@intelligo-dev/core 1.0.0-beta.1 → 1.0.0-beta.13

package/src/db/schema/auth.ts

@@ -0,0 +1,183 @@
+/**
+ * Better-Auth's tables. Table and column names must match what its Drizzle
+ * adapter expects.
+ */
+
+import { sql } from "drizzle-orm";
+import {
+  pgTable,
+  text,
+  timestamp,
+  boolean,
+  index,
+  uniqueIndex,
+} from "drizzle-orm/pg-core";
+
+export const users = pgTable(
+  "users",
+  {
+    id: text("id").primaryKey(),
+    name: text("name").notNull(),
+    email: text("email").notNull().unique(),
+    emailVerified: boolean("email_verified").notNull().default(false),
+    image: text("image"),
+    deletedAt: timestamp("deleted_at"), // Soft delete: null = active, timestamp = deleted
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+    updatedAt: timestamp("updated_at").notNull().defaultNow(),
+    onboardingCompleted: boolean("onboarding_completed")
+      .notNull()
+      .default(false),
+    onboardingStep: text("onboarding_step"), // Current step if incomplete: "workspace" | "language" | "product"
+    preferredLanguage: text("preferred_language").notNull().default("en"), // a locale the app ships, e.g. "en"
+    /**
+     * Platform role, not a workspace role — "platform-admin" or null. Grants
+     * the operational console and impersonation. PLATFORM_ADMIN_EMAILS seeds
+     * it: requirePlatformAdmin promotes an allowlisted user on first use.
+     */
+    role: text("role"),
+    /** Required by Better-Auth's admin plugin schema; unused otherwise. */
+    banned: boolean("banned").notNull().default(false),
+    banReason: text("ban_reason"),
+    banExpires: timestamp("ban_expires"),
+  },
+  (table) => [
+    // Finding the platform admins: a handful of rows among many.
+    index("users_role_idx")
+      .on(table.role)
+      .where(sql`${table.role} IS NOT NULL`),
+  ]
+);
+
+export const sessions = pgTable(
+  "sessions",
+  {
+    id: text("id").primaryKey(),
+    userId: text("user_id")
+      .notNull()
+      .references(() => users.id, { onDelete: "cascade" }),
+    token: text("token").notNull().unique(),
+    expiresAt: timestamp("expires_at").notNull(),
+    ipAddress: text("ip_address"),
+    userAgent: text("user_agent"),
+    /**
+     * Set on a session created by an admin acting as this user, so
+     * impersonation stays visible on the session and in the audit trail.
+     */
+    impersonatedBy: text("impersonated_by"),
+    /**
+     * The organization plugin's active workspace. Without this column its
+     * set-active writes are silently dropped and workspace switching never
+     * persists.
+     */
+    activeOrganizationId: text("active_organization_id"),
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+    updatedAt: timestamp("updated_at").notNull().defaultNow(),
+  },
+  (table) => [index("sessions_user_id_idx").on(table.userId)]
+);
+
+/** OAuth provider connections and password credentials. */
+export const accounts = pgTable(
+  "accounts",
+  {
+    id: text("id").primaryKey(),
+    userId: text("user_id")
+      .notNull()
+      .references(() => users.id, { onDelete: "cascade" }),
+    accountId: text("account_id").notNull(),
+    providerId: text("provider_id").notNull(),
+    accessToken: text("access_token"),
+    refreshToken: text("refresh_token"),
+    accessTokenExpiresAt: timestamp("access_token_expires_at"),
+    refreshTokenExpiresAt: timestamp("refresh_token_expires_at"),
+    scope: text("scope"),
+    idToken: text("id_token"),
+    password: text("password"),
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+    updatedAt: timestamp("updated_at").notNull().defaultNow(),
+  },
+  (table) => [index("accounts_user_id_idx").on(table.userId)]
+);
+
+/** Email verification and password reset tokens. */
+export const verifications = pgTable("verifications", {
+  id: text("id").primaryKey(),
+  identifier: text("identifier").notNull(),
+  value: text("value").notNull(),
