@ftisindia/create-app 0.1.5 → 0.2.0

package/template/docs/REPORTS.md

@@ -0,0 +1,255 @@
+# Reports Module (`@ftisindia/report-builder`)
+
+This app ships with a definition-driven report engine. A report is **a
+declared, versioned view over one data source, plus the verbs users may apply
+to it** — filter, sort, search, paginate, export, and act on rows. Report
+definitions are versioned JSON documents in the database; the behaviors they
+reference — sources, row actions — are code this app registers. New reports
+over existing sources are **data**: most ship with zero backend code.
+
+- Engine architecture: `report-builder/report-builder-design.md` in the
+  starter repository (Rev 2 — the binding spec).
+- Completion standard: [`REPORTS_CHECKLIST.md`](./REPORTS_CHECKLIST.md) on top
+  of [`MODULE_COMPLETION_CHECKLIST.md`](./MODULE_COMPLETION_CHECKLIST.md).
+- The engine is **fully usable without the form builder** — the form adapter
+  is one optional source provider among many (the standalone guarantee).
+
+**Module structure (the standalone guarantee, made structural):**
+`ReportsModule` is self-contained — definitions, queries, views, row actions
+over custom sources, tags, and CSV/XLSX exports (sync + a reports-owned async
+worker and file storage). It imports **no** FormsModule. Form-backed reports
+(`source.kind: "form"`) and the delegated `editSubmission`/`updateStatus` verbs
+live in the **optional** `ReportsFormsModule`, the single artifact aware of
+both engines. Remove its import from `app.module.ts` and reports keeps working
+over custom sources alone.
+
+## The 60-second tour
+
+```text
+GET    /organisations/:orgId/reports                         reports.read     list definitions
+POST   /organisations/:orgId/reports                         reports.create   create draft
+GET    /organisations/:orgId/reports/:key                    reports.read     latest definition
+PATCH  /organisations/:orgId/reports/:key                    reports.update   edit draft (published ⇒ opens v+1)
+POST   /organisations/:orgId/reports/:key/publish            reports.publish  lint + freeze a new version
+POST   /organisations/:orgId/reports/:key/archive            reports.archive  archive the definition
+GET    /organisations/:orgId/reports/:key/meta?version=      reports.read     column/operator/action metadata
+POST   /organisations/:orgId/reports/:key/query              reports.read     THE grid endpoint (QuerySpec)
+GET    /organisations/:orgId/reports/:key/views              reports.read     saved views + compatibility
+POST   /organisations/:orgId/reports/:key/views              reports.read     create PERSONAL view
+POST   /organisations/:orgId/reports/:key/views/shared       reports.update   create SHARED view
+POST   /organisations/:orgId/reports/:key/actions/:n/prepare reports.read*    byFilter token (drift-safe bulk)
+POST   /organisations/:orgId/reports/:key/actions/:n         reports.read*    execute row/bulk action
+POST   /organisations/:orgId/reports/:key/export             reports.export   sync stream or 202 job
+GET    /organisations/:orgId/reports/exports/:jobId          reports.export   async export status
+GET    /organisations/:orgId/reports/exports/:jobId/download reports.export   download a finished export
+```
+
+`*` Row actions are additionally gated by their own declared permission keys
+(e.g. `formSubmissions.update`), checked when the action is wired into a
+definition AND again at execute time.
+
+Example definitions live in `src/modules/reports/examples/` — `org-members`
+(custom source, no form builder anywhere) and `abstract-review-board` (the
+form-backed quick path, indexed tier).
