@12-apps/prisma 6.1.1 → 6.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@12-apps/prisma",
-  "version": "6.1.1",
+  "version": "6.3.0",
   "description": "Prisma host: the multi-file schema folder, the plugin migration seam, and the shared PrismaClient singleton with its audit / append-only extensions",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -12,7 +12,7 @@
     }
   },
   "scripts": {
-    "build": "node scripts/sync-lifecycle-schema.mjs && node scripts/sync-research-schema.mjs && node scripts/sync-shift-schema.mjs --check && node scripts/sync-jobs-schema.mjs --check && node scripts/sync-entitlements-schema.mjs --check && node scripts/sync-payments-schema.mjs --check && node scripts/sync-report-builder-schema.mjs --check && node scripts/sync-feature-flags-schema.mjs --check && node scripts/sync-rbac-schema.mjs --check && node scripts/sync-notifications-schema.mjs --check && node scripts/sync-onboarding-schema.mjs --check && node scripts/sync-mcp-schema.mjs --check && node scripts/sync-realtime-schema.mjs --check && node scripts/sync-audit-schema.mjs --check && node scripts/sync-prisma-plugins.mjs --check && prisma generate && tsc",
+    "build": "node scripts/sync-lifecycle-schema.mjs && node scripts/sync-research-schema.mjs && node scripts/sync-shift-schema.mjs --check && node scripts/sync-jobs-schema.mjs --check && node scripts/sync-entitlements-schema.mjs --check && node scripts/sync-payments-schema.mjs --check && node scripts/sync-report-builder-schema.mjs --check && node scripts/sync-feature-flags-schema.mjs --check && node scripts/sync-rbac-schema.mjs --check && node scripts/sync-notifications-schema.mjs --check && node scripts/sync-onboarding-schema.mjs --check && node scripts/sync-mcp-schema.mjs --check && node scripts/sync-realtime-schema.mjs --check && node scripts/sync-audit-schema.mjs --check && node scripts/sync-discounts-schema.mjs --check && node scripts/sync-prisma-plugins.mjs --check && prisma generate && tsc",
     "clean": "rm -rf dist node_modules coverage",
     "test": "node ../../scripts/vitest-with-teardown.mjs run",
     "test:watch": "vitest watch",
@@ -20,7 +20,7 @@
     "lint": "pnpm run lint:files .",
     "lint:fix": "bash -c 'eslint \"${@:-.}\" --max-warnings 0 --fix' _",
     "typecheck": "tsc --noEmit",
-    "prisma:generate": "node scripts/sync-lifecycle-schema.mjs && node scripts/sync-research-schema.mjs && node scripts/sync-shift-schema.mjs --check && node scripts/sync-jobs-schema.mjs --check && node scripts/sync-entitlements-schema.mjs --check && node scripts/sync-payments-schema.mjs --check && node scripts/sync-auth-schema.mjs --check && node scripts/sync-report-builder-schema.mjs --check && node scripts/sync-feature-flags-schema.mjs --check && node scripts/sync-rbac-schema.mjs --check && node scripts/sync-notifications-schema.mjs --check && node scripts/sync-onboarding-schema.mjs --check && node scripts/sync-mcp-schema.mjs --check && node scripts/sync-realtime-schema.mjs --check && node scripts/sync-audit-schema.mjs --check && node scripts/sync-prisma-plugins.mjs --check && prisma generate",
+    "prisma:generate": "node scripts/sync-lifecycle-schema.mjs && node scripts/sync-research-schema.mjs && node scripts/sync-shift-schema.mjs --check && node scripts/sync-jobs-schema.mjs --check && node scripts/sync-entitlements-schema.mjs --check && node scripts/sync-payments-schema.mjs --check && node scripts/sync-auth-schema.mjs --check && node scripts/sync-report-builder-schema.mjs --check && node scripts/sync-feature-flags-schema.mjs --check && node scripts/sync-rbac-schema.mjs --check && node scripts/sync-notifications-schema.mjs --check && node scripts/sync-onboarding-schema.mjs --check && node scripts/sync-mcp-schema.mjs --check && node scripts/sync-realtime-schema.mjs --check && node scripts/sync-audit-schema.mjs --check && node scripts/sync-discounts-schema.mjs --check && node scripts/sync-prisma-plugins.mjs --check && prisma generate",