+  expiresAt: timestamp("expires_at").notNull(),
+  createdAt: timestamp("created_at").notNull().defaultNow(),
+  updatedAt: timestamp("updated_at").notNull().defaultNow(),
+});
+
+/** Workspaces, managed by Better-Auth's organization plugin. */
+export const organization = pgTable("organization", {
+  id: text("id").primaryKey(),
+  name: text("name").notNull(),
+  slug: text("slug").unique(),
+  logo: text("logo"),
+  metadata: text("metadata"),
+  createdAt: timestamp("created_at").notNull().defaultNow(),
+  updatedAt: timestamp("updated_at").notNull().defaultNow(),
+});
+
+export const member = pgTable(
+  "member",
+  {
+    id: text("id").primaryKey(),
+    organizationId: text("organization_id")
+      .notNull()
+      .references(() => organization.id, { onDelete: "cascade" }),
+    userId: text("user_id")
+      .notNull()
+      .references(() => users.id, { onDelete: "cascade" }),
+    role: text("role").notNull(),
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+    updatedAt: timestamp("updated_at").notNull().defaultNow(),
+  },
+  (table) => [
+    index("member_organization_id_idx").on(table.organizationId),
+    index("member_user_id_idx").on(table.userId),
+    uniqueIndex("member_organization_user_uniq").on(
+      table.organizationId,
+      table.userId
+    ),
+  ]
+);
+
+export const invitation = pgTable(
+  "invitation",
+  {
+    id: text("id").primaryKey(),
+    organizationId: text("organization_id")
+      .notNull()
+      .references(() => organization.id, { onDelete: "cascade" }),
+    email: text("email").notNull(),
+    role: text("role").notNull(),
+    status: text("status").notNull(),
+    expiresAt: timestamp("expires_at").notNull(),
+    inviterId: text("inviter_id").references(() => users.id, {
+      onDelete: "set null",
+    }),
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+    updatedAt: timestamp("updated_at").notNull().defaultNow(),
+  },
+  (table) => [
+    index("invitation_organization_id_idx").on(table.organizationId),
+    index("invitation_email_idx").on(table.email),
+  ]
+);
+
+export type User = typeof users.$inferSelect;
+export type InsertUser = typeof users.$inferInsert;
+export type Session = typeof sessions.$inferSelect;
+export type InsertSession = typeof sessions.$inferInsert;
+export type Account = typeof accounts.$inferSelect;
+export type InsertAccount = typeof accounts.$inferInsert;
+export type Verification = typeof verifications.$inferSelect;
+export type InsertVerification = typeof verifications.$inferInsert;
+export type Organization = typeof organization.$inferSelect;
+export type InsertOrganization = typeof organization.$inferInsert;
+export type Member = typeof member.$inferSelect;
+export type InsertMember = typeof member.$inferInsert;
+export type Invitation = typeof invitation.$inferSelect;
+export type InsertInvitation = typeof invitation.$inferInsert;

package/src/db/schema/billing.ts

@@ -0,0 +1,209 @@
+/**
+ * Plans, subscriptions, credit ledgers, purchases and Stripe events.
+ * Amounts in the credit ledgers are micros of their currency.
+ */
+
+import {
+  pgTable,
+  text,
+  timestamp,
+  integer,
+  bigint,
+  boolean,
+  index,
+  unique,
+} from "drizzle-orm/pg-core";
+import { organization } from "./auth";
+
+/**
+ * The registered plan catalogue, copied into rows so a subscription can
+ * reference its plan. The catalogue is the source: the rows are written
+ * from it at boot, and an edit made here is overwritten by the next one.
+ */
+export const plans = pgTable("plans", {
+  id: text("id").primaryKey(),
+  name: text("name").notNull(),
+  slug: text("slug").notNull().unique(),
+  description: text("description"),
+  /**
+   * Whole major units — 29 is twenty-nine of the currency, not cents —
+   * rounded from the catalogue's price. 0 for free. The row names no
+   * currency; readers take the deployment's billing currency.
