@intelligo-dev/core 1.0.0-beta.1 → 1.0.0-beta.14

package/src/db/schema/auth.ts

@@ -0,0 +1,183 @@
+/**
+ * Better-Auth's tables. Table and column names must match what its Drizzle
+ * adapter expects.
+ */
+
+import { sql } from "drizzle-orm";
+import {
+  pgTable,
+  text,
+  timestamp,
+  boolean,
+  index,
+  uniqueIndex,
+} from "drizzle-orm/pg-core";
+
+export const users = pgTable(
+  "users",
+  {
+    id: text("id").primaryKey(),
+    name: text("name").notNull(),
+    email: text("email").notNull().unique(),
+    emailVerified: boolean("email_verified").notNull().default(false),
+    image: text("image"),
+    deletedAt: timestamp("deleted_at"), // Soft delete: null = active, timestamp = deleted
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+    updatedAt: timestamp("updated_at").notNull().defaultNow(),
+    onboardingCompleted: boolean("onboarding_completed")
+      .notNull()
+      .default(false),
+    onboardingStep: text("onboarding_step"), // Current step if incomplete: "workspace" | "language" | "product"
+    preferredLanguage: text("preferred_language").notNull().default("en"), // a locale the app ships, e.g. "en"
+    /**
+     * Platform role, not a workspace role — "platform-admin" or null. Grants
+     * the operational console and impersonation. PLATFORM_ADMIN_EMAILS seeds
+     * it: requirePlatformAdmin promotes an allowlisted user on first use.
+     */
+    role: text("role"),
+    /** Required by Better-Auth's admin plugin schema; unused otherwise. */
+    banned: boolean("banned").notNull().default(false),
+    banReason: text("ban_reason"),
+    banExpires: timestamp("ban_expires"),
+  },
+  (table) => [
+    // Finding the platform admins: a handful of rows among many.
+    index("users_role_idx")
+      .on(table.role)
+      .where(sql`${table.role} IS NOT NULL`),
+  ]
+);
+
+export const sessions = pgTable(
+  "sessions",
+  {
+    id: text("id").primaryKey(),
+    userId: text("user_id")
+      .notNull()
+      .references(() => users.id, { onDelete: "cascade" }),
+    token: text("token").notNull().unique(),
+    expiresAt: timestamp("expires_at").notNull(),
+    ipAddress: text("ip_address"),
+    userAgent: text("user_agent"),
+    /**
+     * Set on a session created by an admin acting as this user, so
+     * impersonation stays visible on the session and in the audit trail.
+     */
+    impersonatedBy: text("impersonated_by"),
+    /**
+     * The organization plugin's active workspace. Without this column its
+     * set-active writes are silently dropped and workspace switching never
+     * persists.
+     */
+    activeOrganizationId: text("active_organization_id"),
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+    updatedAt: timestamp("updated_at").notNull().defaultNow(),
+  },
+  (table) => [index("sessions_user_id_idx").on(table.userId)]
+);
+
+/** OAuth provider connections and password credentials. */
+export const accounts = pgTable(
+  "accounts",
+  {
+    id: text("id").primaryKey(),
+    userId: text("user_id")
+      .notNull()
+      .references(() => users.id, { onDelete: "cascade" }),
+    accountId: text("account_id").notNull(),
+    providerId: text("provider_id").notNull(),
+    accessToken: text("access_token"),
+    refreshToken: text("refresh_token"),
+    accessTokenExpiresAt: timestamp("access_token_expires_at"),
+    refreshTokenExpiresAt: timestamp("refresh_token_expires_at"),
+    scope: text("scope"),
+    idToken: text("id_token"),
+    password: text("password"),
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+    updatedAt: timestamp("updated_at").notNull().defaultNow(),
+  },
+  (table) => [index("accounts_user_id_idx").on(table.userId)]
+);
+
+/** Email verification and password reset tokens. */
+export const verifications = pgTable("verifications", {
+  id: text("id").primaryKey(),
+  identifier: text("identifier").notNull(),
+  value: text("value").notNull(),