+
+## One contract: the QuerySpec
+
+The frontend never builds queries. Every grid interaction posts a declarative
+spec naming declared column ids and verbs; the backend validates, compiles,
+and applies them:
+
+```jsonc
+POST /organisations/:orgId/reports/abstract-review-board/query
+{
+  "filters": [{ "column": "track", "op": "eq", "value": "trk_ml" }],
+  "search": "transformer",
+  "sort": [{ "column": "createdAt", "dir": "desc" }],
+  "cursor": null,            // keyset cursor from the previous page
+  "pageSize": 50,
+  "count": "none",           // "none" | "estimated" | "exact-capped"
+  "columns": ["title", "track", "status", "createdAt"]
+}
+```
+
+Operators are typed per column (`contains` on a number column is a 400, not a
+seq scan). `GET /reports/:key/meta` describes every column, its operators, the
+wired actions, and export formats — a generic grid UI configures itself from
+it.
+
+## How a query executes (the performance contract)
+
+Slow reports come from four sins; the engine makes them structurally hard:
+
+- **No OFFSET, ever.** Pagination is keyset-only; cursors are opaque,
+  HMAC-signed, and bound to (report, version, sort, filters) — replay against
+  anything else is a 400 telling the client to restart.
+- **Unindexed shapes fail publish.** On the `indexed` tier, every
+  sortable/filterable/searchable column must name its backing index; publish
+  verifies the index against the catalog (expression, opclass, collation,
+  org-leading) AND runs `EXPLAIN` on representative shapes. The failure is
+  constructive: the 422 carries the exact migration SQL to apply.
+- **Counts are a choice.** Default `none` (hasMore comes free), `estimated`
+  (planner estimate, milliseconds), or `exact-capped` (`10000+` beyond cap).
+- **A statement budget backstops everything** — every report query carries
+  `statement_timeout` (`reports.statementTimeoutMs`, default 5s).
+
+The compiler builds every statement from code-owned manifests; user input
+never becomes an identifier and values travel only as bind parameters.
+**SQL expressions can exist only in code** — a definition referencing
+`"path": "title' || (SELECT ...)"` is rejected at save.
+
+## Custom sources (no form builder required)
+
+Register a source in code — one class, one decorator:
+
+```ts
+import { ReportSource } from './modules/reports/infrastructure/registry/report-extension.decorators';
+import type { ReportSourceDef, SourceManifest, SourceQuery } from '@ftisindia/report-builder';
+
+@Injectable()
+@ReportSource()
+export class OrgMembersReportSource implements ReportSourceDef {
+  key = 'org-members';
+  manifest(): SourceManifest { /* columns + types + capabilities + indexes */ }
+  baseQuery(): SourceQuery {
+    return {
+      from: '"Membership" m JOIN "User" u ON u."id" = m."userId"',
+      orgColumn: 'm."orgId"',
+      primaryTable: 'Membership',
+    };
+  }
+}
+```
+
+The source declares structure; the compiler owns query construction — a
+source never sees the QuerySpec, so it cannot be injected and cannot bypass
+the allowlist. The engine injects the org predicate first on every statement,
+plus the source's optional `rowScope` (row-level security in code).
+
+## Reports from forms (the quick path)
+
+Requires the optional `ReportsFormsModule` bridge (imported in `app.module.ts`
+by default in this template). Point a definition at a form and the adapter does
+the thinking:
+
+```jsonc
+{ "source": { "kind": "form", "key": "abstract-submission" }, ... }
+```
+
+- Fields with `reportable: true` become report columns (labels, types, lookup
+  data sources carried over); `indexHint: true` fields are sortable/filterable.
+- **Column-id convention:** a definition column over a form field must use the
+  field path (dots → `_`) as its column id; physical submission columns are
+  referenced as `$row.status`, `$row.createdAt`, `$row.updatedAt`,
+  `$row.createdBy`.
+- On the `indexed` tier the publish lint demands the generated columns + 
+  indexes (hashed `rb_*` names, immutable expressions, datetimes kept as
+  ISO-8601 UTC text + `COLLATE "C"`); the 422's `suggestionSql` is the exact
+  migration to apply — run it, publish again.
+- Grid verbs delegate to the form engine: `editSubmission` re-validates
+  against the submission's stamped `formVersion`; `updateStatus` runs the same
+  pipeline as the form. Both require `formSubmissions.update`. There is no
+  generic UPDATE — the report engine never mutates source rows itself.