+   */
+  priceMonthly: integer("price_monthly").notNull(),
+  /** Whole major units, as `priceMonthly`. 0 when the plan has no yearly price. */
+  priceYearly: integer("price_yearly").notNull(),
+  stripePriceIdMonthly: text("stripe_price_id_monthly"),
+  stripePriceIdYearly: text("stripe_price_id_yearly"),
+  features: text("features").notNull(), // JSON string array
+  limits: text("limits").notNull(), // JSON string: { tokens, conversations, teamMembers, workspaces, documents }
+  isActive: boolean("is_active").notNull().default(true),
+  sortOrder: integer("sort_order").notNull().default(0),
+  createdAt: timestamp("created_at").notNull().defaultNow(),
+  updatedAt: timestamp("updated_at").notNull().defaultNow(),
+});
+
+/** One subscription per workspace (unique constraint). */
+export const subscriptions = pgTable(
+  "subscriptions",
+  {
+    id: text("id").primaryKey(),
+    workspaceId: text("workspace_id")
+      .notNull()
+      .references(() => organization.id, { onDelete: "cascade" }),
+    planId: text("plan_id")
+      .notNull()
+      .references(() => plans.id, { onDelete: "restrict" }),
+    stripeCustomerId: text("stripe_customer_id"),
+    stripeSubscriptionId: text("stripe_subscription_id").unique(),
+    status: text("status").notNull().default("active"), // active|past_due|canceled|trialing|incomplete
+    billingMode: text("billing_mode").notNull().default("subscription"), // subscription|credit
+    currentPeriodStart: timestamp("current_period_start"),
+    currentPeriodEnd: timestamp("current_period_end"),
+    cancelAtPeriodEnd: boolean("cancel_at_period_end").notNull().default(false),
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+    updatedAt: timestamp("updated_at").notNull().defaultNow(),
+  },
+  (table) => [
+    index("subscriptions_workspace_id_idx").on(table.workspaceId),
+    unique("subscriptions_workspace_id_unique").on(table.workspaceId),
+  ]
+);
+
+/** One credit balance per workspace (unique constraint). */
+export const creditBalances = pgTable("credit_balances", {
+  id: text("id").primaryKey(),
+  workspaceId: text("workspace_id")
+    .notNull()
+    .unique()
+    .references(() => organization.id, { onDelete: "cascade" }),
+  /** The balance, in micros of `currency`. */
+  balanceMicros: bigint("balance_micros", { mode: "number" })
+    .notNull()
+    .default(0),
+  totalPurchasedMicros: bigint("total_purchased_micros", { mode: "number" })
+    .notNull()
+    .default(0),
+  totalUsedMicros: bigint("total_used_micros", { mode: "number" })
+    .notNull()
+    .default(0),
+  /** What this ledger is denominated in; a write in another is refused. */
+  currency: text("currency").notNull().default("USD"),
+  updatedAt: timestamp("updated_at").notNull().defaultNow(),
+});
+
+/**
+ * Singleton (id = "default") holding the FX rate and margin, so they change
+ * without a deploy. Read per request, cached 60s in-process.
+ */
+export const billingSettings = pgTable("billing_settings", {
+  id: text("id").primaryKey(),
+  /** The deployment's billing currency — every ledger row is in this. */
+  currency: text("currency").notNull().default("USD"),
+  /** What one USD costs in it, in micros: 1_000_000 is a USD deployment. */
+  usdRateMicros: bigint("usd_rate_micros", { mode: "number" })
+    .notNull()
+    .default(1_000_000),
+  /** Margin over provider cost, in basis points of a multiplier: 40_000 = 4×. */
+  marginBp: integer("margin_bp").notNull().default(40_000),
+  updatedAt: timestamp("updated_at").notNull().defaultNow(),
+});
+
+/** One-time credit purchases. */
+export const creditPurchases = pgTable(
+  "credit_purchases",
+  {
+    id: text("id").primaryKey(),
+    workspaceId: text("workspace_id")
+      .notNull()
+      .references(() => organization.id, { onDelete: "cascade" }),
+    /** What the buyer paid, in minor units of `priceCurrency`. */
+    priceMinor: integer("price_minor"),
+    priceCurrency: text("price_currency"),
+    /**
+     * What the workspace was granted, in micros of `grantedCurrency`.
+     * Separate from the price on purpose: a pack sold for $5 grants an
+     * amount of the billing currency, which is a different unit.
+     */
+    grantedMicros: bigint("granted_micros", { mode: "number" }),
+    grantedCurrency: text("granted_currency"),
+    stripePaymentIntentId: text("stripe_payment_intent_id"),
+    stripeCheckoutSessionId: text("stripe_checkout_session_id"),
+    status: text("status").notNull().default("pending"), // pending|completed|failed
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+  },
+  (table) => [index("credit_purchases_workspace_id_idx").on(table.workspaceId)]
+);
+
+/** Every Stripe event, for idempotent webhook processing and audit. */
+export const financeEvents = pgTable("finance_events", {
+  id: text("id").primaryKey(),
+  workspaceId: text("workspace_id").references(() => organization.id, {
+    onDelete: "set null",
+  }),
+  stripeEventId: text("stripe_event_id").notNull().unique(),
+  type: text("type").notNull(), // e.g., "checkout.session.completed", "invoice.paid"
+  /** Stripe's own amount, in the minor units of `currency`. */
+  amountMinor: integer("amount_minor"),
+  currency: text("currency").default("USD"),
+  metadata: text("metadata"), // JSON string
+  /**
+   * When a delivery took the event for processing. A lease: a claim
+   * older than the webhook's lease is taken as a delivery that died.