+  expiresAt: timestamp("expires_at").notNull(),
+  createdAt: timestamp("created_at").notNull().defaultNow(),
+  updatedAt: timestamp("updated_at").notNull().defaultNow(),
+});
+
+/** Workspaces, managed by Better-Auth's organization plugin. */
+export const organization = pgTable("organization", {
+  id: text("id").primaryKey(),
+  name: text("name").notNull(),
+  slug: text("slug").unique(),
+  logo: text("logo"),
+  metadata: text("metadata"),
+  createdAt: timestamp("created_at").notNull().defaultNow(),
+  updatedAt: timestamp("updated_at").notNull().defaultNow(),
+});
+
+export const member = pgTable(
+  "member",
+  {
+    id: text("id").primaryKey(),
+    organizationId: text("organization_id")
+      .notNull()
+      .references(() => organization.id, { onDelete: "cascade" }),
+    userId: text("user_id")
+      .notNull()
+      .references(() => users.id, { onDelete: "cascade" }),
+    role: text("role").notNull(),
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+    updatedAt: timestamp("updated_at").notNull().defaultNow(),
+  },
+  (table) => [
+    index("member_organization_id_idx").on(table.organizationId),
+    index("member_user_id_idx").on(table.userId),
+    uniqueIndex("member_organization_user_uniq").on(
+      table.organizationId,
+      table.userId
+    ),
+  ]
+);
+
+export const invitation = pgTable(
+  "invitation",
+  {
+    id: text("id").primaryKey(),
+    organizationId: text("organization_id")
+      .notNull()
+      .references(() => organization.id, { onDelete: "cascade" }),
+    email: text("email").notNull(),
+    role: text("role").notNull(),
+    status: text("status").notNull(),
+    expiresAt: timestamp("expires_at").notNull(),
+    inviterId: text("inviter_id").references(() => users.id, {
+      onDelete: "set null",
+    }),
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+    updatedAt: timestamp("updated_at").notNull().defaultNow(),
+  },
+  (table) => [
+    index("invitation_organization_id_idx").on(table.organizationId),
+    index("invitation_email_idx").on(table.email),
+  ]
+);
+
+export type User = typeof users.$inferSelect;
+export type InsertUser = typeof users.$inferInsert;
+export type Session = typeof sessions.$inferSelect;
+export type InsertSession = typeof sessions.$inferInsert;
+export type Account = typeof accounts.$inferSelect;
+export type InsertAccount = typeof accounts.$inferInsert;
+export type Verification = typeof verifications.$inferSelect;
+export type InsertVerification = typeof verifications.$inferInsert;
+export type Organization = typeof organization.$inferSelect;
+export type InsertOrganization = typeof organization.$inferInsert;
+export type Member = typeof member.$inferSelect;
+export type InsertMember = typeof member.$inferInsert;
+export type Invitation = typeof invitation.$inferSelect;
+export type InsertInvitation = typeof invitation.$inferInsert;

package/src/db/schema/billing.ts

@@ -0,0 +1,245 @@
+/**
+ * Plans, subscriptions, credit ledgers, purchases, local payments and
+ * Stripe events. Amounts in the credit ledgers are micros of their
+ * currency; amounts a buyer paid are minor units of theirs.
+ */
+
+import {
+  pgTable,
+  text,
+  timestamp,
+  integer,
+  bigint,
+  boolean,
+  index,
+  unique,
+} from "drizzle-orm/pg-core";
+import { organization, users } from "./auth";
+
+/**
+ * The registered plan catalogue, copied into rows so a subscription can
+ * reference its plan. The catalogue is the source: the rows are written
+ * from it at boot, and an edit made here is overwritten by the next one.
+ */
+export const plans = pgTable("plans", {
+  id: text("id").primaryKey(),
+  name: text("name").notNull(),
+  slug: text("slug").notNull().unique(),
+  description: text("description"),
+  /**
+   * Whole major units — 29 is twenty-nine of the currency, not cents —
+   * rounded from the catalogue's price. 0 for free. The row names no
+   * currency; readers take the deployment's billing currency.
