@de-otio/trellis 0.4.0 → 0.6.0

package/prisma/schema.prisma

@@ -0,0 +1,1408 @@
+generator client {
+  provider      = "prisma-client-js"
+  binaryTargets = ["native", "rhel-openssl-3.0.x", "linux-arm64-openssl-3.0.x"]
+}
+
+datasource db {
+  provider  = "postgresql"
+  url       = env("DATABASE_URL")
+  directUrl = env("DIRECT_DATABASE_URL")
+  // Note: Prisma 7 will require moving url/directUrl to prisma.config.ts
+  // This schema is correct for Prisma 5.x
+}
+
+// Generic Entity model (replaces Dog model)
+// NO tenantId - schema-per-tenant provides isolation
+model Entity {
+  id         String  @id @default(cuid())
+  name       String
+  entityType String? @map("entity_type") // 'pet', 'product', 'event', etc. (defaults to 'dog' for MVP)
+  metadata   Json? // Flexible schema for entity-specific fields (breed, bio, birthdate, breedSize, etc.)
+
+  // Entity lifecycle
+  status           EntityStatus @default(ACTIVE)
+  deceasedAt       DateTime?    @map("deceased_at")
+  memorialSettings Json?        @map("memorial_settings") // { commentsOpen: boolean, ... }
+
+  // Life stage fields (auto-calculated from birthdate and breedSize in metadata)
+  lifeStage               String?   @map("life_stage") // Taxonomy ID: "life-stage:puppy"
+  lifeStageManualOverride Boolean   @default(false) @map("life_stage_manual_override")
+  lifeStageCalculatedAt   DateTime? @map("life_stage_calculated_at")
+
+  // ActivityPub federation fields
+  actorUri     String? @unique @map("actor_uri") // e.g. https://skybber.app/ap/entities/{id}
+  inboxUrl     String? @map("inbox_url")
+  outboxUrl    String? @map("outbox_url")
+  followersUrl String? @map("followers_url")
+  publicKey    String? @map("public_key") // PEM-encoded RSA public key
+  privateKey   String? @map("private_key") // PEM-encoded RSA private key (encrypted at rest)
+
+  createdAt DateTime @default(now()) @map("created_at")
+  updatedAt DateTime @updatedAt @map("updated_at")
+
+  // Co-ownership (replaces single ownerId)
+  owners       EntityOwnership[]
+  // Relationships and follower counts live in the graph DB (AuraDB), not Prisma
+
+  subjectPosts PostSubject[]
+  primaryPosts Post[]              @relation("PrimaryEntityPosts")
+  taxonomyTags EntityTaxonomyTag[]
+
+  connectionCodes ConnectionCode[]
+
+  @@index([status])
+  @@index([entityType, status])
+  @@map("entities")
+}
+
+enum EntityStatus {
+  ACTIVE
+  MEMORIAL
+  TRANSFERRED
+}
+
+model PostGeoIndex {
+  postUri   String   @id @map("post_uri")
+  entityRef String?  @map("entity_ref") // Generic entity reference
+  geohash   String
+  lat       Float
+  lng       Float
+  createdAt DateTime @default(now()) @map("created_at")
+  place     String?
+  labels    Json?    @default("[]")
+
+  // PREPARATORY: Data classification for Border Safety Mode
+  // Classify location data as sensitive, benign, or decoy for future selective wiping
+  sensitivityLevel String @default("benign") @map("sensitivity_level")
+  // Values: 'benign', 'sensitive', 'decoy'
+
+  @@index([entityRef])
+  @@index([geohash])
+  @@index([sensitivityLevel]) // Index for sensitivity level queries
+  @@map("post_geo_index")
+}
+
+model IngestState {
+  id            String   @id @default(cuid())
+  cursor        String?  @unique
+  lastProcessed DateTime @default(now()) @map("last_processed")
+  updatedAt     DateTime @updatedAt @map("updated_at")
+
+  @@map("ingest_state")
+}
+
+// User roles
+enum UserRole {
+  END_USER
+  B2B_PARTNER
+  PARTNER_ADMIN
+  INTERNAL
+  CONTENT_CREATOR
+  SUPER_ADMIN
+}
+
+// Role metadata for UI display and documentation
+model RoleMetadata {
+  role        UserRole @id // Maps to enum value
+  displayName String   @map("display_name") // Human-readable name (e.g., "Partner Administrator")
+  description String? // Detailed description of role permissions
+  category    String // 'partner', 'internal', 'system', 'end_user'
+  permissions Json? // Role-specific permissions (for UI display)
+  isActive    Boolean  @default(true) @map("is_active")
+  createdAt   DateTime @default(now()) @map("created_at")
+  updatedAt   DateTime @updatedAt @map("updated_at")
+
+  @@map("role_metadata")
+}
+
+// User model for feed posts
+// Using Cognito sub (UUID) as primary key via cognitoSub field
+// actorUri is the ActivityPub actor identifier
+model User {
+  id        String   @id @default(cuid())
+  email     String   @unique
+  role      UserRole @default(END_USER)
+  actorUri  String?  @unique @map("actor_uri") // ActivityPub actor URI (e.g., "https://skybber.com/users/{username}")
+  handle    String? // ActivityPub handle (e.g., "@user@skybber.com")
+  createdAt DateTime @default(now()) @map("created_at")
+
+  // Cognito Auth integration
+  cognitoSub String? @unique @map("cognito_sub") // Cognito user pool sub (UUID), nullable for migration safety
+
+  // User Deprovisioning
+  suspended       Boolean   @default(false)
+  suspendedAt     DateTime? @map("suspended_at")
+  suspendedReason String?   @map("suspended_reason")
+  partnerId       String?