     "prisma:migrate": "prisma migrate dev",
     "prisma:push": "prisma db push",
     "prisma:studio": "prisma studio",
@@ -53,7 +53,9 @@
     "prisma:sync-audit": "node scripts/sync-audit-schema.mjs",
     "prisma:sync-audit:check": "node scripts/sync-audit-schema.mjs --check",
     "prisma:sync-auth": "node scripts/sync-auth-schema.mjs",
-    "prisma:sync-auth:check": "node scripts/sync-auth-schema.mjs --check"
+    "prisma:sync-auth:check": "node scripts/sync-auth-schema.mjs --check",
+    "prisma:sync-discounts": "node scripts/sync-discounts-schema.mjs",
+    "prisma:sync-discounts:check": "node scripts/sync-discounts-schema.mjs --check"
   },
   "dependencies": {
     "@electric-sql/pglite": "0.2.17",
@@ -63,23 +65,24 @@
     "pglite-prisma-adapter": "0.7.2"
   },
   "devDependencies": {
-    "@12-apps/audit": "^5.0.1",
-    "@12-apps/auth": "^2.5.0",
-    "@12-apps/entitlements": "^3.1.0",
-    "@12-apps/entity-lifecycle": "^4.2.0",
-    "@12-apps/eslint-config": "^1.21.0",
-    "@12-apps/feature-flags": "^2.0.1",
-    "@12-apps/jobs": "^4.2.0",
-    "@12-apps/mcp": "^3.5.0",
-    "@12-apps/notifications": "^4.1.1",
-    "@12-apps/onboarding": "^2.0.1",
-    "@12-apps/payments-backend": "^4.14.0",
-    "@12-apps/product-research": "^2.0.0",
-    "@12-apps/rbac": "^4.1.0",
-    "@12-apps/realtime": "^2.0.0",
-    "@12-apps/report-builder": "^5.3.0",
-    "@12-apps/shift": "^3.0.1",
-    "@12-apps/typescript-config": "^1.20.0",
+    "@12-apps/audit": "^5.0.2",
+    "@12-apps/auth": "^2.8.0",
+    "@12-apps/discounts": "^1.3.0",
+    "@12-apps/entitlements": "^3.2.0",
+    "@12-apps/entity-lifecycle": "^4.4.0",
+    "@12-apps/eslint-config": "^1.21.1",
+    "@12-apps/feature-flags": "^2.1.1",
+    "@12-apps/jobs": "^4.4.0",
+    "@12-apps/mcp": "^3.5.1",
+    "@12-apps/notifications": "^4.2.0",
+    "@12-apps/onboarding": "^2.1.0",
+    "@12-apps/payments-backend": "^4.16.0",
+    "@12-apps/product-research": "^2.3.0",
+    "@12-apps/rbac": "^4.2.0",
+    "@12-apps/realtime": "^2.3.0",
+    "@12-apps/report-builder": "^5.4.1",
+    "@12-apps/shift": "^3.3.0",
+    "@12-apps/typescript-config": "^1.20.1",
     "@types/node": "^22.10.6",
     "@vitest/coverage-v8": "^3.2.4",
     "eslint": "^9.39.1",

package/prisma/migrations/20260821120000_shift_kind_host_vocabulary/migration.sql

@@ -0,0 +1,25 @@
+-- @12-apps/shift: `kind` carries HOST vocabulary, so the database stops naming it.
+--
+-- `shifts_kind_check` restricted every adopter's `shifts.kind` to two values
+-- taken from the staff structure of the application this package was extracted
+-- from. That is the most structural form this leak can take. A leaked string is
+-- cosmetic and a leaked type union is at least deletable in a major; a CHECK
+-- constraint is a fact recorded in the adopter's own database, and a host whose
+-- workers are not organised into those two groups could not insert a row at all
+-- — no configuration this package offered could reach it.
+--
+-- What replaces it is the guarantee the package genuinely owns: `kind` is
+-- present and not blank. WHICH kinds exist is now stated by the host and
+-- enforced at the open, by the service, against the vocabulary it was
+-- constructed with (`createShiftService(db, { kinds })`).
+--
+-- Deliberately NOT touched: `shifts_ended_reason_check`. Those three values are
+-- this package's own vocabulary — a shift ends because a worker said so, a
+-- supervisor said so, or the sweep did — and no adopter renames them.
