@12-apps/prisma 5.1.0 → 6.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@12-apps/prisma",
-  "version": "5.1.0",
+  "version": "6.0.0",
   "description": "Prisma host: the multi-file schema folder, the plugin migration seam, and the shared PrismaClient singleton with its audit / append-only extensions",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -20,7 +20,7 @@
     "lint": "pnpm run lint:files .",
     "lint:fix": "bash -c 'eslint \"${@:-.}\" --max-warnings 0 --fix' _",
     "typecheck": "tsc --noEmit",
-    "prisma:generate": "node scripts/sync-lifecycle-schema.mjs && node scripts/sync-research-schema.mjs && node scripts/sync-shift-schema.mjs --check && node scripts/sync-jobs-schema.mjs --check && node scripts/sync-entitlements-schema.mjs --check && node scripts/sync-payments-schema.mjs --check && node scripts/sync-report-builder-schema.mjs --check && node scripts/sync-rbac-schema.mjs --check && node scripts/sync-notifications-schema.mjs --check && node scripts/sync-onboarding-schema.mjs --check && node scripts/sync-mcp-schema.mjs --check && node scripts/sync-realtime-schema.mjs --check && node scripts/sync-audit-schema.mjs --check && node scripts/sync-prisma-plugins.mjs --check && prisma generate",
+    "prisma:generate": "node scripts/sync-lifecycle-schema.mjs && node scripts/sync-research-schema.mjs && node scripts/sync-shift-schema.mjs --check && node scripts/sync-jobs-schema.mjs --check && node scripts/sync-entitlements-schema.mjs --check && node scripts/sync-payments-schema.mjs --check && node scripts/sync-auth-schema.mjs --check && node scripts/sync-report-builder-schema.mjs --check && node scripts/sync-rbac-schema.mjs --check && node scripts/sync-notifications-schema.mjs --check && node scripts/sync-onboarding-schema.mjs --check && node scripts/sync-mcp-schema.mjs --check && node scripts/sync-realtime-schema.mjs --check && node scripts/sync-audit-schema.mjs --check && node scripts/sync-prisma-plugins.mjs --check && prisma generate",
     "prisma:migrate": "prisma migrate dev",
     "prisma:push": "prisma db push",
     "prisma:studio": "prisma studio",
@@ -49,7 +49,9 @@
     "prisma:sync-realtime": "node scripts/sync-realtime-schema.mjs",
     "prisma:sync-realtime:check": "node scripts/sync-realtime-schema.mjs --check",
     "prisma:sync-audit": "node scripts/sync-audit-schema.mjs",
-    "prisma:sync-audit:check": "node scripts/sync-audit-schema.mjs --check"
+    "prisma:sync-audit:check": "node scripts/sync-audit-schema.mjs --check",
+    "prisma:sync-auth": "node scripts/sync-auth-schema.mjs",
+    "prisma:sync-auth:check": "node scripts/sync-auth-schema.mjs --check"
   },
   "dependencies": {
     "@electric-sql/pglite": "0.2.17",
@@ -59,20 +61,21 @@
     "pglite-prisma-adapter": "0.7.2"
   },
   "devDependencies": {
-    "@12-apps/audit": "^4.1.0",
+    "@12-apps/audit": "^5.0.1",
+    "@12-apps/auth": "^2.0.0",
     "@12-apps/entitlements": "^3.1.0",
-    "@12-apps/entity-lifecycle": "^4.0.0",
+    "@12-apps/entity-lifecycle": "^4.2.0",
     "@12-apps/eslint-config": "^1.20.0",
-    "@12-apps/jobs": "^4.1.0",
-    "@12-apps/mcp": "^3.0.0",
-    "@12-apps/notifications": "^4.1.0",
-    "@12-apps/onboarding": "^2.0.0",
-    "@12-apps/payments-backend": "^4.1.0",
+    "@12-apps/jobs": "^4.2.0",
+    "@12-apps/mcp": "^3.4.0",
+    "@12-apps/notifications": "^4.1.1",
+    "@12-apps/onboarding": "^2.0.1",
+    "@12-apps/payments-backend": "^4.11.0",
     "@12-apps/product-research": "^2.0.0",
-    "@12-apps/rbac": "^4.0.0",
+    "@12-apps/rbac": "^4.0.2",
     "@12-apps/realtime": "^2.0.0",
-    "@12-apps/report-builder": "^5.0.0",
-    "@12-apps/shift": "^3.0.0",
+    "@12-apps/report-builder": "^5.0.2",
+    "@12-apps/shift": "^3.0.1",
     "@12-apps/typescript-config": "^1.20.0",
     "@types/node": "^22.10.6",
     "@vitest/coverage-v8": "^3.2.4",