+  partner         Partner?  @relation(fields: [partnerId], references: [id])
+
+  // Account Deletion Grace Period
+  deletionRequestedAt DateTime? @map("deletion_requested_at") // When user requested deletion
+  deletionScheduledAt DateTime? @map("deletion_scheduled_at") // When hard deletion will occur (7 days after request)
+  deletionConfirmedAt DateTime? @map("deletion_confirmed_at") // When user confirmed deletion (2FA/confirmation)
+
+  // PREPARATORY CHANGE: Username field for future pseudonymous sign-up
+  // Currently optional, will be required when implementing pseudonymous authentication
+  // This field allows users to sign up without email (for at-risk users)
+  username String? @unique
+
+  // PREPARATORY CHANGE: Privacy settings for future spy-protection features
+  // All fields default to current behavior (no breaking changes)
+  // These will be used when implementing stealth mode and location safety features
+
+  // Stealth mode: Hide online status, typing indicators, last seen
+  // FUTURE USE: When stealth mode is enabled, hide user's online presence
+  stealthMode Boolean @default(false) @map("stealth_mode")
+
+  // Online status visibility controls
+  // FUTURE USE: Control what presence information is visible to others
+  showOnlineStatus    Boolean @default(true) @map("show_online_status")
+  showTypingIndicator Boolean @default(true) @map("show_typing_indicator")
+  showLastSeen        Boolean @default(true) @map("show_last_seen")
+
+  // Location tracking and anonymization
+  // FUTURE USE: Allow users to disable location tracking or anonymize location data
+  locationTrackingEnabled    Boolean @default(true) @map("location_tracking_enabled")
+  // 0=exact, 1=100m, 2=1km, 3=city-level
+  // FUTURE USE: Automatically round location coordinates based on this level
+  locationAnonymizationLevel Int     @default(0) @map("location_anonymization_level")
+
+  // Analytics opt-out
+  // FUTURE USE: Respect user preference when sending analytics events
+  analyticsOptOut Boolean @default(false) @map("analytics_opt_out")
+
+  // Verification Status (synced from Cognito)
+  emailVerified   Boolean   @default(false) @map("email_verified")
+  emailVerifiedAt DateTime? @map("email_verified_at")
+
+  // Badge Display Preferences
+  showVerifiedBadge Boolean @default(true) @map("show_verified_badge") // User can hide badge
+
+  // Identity Verification (Anti-Impersonation)
+  // Helps users identify real accounts vs fake/impersonation accounts
+  identityVerified             Boolean   @default(false) @map("identity_verified")
+  identityVerifiedAt           DateTime? @map("identity_verified_at")
+  identityVerificationMethod   String?   @map("identity_verification_method") // 'automated', 'manual', 'self_service'
+  identityVerificationProvider String?   @map("identity_verification_provider") // 'jumio', 'onfido', 'veriff', 'manual'
+  showIdentityVerifiedBadge    Boolean   @default(true) @map("show_identity_verified_badge")
+
+  // PREPARATORY CHANGE: Region tracking for China expansion
+  // region: User's detected region (where they're located)
+  // dataRegion: Where user's data is stored (for compliance)
+  // FUTURE USE: When China expansion is implemented, dataRegion will be used
+  // to route data to the correct regional database
+  region     String  @default("EU") @map("region") // User's region (US, EU, CN)
+  dataRegion String? @map("data_region") // Where data is stored (for compliance)
+
+  posts               Post[]
+  securityEvents      SecurityEvent[]
+  createdInvitations  Invitation[]         @relation("CreatedInvitations")
+  usedInvitations     Invitation[]         @relation("UsedInvitations")
+  crossRegionConsents CrossRegionConsent[]
+
+  // Circle configuration and read state
+  circleConfig     CircleConfig?
+  circleReadStates CircleReadState[]
+
+  // Entity co-ownership
+  ownedEntities   EntityOwnership[] @relation("EntityOwners")
+  addedOwnerships EntityOwnership[] @relation("OwnershipAddedBy")
+
+  // Relationships and follower counts live in the graph DB (AuraDB), not Prisma
+
+  // Direct messages
+  sentMessages     DirectMessage[] @relation("SentMessages")
+  receivedMessages DirectMessage[] @relation("ReceivedMessages")
+
+  // Custom audiences
+  createdAudiences    CustomAudience[]       @relation("AudienceCreator")
+  audienceMemberships CustomAudienceMember[] @relation("AudienceMembers")
+
+  // Link reports
+  linkReports LinkReport[]
+
+  // ActivityPub protocol fields
+  inboxUrl     String? @map("inbox_url") // ActivityPub inbox endpoint
+  outboxUrl    String? @map("outbox_url") // ActivityPub outbox endpoint
+  followersUrl String? @map("followers_url") // Followers collection URL
+  followingUrl String? @map("following_url") // Following collection URL
+  friendsUrl   String? @map("friends_url") // Friends collection URL (optional)
+  publicKey    String? @map("public_key") // Public key in PEM format
+  privateKey   String? @map("private_key") // Private key in PEM format (encrypted at rest)
+
+  // PREPARATORY: Border Safety Mode support
+  // Default encryption key ID (currently unused, for future E2E encryption)
+  encryptionKeyId String? @map("encryption_key_id")
+
+  // Default profile context (currently always 'primary')
+  defaultContext String @default("primary") @map("default_context")
+
+  // Travel mode status (dormant feature flag)
+  travelModeActive      Boolean   @default(false) @map("travel_mode_active")
+  travelModeActivatedAt DateTime? @map("travel_mode_activated_at")
+
+  // Panic action configuration (JSON, dormant)
+  panicActionConfig String? @map("panic_action_config") // JSON: { enabled: boolean, action: 'wipe' | 'lock' }
+
+  // Privacy fields for email hashing and anonymous IDs
+  emailHash   String? @unique @map("email_hash") // SHA-256 hash of email (for privacy)
+  anonymousId String? @unique @map("anonymous_id") // Anonymous identifier for privacy
+
+  // Data retention settings
+  messageRetentionDays Int? @map("message_retention_days") // How long to keep messages
+  autoDeleteAfterDays  Int? @map("auto_delete_after_days") // Auto-delete data after N days
+
+  // Encryption keys relation
+  encryptionKeys UserEncryptionKey[]
+
+  // MFA enrollment relation
+  mfaEnrollment MfaEnrollment?
+
+  // Safer Social Design: Age verification (Phase 1)
+  dateOfBirth DateTime? @map("date_of_birth")
+  ageTier     AgeTier   @default(ADULT) @map("age_tier")
+
+  // Parental links
+  parentalLinks ParentalLink[] @relation("ChildParentalLinks")
+  guardianLinks ParentalLink[] @relation("GuardianParentalLinks")
+
+  // Safer Social Design: Quiet hours (Phase 2)
+  quietHoursStart   Int?    @map("quiet_hours_start")   // minutes from midnight (e.g., 1320 = 10PM)
+  quietHoursEnd     Int?    @map("quiet_hours_end")     // minutes from midnight (e.g., 420 = 7AM)
+  quietHoursEnabled Boolean @default(false) @map("quiet_hours_enabled")
+
+  // Safer Social Design: Profile visibility and DM access (Phase 5)
+  profileVisibility ProfileVisibility @default(PUBLIC) @map("profile_visibility")
+  dmAccess          DmAccess          @default(CONNECTIONS) @map("dm_access")
+
+  // Safer Social Design: Notifications (Phase 4)
+  notifications          Notification[]
+  notificationPreference NotificationPreference?