+--
+-- Existing rows all satisfy the replacement, so this is safe to deploy against
+-- a live table with no backfill.
+ALTER TABLE "shifts" DROP CONSTRAINT IF EXISTS "shifts_kind_check";
+
+ALTER TABLE "shifts"
+  ADD CONSTRAINT "shifts_kind_present_check" CHECK (btrim("kind") <> '');

package/prisma/migrations/20260821140000_discounts_package_owned/migration.sql

@@ -0,0 +1,286 @@
+-- @12-apps/discounts: the promotions tables, owned by the package and copied
+-- into a host's migrations folder by its plugin-migration sync. Runs
+-- identically on PostgreSQL and PGlite.
+--
+-- ── REPLAY-SAFE ON PURPOSE ────────────────────────────────────────────────
+-- Every statement here is idempotent, because the first host to adopt this
+-- package already HAS a `discounts` table created by its own, earlier
+-- migration. A package migration is applied by name order, so this one sorts
+-- AFTER the host's — and a bare `CREATE TABLE` would then fail
+-- `prisma migrate deploy` on an existing database AND on a fresh one built from
+-- the full folder. `prisma migrate resolve --applied` can only paper over the
+-- first case, by hand, once per database. So this migration ADOPTS an existing
+-- table instead of demanding a baseline:
+--
+--   * a fresh host gets the three tables, every index and every CHECK;
+--   * a host that already has `discounts` gets only what it is missing — the
+--     three combo columns, the two new tables, and the widened CHECKs;
+--   * replaying the whole folder is a no-op.
+--
+-- What it deliberately does NOT do is MOVE a host's existing target rows. A
+-- host adopting this package has `discount_categories` / `discount_items` rows
+-- that belong in `discount_targets`, and only that host knows whether its
+-- catalog tables are named what this package would have to guess. Backfilling
+-- and dropping the old tables is one migration in the host, written once, and
+-- it sorts after this one.
+--
+-- ── NO FOREIGN KEYS INTO HOST TABLES ──────────────────────────────────────
+-- `client_id` and `target_id` are by-value scalars (the payments-backend
+-- doctrine). The relations INTERNAL to these three tables ARE constrained, with
+-- cascades, so a deleted rule can never leave orphan targets or orphan slots.
+-- A host that wants referential integrity against its own catalog adds those
+-- constraints in its own migration — and should first read the partial's note
+-- on what the absence actually costs.
+
+-- ─────────────────────────────────────────────────────────────────────────────
+-- discounts — the rule itself.
+-- ─────────────────────────────────────────────────────────────────────────────
+CREATE TABLE IF NOT EXISTS "discounts" (
+    "id" TEXT NOT NULL,
+    "client_id" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "type" TEXT NOT NULL,
+    "percent_off_bp" INTEGER,
+    "amount_off_cents" INTEGER,
+    "bundle_price_cents" INTEGER,
+    "free_units" INTEGER,
+    "max_combo_applications" INTEGER,
+    "scope" TEXT NOT NULL,
+    "trigger" TEXT NOT NULL,
+    "code" TEXT,
+    "starts_at" TIMESTAMP(3),
+    "ends_at" TIMESTAMP(3),
+    "min_subtotal_cents" INTEGER,
+    "usage_limit" INTEGER,
+    "per_buyer_limit" INTEGER,
+    "usage_count" INTEGER NOT NULL DEFAULT 0,
+    "stackable" BOOLEAN NOT NULL DEFAULT true,
+    "active" BOOLEAN NOT NULL DEFAULT true,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL,
+    "created_by" TEXT,
+    "updated_by" TEXT,
+    "search_name" TEXT,
+    "archived_at" TIMESTAMP(3),
+
+    CONSTRAINT "discounts_pkey" PRIMARY KEY ("id")
+);
+
+-- The three combo columns, for a host whose `discounts` predates them.
+ALTER TABLE "discounts" ADD COLUMN IF NOT EXISTS "bundle_price_cents" INTEGER;
+ALTER TABLE "discounts" ADD COLUMN IF NOT EXISTS "free_units" INTEGER;
+ALTER TABLE "discounts" ADD COLUMN IF NOT EXISTS "max_combo_applications" INTEGER;
+
+-- One live name and one live coupon per tenant. PARTIAL on purpose: deleting is
+-- a soft archive, and an unconditional unique lets a deleted coupon squat its
+-- code forever, so the operator can never recreate a code they removed. NULLs
+-- stay distinct, so the many automatic rules (all `code` NULL) never collide.
