied;
+
+  return Response.json(await dispatchDailyManagerDigests());
+}

app/api/cron/manager-weekly-digest/route.ts

@@ -0,0 +1,11 @@
+import { rejectUnauthorizedCron } from '@/lib/cron';
+import { dispatchWeeklyManagerDigests } from '@/lib/email/manager-digests';
+
+export const maxDuration = 300;
+
+export async function GET(request: Request): Promise<Response> {
+  const denied = rejectUnauthorizedCron(request);
+  if (denied) return denied;
+
+  return Response.json(await dispatchWeeklyManagerDigests());
+}

components/features/activity-feed.tsx

@@ -1,134 +1,176 @@
-import {
-  getMyRecentActivity,
-  getRecentApplications,
-} from '@/prisma/data/applications';
+import Link from 'next/link';
+
+import { getActivityGroups } from '@/prisma/data/activity';
 
 import {
-  APPLICATION_STATUS_BADGE_VARIANT,
-  APPLICATION_STATUS_LABELS,
+  ACTIVITY_FEED_COPY,
+  ACTIVITY_MINE_TITLE,
   STATUS_BADGE_VARIANT_TO_DOT,
 } from '@/lib/constants';
 import { CONCEPT_ICONS } from '@/lib/icons';
-import { type ActivityItem, type Reviewer } from '@/lib/types';
-import { getDisplayName, getRenamedTo } from '@/lib/utils';
+import { type ActivityItem, type ActivityScope } from '@/lib/types';
 
 import { LocalTime } from '@/components/ui/local-time';
-import { SectionCard, SectionCardEmpty } from '@/components/ui/section-card';
+import { SectionCardEmpty } from '@/components/ui/section-card';
+import { SheetClose } from '@/components/ui/sheet';
+import { Skeleton } from '@/components/ui/skeleton';
 
-// ─── Presentational leaf ─────────────────────────────────────────────────────
+function ActivityFeedRowContent({ item }: { item: ActivityItem }) {
+  const dotClass = STATUS_BADGE_VARIANT_TO_DOT[item.statusVariant];
 
-interface ActivityFeedListProps {
-  items: ActivityItem[];
-  emptyDescription: string;
+  return (
+    <>
+      <span
+        className={`mt-1.5 size-2 shrink-0 rounded-full ${dotClass}`}
+        aria-hidden="true"
+      />
+      <p className="line-clamp-3 min-w-0 flex-1 text-sm">{item.sentence}</p>
+      <LocalTime
+        date={item.timestamp}
+        precision="relative"
+        className="text-muted-foreground ml-auto shrink-0 text-xs tabular-nums"
+      />
+    </>
+  );
 }
 
-function ActivityFeedList({ items, emptyDescription }: ActivityFeedListProps) {
+export function ActivityFeedList({ items }: { items: ActivityItem[] }) {
   return (
-    <SectionCard
-      title="Recent Activity"
-      icon={CONCEPT_ICONS.activity}
-      sectionLabel="Recent activity"
-    >
-      {items.length === 0 ? (
-        <SectionCardEmpty
-          icon={CONCEPT_ICONS.activity}
-          title="No recent activity"
-          description={emptyDescription}
-        />
-      ) : (
-        <ol>
-          {items.map((item) => {
-            const dotClass = STATUS_BADGE_VARIANT_TO_DOT[item.statusVariant];
-
-            return (
-              <li
-                key={item.id}
-                className="flex items-start gap-3 border-b px-4 py-3 last:border-0"
+    <ol>
+      {items.map((item) => (
+        <li key={item.id} className="border-b last:border-0">
+          {item.href ? (
+            <SheetClose asChild>
+              <Link
+                href={item.href}
+                className="hover:bg-muted/50 focus-visible:ring-ring flex items-start gap-3 px-4 py-3 outline-none focus-visible:ring-2"
               >
-                <span
-                  className={`mt-1.5 size-2 shrink-0 rounded-full ${dotClass}`}
-                  aria-hidden="true"
-                />
-                <p className="line-clamp-2 min-w-0 flex-1 text-sm">
-                  {item.sentence}
-                </p>
-                <LocalTime
-                  date={item.timestamp}
-                  precision="relative"
-                  className="text-muted-foreground ml-auto shrink-0 text-xs tabular-nums"
-                />
-              </li>
-            );
-          })}
-        </ol>
-      )}
-    </SectionCard>
+                <ActivityFeedRowContent item={item} />
+              </Link>
+            </SheetClose>
+          ) : (
+            <div className="flex items-start gap-3 px-4 py-3">
+              <ActivityFeedRowContent item={item} />
+            </div>
+          )}
+        </li>
+      ))}
+    </ol>
   );
 }
 
-// ─── Applicant feed wrapper ───────────────────────────────────────────────────
+function ActivityFeedGroup({
+  id,
+  title,
+  items,
+}: {
+  id: string;
+  title: string;
+  items: ActivityItem[];
+}) {
+  return (
+    <section aria-labelledby={id}>
+      <h3
+        id={id}
+        className="text-muted-foreground px-4 pt-4 pb-1 text-xs font-medium"
+      >
+        {title}
+      </h3>
+      <ActivityFeedList items={items} />
+    </section>
+  );
+}
 
-interface ApplicantActivityFeedProps {
+interface ActivityFeedProps {
   userId: string;
+  isAdmin: boolean;
 }
 
