@marinoscar/kvox-eval 0.0.0-bootstrap → 0.1.0-next.0

package/host/prisma/schema/platform.identity.prisma

@@ -0,0 +1,638 @@
+// GENERATED by platform db compose — do not edit
+// source: package:identity.prisma
+
+// =============================================================================
+// User & Identity
+// =============================================================================
+
+// @extensible — back-relations only, added with "extend model User { ... }" in a fragment
+model User {
+  id                      String   @id @default(uuid()) @db.Uuid
+  email                   String   @unique
+  displayName             String?  @map("display_name")
+  providerDisplayName     String?  @map("provider_display_name")
+  profileImageUrl         String?  @map("profile_image_url")
+  providerProfileImageUrl String?  @map("provider_profile_image_url")
+  isActive                Boolean  @default(true) @map("is_active")
+  createdAt               DateTime @default(now()) @map("created_at") @db.Timestamptz
+  updatedAt               DateTime @updatedAt @map("updated_at") @db.Timestamptz
+  // App-owned, namespaced fields (`registerUserMetadataSchema`, PP-14.27): one top-level
+  // key per registered namespace, each validated against its zod schema on write.
+  // NOT a secret store (a secret-named field is refused at registration; secrets go
+  // in `user_credentials`). At most 16 KiB per row, enforced by the writer and, as a
+  // 32 KiB backstop, by `users_metadata_size_check`. Never returned by the platform's
+  // routes: an app exposes a namespace only through a route it writes.
+  metadata                Json     @default("{}") @db.JsonB
+
+  // Relations
+  identities             UserIdentity[]
+  userRoles              UserRole[]
+  auditEvents            AuditEvent[]            @relation("ActorEvents")
+  refreshTokens          RefreshToken[]          @relation("UserRefreshTokens")
+  allowlistEntriesAdded  AllowedEmail[]          @relation("AllowlistAddedBy")
+  allowlistEntry         AllowedEmail?           @relation("AllowlistClaimedBy")
+  deviceCodes            DeviceCode[]            @relation("UserDeviceCodes")
+  personalAccessTokens   PersonalAccessToken[]   @relation("UserPersonalAccessTokens")
+  memberships            Membership[]
+  organizationsCreated   Organization[]          @relation("OrganizationCreatedBy")
+  invitesSent            Invite[]                @relation("InviteInvitedBy")
+  invitesAccepted        Invite[]                @relation("InviteAcceptedBy")
+
+  // composed from package:ai.prisma
+  // AI platform (#423, epic #419). Four relations, four different
+  // `onDelete` answers — see each model's own block comment for why:
+  //   - `aiModelsUpdated` (`AiModel.updatedByUser`) is provenance on a
+  //     CATALOG row nobody owns, so `SetNull`, matching `Credential
+  //     .updatedByUser` above.
+  //   - `aiKeys` (`UserAiKey.user`) is `Cascade`: a BYOK key belongs to the
+  //     user who typed it in, in exactly the sense `PushSubscription.user`
+  //     does — there is no reader for it once the account is gone.
+  //   - `aiRuns` (`AiRun.user`) is `SetNull`: a run is history, kept for
+  //     usage/audit purposes independent of whether its requester's account
+  //     still exists, matching `NotificationDelivery.user`.
+  //   - `aiUsageEvents` (`AiUsageEvent.user`) is `SetNull` for the identical
+  //     reason `aiRuns` is: usage accounting must outlive the account it
+  //     billed.
+  aiModelsUpdated        AiModel[]               @relation("AiModelUpdatedBy")
+  aiKeys                 UserAiKey[]
+  aiRuns                 AiRun[]
+  aiUsageEvents          AiUsageEvent[]
+
+  // composed from package:android-app.prisma
+  androidAppReleases AndroidAppRelease[] @relation("AndroidAppReleaseUploader")
+
+  // composed from package:credentials.prisma
+  credentialUpdates      Credential[]            @relation("CredentialUpdatedBy")
+  // Per-user encrypted credentials (issue #387). Cascade: a user-owned
+  // secret has no meaning once its owner is gone — see `UserCredential`.
+  userCredentials        UserCredential[]        @relation("UserCredentials")
+
+  // composed from package:credentials.prisma
+  // Provenance on an organization's credential (issue #735). SetNull: an
+  // org's key outlives the administrator who last typed it in.