+- Known limitation: columns resolve against the latest **published** form
+  version. Renamed-field mapping across versions needs rename metadata the form
+  definition format does not yet carry.
+
+## Performance tiers
+
+| Tier | Meaning | Publish gate |
+|---|---|---|
+| `live` | Query raw source/JSONB directly | Source row estimate under `reports.liveTierMaxRows` |
+| `indexed` | Hot columns physical + index-declared | Catalog + EXPLAIN lint pass (suggested SQL on failure) |
+| `materialized` | Reads hit a declared materialized relation | Relation exists; staleness bound declared; `meta.freshAsOf` always set |
+
+Tier upgrades are ordinary new versions: v5 `materialized` publishes after its
+migration lands while v4 keeps serving.
+
+## Row actions & drift-safe bulk
+
+Single rows / explicit lists go through `byIds` (capped at 1,000). Filter-based
+bulk (`byFilter`) is a two-step protocol because rows matching at confirmation
+may differ at execution:
+
+1. `POST .../actions/:name/prepare { selection: { byFilter } }` →
+   `{ expectedCount, asOf, actionToken }` (HMAC-signed, 5-minute TTL).
+2. `POST .../actions/:name { selection, actionToken, input, idempotencyKey }` —
+   the server re-resolves the selection; drift beyond tolerance (0 for
+   destructive actions) is a 409 with the current count. The
+   `idempotencyKey` is persisted: a retried execute returns the recorded
+   outcome instead of re-running.
+
+Execution walks rows in keyset order in transactional batches; every batch
+re-applies org + rowScope. Every bulk run writes an audit row with report key,
+version, action, row count, and the filter snapshot.
+
+## Tags & labels
+
+`manageTags` (built-in action, `reportTags.manage`) annotates rows with
+org-scoped tags without touching the source schema. Rows hydrate `$tags`; the
+virtual `$tags` column filters with `hasTag` / `hasAnyTag` (indexed EXISTS).
+Labels are single-valued tags by convention (`label:approved` replaces the
+row family's previous `label:*`). Curate the vocabulary with the
+`reports.tagVocabulary` setting (empty = free-form).
+
+## Exports
+
+`POST /reports/:key/export { format: "csv" | "xlsx", spec?, columns? }`:
+
+- Up to `reports.maxRowsSync` (default 10k): direct stream with
+  `Content-Disposition`. Larger: `202 { job }` — the job is picked up by the
+  reports-owned export worker (polling `ReportExportJob`, no forms outbox),
+  streamed into reports-owned org-scoped file storage
+  (`REPORTS_EXPORT_STORAGE_DIR`), polled at `GET /reports/exports/:jobId`, and
+  downloaded from `GET /reports/exports/:jobId/download`.
+- The default local-disk storage is for a single app instance or for multiple
+  instances sharing the same mounted volume. For horizontal scaling without a
+  shared volume, bind an S3/GCS-backed `ExportFileSink` so downloads can land on
+  any node.
+- Finished async export files are retained for `REPORTS_EXPORT_RETENTION_DAYS`
+  (default 7) and swept by the reports export worker. After expiry, the job row
+  remains for audit/status history but the file is no longer downloadable.
+- Every export — sync or async — runs inside ONE `REPEATABLE READ` snapshot
+  (duration-bounded by `reports.exportMaxSnapshotSeconds`); an export that
+  cannot finish in time is rejected with guidance to tighten filters or move
+  to the materialized tier.
+- `reports.export` is never implied by read; **every export writes an audit
+  row** with report key, version, filter snapshot, row count, and the exact
+  column list. Columns marked `exportable: false` are stripped regardless of
+  the requested projection.
+
+## Saved views
+
+Views store the QuerySpec **and the version they were authored against**.