+CREATE UNIQUE INDEX IF NOT EXISTS "discounts_client_id_name_key"
+    ON "discounts"("client_id", "name") WHERE "archived_at" IS NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS "discounts_client_id_code_key"
+    ON "discounts"("client_id", "code") WHERE "archived_at" IS NULL;
+
+-- The storefront's "which rules could fire right now", and the admin list's
+-- default active-first ordering.
+CREATE INDEX IF NOT EXISTS "discounts_client_id_active_archived_at_idx"
+    ON "discounts"("client_id", "active", "archived_at");
+
+-- ─────────────────────────────────────────────────────────────────────────────
+-- discount_combo_slots — the quantified groups a COMBO matches.
+-- ─────────────────────────────────────────────────────────────────────────────
+CREATE TABLE IF NOT EXISTS "discount_combo_slots" (
+    "id" TEXT NOT NULL,
+    "discount_id" TEXT NOT NULL,
+    -- The operator's order, which is also the order a card describes the combo
+    -- in. Stable because two slots of the same size are otherwise
+    -- indistinguishable in a list.
+    "position" INTEGER NOT NULL,
+    "quantity" INTEGER NOT NULL,
+
+    CONSTRAINT "discount_combo_slots_pkey" PRIMARY KEY ("id")
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS "discount_combo_slots_discount_id_position_key"
+    ON "discount_combo_slots"("discount_id", "position");
+
+-- ─────────────────────────────────────────────────────────────────────────────
+-- discount_targets — what a rule points at, BY VALUE.
+--
+-- One table for both jobs, told apart by `slot_id`: NULL is a SCOPE target,
+-- non-null is one combo slot's. They are the same fact — "this rule cares about
+-- this row of this collection" — and two tables would need every reverse read,
+-- every ownership check and every cascade written twice.
+-- ─────────────────────────────────────────────────────────────────────────────
+CREATE TABLE IF NOT EXISTS "discount_targets" (
+    "id" TEXT NOT NULL,
+    "discount_id" TEXT NOT NULL,
+    "slot_id" TEXT,
+    "target_type" TEXT NOT NULL,
+    "target_id" TEXT NOT NULL,
+
+    CONSTRAINT "discount_targets_pkey" PRIMARY KEY ("id")
+);
+
+-- PARTIAL uniques, and they have to be: NULLs are distinct in Postgres, so one
+-- unconditional unique over `slot_id` would not constrain the scope rows at all
+-- — a rule could name the same category twice and cover it twice.
+CREATE UNIQUE INDEX IF NOT EXISTS "discount_targets_scope_key"
+    ON "discount_targets"("discount_id", "target_type", "target_id")
+    WHERE "slot_id" IS NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS "discount_targets_slot_key"
+    ON "discount_targets"("slot_id", "target_type", "target_id")
+    WHERE "slot_id" IS NOT NULL;
+
+-- The reverse read a menu badge does: "which rules touch this row".
+CREATE INDEX IF NOT EXISTS "discount_targets_target_type_target_id_idx"
+    ON "discount_targets"("target_type", "target_id");
+CREATE INDEX IF NOT EXISTS "discount_targets_discount_id_idx"
+    ON "discount_targets"("discount_id");
+CREATE INDEX IF NOT EXISTS "discount_targets_slot_id_idx"
+    ON "discount_targets"("slot_id");
+
+-- ─────────────────────────────────────────────────────────────────────────────
+-- Foreign keys — INTERNAL only.
+-- ─────────────────────────────────────────────────────────────────────────────
+DO $$ BEGIN
+    ALTER TABLE "discount_combo_slots" ADD CONSTRAINT "discount_combo_slots_discount_id_fkey"
+        FOREIGN KEY ("discount_id") REFERENCES "discounts"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+
+DO $$ BEGIN
+    ALTER TABLE "discount_targets" ADD CONSTRAINT "discount_targets_discount_id_fkey"
+        FOREIGN KEY ("discount_id") REFERENCES "discounts"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+
+-- Cascading from the SLOT as well as from the discount: removing one slot of a
+-- combo must take its targets, or the next write would merge them into the slot
+-- that replaced it.