+  orgCredentialUpdates OrgCredential[] @relation("OrgCredentialUpdatedBy")
+
+  // composed from package:db-backup.prisma
+  // Two relations to ONE table, deliberately (#281, epic #254): a
+  // `database_backup_runs` row records both "who asked for this backup" and,
+  // once Phase 7 restores from it, "who restored it". They are different acts
+  // by (usually) different people at different times, so they are different
+  // columns and therefore different relation names. See the block comment
+  // above `DatabaseBackupRun` for why the restore audit lives on the backup's
+  // own row rather than in a second table.
+  databaseBackupRuns     DatabaseBackupRun[]     @relation("UserDatabaseBackupRuns")
+  databaseRestores       DatabaseBackupRun[]     @relation("UserDatabaseRestores")
+
+  // composed from package:jobs.prisma
+  workerNodes            WorkerNode[]            @relation("UserWorkerNodes")
+  nodeCredentials        NodeCredential[]        @relation("UserNodeCredentials")
+
+  // composed from package:notifications.prisma
+  notificationDeliveries NotificationDelivery[]  @relation("UserNotificationDeliveries")
+  notifications          Notification[]          @relation("UserNotifications")
+  pushSubscriptions      PushSubscription[]      @relation("UserPushSubscriptions")
+  broadcastsCreated      NotificationBroadcast[] @relation("BroadcastAuthor")
+
+  // composed from package:settings.prisma
+  userSettings           UserSettings?
+  settingsUpdates        SystemSettings[]        @relation("SettingsUpdater")
+  orgSettingsUpdates     OrgSettings[]           @relation("OrgSettingsUpdater")
+
+  // composed from package:sharing.prisma
+  groupsCreated       Group[]       @relation("GroupCreatedBy")
+  groupMemberships    GroupMember[] @relation("GroupMemberUser")
+  groupMembersAdded   GroupMember[] @relation("GroupMemberAddedBy")
+  groupInvitesSent    GroupInvite[] @relation("GroupInviteInvitedBy")
+  groupInvitesClaimed GroupInvite[] @relation("GroupInviteAcceptedBy")
+  grantsReceived      Grant[]       @relation("GrantGranteeUser")
+  grantsRevoked       Grant[]       @relation("GrantRevokedBy")
+  grantsGiven         Grant[]       @relation("GrantGrantedBy")
+
+  // composed from package:storage.prisma
+  storageObjects         StorageObject[]         @relation("UserStorageObjects")
+
+  // composed from app:kvox.ask.prisma
+  // Back-relations onto the platform's User (an `extend model` block holds back-relation fields only).
+  // Ask conversations (issue #376, epic #348). CASCADES — a saved question
+  // and its answers are the user's own content, derived from their private
+  // recordings, with no read path for anyone else (no `ask:read_any`), so a
+  // deleted account leaves no Ask history. See the block comment above
+  // `AskConversation`.
+  askConversations AskConversation[]
+
+  // composed from app:kvox.graph.prisma
+  // Back-relations onto the platform's User (an `extend model` block holds back-relation fields only).
+  // Connected Knowledge (epic #344, issue #351). Every `kg_*` table carries
+  // its own `owner_id` and CASCADES — an entity, relation, item, piece of
+  // evidence, mention, proposal, merge, distinct-pair or attribute
+  // definition has no meaning and no permission path to read it once its
+  // owner is gone, the identical reasoning `notes.owner_id`/
+  // `transcripts.owner_id` already establish (§10, and there is no
+  // `graph:read_any` for the same reason there is no `notes:read_any`).
+  // `kgEntityViews` is the one exception: it is keyed on `user_id`, not
+  // `owner_id`, because "which entities has THIS user looked at" is a
+  // per-viewer fact, not an ownership fact — see the block comment above
+  // `KgEntityView`.