+
+  // Connection codes (out-of-band invite mechanism)
+  createdConnectionCodes  ConnectionCode[]           @relation("ConnectionCodeCreator")
+  redeemedConnectionCodes ConnectionCodeRedemption[]
+
+  @@index([role])
+  @@index([region])
+  @@index([dataRegion])
+  @@index([suspended])
+  @@index([partnerId])
+  @@index([username])
+  @@index([emailVerified])
+  @@index([identityVerified])
+  @@index([actorUri]) // Index for ActivityPub actor lookups
+  @@index([encryptionKeyId]) // Index for encryption key lookups
+  @@index([travelModeActive]) // Index for travel mode queries
+  @@index([defaultContext]) // Index for context queries
+  @@index([emailHash]) // Index for email hash lookups
+  @@index([anonymousId]) // Index for anonymous ID lookups
+  @@index([cognitoSub]) // Index for Cognito sub lookups
+  @@map("users")
+}
+
+// MFA enrollment for admin roles (AUTH-1)
+model MfaEnrollment {
+  id              String    @id @default(uuid())
+  userId          String    @unique @map("user_id")
+  user            User      @relation(fields: [userId], references: [id], onDelete: Cascade)
+  encryptedSecret String    @map("encrypted_secret") @db.Text
+  backupCodes     String[]  @map("backup_codes") // hashed, one-time use
+  enrolledAt      DateTime  @default(now()) @map("enrolled_at")
+  lastUsedAt      DateTime? @map("last_used_at")
+
+  @@map("mfa_enrollments")
+}
+
+// User encryption keys (for Border Safety Mode and future E2E message encryption)
+model UserEncryptionKey {
+  id        String @id @default(cuid())
+  userId    String @map("user_id")
+  contextId String @map("context_id") // 'primary' or 'decoy'
+
+  // Encrypted key material (encrypted with user's password-derived key)
+  encryptedKey String @map("encrypted_key") @db.Text
+
+  // Key derivation parameters (for PBKDF2 or Argon2)
+  kdfParams String @map("kdf_params") @db.Text // JSON
+
+  // Key metadata
+  algorithm  String @default("AES-256-GCM")
+  keyPurpose String // 'data_encryption', 'backup', 'export', 'message_encryption'
+
+  // FUTURE: Support for E2E message encryption
+  // Distinguishes between Border Safety Mode keys and E2E message keys
+  keyType String @default("border_safety") @map("key_type")
+  // Values: 'border_safety' (user's own data), 'e2e_messages' (message encryption)
+
+  createdAt DateTime  @default(now()) @map("created_at")
+  rotatedAt DateTime? @map("rotated_at")
+
+  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@unique([userId, contextId, keyPurpose, keyType])
+  @@index([userId])
+  @@index([userId, keyType]) // For querying keys by type
+  @@map("user_encryption_keys")
+}
+
+// Cross-region access consent for GDPR compliance
+// Tracks user consent for accessing data from different regions
+model CrossRegionConsent {
+  id           String    @id @default(cuid())
+  userId       String    @map("user_id")
+  dataRegion   String    @map("data_region") // Where data is stored (e.g., "EU")
+  accessRegion String    @map("access_region") // Region user is accessing from (e.g., "US")
+  consented    Boolean   @default(false)
+  consentedAt  DateTime? @map("consented_at")
+  withdrawnAt  DateTime? @map("withdrawn_at")
+  ipAddress    String?   @map("ip_address")
+  userAgent    String?   @map("user_agent")
+  createdAt    DateTime  @default(now()) @map("created_at")
+  updatedAt    DateTime  @updatedAt @map("updated_at")
+
+  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@unique([userId, dataRegion, accessRegion])
+  @@index([userId])
+  @@index([consented])
+  @@index([dataRegion, accessRegion])
+  @@map("cross_region_consent")
+}
+
+// Posting radius — how far content radiates on the author's social graph
+enum PostRadius {
+  WHISPER // Inner circle only (tier 0)
+  NORMAL  // Close friends + inner circle (tiers 0-1)
+  LOUD    // Community and closer (tiers 0-2)
+  SHOUT   // Everyone (all tiers)
+}
+
+// Privacy levels for follow relationships
+enum Privacy {
+  PUBLIC
+  FOLLOWERS
+  PRIVATE
+}
+
+// Post model (unified for all visibility levels)
+model Post {
+  id              String              @id @default(cuid())
+  authorId        String              @map("author_id")
+  text            String              @db.Text
+  radius          PostRadius          @default(NORMAL)
+  geoData         Json?               @map("geo_data")
+  uri             String? // ActivityPub URI (for public posts)
+  contentWarnings String[]            @map("content_warnings")
+  deletedAt       DateTime?           @map("deleted_at")
+  hiddenByAuthor  Boolean             @default(false) @map("hidden_by_author")
+  createdAt       DateTime            @default(now()) @map("created_at")
+  updatedAt       DateTime            @updatedAt @map("updated_at")
+  editedAt        DateTime?           @map("edited_at") // Timestamp of last user edit (null if never edited)
+
+  author         User              @relation(fields: [authorId], references: [id])
+  group          Group?            @relation(fields: [groupId], references: [id])
+  groupId        String?           @map("group_id") // Group this post belongs to
+  media          PostMedia[]
+  sentiments     PostSentiment[]
+  comments       PostComment[]
+  subjectEntities PostSubject[]
+  primaryEntityId String?       @map("primary_entity_id")
+  primaryEntity   Entity?       @relation("PrimaryEntityPosts", fields: [primaryEntityId], references: [id])
+  taxonomyTags   PostTaxonomyTag[]
+  linkChecks     LinkCheck[]
+
+  // PREPARATORY CHANGE: Region tracking for China expansion
+  // dataRegion: Where post data is stored (for compliance)
+  // FUTURE USE: When China expansion is implemented, dataRegion will be used
+  // to route data to the correct regional database
+  dataRegion String? @map("data_region") // Where post data is stored (for compliance)
+
+  // ActivityPub fields (nullable for backward compatibility)
+  activityId String?   @unique @map("activity_id") // Activity URI (e.g., "https://skybber.com/posts/{id}/activity")
+  objectId   String?   @unique @map("object_id") // Note object URI (e.g., "https://skybber.com/posts/{id}")
+  to         Json? // Audience targeting (array of URIs)
+  cc         Json? // Additional audience
+  bto        Json? // Blind recipients (for private posts)
+  bcc        Json? // Blind carbon copy
+  published  DateTime? @map("published") // ISO 8601 timestamp (for ActivityPub, defaults to createdAt)
+
+  // Link security fields
+  hasBlockedLinks Boolean @default(false) @map("has_blocked_links")
+
+  // PREPARATORY: Data classification for Border Safety Mode
+  // Classify data as sensitive, benign, or decoy for future selective wiping
+  sensitivityLevel String @default("benign") @map("sensitivity_level")
+  // Values: 'benign', 'sensitive', 'decoy'
+  // Currently all posts are 'benign' (default)
+
+  // Profile context that owns this data
+  ownerContext String @default("primary") @map("owner_context")
+  // Currently always 'primary'
+
+  // Screening risk level (for content screening)
+  screeningRiskLevel String @default("low") @map("screening_risk_level")
+  // Values: 'low', 'medium', 'high'
+
+  // Content category (optional classification)
+  contentCategory String? @map("content_category")
+
+  @@index([authorId, createdAt])
+  @@index([authorId, radius, createdAt])
+  @@index([primaryEntityId])
+  @@index([createdAt])
+  @@index([uri])
+  @@index([deletedAt])
+  @@index([dataRegion, createdAt]) // Composite index for feed queries: filters by region and orders by creation time (most selective fields first)
+  @@index([activityId]) // For ActivityPub activity lookups
+  @@index([objectId]) // For ActivityPub object lookups
+  @@index([groupId]) // Index for group posts
+  @@index([authorId, ownerContext, sensitivityLevel]) // Composite index for context-aware data access
+  @@index([sensitivityLevel]) // Index for sensitivity level queries
+  @@index([ownerContext]) // Index for context queries
+  @@index([screeningRiskLevel]) // Index for risk level queries
+  @@index([editedAt]) // Index for querying edited posts
+  @@map("posts")
+}
+