+DO $$ BEGIN
+    ALTER TABLE "discount_targets" ADD CONSTRAINT "discount_targets_slot_id_fkey"
+        FOREIGN KEY ("slot_id") REFERENCES "discount_combo_slots"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+
+-- ─────────────────────────────────────────────────────────────────────────────
+-- CHECK constraints — the String+CHECK house style. The closed sets here and
+-- the arrays in `src/engine/kinds.ts` are two halves of ONE set: widening one
+-- without the other is how a write starts failing at the database rather than
+-- at the validator.
+--
+-- The three that a host may already have in a NARROWER form are dropped and
+-- re-added rather than guarded, because the whole point is to widen them.
+-- ─────────────────────────────────────────────────────────────────────────────
+ALTER TABLE "discounts" DROP CONSTRAINT IF EXISTS "discounts_type_check";
+ALTER TABLE "discounts" ADD CONSTRAINT "discounts_type_check"
+    CHECK ("type" IN ('PERCENTAGE', 'FIXED_AMOUNT', 'BUNDLE_PRICE', 'FREE_UNITS'));
+
+ALTER TABLE "discounts" DROP CONSTRAINT IF EXISTS "discounts_scope_check";
+ALTER TABLE "discounts" ADD CONSTRAINT "discounts_scope_check"
+    CHECK ("scope" IN ('ORDER', 'CATEGORY', 'ITEM', 'COMBO'));
+
+-- Exactly one value column, chosen by the type. A percentage with no rate, or a
+-- bundle with no price, would silently discount nothing.
+ALTER TABLE "discounts" DROP CONSTRAINT IF EXISTS "discounts_value_check";
+ALTER TABLE "discounts" ADD CONSTRAINT "discounts_value_check"
+    CHECK (("type" = 'PERCENTAGE')   = ("percent_off_bp" IS NOT NULL)
+       AND ("type" = 'FIXED_AMOUNT') = ("amount_off_cents" IS NOT NULL)
+       AND ("type" = 'BUNDLE_PRICE') = ("bundle_price_cents" IS NOT NULL)
+       AND ("type" = 'FREE_UNITS')   = ("free_units" IS NOT NULL));
+
+-- A combo REWARD only means something against a matched group: "the group costs
+-- R$ 25" and "one of them is free" are both statements ABOUT a group.
+DO $$ BEGIN
+    ALTER TABLE "discounts" ADD CONSTRAINT "discounts_combo_reward_scope_check"
+        CHECK ("type" NOT IN ('BUNDLE_PRICE', 'FREE_UNITS') OR "scope" = 'COMBO');
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+
+DO $$ BEGIN
+    ALTER TABLE "discounts" ADD CONSTRAINT "discounts_bundle_price_check"
+        CHECK ("bundle_price_cents" IS NULL OR "bundle_price_cents" > 0);
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+
+DO $$ BEGIN
+    ALTER TABLE "discounts" ADD CONSTRAINT "discounts_free_units_check"
+        CHECK ("free_units" IS NULL OR "free_units" > 0);
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+
+-- A per-cart cap on a rule that is not a combo would be a number nothing reads.
+DO $$ BEGIN
+    ALTER TABLE "discounts" ADD CONSTRAINT "discounts_max_combo_applications_check"
+        CHECK ("max_combo_applications" IS NULL
+            OR ("max_combo_applications" > 0 AND "scope" = 'COMBO'));
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+
+DO $$ BEGIN
+    ALTER TABLE "discounts" ADD CONSTRAINT "discounts_trigger_check"
+        CHECK ("trigger" IN ('AUTOMATIC', 'CODE'));
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+
+-- 0 bp is not a promotion; over 100% would credit the buyer.
+DO $$ BEGIN
+    ALTER TABLE "discounts" ADD CONSTRAINT "discounts_percent_off_bp_check"
+        CHECK ("percent_off_bp" IS NULL
+            OR ("percent_off_bp" > 0 AND "percent_off_bp" <= 10000));
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+
+DO $$ BEGIN
+    ALTER TABLE "discounts" ADD CONSTRAINT "discounts_amount_off_cents_check"
+        CHECK ("amount_off_cents" IS NULL OR "amount_off_cents" > 0);
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+
+-- A CODE rule with no code can never be redeemed; an AUTOMATIC one with a code
+-- would be redeemable two different ways.