+Listing views returns a `compatibility` verdict per view against the requested
+version — `ok` | `degraded` (names missing/retyped columns) | `incompatible` —
+so a new publish turns stale views into a visible, fixable state instead of a
+silent 500. Personal views need `reports.read`; shared views (no owner) need
+`reports.update`.
+
+## Org settings & env
+
+Typed settings (audited like all settings): `reports.statementTimeoutMs`
+(5000), `reports.exportMaxSnapshotSeconds` (120), `reports.maxRowsSync`
+(10000), `reports.countCap` (10000), `reports.liveTierMaxRows` (50000),
+`reports.resultCacheTtlMs` (0 = cache off), `reports.tagVocabulary` ([]).
+
+Env: `REPORTS_SCHEMA_CHECK` (`on`/`off`); `REPORTS_TOKEN_SECRET` (optional, min
+32 chars — cursor/token HMAC key; when empty a dedicated key is derived from
+`JWT_SECRET` via HKDF; rotating it invalidates outstanding cursors/tokens —
+clients restart from page one); and the reports-owned async-export worker:
+`REPORTS_EXPORT_WORKER_ENABLED` (default true), `REPORTS_EXPORT_POLL_MS`
+(default 5000), `REPORTS_EXPORT_STORAGE_DIR` (default `./var/report-exports`),
+`REPORTS_EXPORT_RETENTION_DAYS` (default 7; 0 disables cleanup), and
+`REPORTS_EXPORT_RETENTION_SWEEP_MS` (default 3600000).
+
+## Engine upgrades (schema ownership)
+
+The app owns `schema.prisma` and the migration history; the engine ships the
+canonical snippet at `@ftisindia/report-builder/prisma/reports.prisma` plus
+`REPORTS_ENGINE_SCHEMA_VERSION`. The boot check verifies tables/columns AND
+the two **partial unique indexes** on `ReportSavedView`
+(`report_view_shared_uq`, `report_view_personal_uq`) — Prisma cannot express
+partial indexes, so they live as raw SQL in the `add_report_builder`
+migration. If a later `prisma migrate dev` proposes `DROP INDEX` for them,
+delete those lines; the boot check fails fast if they ever go missing.

package/template/docs/REPORTS_CHECKLIST.md

@@ -0,0 +1,152 @@
+# Reports Module Completion Checklist
+
+This is the current go/no-go record for the reports module on top of the generic
+[`MODULE_COMPLETION_CHECKLIST.md`](./MODULE_COMPLETION_CHECKLIST.md). Section
+references are to `report-builder/report-builder-design.md` Rev 2.
+
+## Boundary and Standalone Guarantee
+
+- [x] The engine package (`@ftisindia/report-builder`) compiles and unit-tests
+  without the template and without `@ftisindia/form-builder` installed. Proof:
+  `.github/workflows/ci.yml` `report-builder-engine`.
+- [x] The engine boundary lint blocks `@nestjs/*`, `@prisma/*`, `@casl/*`,
+  `@ftisindia/form-builder`, and template imports from the core; engine errors
+  are mapped to HTTP only in `reports-error.mapper.ts`.
+- [x] `ReportsModule` imports no `FormsModule`. Custom-source reports, tags,
+  query, row actions, and async exports run from reports-owned glue. Form-backed
+  sources and delegated form verbs live only in `ReportsFormsModule`.
+
+## Schema Ownership
+
+- [x] Boot schema check passes on a migrated app and fails loudly on stale
+  schema. Proof: `test/reports-tiers.e2e-spec.ts`.
+- [x] The check verifies `report_view_shared_uq` and
+  `report_view_personal_uq`, and prints the raw SQL when missing.
+- [x] `packages/report-builder/prisma/reports.prisma` matches the template
+  Prisma models; app-owned migrations carry the raw partial indexes.
+
+## Permissions and Registry
+
+- [x] All report permission keys plus `formSubmissions.update` exist in the
+  template and are synced with the engine list. Proof:
+  `test/reports-permission-sync.spec.ts`.