+   */
+  claimedAt: timestamp("claimed_at"),
+  /** Set once the handlers finished; the event is never run again. */
+  processedAt: timestamp("processed_at"),
+  createdAt: timestamp("created_at").notNull().defaultNow(),
+});
+
+/**
+ * Closes the admission → settlement race. Admission inserts a reservation
+ * for the worst-case estimate inside the same transaction that sums the
+ * other active reservations, so concurrent requests cannot all be admitted
+ * against the same balance. Settlement closes the reservation; abandoned
+ * ones expire via `expires_at`, are ignored by the sum, and are deleted by
+ * a cleanup job.
+ */
+export const creditReservations = pgTable(
+  "credit_reservations",
+  {
+    id: text("id").primaryKey(),
+    workspaceId: text("workspace_id")
+      .notNull()
+      .references(() => organization.id, { onDelete: "cascade" }),
+    /** Correlates admission with settlement. */
+    requestId: text("request_id").notNull().unique(),
+    /** The hold, in micros of `currency`. */
+    estimatedMicros: bigint("estimated_micros", { mode: "number" })
+      .notNull()
+      .default(0),
+    currency: text("currency").notNull().default("USD"),
+    status: text("status").notNull().default("active"), // active | settled
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+    expiresAt: timestamp("expires_at").notNull(),
+    settledAt: timestamp("settled_at"),
+  },
+  (table) => [
+    index("credit_reservations_active_idx").on(
+      table.workspaceId,
+      table.status,
+      table.expiresAt
+    ),
+  ]
+);
+
+export type Plan = typeof plans.$inferSelect;
+export type InsertPlan = typeof plans.$inferInsert;
+export type Subscription = typeof subscriptions.$inferSelect;
+export type InsertSubscription = typeof subscriptions.$inferInsert;
+export type CreditBalance = typeof creditBalances.$inferSelect;
+export type InsertCreditBalance = typeof creditBalances.$inferInsert;
+export type CreditPurchase = typeof creditPurchases.$inferSelect;
+export type InsertCreditPurchase = typeof creditPurchases.$inferInsert;
+export type FinanceEvent = typeof financeEvents.$inferSelect;
+export type InsertFinanceEvent = typeof financeEvents.$inferInsert;
+export type BillingSettings = typeof billingSettings.$inferSelect;
+export type InsertBillingSettings = typeof billingSettings.$inferInsert;
+export type CreditReservation = typeof creditReservations.$inferSelect;
+export type InsertCreditReservation = typeof creditReservations.$inferInsert;

package/src/db/schema/feature-flags.ts

@@ -0,0 +1,20 @@
+/**
+ * Runtime overrides for feature gates: `@intelligo-dev/billing`'s feature
+ * check reads a flag by name here before it falls back to the plan's
+ * entitlements, so a feature can be switched without a deploy.
+ */
+
+import { pgTable, text, timestamp, boolean } from "drizzle-orm/pg-core";
+
+export const featureFlags = pgTable("feature_flags", {
+  id: text("id").primaryKey(),
+  name: text("name").notNull().unique(),
+  description: text("description"),
+  enabledPlans: text("enabled_plans").notNull(), // JSON array string: e.g., '["free","pro","enterprise"]'
+  isActive: boolean("is_active").notNull().default(true),
+  createdAt: timestamp("created_at").notNull().defaultNow(),
+  updatedAt: timestamp("updated_at").notNull().defaultNow(),
+});
+
+export type FeatureFlag = typeof featureFlags.$inferSelect;
+export type InsertFeatureFlag = typeof featureFlags.$inferInsert;

package/src/db/schema/identity.ts

@@ -0,0 +1,250 @@
+/**
+ * The user identity graph: a user's facts, episodic memories and audit
+ * trail, synthesized into one profile snapshot an agent session reads in
+ * one query.
+ *
+ *  - `user_facts`: the structured source of truth, queryable by category
+ *    and weighted by confidence and importance.
+ *  - `user_memories`: unstructured episodic recall via pgvector search.
+ *  - `user_profile_snapshots`: the cached synthesis, since voice agents
+ *    cannot rebuild the profile inside a turn's latency budget.