+// Media files (content-addressed storage)
+model MediaFile {
+  id           String  @id @default(cuid())
+  contentHash  String  @unique @map("content_hash") // SHA-256 hash
+  cid          String? @unique // AT Protocol CID (optional, for compatibility)
+  mimeType     String  @map("mime_type")
+  size         Int
+  originalKey  String  @map("original_key") // S3 key: media/{hash}.{ext}
+  thumbnailKey String? @map("thumbnail_key") // S3 key: media/{hash}_thumb.webp
+  optimizedKey String? @map("optimized_key") // S3 key: media/{hash}_opt.webp
+
+  // Media metadata (extracted from file headers)
+  width    Int? // Image/video width in pixels
+  height   Int? // Image/video height in pixels
+  duration Int? @map("duration") // Video duration in seconds
+
+  // Raw metadata payloads (JSON)
+  exifData      Json? @map("exif_data")
+  iptcData      Json? @map("iptc_data")
+  videoMetadata Json? @map("video_metadata")
+
+  // Denormalized/unified metadata fields
+  dateTaken    DateTime? @map("date_taken")
+  gpsLatitude  Float?    @map("gps_latitude")
+  gpsLongitude Float?    @map("gps_longitude")
+  keywords     String[]  @default([]) @map("keywords")
+
+  // Privacy flags
+  metadataVisible Boolean @default(true) @map("metadata_visible")
+  locationVisible Boolean @default(false) @map("location_visible")
+
+  // Media visibility and deletion tracking
+  hidden    Boolean   @default(false) // Hide from posts (soft delete)
+  deletedAt DateTime? @map("deleted_at") // Permanent deletion timestamp
+  hiddenAt  DateTime? @map("hidden_at") // When media was hidden
+  hiddenBy  String?   @map("hidden_by") // User ID who hid the media
+
+  // Reconciliation fields (Option 2: Eventual Consistency)
+  uploadStatus             String    @default("PENDING") @map("upload_status") // PENDING, RECONCILING, COMPLETE, FAILED
+  uploadedBy               String?   @map("uploaded_by")
+  uploadBatchId            String?   @map("upload_batch_id")
+  reconciledAt             DateTime? @map("reconciled_at")
+  reconcileAttempts        Int       @default(0) @map("reconcile_attempts")
+  createdViaReconciliation Boolean   @default(false) @map("created_via_reconciliation")
+
+  // Optimistic upload tracking (for orphaned media cleanup)
+  attachedToPost Boolean   @default(false) @map("attached_to_post") // Whether media is attached to a post
+  orphanedAt     DateTime? @map("orphaned_at") // When media was marked as orphaned
+  lastAccessedAt DateTime  @default(now()) @map("last_accessed_at") // Last time media was accessed
+
+  createdAt DateTime @default(now()) @map("created_at")
+  updatedAt DateTime @updatedAt @map("updated_at")
+
+  // Relations
+  posts PostMedia[] // Many-to-many with posts
+
+  @@index([contentHash])
+  @@index([cid])
+  @@index([hidden, deletedAt]) // For filtering visible media
+  @@index([createdAt]) // For chronological sorting
+  @@index([dateTaken])
+  @@index([metadataVisible])
+  @@index([locationVisible])
+  @@index([gpsLatitude, gpsLongitude])
+  @@index([uploadStatus])
+  @@index([uploadedBy])
+  @@index([uploadBatchId])
+  @@index([reconciledAt])
+  @@index([uploadStatus, reconciledAt]) // For cleanup queries
+  @@index([attachedToPost, createdAt]) // For orphaned media queries
+  @@index([orphanedAt]) // For cleanup job queries
+  @@map("media_files")
+}
+
+// Upload session for optimistic image uploads
+model UploadSession {
+  id        String   @id @default(cuid())
+  userId    String   @map("user_id")
+  mediaIds  String[] @map("media_ids") // Array of uploaded media IDs
+  status    String   @default("active") // 'active', 'completed', 'abandoned'
+  createdAt DateTime @default(now()) @map("created_at")
+  expiresAt DateTime @map("expires_at")
+
+  @@index([userId, status])
+  @@index([expiresAt])
+  @@map("upload_sessions")
+}
+
+// Post media
+model PostMedia {
+  id      String  @id @default(cuid())
+  postId  String  @map("post_id")
+  mediaId String  @map("media_id")
+  alt     String?
+  order   Int     @default(0)
+
+  post  Post      @relation(fields: [postId], references: [id], onDelete: Cascade)
+  media MediaFile @relation(fields: [mediaId], references: [id], onDelete: Restrict)
+
+  @@unique([postId, mediaId])
+  @@index([postId])
+  @@index([mediaId])
+  @@map("post_media")
+}
+
+// Post sentiment reactions
+model PostSentiment {
+  id        String   @id @default(cuid())
+  postId    String   @map("post_id")
+  postUri   String?  @map("post_uri")
+  authorId  String   @map("author_id")
+  sentiment String
+  createdAt DateTime @default(now()) @map("created_at")
+
+  post Post @relation(fields: [postId], references: [id], onDelete: Cascade)
+
+  @@unique([postId, authorId])
+  @@unique([postUri, authorId])
+  @@index([postId])
+  @@index([postUri])
+  @@index([authorId])
+  @@index([postId, sentiment]) // For faster sentiment count aggregation (groupBy)
+  @@index([postId, createdAt]) // For time-based sentiment queries
+  @@index([postId, sentiment, createdAt(sort: Desc)], name: "idx_post_sentiment_summary") // For window function query (top 3 users per sentiment)
+  @@index([postId, sentiment, createdAt(sort: Desc), id(sort: Desc)], name: "idx_post_sentiment_pagination") // For cursor-based pagination
+  @@map("post_sentiments")
+}
+
+// Post comments
+model PostComment {
+  id                String   @id @default(cuid())
+  postId            String   @map("post_id")
+  postUri           String?  @map("post_uri")
+  authorId          String   @map("author_id")
+  text              String   @db.Text
+  rootUri           String?  @map("root_uri")
+  replyToUri        String?  @map("reply_to_uri")
+  hiddenByPostOwner Boolean  @default(false) @map("hidden_by_post_owner")
+  createdAt         DateTime @default(now()) @map("created_at")
+
+  // Edit tracking
+  editedAt     DateTime? @map("edited_at") // When last edited
+  originalText String?   @db.Text @map("original_text") // Preserve original on first edit
+
+  // Soft delete tracking
+  deletedAt DateTime? @map("deleted_at") // When deleted (soft delete)
+  deletedBy String?   @map("deleted_by") // User ID who deleted (author or post owner)
+
+  // Link security fields
+  hasBlockedLinks Boolean @default(false) @map("has_blocked_links")
+
+  // PREPARATORY: Data classification for Border Safety Mode
+  // Classify data as sensitive, benign, or decoy for future selective wiping
+  sensitivityLevel String @default("benign") @map("sensitivity_level")
+  // Values: 'benign', 'sensitive', 'decoy'
+
+  // Profile context that owns this data
+  ownerContext String @default("primary") @map("owner_context")
+  // Currently always 'primary'
+
+  // Screening risk level (for content screening)
+  screeningRiskLevel String @default("low") @map("screening_risk_level")
+  // Values: 'low', 'medium', 'high'
+
+  // Content category (optional classification)
+  contentCategory String? @map("content_category")
+
+  post       Post               @relation(fields: [postId], references: [id], onDelete: Cascade)
+  media      PostCommentMedia[]
+  sentiments CommentSentiment[]
+  linkChecks LinkCheck[]
+
+  @@index([postId, createdAt])
+  @@index([postUri, createdAt])
+  @@index([authorId])
+  @@index([hiddenByPostOwner])
+  @@index([deletedAt]) // Filter deleted comments
+  @@index([authorId, ownerContext]) // Composite index for context-aware data access
+  @@index([sensitivityLevel]) // Index for sensitivity level queries
+  @@index([ownerContext]) // Index for context queries
+  @@index([screeningRiskLevel]) // Index for risk level queries
+  // Threading indexes
+  @@index([rootUri]) // Find all comments in a thread
+  @@index([replyToUri]) // Find direct replies to a comment
+  @@index([rootUri, createdAt]) // Thread comments ordered by time
+  @@index([postId, rootUri]) // Thread comments within a specific post
+  @@map("post_comments")
+}
+
+// Comment media (placeholder - MediaFile model to be defined separately)
+model PostCommentMedia {
+  id        String  @id @default(cuid())
+  commentId String  @map("comment_id")
+  mediaId   String  @map("media_id")
+  alt       String?