+  kgEntities      KgEntity[]
+  kgEntityAliases KgEntityAlias[]
+  kgRelations     KgRelation[]
+  kgItems         KgItem[]
+  kgEvidence      KgEvidence[]
+  kgMentions      KgMention[]
+  kgProposals     KgProposal[]
+  kgMerges        KgMerge[]
+  kgDistinctPairs KgDistinctPair[]
+  kgAttributeDefs KgAttributeDef[]
+  kgEntityDigests KgEntityDigest[]
+  kgEntityViews   KgEntityView[]
+  kgGraphLayouts  KgGraphLayout[]
+
+  // #386 — RDF exports of the owner's graph. CASCADES: a disposable,
+  // reproducible artefact with its own 7-day expiry, like `note_exports`.
+  kgExports       KgExport[]
+
+  // composed from app:kvox.notes.prisma
+  // Back-relations onto the platform's User (an `extend model` block holds back-relation fields only).
+  // Notes (issue #48, epic #45). Four relations to the note tables, split by
+  // role for the identical reason the six transcript relations above are:
+  // "owns this note", "owns this custom template", "wrote this version" and
+  // "asked for this export" are four different acts. See the block comment
+  // above the `Note` model for the full reasoning behind each `onDelete`.
+  notes                Note[]                   @relation("NoteOwner")
+  noteTemplatesOwned   NoteTemplate[]           @relation("NoteTemplateOwner")
+  noteVersionsAuthored NoteVersion[]            @relation("NoteVersionAuthor")
+  noteExportsRequested NoteExport[]             @relation("NoteExportRequestedBy")
+
+  // Per-user "hide this template from my picker" preference (#310, epic
+  // #306). CASCADES — the preference is meaningless once its owner is gone.
+  // See the block comment above `UserHiddenNoteTemplate` for why this is a
+  // join table rather than a `user_settings` namespace.
+  hiddenNoteTemplates  UserHiddenNoteTemplate[]
+
+  // composed from app:kvox.search.prisma
+  // Back-relations onto the platform's User (an `extend model` block holds back-relation fields only).
+  // Semantic search index state (issue #181, epic #165). ONE relation, and
+  // it CASCADES — an index-state row for a document owned by nobody means
+  // nothing, the identical reasoning `transcripts`/`notes` already apply to
+  // their own `ownerId`. See the block comment above `SearchIndexState`.
+  searchIndexStates SearchIndexState[] @relation("SearchIndexStateOwner")
+
+  // composed from app:kvox.transcripts.prisma
+  // Back-relations onto the platform's User (an `extend model` block holds back-relation fields only).
+  // Transcripts (issue #24, epic #19). Four relations to the transcript
+  // tables, split by role for the same reason `databaseBackupRuns` /
+  // `databaseRestores` are two relations to one table above: "owns this
+  // transcript", "wrote this version", "last edited this segment" and "asked
+  // for this export" are four different acts, not one (a share is a platform
+  // `grants` row since issue #485). See the block comment above the `Transcript`
+  // model for the full reasoning behind every one of these relations'
+  // `onDelete` behaviour.
+  transcripts                      Transcript[]               @relation("TranscriptOwner")
+  transcriptVersionsAuthored       TranscriptVersion[]        @relation("TranscriptVersionAuthor")
+  transcriptSegmentEdits           TranscriptSegment[]        @relation("TranscriptSegmentEditor")
+  transcriptExportsRequested       TranscriptExport[]         @relation("TranscriptExportRequestedBy")
+
+  // AI name checks (issue #328, epic #326). Two relations, split by role for
+  // the same reason the six transcript relations above are: "asked for this
+  // run" and "accepted/rejected this suggestion" are different acts. See the
+  // block comment above the `TranscriptNameCheck` model for the full
+  // reasoning behind each `onDelete`.
+  transcriptNameChecksRequested    TranscriptNameCheck[]      @relation("TranscriptNameCheckRequestedBy")
+  transcriptNameSuggestionsDecided TranscriptNameSuggestion[] @relation("TranscriptNameSuggestionDecidedBy")
+
+  @@map("users")
+}
+
+model UserIdentity {
+  id              String   @id @default(uuid()) @db.Uuid
+  userId          String   @map("user_id") @db.Uuid
+  provider        String
+  providerSubject String   @map("provider_subject")
+  providerEmail   String?  @map("provider_email")
+  createdAt       DateTime @default(now()) @map("created_at") @db.Timestamptz
+
+  // Relations
+  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@unique([provider, providerSubject])
+  @@map("user_identities")
+}
+
+// =============================================================================
+// RBAC - Roles & Permissions
+// =============================================================================
+//
+// Two kinds of role (PP-6.3): SYSTEM roles operate the deployment and are held
+// in `user_roles`; ORG roles operate one organization and are held on a
+// membership (`memberships.role_id`). A role is granted only permissions of its
+// own scope (enforced by the app's permission registry, seeded by
+// `seedPlatform`). Roles stay global rows; per-organization custom roles are a
+// later seam.