+   */
+  priceMonthly: integer("price_monthly").notNull(),
+  /** Whole major units, as `priceMonthly`. 0 when the plan has no yearly price. */
+  priceYearly: integer("price_yearly").notNull(),
+  stripePriceIdMonthly: text("stripe_price_id_monthly"),
+  stripePriceIdYearly: text("stripe_price_id_yearly"),
+  features: text("features").notNull(), // JSON string array
+  limits: text("limits").notNull(), // JSON string: { tokens, conversations, teamMembers, workspaces, documents }
+  isActive: boolean("is_active").notNull().default(true),
+  sortOrder: integer("sort_order").notNull().default(0),
+  createdAt: timestamp("created_at").notNull().defaultNow(),
+  updatedAt: timestamp("updated_at").notNull().defaultNow(),
+});
+
+/** One subscription per workspace (unique constraint). */
+export const subscriptions = pgTable(
+  "subscriptions",
+  {
+    id: text("id").primaryKey(),
+    workspaceId: text("workspace_id")
+      .notNull()
+      .references(() => organization.id, { onDelete: "cascade" }),
+    planId: text("plan_id")
+      .notNull()
+      .references(() => plans.id, { onDelete: "restrict" }),
+    stripeCustomerId: text("stripe_customer_id"),
+    stripeSubscriptionId: text("stripe_subscription_id").unique(),
+    status: text("status").notNull().default("active"), // active|past_due|canceled|trialing|incomplete
+    billingMode: text("billing_mode").notNull().default("subscription"), // subscription|credit
+    currentPeriodStart: timestamp("current_period_start"),
+    currentPeriodEnd: timestamp("current_period_end"),
+    cancelAtPeriodEnd: boolean("cancel_at_period_end").notNull().default(false),
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+    updatedAt: timestamp("updated_at").notNull().defaultNow(),
+  },
+  (table) => [
+    index("subscriptions_workspace_id_idx").on(table.workspaceId),
+    unique("subscriptions_workspace_id_unique").on(table.workspaceId),
+  ]
+);
+
+/** One credit balance per workspace (unique constraint). */
+export const creditBalances = pgTable("credit_balances", {
+  id: text("id").primaryKey(),
+  workspaceId: text("workspace_id")
+    .notNull()
+    .unique()
+    .references(() => organization.id, { onDelete: "cascade" }),
+  /** The balance, in micros of `currency`. */
+  balanceMicros: bigint("balance_micros", { mode: "number" })
+    .notNull()
+    .default(0),
+  totalPurchasedMicros: bigint("total_purchased_micros", { mode: "number" })
+    .notNull()
+    .default(0),
+  totalUsedMicros: bigint("total_used_micros", { mode: "number" })
+    .notNull()
+    .default(0),
+  /** What this ledger is denominated in; a write in another is refused. */
+  currency: text("currency").notNull().default("USD"),
+  updatedAt: timestamp("updated_at").notNull().defaultNow(),
+});
+
+/**
+ * Singleton (id = "default") holding the FX rate and margin, so they change
+ * without a deploy. Read per request, cached 60s in-process.
+ */
+export const billingSettings = pgTable("billing_settings", {
+  id: text("id").primaryKey(),
+  /** The deployment's billing currency — every ledger row is in this. */
+  currency: text("currency").notNull().default("USD"),
+  /** What one USD costs in it, in micros: 1_000_000 is a USD deployment. */
+  usdRateMicros: bigint("usd_rate_micros", { mode: "number" })
+    .notNull()
+    .default(1_000_000),
+  /** Margin over provider cost, in basis points of a multiplier: 40_000 = 4×. */
+  marginBp: integer("margin_bp").notNull().default(40_000),
+  updatedAt: timestamp("updated_at").notNull().defaultNow(),
+});
+
+/** One-time credit purchases. */
+export const creditPurchases = pgTable(
+  "credit_purchases",
+  {
+    id: text("id").primaryKey(),
+    workspaceId: text("workspace_id")
+      .notNull()
+      .references(() => organization.id, { onDelete: "cascade" }),
+    /** What the buyer paid, in minor units of `priceCurrency`. */
+    priceMinor: integer("price_minor"),
+    priceCurrency: text("price_currency"),
+    /**
+     * What the workspace was granted, in micros of `grantedCurrency`.
+     * Separate from the price on purpose: a pack sold for $5 grants an
+     * amount of the billing currency, which is a different unit.
+     */
+    grantedMicros: bigint("granted_micros", { mode: "number" }),
+    grantedCurrency: text("granted_currency"),
+    stripePaymentIntentId: text("stripe_payment_intent_id"),
+    stripeCheckoutSessionId: text("stripe_checkout_session_id"),
+    status: text("status").notNull().default("pending"), // pending|completed|failed
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+  },
+  (table) => [index("credit_purchases_workspace_id_idx").on(table.workspaceId)]
+);
+
+/**
+ * Invoices issued through a registered payment provider (QR-and-poll
+ * methods such as QPay, PIX or UPI), one row per invoice. The row is
+ * written when the invoice is opened, so settlement knows who pays and
+ * what was priced without trusting the browser; `fulfilled_at` is set
+ * in the same transaction that grants what was bought, so a payment is
+ * granted once however many polls see it paid.