+DO $$ BEGIN
+    ALTER TABLE "discounts" ADD CONSTRAINT "discounts_code_check"
+        CHECK (("trigger" = 'CODE') = ("code" IS NOT NULL));
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+
+-- An inverted window is always empty; whoever typed it meant something else.
+DO $$ BEGIN
+    ALTER TABLE "discounts" ADD CONSTRAINT "discounts_window_check"
+        CHECK ("ends_at" IS NULL OR "starts_at" IS NULL OR "ends_at" > "starts_at");
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+
+DO $$ BEGIN
+    ALTER TABLE "discounts" ADD CONSTRAINT "discounts_min_subtotal_check"
+        CHECK ("min_subtotal_cents" IS NULL OR "min_subtotal_cents" > 0);
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+
+DO $$ BEGIN
+    ALTER TABLE "discounts" ADD CONSTRAINT "discounts_usage_limit_check"
+        CHECK ("usage_limit" IS NULL OR "usage_limit" > 0);
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+
+DO $$ BEGIN
+    ALTER TABLE "discounts" ADD CONSTRAINT "discounts_per_buyer_limit_check"
+        CHECK ("per_buyer_limit" IS NULL OR "per_buyer_limit" > 0);
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+
+DO $$ BEGIN
+    ALTER TABLE "discounts" ADD CONSTRAINT "discounts_usage_count_check"
+        CHECK ("usage_count" >= 0);
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+
+-- The invariant the predicated PAID-time UPDATE exists to keep true.
+DO $$ BEGIN
+    ALTER TABLE "discounts" ADD CONSTRAINT "discounts_usage_within_limit_check"
+        CHECK ("usage_limit" IS NULL OR "usage_count" <= "usage_limit");
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+
+-- A slot asking for zero units can never be filled; the upper bound is
+-- MAX_COMBO_SLOT_QUANTITY, and a combo nobody can carry is not an offer.
+DO $$ BEGIN
+    ALTER TABLE "discount_combo_slots" ADD CONSTRAINT "discount_combo_slots_quantity_check"
+        CHECK ("quantity" > 0 AND "quantity" <= 50);
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+
+DO $$ BEGIN
+    ALTER TABLE "discount_combo_slots" ADD CONSTRAINT "discount_combo_slots_position_check"
+        CHECK ("position" >= 0);
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+
+-- The closed set of discountable dimensions. Widening it is a host registering
+-- one more DiscountableCollection, plus this line.
+DO $$ BEGIN
+    ALTER TABLE "discount_targets" ADD CONSTRAINT "discount_targets_target_type_check"
+        CHECK ("target_type" IN ('CATEGORY', 'ITEM'));
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;

package/prisma/plugin-migrations.json

@@ -33,6 +33,8 @@
     "20260813140000_add_notification_tables",
     "20260813180000_add_realtime_outbox",
     "20260819230000_auth_email_password",
-    "20260820120000_add_user_feature_grants"
+    "20260820120000_add_user_feature_grants",
+    "20260821120000_shift_kind_host_vocabulary",
+    "20260821140000_discounts_package_owned"
   ]
 }

package/prisma/schema/discounts.prisma

@@ -0,0 +1,181 @@
+// ---------------------------------------------------------------------------
+// @12-apps/discounts — CANONICAL Prisma model partial (plug-and-play).
+//
+// The single source of truth for the three tables a promotions surface owns. A
+// host does NOT copy these models into its schema by hand: it uses Prisma's
+// multi-file schema folder and SYNCS this file into it
+// (`scripts/sync-discounts-schema.mjs`), then discovers the migrations beside
+// it structurally.
+//
+// Host-agnostic by design, and this is the whole reason the shape differs from
+// the origin's:
+//
+//   - The TENANT is a by-value `client_id` scalar — no relation to the host's
+//     tenant model, whose name this package cannot know.
+//   - A TARGET is named BY VALUE via (target_type, target_id) — no FK into the
+//     host's catalog tables, so any collection plugs in with zero schema change
+//     here. That replaces one join table per dimension, which is what made the
+//     old shape unshippable: a partial literally naming `product_categories`
+//     and `menu_items` only compiles inside a host that has tables under those
+//     names. Which collections are discountable is answered at RUNTIME by a
+//     `DiscountableCollection` registration (`src/server/collections.ts`), not
+//     by the schema.