package/prisma/migrations/20260731210000_shift_delete_guard/migration.sql

@@ -5,7 +5,7 @@
 -- with no foreign key (that is what keeps the package host-agnostic), so a host
 -- that deletes its tenant row and then sweeps the remaining by-value tables by
 -- `client_id` could never remove a shift: the RAISE aborted the whole
--- transaction. The origin host's demo-store reset does exactly that on EVERY deploy,
+-- transaction. Future Pay's demo-store reset does exactly that on EVERY deploy,
 -- so a single shift row would have wedged the deploy step.
 --
 -- Deletability is host policy, not a package invariant. What the guard actually

package/prisma/migrations/20260812150000_add_mcp_oauth_tables/migration.sql

@@ -18,13 +18,13 @@
 -- Authorization codes are deliberately absent: they are STATELESS signed blobs,
 -- so there is no table to create and nothing to sweep.
 --
--- The columns, defaults, indexes and CHECK are the origin host's
+-- The columns, defaults, indexes and CHECK are future-pay's
 -- `20260713120000_add_oauth_client_refresh`,
 -- `20260715180000_add_onboarding_state_mcp_connection` (the mcp_connections half
 -- — the onboarding half belongs to @12-apps/onboarding) and
 -- `20260720120000_add_mcp_connection_host` verbatim, minus the FK to `users`:
 -- this package cannot know the name of a host's user table, and a host that has
--- one keeps its own constraint (the origin host's is ON DELETE CASCADE).
+-- one keeps its own constraint (future-pay's is ON DELETE CASCADE).
 --
 -- EVERY statement is guarded (`IF NOT EXISTS`, and a conrelid-scoped DO block for
 -- the CHECK, which has no IF NOT EXISTS form). That is what makes adoption by a
@@ -35,7 +35,7 @@
 -- the difference bites exactly the host this file is written for: `CREATE TABLE IF
 -- NOT EXISTS` skips the whole table, columns included, so a host holding an OLDER
 -- shape of one of these tables silently keeps it. Each table below is therefore
--- followed by a guarded `ADD COLUMN` for every column that reached the origin host in a
+-- followed by a guarded `ADD COLUMN` for every column that reached future-pay in a
 -- LATER migration than its own CREATE. The full audit: `oauth_refresh_tokens
 -- .user_sub` (`20260713150000_add_oauth_refresh_user_sub`) and `mcp_connections
 -- .host` (`20260720120000_add_mcp_connection_host`). `oauth_clients` needs none —
@@ -112,10 +112,10 @@ CREATE INDEX IF NOT EXISTS "oauth_refresh_tokens_user_email_client_id_idx"
 -- `CREATE TABLE IF NOT EXISTS` skips the WHOLE table, so a host that already holds
 -- `oauth_refresh_tokens` in an OLDER SHAPE gets none of the columns declared above
 -- — statement-level guarding is not the same as column-level guarding. That is
--- precisely how the origin host's own history ran: `user_sub` arrived in a SECOND
+-- precisely how future-pay's own history ran: `user_sub` arrived in a SECOND
 -- migration (FUT-105, `20260713150000_add_oauth_refresh_user_sub`), so a host
 -- frozen before it would adopt this file, skip the CREATE, never get the column,
--- and then fail on every refresh the package serves. Mirror the origin host's pair
+-- and then fail on every refresh the package serves. Mirror future-pay's pair
 -- verbatim — guarded add with a backfill default to satisfy NOT NULL, then drop
 -- the default so the column matches the Prisma schema (`String`, no default).
 -- Both statements are no-ops on a fresh host and on a replay.
@@ -147,6 +147,6 @@ CREATE INDEX IF NOT EXISTS "mcp_connections_last_active_at_idx"
   ON "mcp_connections"("last_active_at");
 
 -- A host adopting this migration where `mcp_connections` predates the `host`
--- column (the origin host added it in a later migration) gets it here; a fresh host
+-- column (future-pay added it in a later migration) gets it here; a fresh host
 -- already has it from the CREATE above, so the guard makes both cases a no-op.
 ALTER TABLE "mcp_connections" ADD COLUMN IF NOT EXISTS "host" TEXT;