-// States the current status only — no status-history table, so no from-state to assert.
-export async function ApplicantActivityFeed({
-  userId,
-}: ApplicantActivityFeedProps) {
-  const applications = await getMyRecentActivity(userId, 10);
-
-  const items: ActivityItem[] = applications.map((app) => {
-    const statusLabel = APPLICATION_STATUS_LABELS[app.status];
-    const variant = APPLICATION_STATUS_BADGE_VARIANT[app.status];
-    return {
-      id: app.id,
-      statusVariant: variant,
-      sentence: `Your application for ${app.position.title} is ${statusLabel}`,
-      timestamp: app.submittedAt,
-    };
-  });
+export async function ActivityFeed({ userId, isAdmin }: ActivityFeedProps) {
+  let groups;
+  try {
+    groups = await getActivityGroups(userId, isAdmin);
+  } catch (error) {
+    console.error('getActivityGroups failed', error);
+    return (
+      <SectionCardEmpty
+        variant="compact"
+        message="Couldn't load recent activity."
+      />
+    );
+  }
+
+  const { scope, mine, reviewed } = groups;
+  const copy = ACTIVITY_FEED_COPY[scope];
+
+  if (mine.length === 0 && reviewed.length === 0)
+    return (
+      <div className="px-4">
+        <SectionCardEmpty
+          icon={CONCEPT_ICONS.activity}
+          title="No recent activity"
+          description={copy.emptyDescription}
+        />
+      </div>
+    );
+
+  if (scope === 'none') return <ActivityFeedList items={mine} />;
 
   return (
-    <ActivityFeedList
-      items={items}
-      emptyDescription="Updates to your applications will show up here."
-    />
+    <>
+      {mine.length > 0 && (
+        <ActivityFeedGroup
+          id="activity-mine"
+          title={ACTIVITY_MINE_TITLE}
+          items={mine}
+        />
+      )}
+      {reviewed.length > 0 && copy.reviewedTitle && (
+        <ActivityFeedGroup
+          id="activity-reviewed"
+          title={copy.reviewedTitle}
+          items={reviewed}
+        />
+      )}
+    </>
   );
 }
 
-// ─── Reviewer feed wrapper ─────────────────────────────────────────────────────
+function ActivityFeedRowsSkeleton({ count }: { count: number }) {
+  return (
+    <ol>
+      {Array.from({ length: count }).map((_, i) => (
+        <li
+          key={i}
+          className="flex items-center gap-3 border-b px-4 py-3 last:border-0"
+        >
+          <Skeleton className="size-2 shrink-0 rounded-full" />
+          <Skeleton className="h-4 flex-1" />
+          <Skeleton className="h-3 w-12" />
+        </li>
+      ))}
+    </ol>
+  );
+}
 
-interface ReviewerActivityFeedProps {
-  reviewer: Reviewer;
+function ActivityFeedGroupSkeleton() {
+  return (
+    <div>
+      <div className="px-4 pt-4 pb-1">
+        <Skeleton className="h-3 w-28" />
+      </div>
+      <ActivityFeedRowsSkeleton count={5} />
+    </div>
+  );
 }
 
-// Ordered by submittedAt (a provable event stream); cross-user data, reviewer-gated only.
-export async function ReviewerActivityFeed({
-  reviewer,
-}: ReviewerActivityFeedProps) {
-  const applications = await getRecentApplications(reviewer, 10);
-
-  const items: ActivityItem[] = applications.map((app) => {
-    const applicantLabel = getDisplayName(app);
-    const renamedTo = getRenamedTo(app);
-    const variant = APPLICATION_STATUS_BADGE_VARIANT[app.status];
-    return {
-      id: app.id,
-      statusVariant: variant,
-      sentence: `${applicantLabel}${renamedTo ? ` (${renamedTo})` : ''} applied for ${app.position.title}`,
-      timestamp: app.submittedAt,
-    };
-  });
+export function ActivityFeedListSkeleton({ scope }: { scope: ActivityScope }) {
+  if (scope === 'none') return <ActivityFeedRowsSkeleton count={10} />;
 
   return (
-    <ActivityFeedList
-      items={items}
-      emptyDescription={
-        reviewer.isAdmin
-          ? 'New applications across all positions will show up here.'
-          : 'New applications to the positions you manage will show up here.'
-      }
-    />
+    <>
+      <ActivityFeedGroupSkeleton />
+      <ActivityFeedGroupSkeleton />
+    </>
   );
 }

components/features/activity-panel.tsx

@@ -0,0 +1,42 @@
+'use client';
+
+import { type ReactNode, useState } from 'react';
+
+import { CONCEPT_ICONS } from '@/lib/icons';
+
+import { Button } from '@/components/ui/button';
+import {
+  Sheet,
+  SheetContent,
+  SheetTitle,
+  SheetTrigger,
+} from '@/components/ui/sheet';
+
+interface ActivityPanelProps {
+  children: ReactNode;
+}
+
+export function ActivityPanel({ children }: ActivityPanelProps) {
+  const [open, setOpen] = useState(false);
+  const ActivityIcon = CONCEPT_ICONS.activity;
+
+  return (
+    <Sheet open={open} onOpenChange={setOpen}>
+      <SheetTrigger asChild>
+        <Button variant="ghost" size="icon" aria-label="Open recent activity">
+          <ActivityIcon className="size-5" />
+        </Button>
+      </SheetTrigger>
+      <SheetContent
+        side="right"
+        className="flex flex-col gap-0 p-0"
+        aria-describedby={undefined}
+      >
+        <div className="border-b px-4 py-3 pr-12">
+          <SheetTitle className="text-base">Recent activity</SheetTitle>
+        </div>
+        <div className="min-h-0 flex-1 overflow-y-auto">{children}</div>
+      </SheetContent>
+    </Sheet>
+  );
+}