+ */
+export const payments = pgTable(
+  "payments",
+  {
+    id: text("id").primaryKey(),
+    /** The PAYMENT_MODE the invoice was opened under; settlement asks the same provider. */
+    provider: text("provider").notNull(),
+    invoiceId: text("invoice_id").notNull().unique(),
+    workspaceId: text("workspace_id")
+      .notNull()
+      .references(() => organization.id, { onDelete: "cascade" }),
+    userId: text("user_id").references(() => users.id, {
+      onDelete: "set null",
+    }),
+    /** What was bought, in the product's words: a plan slug, a bundle id. */
+    reference: text("reference").notNull(),
+    /** The price, in minor units of `currency`. */
+    amountMinor: integer("amount_minor").notNull(),
+    currency: text("currency").notNull(),
+    status: text("status").notNull().default("pending"), // pending|paid|failed
+    fulfilledAt: timestamp("fulfilled_at"),
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+  },
+  (table) => [index("payments_workspace_id_idx").on(table.workspaceId)]
+);
+
+/** Every Stripe event, for idempotent webhook processing and audit. */
+export const financeEvents = pgTable("finance_events", {
+  id: text("id").primaryKey(),
+  workspaceId: text("workspace_id").references(() => organization.id, {
+    onDelete: "set null",
+  }),
+  stripeEventId: text("stripe_event_id").notNull().unique(),
+  type: text("type").notNull(), // e.g., "checkout.session.completed", "invoice.paid"
+  /** Stripe's own amount, in the minor units of `currency`. */
+  amountMinor: integer("amount_minor"),
+  currency: text("currency").default("USD"),
+  metadata: text("metadata"), // JSON string
+  /**
+   * When a delivery took the event for processing. A lease: a claim
+   * older than the webhook's lease is taken as a delivery that died.
+   */
+  claimedAt: timestamp("claimed_at"),
+  /** Set once the handlers finished; the event is never run again. */
+  processedAt: timestamp("processed_at"),
+  createdAt: timestamp("created_at").notNull().defaultNow(),
+});
+
+/**
+ * Closes the admission → settlement race. Admission inserts a reservation
+ * for the worst-case estimate inside the same transaction that sums the
+ * other active reservations, so concurrent requests cannot all be admitted
+ * against the same balance. Settlement closes the reservation; abandoned
+ * ones expire via `expires_at`, are ignored by the sum, and are deleted by
+ * a cleanup job.
+ */
+export const creditReservations = pgTable(
+  "credit_reservations",
+  {
+    id: text("id").primaryKey(),
+    workspaceId: text("workspace_id")
+      .notNull()
+      .references(() => organization.id, { onDelete: "cascade" }),
+    /** Correlates admission with settlement. */
+    requestId: text("request_id").notNull().unique(),
+    /** The hold, in micros of `currency`. */
+    estimatedMicros: bigint("estimated_micros", { mode: "number" })
+      .notNull()
+      .default(0),
+    currency: text("currency").notNull().default("USD"),
+    status: text("status").notNull().default("active"), // active | settled
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+    expiresAt: timestamp("expires_at").notNull(),
+    settledAt: timestamp("settled_at"),
+  },
+  (table) => [
+    index("credit_reservations_active_idx").on(
+      table.workspaceId,
+      table.status,
+      table.expiresAt
+    ),
+  ]
+);
+
+export type Plan = typeof plans.$inferSelect;
+export type InsertPlan = typeof plans.$inferInsert;
+export type Subscription = typeof subscriptions.$inferSelect;
+export type InsertSubscription = typeof subscriptions.$inferInsert;
+export type CreditBalance = typeof creditBalances.$inferSelect;
+export type InsertCreditBalance = typeof creditBalances.$inferInsert;
+export type CreditPurchase = typeof creditPurchases.$inferSelect;
+export type InsertCreditPurchase = typeof creditPurchases.$inferInsert;
+export type Payment = typeof payments.$inferSelect;
+export type InsertPayment = typeof payments.$inferInsert;
+export type FinanceEvent = typeof financeEvents.$inferSelect;
+export type InsertFinanceEvent = typeof financeEvents.$inferInsert;
+export type BillingSettings = typeof billingSettings.$inferSelect;
+export type InsertBillingSettings = typeof billingSettings.$inferInsert;
+export type CreditReservation = typeof creditReservations.$inferSelect;
+export type InsertCreditReservation = typeof creditReservations.$inferInsert;

package/src/db/schema/feature-flags.ts

@@ -0,0 +1,20 @@
+/**
+ * Runtime overrides for feature gates: `@intelligo-dev/billing`'s feature
+ * check reads a flag by name here before it falls back to the plan's
+ * entitlements, so a feature can be switched without a deploy.
+ */
+
+import { pgTable, text, timestamp, boolean } from "drizzle-orm/pg-core";
+
+export const featureFlags = pgTable("feature_flags", {
+  id: text("id").primaryKey(),
+  name: text("name").notNull().unique(),
+  description: text("description"),
+  enabledPlans: text("enabled_plans").notNull(), // JSON array string: e.g., '["free","pro","enterprise"]'
+  isActive: boolean("is_active").notNull().default(true),
+  createdAt: timestamp("created_at").notNull().defaultNow(),
+  updatedAt: timestamp("updated_at").notNull().defaultNow(),
+});
+
+export type FeatureFlag = typeof featureFlags.$inferSelect;
+export type InsertFeatureFlag = typeof featureFlags.$inferInsert;