package/prisma/migrations/20260812150000_add_onboarding_states/migration.sql

@@ -2,13 +2,13 @@
 -- the package and copied into a host's migrations folder by its
 -- plugin-migration sync.
 --
--- The columns, defaults, indexes and the status CHECK are the origin host's
+-- The columns, defaults, indexes and the status CHECK are future-pay's
 -- `20260715180000_add_onboarding_state_mcp_connection` verbatim, minus two
 -- things that are the HOST's vocabulary rather than the package's:
 --
 --   * the FKs to `users` / `clients` — this package cannot know the name of a
 --     host's user or tenant table. A host that has them keeps its own
---     constraints (the origin host's are ON DELETE CASCADE) and they stay
+--     constraints (future-pay's are ON DELETE CASCADE) and they stay
 --     compatible with everything the package writes;
 --   * the `mcp_connections` half of that migration, which belongs to
 --     @12-apps/mcp and ships in ITS folder.
@@ -16,7 +16,7 @@
 -- EVERY statement is guarded (`IF NOT EXISTS`, and a conrelid-scoped DO block
 -- for the CHECK, which has no IF NOT EXISTS form). That is what makes adoption
 -- by a host that ALREADY has the table a no-op instead of a failed deploy —
--- the origin host applies this and nothing changes, no `prisma migrate resolve`
+-- future-pay applies this and nothing changes, no `prisma migrate resolve`
 -- dance required. It is also what lets the PGlite provisioner replay it into an
 -- existing schema, which is how the harness and the integration suites run.
 

package/prisma/migrations/20260813140000_add_notification_tables/migration.sql

@@ -24,7 +24,7 @@
 --
 -- ============================ REPLAY SAFETY ================================
 -- Every statement is guarded, because the first adopters ALREADY HAVE these
--- tables: the origin host created them by hand before the package existed, so this
+-- tables: future-pay created them by hand before the package existed, so this
 -- migration must be a no-op there and correct on an empty database.
 --
 -- The guards are per COLUMN, not per table. `CREATE TABLE IF NOT EXISTS` alone

package/prisma/migrations/20260819230000_auth_email_password/migration.sql

@@ -0,0 +1,58 @@
+-- @12-apps/auth's own tables. Self-contained by design: every user reference is
+-- an opaque `user_id` with NO foreign key into a host table, so this migration
+-- applies to any schema regardless of what the host calls its users.
+
+CREATE TABLE IF NOT EXISTS "auth_credentials" (
+    "user_id"             TEXT NOT NULL,
+    "password_hash"       TEXT,
+    "password_updated_at" TIMESTAMP(3),
+    "email_verified_at"   TIMESTAMP(3),
+    "created_at"          TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at"          TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "auth_credentials_pkey" PRIMARY KEY ("user_id")
+);
+
+CREATE TABLE IF NOT EXISTS "auth_tokens" (
+    "id"          TEXT NOT NULL,
+    "user_id"     TEXT NOT NULL,
+    "purpose"     TEXT NOT NULL,
+    "token_hash"  TEXT NOT NULL,
+    "expires_at"  TIMESTAMP(3) NOT NULL,
+    "consumed_at" TIMESTAMP(3),
+    "created_at"  TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "auth_tokens_pkey" PRIMARY KEY ("id")
+);
+
+-- The purposes, as a CHECK rather than a Prisma enum (house style). A token of
+-- one purpose presented to the other endpoint must read as "no such token".
+ALTER TABLE "auth_tokens"
+  ADD CONSTRAINT "auth_tokens_purpose_check"
+  CHECK ("purpose" IN ('EMAIL_VERIFICATION', 'PASSWORD_RESET'));
+
+-- Unique because the hash IS the lookup key: a collision would mean two
+-- accounts sharing one link.
+CREATE UNIQUE INDEX IF NOT EXISTS "auth_tokens_token_hash_key" ON "auth_tokens"("token_hash");
+CREATE INDEX IF NOT EXISTS "auth_tokens_user_id_purpose_idx" ON "auth_tokens"("user_id", "purpose");
+CREATE INDEX IF NOT EXISTS "auth_tokens_expires_at_idx" ON "auth_tokens"("expires_at");
+
+CREATE TABLE IF NOT EXISTS "auth_platform_settings" (
+    "key"        TEXT NOT NULL,
+    "value"      JSONB NOT NULL,
+    "updated_by" TEXT,
+    "updated_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "auth_platform_settings_pkey" PRIMARY KEY ("key")
+);
+
+-- The two switches, seeded to the posture this ships in: the method is OFF
+-- until an operator turns it on, and verification is ON so that turning the
+-- method on cannot accidentally open unverified registration. Both are the
+-- conservative half of their own trade-off.
+INSERT INTO "auth_platform_settings" ("key", "value", "updated_at")
+VALUES
+    ('auth.email_password.enabled', 'false'::jsonb, CURRENT_TIMESTAMP),
+    ('auth.email_password.require_verification', 'true'::jsonb, CURRENT_TIMESTAMP)
+ON CONFLICT ("key") DO NOTHING;