+//   - `type` / `scope` / `trigger` / `target_type` are Strings; the migration
+//     adds the CHECK constraints for the closed sets `src/engine/kinds.ts`
+//     declares. Those arrays and these CHECKs are two halves of ONE set.
+//
+// WHAT THE HOST STILL OWNS: the REDEMPTION snapshot (`order_discounts`). It is
+// a child of the host's own order with a cascade, and its whole purpose is to
+// freeze what a buyer received on an order the host owns. Shipping the rule and
+// leaving the receipt behind is the clean cut.
+//
+// WHAT THE BY-VALUE TARGET COSTS, stated plainly: this schema no longer
+// guarantees that deleting a category cannot leave a discount pointing at a
+// ghost. Three things carry that instead — the evaluator already tolerates an
+// unmatched target (it simply covers nothing), `DiscountableOps.ownsAll`
+// refuses a foreign or missing id on every write, and a host that wants the
+// constraint back may add it in its own migration.
+// ---------------------------------------------------------------------------
+
+// The rule itself: what it takes off, from what, when, and how often.
+//
+// `usage_count` is the live redemption counter, incremented inside the host's
+// PAID confirmation transaction by a predicated UPDATE. That predicate is what
+// makes `usage_count <= usage_limit` an invariant the CHECK can assert; a plain
+// read-then-write under READ COMMITTED would lose increments and break it.
+model Discount {
+  id                   String    @id @default(uuid())
+  // BY VALUE — no relation to the host's tenant model. Every read and every
+  // write carries it: a discount is a direct lever on what a buyer is charged,
+  // so a query that forgot its tenant would let one store reprice another's.
+  clientId             String    @map("client_id")
+  name                 String
+  // PERCENTAGE | FIXED_AMOUNT | BUNDLE_PRICE | FREE_UNITS (CHECK in migration).
+  type                 String
+  // Basis points off, 1..10000. Set iff type = PERCENTAGE.
+  percentOffBp         Int?      @map("percent_off_bp")
+  // Cents off. Set iff type = FIXED_AMOUNT. Clamped at application time to what
+  // is left, so it can never credit the buyer.
+  amountOffCents       Int?      @map("amount_off_cents")
+  // The matched combo group costs exactly this. Set iff type = BUNDLE_PRICE.
+  bundlePriceCents     Int?      @map("bundle_price_cents")
+  // The cheapest N units of the matched group are free. Set iff type =
+  // FREE_UNITS, and always fewer than the units one application requires — a
+  // combo that gives away everything it asks for sells nothing.
+  freeUnits            Int?      @map("free_units")
+  // How many times one cart may claim this combo. NULL = as often as it matches.
+  maxComboApplications Int?      @map("max_combo_applications")
+  // ORDER | CATEGORY | ITEM | COMBO (CHECK in migration). ORDER carries no
+  // targets; CATEGORY/ITEM resolve through `discount_targets`; COMBO resolves by
+  // MATCHING the cart against its quantified slots.
+  scope                String
+  // AUTOMATIC | CODE (CHECK in migration).
+  trigger              String
+  // The coupon the buyer types, upper-cased and unmasked. Non-null iff
+  // trigger = CODE. Unique per tenant among LIVE rows only — see the note below.
+  code                 String?
+  // Active window, half-open [starts_at, ends_at): `ends_at` is EXCLUSIVE, so
+  // an operator setting midnight of the next day means exactly that. Null on
+  // either side = open-ended.
+  startsAt             DateTime? @map("starts_at")
+  endsAt               DateTime? @map("ends_at")
+  // Minimum PRE-DISCOUNT cart subtotal, in cents. Always compared against the
+  // untouched subtotal, never a running total — which is what makes the result
+  // independent of the order the discounts are applied in.
+  minSubtotalCents     Int?      @map("min_subtotal_cents")
+  // Redemptions allowed across every buyer, and per buyer. Null = no cap.
+  usageLimit           Int?      @map("usage_limit")
+  perBuyerLimit        Int?      @map("per_buyer_limit")
+  usageCount           Int       @default(0) @map("usage_count")
+  // When false this rule stacks with nothing: if it wins it is the only one
+  // applied to the order ("best single discount wins").