+- [x] Every report route is listed in `routePermissionRegistry`; the registry
+  validator covers the report controllers.
+- [x] `reports.export` is enforced independently of `reports.read`. Proof:
+  `test/reports-query.e2e-spec.ts`.
+- [x] Row actions are checked at attach time and execute time. Proof:
+  engine linter/action-service unit tests plus route-level e2e for `manageTags`.
+
+## SQL Boundary
+
+- [x] Definition-side SQL is rejected by meta-schema/lint; SQL-shaped paths are
+  rejected before SQL compilation. Proof: engine linter unit tests and
+  `test/reports-query.e2e-spec.ts`.
+- [x] `$row.*` paths resolve only against manifest-exposed physical columns.
+- [x] User values reach SQL only through bind parameters. Proof:
+  `ParamSink`, compiler snapshot tests, and Postgres e2e.
+
+## Query Semantics
+
+- [x] Keyset pagination is proven at depth; `OFFSET` is not used; the row-id
+  tiebreaker is always appended. Proof: compiler tests and
+  `test/reports-query.e2e-spec.ts`.
+- [x] Cursor tamper and replay against changed sort/filter/version are rejected.
+- [x] Typed operators reject invalid combinations before SQL.
+- [x] Counts cover `none`, `estimated`, and the capped subquery `exact-capped`
+  shape.
+- [x] Org predicates compile first; cross-org query/export/action attempts are
+  denied, and cross-org `byIds` resolve to zero rows. Proof:
+  `test/reports-query.e2e-spec.ts`.
+- [x] Statement budgets are applied by `PrismaQueryExecutor` and mapped as typed
+  report errors.
+
+## Tiers and Publish Lint
+
+- [x] `live` tier publish fails above `reports.liveTierMaxRows`. Proof:
+  engine definition/tier-lint tests.
+- [x] `indexed` tier publish fails with migration SQL, and the same draft
+  publishes after applying the required indexes. Proof:
+  `test/reports-tiers.e2e-spec.ts`.
+- [x] Plan lint records compiled metadata at publish; queries use compiled
+  physical columns when present. Proof: engine tier-lint and definition-service
+  tests.
+- [x] `materialized` tier requires the declared relation and returns
+  `meta.freshAsOf`. Proof: `test/reports-tiers.e2e-spec.ts`.
+
+## Row Actions and Bulk
+
+- [x] Reports do not raw-update/delete source tables; mutations delegate to
+  registered action handlers.
+- [x] `byFilter` requires a token; prepare/execute works; drift returns 409;
+  expired tokens are rejected. Proof: engine action-service tests and
+  `test/reports-advanced.e2e-spec.ts`.
+- [x] Idempotency replays recorded outcomes without rerunning the handler.
+- [x] `byIds` is capped and cross-org ids resolve to zero rows. Proof:
+  engine action-service tests and `test/reports-query.e2e-spec.ts`.
+
+## Tags
+
+- [x] `manageTags` is gated by `reportTags.manage`; tags normalize; curated
+  vocabulary and `label:*` replacement are covered by engine tests.
+- [x] `$tags` hydration and `hasTag` filters are covered against the
+  `ReportRowTag` table. Proof: `test/reports-query.e2e-spec.ts`.
+
+## Exports
+
+- [x] Sync export streams with `Content-Disposition`; async export creates a
+  `ReportExportJob`, runs on the reports-owned worker, writes a storage fileId,
+  and is pollable/downloadable.
+- [x] Async export storage streams chunks to disk instead of buffering the whole
+  export in memory.
+- [x] Local async export files have retention cleanup:
+  `REPORTS_EXPORT_RETENTION_DAYS` plus worker sweep.
+- [x] Sync and async exports run in a `REPEATABLE READ` snapshot; over-long
+  snapshots map to the tier-guidance export error.
+- [x] Every export writes a PII-egress audit row; `exportable: false` columns are
+  stripped even when requested.