package/prisma/plugin-migrations.json

@@ -31,6 +31,7 @@
     "20260813120000_add_audit_log",
     "20260813120000_add_entity_lifecycle_tables",
     "20260813140000_add_notification_tables",
-    "20260813180000_add_realtime_outbox"
+    "20260813180000_add_realtime_outbox",
+    "20260819230000_auth_email_password"
   ]
 }

package/prisma/schema/auth.prisma

@@ -0,0 +1,90 @@
+// ─────────────────────────────────────────────────────────────────────────────
+// OWNED BY @12-apps/auth — the host's multi-file schema folder holds a COPY of
+// this file, written by `pnpm --filter @12-apps/auth prisma:sync`. The
+// credential persistence model lives here, in the package, never in the
+// application.
+//
+// COPIED, never symlinked (the entity-lifecycle doctrine): `npm pack` silently
+// drops symlinked entries, `turbo prune` dangles a link whose owner is not a
+// declared dependency, and Prisma silently SKIPS a symlinked migration
+// directory — a green deploy that applied no schema.
+//
+// Deliberately self-contained (the payments-backend doctrine, and the same rule
+// `report-builder.prisma` states): every user reference is a `user_id` String
+// column — NO foreign key into any host table — so these models work in a repo
+// whose user table is called something else, or is in another database, or does
+// not exist yet at migrate time.
+//
+// That constraint is why the three credential columns are a TABLE here rather
+// than columns on the host's `users`, which is where they started. A package
+// cannot add columns to a table it does not own, and a host should not have to
+// hand-edit its own model to install a login flow.
+// ─────────────────────────────────────────────────────────────────────────────
+
+/// One account's password state, keyed by the host's user id as an OPAQUE
+/// scalar. A row exists only once the address has a credential — an account
+/// that has only ever signed in with Google has none, which is exactly the
+/// "no password yet" state the security card reads.
+model AuthCredential {
+  /// The host's user id. No relation by design: a stale id simply matches no
+  /// row, which is the same answer a deleted user should produce.
+  userId            String    @id @map("user_id")
+  /// `@12-apps/auth`'s self-describing scrypt string. Nullable because a row
+  /// may be created by verification before any password is set.
+  passwordHash      String?   @map("password_hash")
+  passwordUpdatedAt DateTime? @map("password_updated_at")
+  /// Answers "has this address been proven to belong to its owner", which is
+  /// not the same question as "does this account have a password".
+  emailVerifiedAt   DateTime? @map("email_verified_at")
+  createdAt         DateTime  @default(now()) @map("created_at")
+  updatedAt         DateTime  @updatedAt @map("updated_at")
+
+  @@map("auth_credentials")
+}
+
+/// A single-use link: e-mail confirmation, or password reset.
+///
+/// Only the HASH is stored. The raw token exists in the mail and nowhere else,
+/// so a database read cannot mint a working link.
+model AuthToken {
+  id         String    @id @default(uuid())
+  /// The host's user id, opaque. See the header — no FK.
+  userId     String    @map("user_id")
+  /// EMAIL_VERIFICATION | PASSWORD_RESET — a String + DB CHECK, the house style
+  /// used elsewhere rather than a Prisma enum. The two purposes never share a
+  /// namespace: a verification token presented to the reset endpoint is not a
+  /// token at all.
+  purpose    String
+  /// SHA-256 of the raw token, lower-case hex. Unique because it IS the lookup
+  /// key, and a collision would mean two accounts sharing one link.
+  tokenHash  String    @unique @map("token_hash")
+  expiresAt  DateTime  @map("expires_at")
+  consumedAt DateTime? @map("consumed_at")
+  createdAt  DateTime  @default(now()) @map("created_at")
+
+  /// The sweep-on-password-change query, and the resend path's "does this user
+  /// already have one".
+  @@index([userId, purpose])
+  /// The retention job drops abandoned rows cheaply.
+  @@index([expiresAt])
+  @@map("auth_tokens")
+}
+
+/// Platform-wide switches, read on every sign-in attempt.
+///
+/// Prefixed `auth_` rather than the bare `platform_settings` it started as: a
+/// host may well own a settings table of its own, and a package must not claim
+/// a name that generic. Deliberately NOT tenant-scoped — sign-in happens before
+/// a tenant is known.
+model AuthPlatformSetting {
+  key       String   @id
+  value     Json
+  /// Who last changed it, by e-mail, for the audit trail the settings screen
+  /// shows. A plain string rather than a relation: the person may be an env
+  /// allowlist superadmin with no user row of their own.
+  updatedBy String?  @map("updated_by")
+  updatedAt DateTime @updatedAt @map("updated_at")
+  createdAt DateTime @default(now()) @map("created_at")
+
+  @@map("auth_platform_settings")
+}