+
+enum RoleScope {
+  system
+  org
+}
+
+// @extensible — back-relations only, added with "extend model Role { ... }" in a fragment
+// (a table of the app's own that points at a role, such as per-role settings). The
+// role's own columns and the `role_permissions` grants stay the platform's: `seedPlatform`
+// refreshes them from the registry on every run.
+model Role {
+  id          String    @id @default(uuid()) @db.Uuid
+  name        String    @unique
+  description String?
+  scope       RoleScope @default(system)
+
+  // Relations
+  rolePermissions RolePermission[]
+  userRoles       UserRole[]
+  memberships     Membership[]
+  invites         Invite[]
+
+  @@map("roles")
+}
+
+// Deliberately NOT `@extensible` (PP-14.27). A permission is a string owned by code:
+// the registry (`registerPermissions`) is the source of truth, `seedPlatform` upserts
+// the rows by `name` and never deletes one, and a removed permission is retired by an
+// explicit expand/contract migration. A foreign key from an app table would make that
+// retirement fail and would tie app data to a row id that no registry declares. An app
+// refers to a permission by its name string in code, never by a relation.
+model Permission {
+  id          String    @id @default(uuid()) @db.Uuid
+  name        String    @unique
+  description String?
+  scope       RoleScope @default(system)
+
+  // Relations
+  rolePermissions RolePermission[]
+
+  @@map("permissions")
+}
+
+model RolePermission {
+  roleId       String @map("role_id") @db.Uuid
+  permissionId String @map("permission_id") @db.Uuid
+
+  // Relations
+  role       Role       @relation(fields: [roleId], references: [id], onDelete: Cascade)
+  permission Permission @relation(fields: [permissionId], references: [id], onDelete: Cascade)
+
+  @@id([roleId, permissionId])
+  @@map("role_permissions")
+}
+
+model UserRole {
+  userId String @map("user_id") @db.Uuid
+  roleId String @map("role_id") @db.Uuid
+
+  // Relations
+  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
+  role Role @relation(fields: [roleId], references: [id], onDelete: Cascade)
+
+  @@id([userId, roleId])
+  @@map("user_roles")
+}
+
+// =============================================================================
+// Audit
+// =============================================================================
+
+model AuditEvent {
+  id          String   @id @default(uuid()) @db.Uuid
+  actorUserId String?  @map("actor_user_id") @db.Uuid
+  action      String
+  targetType  String   @map("target_type")
+  targetId    String   @map("target_id")
+  meta        Json?
+  // The organization the action happened in (#725). NULL for a system event
+  // (settings, backups, restores, the allowlist): see the backfill in
+  // `0025_org_scoped_rls`. `SetNull`: history outlives the organization. No
+  // row-level security on this table in this release (`org-optional`).
+  orgId       String?  @map("org_id") @db.Uuid
+  createdAt   DateTime @default(now()) @map("created_at") @db.Timestamptz
+
+  // Relations
+  actorUser User?         @relation("ActorEvents", fields: [actorUserId], references: [id], onDelete: SetNull)
+  org       Organization? @relation(fields: [orgId], references: [id], onDelete: SetNull)
+
+  @@index([actorUserId])
+  @@index([targetType, targetId])
+  @@index([createdAt])
+  @@index([orgId, createdAt])
+  @@map("audit_events")
+}
+
+// =============================================================================
+// Refresh Tokens (for token rotation)
+// =============================================================================
+
+model RefreshToken {
+  id           String    @id @default(uuid()) @db.Uuid
+  userId       String    @map("user_id") @db.Uuid
+  tokenHash    String    @unique @map("token_hash")
+  expiresAt    DateTime  @map("expires_at") @db.Timestamptz
+  createdAt    DateTime  @default(now()) @map("created_at") @db.Timestamptz
+  revokedAt    DateTime? @map("revoked_at") @db.Timestamptz
+  // The device-authorization session that minted this refresh token, if any
+  // (issue #518). Lets revoking a `DeviceCode` session reach the refresh
+  // token it handed out. Nullable: most refresh tokens come from the
+  // interactive login flow, not the device flow. `SetNull` because a device
+  // code can be purged independently of the token lifecycle it kicked off.