+  order     Int     @default(0)
+
+  comment PostComment @relation(fields: [commentId], references: [id], onDelete: Cascade)
+
+  @@unique([commentId, mediaId])
+  @@index([commentId])
+  @@index([mediaId])
+  @@map("post_comment_media")
+}
+
+// Comment sentiment reactions
+model CommentSentiment {
+  id         String   @id @default(cuid())
+  commentId  String   @map("comment_id")
+  commentUri String?  @map("comment_uri")
+  authorId   String   @map("author_id")
+  sentiment  String
+  createdAt  DateTime @default(now()) @map("created_at")
+
+  comment PostComment @relation(fields: [commentId], references: [id], onDelete: Cascade)
+
+  @@unique([commentId, authorId])
+  @@unique([commentUri, authorId])
+  @@index([commentId])
+  @@index([commentUri])
+  @@index([authorId])
+  @@index([commentId, sentiment]) // For faster sentiment count aggregation (groupBy)
+  @@index([commentId, createdAt]) // For time-based sentiment queries
+  @@map("comment_sentiments")
+}
+
+// Post-Subject junction — which entities a post is about (primary content model)
+model PostSubject {
+  id        String   @id @default(cuid())
+  postId    String   @map("post_id")
+  entityId  String   @map("entity_id")
+  isPrimary Boolean  @default(false) @map("is_primary") // The "main" entity when multiple are featured
+  createdAt DateTime @default(now()) @map("created_at")
+
+  post   Post   @relation(fields: [postId], references: [id], onDelete: Cascade)
+  entity Entity @relation(fields: [entityId], references: [id], onDelete: Cascade)
+
+  @@unique([postId, entityId])
+  @@index([postId])
+  @@index([entityId, createdAt]) // Core query: "posts about this entity, newest first"
+  @@index([entityId])
+  @@map("post_subjects")
+}
+
+// Security Events for SSO monitoring and compliance
+model SecurityEvent {
+  id        String   @id @default(cuid())
+  type      String // sso_login, sso_failed, sso_config_error, rate_limit_exceeded, suspicious_activity, unauthorized_access
+  severity  String // low, medium, high, critical
+  userId    String?
+  partnerId String?
+  ipAddress String?  @map("ip_address")
+  userAgent String?  @map("user_agent")
+  details   String // JSON string
+  timestamp DateTime @default(now())
+
+  // PREPARATORY CHANGE: Retention tracking for future log retention policy
+  // This field stores when the log entry should be automatically deleted
+  // FUTURE USE: A scheduled cleanup job will delete events where retentionUntil < NOW()
+  // Retention periods: critical=365 days, high=90 days, medium=30 days, low=7 days
+  retentionUntil DateTime? @map("retention_until")
+
+  user    User?    @relation(fields: [userId], references: [id])
+  partner Partner? @relation(fields: [partnerId], references: [id])
+
+  @@index([type])
+  @@index([severity])
+  @@index([timestamp])
+  @@index([userId])
+  @@index([partnerId])
+  @@index([ipAddress])
+  @@index([retentionUntil]) // Index for efficient cleanup job queries
+  @@map("security_events")
+}
+
+// Partner model for B2B SSO
+model Partner {
+  id        String   @id @default(cuid())
+  name      String
+  createdAt DateTime @default(now()) @map("created_at")
+
+  users          User[]
+  securityEvents SecurityEvent[]
+
+  @@map("partners")
+}
+
+// Feature Toggle model for global feature flags
+model FeatureToggle {
+  id          String   @id @default(cuid())
+  key         String   @unique // e.g., "global_public_posting_enabled"
+  enabled     Boolean  @default(false)
+  description String? // Human-readable description
+  changedBy   String?  @map("changed_by") // Email of user who last changed it
+  lastChanged DateTime @default(now()) @updatedAt @map("last_changed")
+  createdAt   DateTime @default(now()) @map("created_at")
+
+  @@index([key])
+  @@index([enabled])
+  @@map("feature_toggles")
+}
+
+// Invitation model for user-to-user invitations
+model Invitation {
+  id        String    @id @default(cuid())
+  code      String    @unique // Unique invitation code (e.g., "ABC123XYZ")
+  createdBy String    @map("created_by") // User ID who created the invitation
+  email     String? // Optional: restrict invitation to specific email
+  used      Boolean   @default(false) // Whether invitation has been used
+  usedBy    String?   @map("used_by") // User ID who used the invitation
+  usedAt    DateTime? @map("used_at") // When invitation was used
+  scannedAt DateTime? @map("scanned_at") // When invitation code was first scanned/claimed
+  scannedBy String?   @map("scanned_by") // Temporary identifier for who scanned it (session ID or similar)
+  expiresAt DateTime? @map("expires_at") // Optional expiration date
+  createdAt DateTime  @default(now()) @map("created_at")
+
+  creator User? @relation("CreatedInvitations", fields: [createdBy], references: [id])
+  user    User? @relation("UsedInvitations", fields: [usedBy], references: [id])
+
+  @@index([code])
+  @@index([createdBy])
+  @@index([createdBy, createdAt]) // Composite index for efficient listing queries (filter by createdBy, order by createdAt)
+  @@index([usedBy])
+  @@index([used])
+  @@index([email])
+  @@index([expiresAt])
+  @@map("invitations")
+}
+
+// ============================================================================
+// Taxonomy System (Phase 1: Core Taxonomy Foundation)
+// ============================================================================
+
+// Taxonomy dimension (top-level category)
+model TaxonomyDimension {
+  id          String   @id @default(cuid())
+  tenantId    String   @map("tenant_id") // REQUIRED - Tenant-specific taxonomy
+  code        String // e.g., "behavior", "context"
+  displayName String   @map("display_name")
+  description String?  @db.Text
+  order       Int      @default(0) // For UI ordering
+  isActive    Boolean  @default(true) @map("is_active")
+  createdAt   DateTime @default(now()) @map("created_at")
+  updatedAt   DateTime @updatedAt @map("updated_at")
+
+  categories TaxonomyCategory[]
+
+  @@unique([tenantId, code])
+  @@index([tenantId])
+  @@index([tenantId, code])
+  @@index([tenantId, isActive])
+  @@map("taxonomy_dimensions")
+}
+
+// Taxonomy category (second-level, e.g., "training" under "behavior")
+model TaxonomyCategory {
+  id          String   @id @default(cuid())
+  tenantId    String   @map("tenant_id") // REQUIRED - Tenant-specific taxonomy
+  dimensionId String   @map("dimension_id")
+  code        String // e.g., "training", "issues"
+  displayName String   @map("display_name")
+  description String?  @db.Text
+  order       Int      @default(0)
+  isActive    Boolean  @default(true) @map("is_active")
+  createdAt   DateTime @default(now()) @map("created_at")
+  updatedAt   DateTime @updatedAt @map("updated_at")
+
+  dimension TaxonomyDimension @relation(fields: [dimensionId], references: [id], onDelete: Cascade)
+  taxons    TaxonomyTaxon[]
+
+  @@unique([tenantId, dimensionId, code])
+  @@index([tenantId])
+  @@index([tenantId, dimensionId])
+  @@index([tenantId, isActive])
+  @@map("taxonomy_categories")
+}
+
+// Taxonomy taxon (specific term, e.g., "recall" under "behavior:training")
+model TaxonomyTaxon {
+  id          String  @id @default(cuid())
+  tenantId    String  @map("tenant_id") // REQUIRED - Tenant-specific taxonomy
+  categoryId  String  @map("category_id")