+ *  - `user_memory_audit`: append-only log of every write, so a user can see
+ *    where each fact came from.
+ */
+
+import {
+  pgTable,
+  primaryKey,
+  text,
+  timestamp,
+  integer,
+  index,
+  uniqueIndex,
+  jsonb,
+  doublePrecision,
+} from "drizzle-orm/pg-core";
+import { vector } from "drizzle-orm/pg-core/columns/vector_extension/vector";
+import { organization, users } from "./auth";
+
+/**
+ * A fact's category, the filter axis for synthesis and display. A closed
+ * list on purpose: a new category is a decision, not a free-form string.
+ */
+export const USER_FACT_CATEGORIES = [
+  "interest",
+  "skill",
+  "goal",
+  "constraint",
+  "trait",
+  "value",
+  "preference",
+  "context",
+  "background",
+] as const;
+
+export type UserFactCategory = (typeof USER_FACT_CATEGORIES)[number];
+
+/**
+ * How a fact entered the system. "explicit_user_input" facts are
+ * considered ground truth and survive conflict resolution against
+ * lower-confidence LLM extractions.
+ */
+export const USER_FACT_EXTRACTION_METHODS = [
+  "llm_extraction",
+  "explicit_user_input",
+  "inline_tool",
+  "onboarding_form",
+] as const;
+
+export type UserFactExtractionMethod =
+  (typeof USER_FACT_EXTRACTION_METHODS)[number];
+
+export const userFacts = pgTable(
+  "user_facts",
+  {
+    id: text("id").primaryKey(),
+    userId: text("user_id")
+      .notNull()
+      .references(() => users.id, { onDelete: "cascade" }),
+    workspaceId: text("workspace_id")
+      .notNull()
+      .references(() => organization.id, { onDelete: "cascade" }),
+
+    category: text("category").$type<UserFactCategory>().notNull(),
+    key: text("key").notNull(),
+    value: jsonb("value").notNull(),
+    confidence: doublePrecision("confidence").notNull(),
+    importance: integer("importance").notNull().default(5),
+
+    sourceProduct: text("source_product"),
+    sourceSessionId: text("source_session_id"),
+    sourceMessageId: text("source_message_id"),
+    extractionMethod:
+      text("extraction_method").$type<UserFactExtractionMethod>(),
+
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+    lastConfirmedAt: timestamp("last_confirmed_at"),
+    expiresAt: timestamp("expires_at"),
+  },
+  (table) => [
+    index("user_facts_user_idx").on(table.userId),
+    index("user_facts_workspace_idx").on(table.workspaceId),
+    index("user_facts_category_idx").on(table.workspaceId, table.category),
+    // Scoped to (user, workspace, category, key) so members of a shared
+    // workspace can hold the same fact key without collision.
+    uniqueIndex("user_facts_user_workspace_category_key_uniq").on(
+      table.userId,
+      table.workspaceId,
+      table.category,
+      table.key
+    ),
+  ]
+);
+
+export const USER_MEMORY_KINDS = [
+  "conversation_summary",
+  "event",
+  "insight",
+  "preference_statement",
+  "decision",
+  "struggle",
+  "success",
+] as const;
+
+export type UserMemoryKind = (typeof USER_MEMORY_KINDS)[number];
+
+export const userMemories = pgTable(
+  "user_memories",
+  {
+    id: text("id").primaryKey(),
+    userId: text("user_id")
+      .notNull()
+      .references(() => users.id, { onDelete: "cascade" }),
+    workspaceId: text("workspace_id")
+      .notNull()
+      .references(() => organization.id, { onDelete: "cascade" }),
+
+    kind: text("kind").$type<UserMemoryKind>().notNull(),
+    content: text("content").notNull(),
+    embedding: vector({ dimensions: 1536 }),
+
+    sourceProduct: text("source_product"),
+    sourceSessionId: text("source_session_id"),
+    sourceMessageIds: text("source_message_ids").array(),
+
+    importance: integer("importance").notNull().default(5),
+    decayFactor: doublePrecision("decay_factor").notNull().default(1.0),
+    metadata: jsonb("metadata"),
+
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+  },
+  (table) => [
+    index("user_memories_user_idx").on(table.userId),
+    index("user_memories_workspace_idx").on(table.workspaceId),
+    index("user_memories_kind_idx").on(table.workspaceId, table.kind),
+    // The pgvector index is created in migration SQL: drizzle-orm cannot
+    // express it.