+  stackable            Boolean   @default(true)
+  // The operator's on/off switch, ORTHOGONAL to `archived_at` (deleted) and to
+  // the window (scheduled).
+  active               Boolean   @default(true)
+  createdAt            DateTime  @default(now()) @map("created_at")
+  updatedAt            DateTime  @updatedAt @map("updated_at")
+  // Change attribution: the host's user id, by value, nullable for system rows.
+  createdBy            String?   @map("created_by")
+  updatedBy            String?   @map("updated_by")
+  // Accent/case-insensitive search key over `name`, written by the host.
+  searchName           String?   @map("search_name")
+  // Soft delete. A non-null timestamp hides the rule from every live read while
+  // its redemption history and its counter survive. Null = live.
+  archivedAt           DateTime? @map("archived_at")
+
+  targets   DiscountTarget[]
+  comboSlots DiscountComboSlot[]
+
+  // NO @@unique here, and that is an honest declaration rather than an
+  // omission. The tenant uniques on (client_id, name) and (client_id, code)
+  // exist in the database as PARTIAL indexes, both `WHERE archived_at IS NULL`.
+  // Prisma cannot express a filtered unique, and declaring an unconditional one
+  // here would be a lie the generated client acts on: it would expose a
+  // `clientId_code` findUnique the index cannot serve.
+  //
+  // Partial because deleting is a SOFT archive: an unconditional unique lets a
+  // soft-deleted coupon squat its code forever, so an operator could never
+  // recreate a code they had deleted. Live rows still own one name and one code
+  // per tenant; archived rows leave the index.
+  @@index([clientId, active, archivedAt])
+  @@map("discounts")
+}
+
+// One quantified slot of a combo: "2 units of anything in Drinks".
+//
+// A child table rather than a JSON column, for the reason the target rows are
+// rows: the slot's own targets need the same by-value shape and the same
+// reverse read, and a JSON blob would put half the combo behind a scan.
+//
+// `position` is the operator's order, which is also the order a card describes
+// the combo in — a stable order matters because two slots of the same size are
+// otherwise indistinguishable in a UI that lists them.
+model DiscountComboSlot {
+  id         String @id @default(uuid())
+  discountId String @map("discount_id")
+  position   Int
+  // Units of this slot ONE application consumes. Bounded by
+  // MAX_COMBO_SLOT_QUANTITY (CHECK in migration).
+  quantity   Int
+
+  discount Discount         @relation(fields: [discountId], references: [id], onDelete: Cascade)
+  targets  DiscountTarget[]
+
+  @@unique([discountId, position])
+  @@map("discount_combo_slots")
+}
+
+// What a discount points at, BY VALUE.
+//
+// One table for both jobs, told apart by `slot_id`: NULL means a SCOPE target
+// (what a CATEGORY- or ITEM-scoped rule covers), non-null means the target of
+// one combo slot. One table because they are the same fact — "this rule cares
+// about this row of this collection" — and two would need every reverse read,
+// every ownership check and every cascade written twice.
+//
+// The uniques are PARTIAL (`WHERE slot_id IS NULL` / `IS NOT NULL`) and
+// therefore live only in the migration, for the same reason the tenant uniques
+// on `Discount` do: NULLs are distinct in Postgres, so one unconditional unique
+// over a nullable column would not constrain the scope rows at all.
+model DiscountTarget {
+  id         String  @id @default(uuid())
+  discountId String  @map("discount_id")
+  // NULL = a scope target. Non-null = a target of that combo slot.
+  slotId     String? @map("slot_id")
+  // CATEGORY | ITEM (CHECK in migration) — which host collection `targetId`
+  // names. Widening this set is a host registering one more
+  // `DiscountableCollection`, plus this CHECK.
+  targetType String  @map("target_type")
+  // The host row's id. No FK: see the partial's header.
+  targetId   String  @map("target_id")
+
+  discount Discount           @relation(fields: [discountId], references: [id], onDelete: Cascade)
+  slot     DiscountComboSlot? @relation(fields: [slotId], references: [id], onDelete: Cascade)
+
+  // The reverse read a menu badge does: "which rules touch this row".
+  @@index([targetType, targetId])
+  @@index([discountId])
+  @@index([slotId])
+  @@map("discount_targets")
+}