+  taxonId     String // Full ID: "behavior:training:recall"
+  displayName String  @map("display_name")
+  description String? @db.Text
+  order       Int     @default(0)
+  isActive    Boolean @default(true) @map("is_active")
+
+  // Synonyms and user terms for search matching
+  synonyms  Json? // Array of alternative terms: ["obedience", "foundation-training"]
+  userTerms Json? // Array of user search terms: ["sit-stay-come", "basic-commands"]
+
+  // Hierarchical support
+  parentTaxonId String?         @map("parent_taxon_id")
+  parentTaxon   TaxonomyTaxon?  @relation("TaxonHierarchy", fields: [parentTaxonId], references: [id])
+  childTaxons   TaxonomyTaxon[] @relation("TaxonHierarchy")
+
+  // Translations (stored as JSON for now, can be normalized later)
+  translations Json? // { "en": {...}, "de": {...}, "fr": {...} }
+
+  createdAt DateTime @default(now()) @map("created_at")
+  updatedAt DateTime @updatedAt @map("updated_at")
+
+  category    TaxonomyCategory     @relation(fields: [categoryId], references: [id], onDelete: Cascade)
+  tags        PostTaxonomyTag[]
+  entityTags  EntityTaxonomyTag[]
+  productTags ProductTaxonomyTag[]
+
+  @@unique([tenantId, taxonId])
+  @@index([tenantId])
+  @@index([tenantId, categoryId])
+  @@index([tenantId, taxonId])
+  @@index([tenantId, isActive])
+  @@index([parentTaxonId])
+  @@map("taxonomy_taxons")
+}
+
+// Junction table for post-taxonomy tag relationships
+model PostTaxonomyTag {
+  id        String   @id @default(cuid())
+  postId    String   @map("post_id")
+  taxonId   String   @map("taxon_id")
+  addedBy   String   @map("added_by") // User ID
+  createdAt DateTime @default(now()) @map("created_at")
+
+  post  Post          @relation(fields: [postId], references: [id], onDelete: Cascade)
+  taxon TaxonomyTaxon @relation(fields: [taxonId], references: [id], onDelete: Cascade)
+
+  @@unique([postId, taxonId])
+  @@index([postId])
+  @@index([taxonId])
+  @@index([addedBy])
+  @@map("post_taxonomy_tags")
+}
+
+// Junction table for entity-taxonomy tag relationships
+model EntityTaxonomyTag {
+  id        String   @id @default(cuid())
+  entityId  String   @map("entity_id")
+  taxonId   String   @map("taxon_id")
+  createdAt DateTime @default(now()) @map("created_at")
+
+  entity Entity        @relation(fields: [entityId], references: [id], onDelete: Cascade)
+  taxon  TaxonomyTaxon @relation(fields: [taxonId], references: [id], onDelete: Cascade)
+
+  @@unique([entityId, taxonId])
+  @@index([entityId])
+  @@index([taxonId])
+  @@map("entity_taxonomy_tags")
+}
+
+// Junction table for product-taxonomy tag relationships
+model ProductTaxonomyTag {
+  id        String   @id @default(cuid())
+  productId String   @map("product_id")
+  taxonId   String   @map("taxon_id")
+  createdAt DateTime @default(now()) @map("created_at")
+
+  taxon TaxonomyTaxon @relation(fields: [taxonId], references: [id], onDelete: Cascade)
+
+  @@unique([productId, taxonId])
+  @@index([productId])
+  @@index([taxonId])
+  @@map("product_taxonomy_tags")
+}
+
+// ============================================================================
+// Relationships (scored edges live in the graph DB — see graph-service.ts)
+// Follow and Friendship models removed — replaced by :RELATES_TO edges in graph DB
+// ============================================================================
+
+// ============================================================================
+// Co-Ownership
+// ============================================================================
+
+// Entity co-ownership — replaces single Entity.ownerId FK
+model EntityOwnership {
+  id       String          @id @default(cuid())
+  entityId String          @map("entity_id")
+  userId   String          @map("user_id")
+  role     OwnershipRole   @default(CO_OWNER)
+
+  addedByUserId String          @map("added_by_user_id")
+  addedAt       DateTime        @default(now()) @map("added_at")
+  status        OwnershipStatus @default(ACTIVE)
+  removedAt     DateTime?       @map("removed_at")
+
+  entity  Entity @relation(fields: [entityId], references: [id], onDelete: Cascade)
+  user    User   @relation("EntityOwners", fields: [userId], references: [id], onDelete: Cascade)
+  addedBy User   @relation("OwnershipAddedBy", fields: [addedByUserId], references: [id])
+
+  @@unique([entityId, userId])
+  @@index([entityId])
+  @@index([userId])
+  @@index([entityId, role])
+  @@map("entity_ownerships")
+}
+
+enum OwnershipRole {
+  PRIMARY_OWNER // Full control, can transfer primary, can delete entity
+  CO_OWNER      // Post and manage, cannot delete entity
+  CARETAKER     // Can post about entity, cannot modify profile
+}
+
+enum OwnershipStatus {
+  ACTIVE
+  REMOVED
+  LEFT
+}
+
+// ============================================================================
+// Circle Configuration & Read State
+// ============================================================================
+
+// User's circle tier thresholds and view preferences
+model CircleConfig {
+  id     String @id @default(cuid())
+  userId String @unique @map("user_id")
+
+  // Tier thresholds (score >= threshold = in this tier)
+  innerThreshold       Float @default(0.8) @map("inner_threshold")       // tier 0
+  closeFriendThreshold Float @default(0.5) @map("close_friend_threshold") // tier 1
+  communityThreshold   Float @default(0.2) @map("community_threshold")   // tier 2
+  // Below communityThreshold = ambient (tier 3)
+
+  // View preferences
+  dailyDeckSize   Int? @map("daily_deck_size")    // null = no daily limit
+  glanceLimit     Int  @default(20) @map("glance_limit") // Max items in glance mode
+  depthWindowDays Int  @default(7) @map("depth_window_days") // How far back depth mode goes
+
+  createdAt DateTime @default(now()) @map("created_at")
+  updatedAt DateTime @updatedAt @map("updated_at")
+
+  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@map("circle_configs")
+}
+
+// Per-user, per-tier read tracking for "you're caught up" signal
+model CircleReadState {
+  id     String @id @default(cuid())
+  userId String @map("user_id")
+  tier   Int    // 0 = inner, 1 = close friends, 2 = community, 3 = ambient
+
+  lastReadAt     DateTime @map("last_read_at")
+  lastReadPostId String?  @map("last_read_post_id") // Cursor for pagination
+  caughtUp       Boolean  @default(true) @map("caught_up") // Server-computed
+
+  updatedAt DateTime @updatedAt @map("updated_at")
+
+  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@unique([userId, tier])
+  @@index([userId])
+  @@map("circle_read_states")
+}
+
+// ============================================================================
+// ActivityPub Private Groups
+// ============================================================================
+
+// Group model for ActivityPub private groups
+model Group {
+  id           String       @id @default(cuid())
+  name         String
+  description  String?      @db.Text
+  actorUri     String       @unique @map("actor_uri") // Group actor URI
+  inboxUrl     String       @map("inbox_url")
+  outboxUrl    String       @map("outbox_url")
+  followersUrl String       @map("followers_url") // Members collection
+  publicKey    String       @map("public_key") // Public key in PEM format