+- [x] XLSX output is structurally valid OOXML; CSV output has formula-injection
+  guarding.
+
+## Saved Views
+
+- [x] Shared-view create/update requires `reports.update`; duplicate shared
+  names are rejected by the partial unique index. Proof:
+  `test/reports-advanced.e2e-spec.ts`.
+- [x] Personal/shared compatibility reports `ok`, `degraded`, or
+  `incompatible` instead of throwing on stale views. Proof: engine view-service
+  tests and template e2e.
+
+## Envelope and Docs
+
+- [x] Engine error codes map through `reports-error.mapper.ts`; Swagger
+  decorators document the report routes.
+- [x] `docs/REPORTS.md` matches current storage topology, retention behavior,
+  tier coverage, and the form-field rename limitation.
+
+## Current E2E Coverage
+
+Template e2e coverage now includes the basic report lifecycle, keyset paging,
+typed operator rejection, meta, `reports.read` vs `reports.export`, saved views,
+tags, sync CSV export, SQL-boundary rejection, cross-org isolation for query /
+export / `byIds`, byFilter token protocol, drift, idempotent replay, async
+export worker + download + retention cleanup, XLSX validity, PII-egress audit,
+shared-view partial unique enforcement, indexed-tier failure, indexed-tier
+success after applying indexes, materialized tier `freshAsOf`, and boot
+schema-check failure.
+
+## Release and Operations Sign-Off
+
+- [x] OPS-2: async local-disk exports no longer buffer the whole file in memory.
+- [x] OPS-3: local async export files have retention cleanup and documented
+  retention env vars.
+- [x] LIM-1: form-backed renamed fields are documented as a known limitation
+  until form definitions carry rename metadata.
+- [x] OPS-1: deployment topology decision recorded. Single-node/shared-volume is
+  supported by the default local adapter; horizontal scaling without shared
+  storage requires rebinding `ExportFileSink` to object storage.
+- [ ] PKG-1: deliberate `@ftisindia/report-builder` version/publish decision
+  made for go-live, following engine-before-CLI publish order.
+- [ ] PROC-1: release commit/tag remains pending. `npm run sync-template` and
+  `npm run dogfood` have been run locally so the scaffolded CLI output carries
+  the same coverage.

package/template/prisma/migrations/20260612000000_add_form_builder/migration.sql

@@ -0,0 +1,147 @@
+-- CreateEnum
+CREATE TYPE "FormDefinitionStatus" AS ENUM ('DRAFT', 'PUBLISHED', 'ARCHIVED');
+
+-- CreateEnum
+CREATE TYPE "SubmissionStatus" AS ENUM ('DRAFT', 'SUBMITTED');
+
+-- CreateEnum
+CREATE TYPE "FormActionStatus" AS ENUM ('OK', 'ERROR');
+
+-- CreateEnum
+CREATE TYPE "OutboxStatus" AS ENUM ('PENDING', 'PROCESSING', 'DONE', 'FAILED');
+
+-- CreateEnum
+CREATE TYPE "FileStatus" AS ENUM ('TEMPORARY', 'SCANNING', 'CLEAN', 'INFECTED', 'LINKED');
+
+-- CreateTable
+CREATE TABLE "FormDefinition" (
+    "id" TEXT NOT NULL,
+    "orgId" TEXT NOT NULL,
+    "key" TEXT NOT NULL,
+    "version" INTEGER NOT NULL,
+    "status" "FormDefinitionStatus" NOT NULL DEFAULT 'DRAFT',
+    "schema" JSONB NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "FormDefinition_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "FormSubmission" (
+    "id" TEXT NOT NULL,
+    "orgId" TEXT NOT NULL,
+    "formKey" TEXT NOT NULL,
+    "formVersion" INTEGER NOT NULL,
+    "data" JSONB NOT NULL,