+  ]
+);
+
+export const SYNTHESIS_TRIGGER_REASONS = [
+  "fact_threshold",
+  "session_close",
+  "daily_cron",
+  "manual",
+] as const;
+
+export type SynthesisTriggerReason = (typeof SYNTHESIS_TRIGGER_REASONS)[number];
+
+export const userProfileSnapshots = pgTable(
+  "user_profile_snapshots",
+  {
+    userId: text("user_id")
+      .notNull()
+      .references(() => users.id, { onDelete: "cascade" }),
+    workspaceId: text("workspace_id")
+      .notNull()
+      .references(() => organization.id, { onDelete: "cascade" }),
+    version: integer("version").notNull(),
+
+    summary: text("summary").notNull(),
+    summaryEn: text("summary_en"),
+    summaryMn: text("summary_mn"),
+
+    factsDigest: jsonb("facts_digest").notNull(),
+    activeGoals: jsonb("active_goals"),
+    personalitySignals: jsonb("personality_signals"),
+    relationshipNotes: jsonb("relationship_notes"),
+
+    synthesizedByModel: text("synthesized_by_model"),
+    synthesizedAt: timestamp("synthesized_at").notNull().defaultNow(),
+    nextSynthesisAt: timestamp("next_synthesis_at"),
+    triggerReason: text("trigger_reason").$type<SynthesisTriggerReason>(),
+  },
+  // One snapshot per user per workspace: a user in two workspaces gets two
+  // distinct profiles.
+  (table) => [
+    primaryKey({ columns: [table.userId, table.workspaceId] }),
+    index("user_profile_snapshots_workspace_idx").on(table.workspaceId),
+  ]
+);
+
+export const AUDIT_TARGET_KINDS = ["fact", "memory", "snapshot"] as const;
+export type AuditTargetKind = (typeof AUDIT_TARGET_KINDS)[number];
+
+export const AUDIT_ACTIONS = [
+  "create",
+  "update",
+  "delete",
+  "view",
+  "export",
+] as const;
+export type AuditAction = (typeof AUDIT_ACTIONS)[number];
+
+export const AUDIT_ACTOR_KINDS = [
+  "agent",
+  "user",
+  "system_job",
+  "admin",
+] as const;
+export type AuditActorKind = (typeof AUDIT_ACTOR_KINDS)[number];
+
+export const userMemoryAudit = pgTable(
+  "user_memory_audit",
+  {
+    id: text("id").primaryKey(),
+    userId: text("user_id")
+      .notNull()
+      .references(() => users.id, { onDelete: "cascade" }),
+    workspaceId: text("workspace_id")
+      .notNull()
+      .references(() => organization.id, { onDelete: "cascade" }),
+
+    targetKind: text("target_kind").$type<AuditTargetKind>().notNull(),
+    targetId: text("target_id").notNull(),
+    action: text("action").$type<AuditAction>().notNull(),
+    actorKind: text("actor_kind").$type<AuditActorKind>().notNull(),
+    actorId: text("actor_id"),
+
+    beforeValue: jsonb("before_value"),
+    afterValue: jsonb("after_value"),
+    reason: text("reason"),
+
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+  },
+  (table) => [
+    index("user_memory_audit_user_idx").on(table.userId),
+    index("user_memory_audit_workspace_idx").on(table.workspaceId),
+    index("user_memory_audit_target_idx").on(table.targetKind, table.targetId),
+  ]
+);
+
+export type UserFact = typeof userFacts.$inferSelect;
+export type InsertUserFact = typeof userFacts.$inferInsert;
+export type UserMemory = typeof userMemories.$inferSelect;
+export type InsertUserMemory = typeof userMemories.$inferInsert;
+export type UserProfileSnapshot = typeof userProfileSnapshots.$inferSelect;
+export type InsertUserProfileSnapshot =
+  typeof userProfileSnapshots.$inferInsert;
+export type UserMemoryAuditRow = typeof userMemoryAudit.$inferSelect;
+export type InsertUserMemoryAudit = typeof userMemoryAudit.$inferInsert;

package/src/db/schema/index.ts

@@ -0,0 +1,12 @@
+// Better-Auth's tables, including organization, member and invitation.
+// Product code goes through the Better-Auth API rather than querying the
+// organization tables directly, so membership and role rules stay in one
+// place.
+export * from "./auth";
+export * from "./billing";
+export * from "./usage";
+export * from "./notifications";
+export * from "./feature-flags";
+export * from "./ai";
+export * from "./agents";
+export * from "./identity";