+  privateKey   String       @map("private_key") // Private key in PEM format (encrypted at rest)
+  privacy      GroupPrivacy
+  createdAt    DateTime     @default(now()) @map("created_at")
+  updatedAt    DateTime     @updatedAt @map("updated_at")
+
+  members GroupMember[]
+  posts   Post[]
+
+  @@index([actorUri])
+  @@index([privacy])
+  @@map("groups")
+}
+
+// Group membership model
+model GroupMember {
+  id       String    @id @default(cuid())
+  groupId  String    @map("group_id")
+  actorUri String    @map("actor_uri") // User's actor URI
+  role     GroupRole
+  joinedAt DateTime  @default(now()) @map("joined_at")
+
+  group Group @relation(fields: [groupId], references: [id], onDelete: Cascade)
+
+  @@unique([groupId, actorUri])
+  @@index([groupId])
+  @@index([actorUri])
+  @@index([groupId, role])
+  @@map("group_members")
+}
+
+enum GroupPrivacy {
+  PUBLIC // Anyone can join
+  PRIVATE // Invite-only
+  FRIENDS_ONLY // Only friends can join
+}
+
+enum GroupRole {
+  MEMBER
+  MODERATOR
+  ADMIN
+}
+
+// ============================================================================
+// ActivityPub System
+// ============================================================================
+
+// Activity model for ActivityPub inbox/outbox
+model Activity {
+  id         String   @id @default(cuid())
+  actorUri   String   @map("actor_uri") // Actor who created this activity
+  type       String // Create, Like, Follow, etc.
+  objectId   String?  @map("object_id") // ActivityStreams object URI
+  targetId   String?  @map("target_id") // Target actor/object
+  to         Json? // Audience (array of URIs)
+  cc         Json? // Additional audience
+  bto        Json? // Blind recipients
+  bcc        Json? // Blind carbon copy
+  published  DateTime // ISO 8601 timestamp
+  receivedAt DateTime @default(now()) @map("received_at")
+
+  // Inbox/outbox tracking
+  inboxActorUri  String? @map("inbox_actor_uri") // For inbox activities
+  outboxActorUri String? @map("outbox_actor_uri") // For outbox activities
+
+  @@index([actorUri])
+  @@index([inboxActorUri, receivedAt])
+  @@index([outboxActorUri, published])
+  @@index([published])
+  @@map("activities")
+}
+
+// Direct Message model for ActivityPub DMs
+model DirectMessage {
+  id          String @id @default(cuid())
+  senderId    String @map("sender_id") // Sender's user ID (not actor URI, for foreign key)
+  recipientId String @map("recipient_id") // Recipient's user ID (not actor URI, for foreign key)
+  text        String @db.Text
+
+  // PREPARATORY: E2E message encryption support (for future implementation)
+  // Currently messages are plaintext. These fields prepare for E2E encryption.
+  encryptedText       String? @map("encrypted_text") @db.Text // Encrypted message content (future)
+  encryptionKeyId     String? @map("encryption_key_id") // Reference to UserEncryptionKey (keyType: 'e2e_messages')
+  encryptionAlgorithm String? @default("AES-256-GCM") @map("encryption_algorithm") // Encryption algorithm
+  encryptionIV        String? @map("encryption_iv") // Initialization vector for encryption
+
+  objectId   String?   @unique @map("object_id") // ActivityStreams object URI
+  activityId String?   @unique @map("activity_id") // Create activity URI
+  read       Boolean   @default(false)
+  readAt     DateTime? @map("read_at")
+  createdAt  DateTime  @default(now()) @map("created_at")
+
+  sender    User @relation("SentMessages", fields: [senderId], references: [id], onDelete: Cascade)
+  recipient User @relation("ReceivedMessages", fields: [recipientId], references: [id], onDelete: Cascade)
+
+  @@index([senderId])
+  @@index([recipientId])
+  @@index([recipientId, read])
+  @@index([encryptionKeyId]) // Index for encryption key lookups
+  @@map("direct_messages")
+}
+
+// Custom Audience model for ActivityPub custom audience targeting
+model CustomAudience {
+  id           String   @id @default(cuid())
+  name         String
+  creatorId    String   @map("creator_id") // Creator's user ID
+  collectionId String   @unique @map("collection_id") // Collection URI (e.g., "https://skybber.com/audiences/{id}")
+  createdAt    DateTime @default(now()) @map("created_at")
+  updatedAt    DateTime @updatedAt @map("updated_at")
+
+  creator User                   @relation("AudienceCreator", fields: [creatorId], references: [id], onDelete: Cascade)
+  members CustomAudienceMember[]
+
+  @@index([creatorId])
+  @@map("custom_audiences")
+}
+
+// Custom Audience Member model (many-to-many relationship)
+model CustomAudienceMember {
+  id         String   @id @default(cuid())
+  audienceId String   @map("audience_id")
+  memberId   String   @map("member_id") // Member's user ID
+  addedAt    DateTime @default(now()) @map("added_at")
+
+  audience CustomAudience @relation(fields: [audienceId], references: [id], onDelete: Cascade)
+  member   User           @relation("AudienceMembers", fields: [memberId], references: [id], onDelete: Cascade)
+
+  @@unique([audienceId, memberId]) // Prevent duplicate members
+  @@index([audienceId])
+  @@index([memberId])
+  @@map("custom_audience_members")
+}
+
+// ============================================================================
+// Link Security System
+// ============================================================================
+
+// Domain reputation tracking
+model DomainReputation {
+  id          String   @id @default(cuid())
+  domain      String   @unique
+  reputation  Int      @default(0) // -100 to +100
+  status      String   @default("unknown") // unknown, safe, warning, blocked
+  lastChecked DateTime @default(now()) @map("last_checked")
+  createdAt   DateTime @default(now()) @map("created_at")
+  updatedAt   DateTime @updatedAt @map("updated_at")
+
+  // Relations
+  linkChecks LinkCheck[]
+
+  @@index([domain])
+  @@index([status])
+  @@index([reputation])
+  @@map("domain_reputations")
+}
+
+// Link check results (for posts/comments)
+model LinkCheck {
+  id            String    @id @default(cuid())
+  postId        String?   @map("post_id") // Nullable for comments
+  commentId     String?   @map("comment_id") // Nullable for posts
+  originalUrl   String    @map("original_url")
+  normalizedUrl String    @map("normalized_url")
+  finalUrl      String?   @map("final_url") // After redirect resolution
+  domain        String
+  status        String // pending, safe, warning, blocked
+  checkType     String    @map("check_type") // immediate, async
+  threatIntel   Json?     @map("threat_intel") // Results from external APIs
+  createdAt     DateTime  @default(now()) @map("created_at")
+  checkedAt     DateTime? @map("checked_at")
+
+  // Relations
+  post             Post?            @relation(fields: [postId], references: [id], onDelete: Cascade)
+  comment          PostComment?     @relation(fields: [commentId], references: [id], onDelete: Cascade)
+  domainReputation DomainReputation @relation(fields: [domain], references: [domain])
+
+  @@index([postId])
+  @@index([commentId])
+  @@index([domain])
+  @@index([status])
+  @@map("link_checks")
+}
+
+// Link reports from users
+model LinkReport {
+  id        String   @id @default(cuid())
+  userId    String   @map("user_id")
+  linkUrl   String   @map("link_url")
+  domain    String
+  reason    String?