+    "status" "SubmissionStatus" NOT NULL DEFAULT 'DRAFT',
+    "locked" BOOLEAN NOT NULL DEFAULT false,
+    "createdBy" TEXT,
+    "ipAddress" TEXT,
+    "userAgent" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "FormSubmission_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "FormActionLog" (
+    "id" TEXT NOT NULL,
+    "orgId" TEXT NOT NULL,
+    "submissionId" TEXT,
+    "formKey" TEXT NOT NULL,
+    "formVersion" INTEGER,
+    "action" TEXT NOT NULL,
+    "status" "FormActionStatus" NOT NULL,
+    "input" JSONB,
+    "output" JSONB,
+    "errorCode" TEXT,
+    "errorMessage" TEXT,
+    "actorId" TEXT,
+    "requestId" TEXT,
+    "durationMs" INTEGER,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "FormActionLog_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "FormOutboxJob" (
+    "id" TEXT NOT NULL,
+    "type" TEXT NOT NULL,
+    "payload" JSONB NOT NULL,
+    "status" "OutboxStatus" NOT NULL DEFAULT 'PENDING',
+    "attempts" INTEGER NOT NULL DEFAULT 0,
+    "maxAttempts" INTEGER NOT NULL DEFAULT 8,
+    "idempotencyKey" TEXT,
+    "lastError" TEXT,
+    "runAfter" TIMESTAMP(3),
+    "orgId" TEXT,
+    "actorUserId" TEXT,
+    "originRequestId" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "FormOutboxJob_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "UploadedFile" (
+    "id" TEXT NOT NULL,
+    "storageKey" TEXT NOT NULL,
+    "originalName" TEXT NOT NULL,
+    "mimeType" TEXT NOT NULL,
+    "size" INTEGER NOT NULL,
+    "checksum" TEXT NOT NULL,
+    "ownerId" TEXT NOT NULL,
+    "orgId" TEXT NOT NULL,
+    "status" "FileStatus" NOT NULL DEFAULT 'TEMPORARY',
+    "submissionId" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "UploadedFile_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "FormDefinition_orgId_idx" ON "FormDefinition"("orgId");
+
+-- CreateIndex
+CREATE INDEX "FormDefinition_orgId_status_idx" ON "FormDefinition"("orgId", "status");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "FormDefinition_orgId_key_version_key" ON "FormDefinition"("orgId", "key", "version");
+
+-- CreateIndex
+CREATE INDEX "FormSubmission_orgId_formKey_status_idx" ON "FormSubmission"("orgId", "formKey", "status");
+
+-- CreateIndex
+CREATE INDEX "FormSubmission_orgId_createdAt_idx" ON "FormSubmission"("orgId", "createdAt");
+
+-- CreateIndex
+CREATE INDEX "FormSubmission_orgId_formKey_ipAddress_createdAt_idx" ON "FormSubmission"("orgId", "formKey", "ipAddress", "createdAt");
+
+-- CreateIndex
+CREATE INDEX "FormActionLog_orgId_createdAt_idx" ON "FormActionLog"("orgId", "createdAt");
+
+-- CreateIndex
+CREATE INDEX "FormActionLog_orgId_formKey_action_status_idx" ON "FormActionLog"("orgId", "formKey", "action", "status");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "FormOutboxJob_idempotencyKey_key" ON "FormOutboxJob"("idempotencyKey");
+
+-- CreateIndex
+CREATE INDEX "FormOutboxJob_status_runAfter_idx" ON "FormOutboxJob"("status", "runAfter");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "UploadedFile_storageKey_key" ON "UploadedFile"("storageKey");
+
+-- CreateIndex
+CREATE INDEX "UploadedFile_orgId_status_idx" ON "UploadedFile"("orgId", "status");
+
+-- CreateIndex
+CREATE INDEX "UploadedFile_ownerId_status_idx" ON "UploadedFile"("ownerId", "status");
+
+-- CreateIndex
+CREATE INDEX "UploadedFile_status_createdAt_idx" ON "UploadedFile"("status", "createdAt");
+