+  status    String   @default("pending") // pending, reviewed, resolved
+  createdAt DateTime @default(now()) @map("created_at")
+
+  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@index([domain])
+  @@index([status])
+  @@index([userId])
+  @@map("link_reports")
+}
+
+// ============================================================================
+// Email Suppression (AWS SES bounce/complaint handling)
+// ============================================================================
+
+model EmailSuppression {
+  id           String   @id @default(cuid())
+  email        String   @unique
+  reason       String   // "bounce" | "complaint"
+  bounceType   String?  // "permanent" | "transient" for bounces
+  suppressedAt DateTime @default(now())
+  createdAt    DateTime @default(now())
+  updatedAt    DateTime @updatedAt
+
+  @@index([email])
+}
+
+// ============================================================================
+// Deletion Audit Log (GDPR compliance proof — NOT cascade-deleted)
+// ============================================================================
+
+model DeletionAuditLog {
+  id           String    @id @default(cuid())
+  userId       String    @map("user_id")
+  email        String
+  requestedAt  DateTime  @map("requested_at")
+  confirmedAt  DateTime? @map("confirmed_at")
+  completedAt  DateTime  @map("completed_at") @default(now())
+  itemsDeleted Json      @map("items_deleted")
+  createdAt    DateTime  @default(now()) @map("created_at")
+
+  @@index([userId])
+  @@map("deletion_audit_logs")
+}
+
+// ============================================================================
+// Safer Social Design (Plan 003)
+// ============================================================================
+
+// Age tiers for age-gated behavior
+enum AgeTier {
+  CHILD // under 13
+  TEEN  // 13-17
+  ADULT // 18+
+}
+
+// Profile visibility levels
+enum ProfileVisibility {
+  PUBLIC      // discoverable in search, visible to all
+  CONNECTIONS // visible only to mutual follows
+  PRIVATE     // visible only to self and guardian
+}
+
+// DM access control
+enum DmAccess {
+  ANYONE      // anyone can DM
+  CONNECTIONS // only mutual follows
+  NOBODY      // DMs disabled
+}
+
+// Parental link status
+enum ParentalLinkStatus {
+  PENDING
+  ACTIVE
+  REVOKED
+}
+
+// Parental link between guardian and child accounts
+model ParentalLink {
+  id          String             @id @default(cuid())
+  childId     String             @map("child_id")
+  guardianId  String             @map("guardian_id")
+  status      ParentalLinkStatus @default(PENDING)
+  createdAt   DateTime           @default(now()) @map("created_at")
+  confirmedAt DateTime?          @map("confirmed_at")
+
+  child    User @relation("ChildParentalLinks", fields: [childId], references: [id])
+  guardian User @relation("GuardianParentalLinks", fields: [guardianId], references: [id])
+
+  @@unique([childId, guardianId])
+  @@index([guardianId])
+  @@map("parental_links")
+}
+
+// Notification types (safe by default — no re-engagement or social proof)
+enum NotificationType {
+  DIRECT_MESSAGE
+  SAFETY_ALERT
+  PARENTAL_LINK
+  FOLLOW
+  SENTIMENT_DIGEST
+  SYSTEM
+  RELATIONSHIP_CREATED
+  RELATIONSHIP_RECIPROCATED
+  TIER_CHANGED
+  ENTITY_RELATIONSHIP_PROPOSED
+  ENTITY_RELATIONSHIP_CONFIRMED
+  CONNECTION_CODE_REDEEMED
+}
+
+// Notification model (poll-based, never pushed)
+model Notification {
+  id          String           @id @default(cuid())
+  userId      String           @map("user_id")
+  type        NotificationType
+  title       String
+  body        String
+  data        Json?
+  read        Boolean          @default(false)
+  createdAt   DateTime         @default(now()) @map("created_at")
+  deliveredAt DateTime?        @map("delivered_at")
+  batchId     String?          @map("batch_id")
+
+  user User @relation(fields: [userId], references: [id])
+
+  @@index([userId, read, createdAt])
+  @@index([userId, batchId])
+  @@map("notifications")
+}
+
+// Notification preferences (safety and parental always enabled, not configurable)
+model NotificationPreference {
+  id            String  @id @default(cuid())
+  userId        String  @unique @map("user_id")
+  dmEnabled           Boolean @default(true) @map("dm_enabled")
+  followEnabled       Boolean @default(true) @map("follow_enabled")
+  digestEnabled       Boolean @default(true) @map("digest_enabled")
+  systemEnabled       Boolean @default(true) @map("system_enabled")
+  relationshipEnabled Boolean @default(true) @map("relationship_enabled")
+
+  user User @relation(fields: [userId], references: [id])
+
+  @@map("notification_preferences")
+}
+
+// Out-of-band invite codes — users share codes privately; redemption establishes
+// a relationship in the graph DB. Entity-scoped codes can be created by entity owners.
+model ConnectionCode {
+  id        String   @id @default(cuid())
+  code      String   @unique
+  creatorId String   @map("creator_id")
+  entityId  String?  @map("entity_id")
+  expiresAt DateTime @map("expires_at")
+  maxUses   Int      @map("max_uses")
+  useCount  Int      @default(0) @map("use_count")
+  createdAt DateTime @default(now()) @map("created_at")
+
+  creator     User                       @relation("ConnectionCodeCreator", fields: [creatorId], references: [id])
+  entity      Entity?                    @relation(fields: [entityId], references: [id])
+  redemptions ConnectionCodeRedemption[]
+
+  @@index([creatorId, expiresAt])
+  @@index([entityId])
+  @@map("connection_codes")
+}
+
+// One row per (code, redeemer). Composite unique prevents double-redemption under races.
+model ConnectionCodeRedemption {
+  id        String   @id @default(cuid())
+  codeId    String   @map("code_id")
+  userId    String   @map("user_id")
+  createdAt DateTime @default(now()) @map("created_at")
+
+  code ConnectionCode @relation(fields: [codeId], references: [id])
+  user User           @relation(fields: [userId], references: [id])
+
+  @@unique([codeId, userId])
+  @@index([userId])
+  @@map("connection_code_redemptions")
+}