+  deviceCodeId String?   @map("device_code_id") @db.Uuid
+  // The organization this session is active in (PP-6.1). Nullable (expand
+  // step); backfilled to the default organization. Carried by the active-org
+  // token (PP-6.4). `Cascade`: a credential has no meaning once its org is gone.
+  orgId        String?   @map("org_id") @db.Uuid
+
+  // Relations
+  user       User          @relation("UserRefreshTokens", fields: [userId], references: [id], onDelete: Cascade)
+  deviceCode DeviceCode?   @relation(fields: [deviceCodeId], references: [id], onDelete: SetNull)
+  org        Organization? @relation(fields: [orgId], references: [id], onDelete: Cascade)
+
+  @@index([userId])
+  @@index([expiresAt])
+  @@index([deviceCodeId])
+  @@index([orgId])
+  @@map("refresh_tokens")
+}
+
+// =============================================================================
+// Personal Access Tokens (PAT)
+// =============================================================================
+
+enum PatDurationUnit {
+  minutes
+  days
+  months
+}
+
+model PersonalAccessToken {
+  id            String          @id @default(uuid()) @db.Uuid
+  userId        String          @map("user_id") @db.Uuid
+  name          String
+  tokenHash     String          @unique @map("token_hash")
+  tokenPrefix   String          @map("token_prefix")
+  durationValue Int             @map("duration_value")
+  durationUnit  PatDurationUnit @map("duration_unit")
+  expiresAt     DateTime        @map("expires_at") @db.Timestamptz
+  lastUsedAt    DateTime?       @map("last_used_at") @db.Timestamptz
+  createdAt     DateTime        @default(now()) @map("created_at") @db.Timestamptz
+  revokedAt     DateTime?       @map("revoked_at") @db.Timestamptz
+  // The organization the token acts in (PP-6.1). Nullable (expand step);
+  // backfilled to the default organization. `Cascade`: see `RefreshToken.orgId`.
+  orgId         String?         @map("org_id") @db.Uuid
+
+  // Relations
+  user        User          @relation("UserPersonalAccessTokens", fields: [userId], references: [id], onDelete: Cascade)
+  org         Organization? @relation(fields: [orgId], references: [id], onDelete: Cascade)
+  // The device-authorization sessions that issued this PAT (issue #518).
+  // Almost always at most one, but not constrained `@unique` here — see
+  // `DeviceCode.patId`.
+  deviceCodes DeviceCode[]
+
+  @@index([userId])
+  @@index([expiresAt])
+  @@index([orgId])
+  @@map("personal_access_tokens")
+}
+
+// =============================================================================
+// Allowlist (Email Access Control)
+// =============================================================================
+
+model AllowedEmail {
+  id          String    @id @default(uuid()) @db.Uuid
+  email       String    @unique
+  addedById   String?   @map("added_by_id") @db.Uuid
+  addedAt     DateTime  @default(now()) @map("added_at") @db.Timestamptz
+  claimedById String?   @unique @map("claimed_by_id") @db.Uuid
+  claimedAt   DateTime? @map("claimed_at") @db.Timestamptz
+  notes       String?
+
+  // Relations
+  addedBy   User? @relation("AllowlistAddedBy", fields: [addedById], references: [id], onDelete: SetNull)
+  claimedBy User? @relation("AllowlistClaimedBy", fields: [claimedById], references: [id], onDelete: SetNull)
+
+  @@map("allowed_emails")
+}
+
+// =============================================================================
+// Device Authorization Flow (RFC 8628)
+// =============================================================================
+
+enum DeviceCodeStatus {
+  pending
+  approved
+  denied
+  expired
+}
+
+model DeviceCode {
+  id         String           @id @default(uuid()) @db.Uuid
+  deviceCode String           @unique @map("device_code")
+  userCode   String           @unique @map("user_code")
+  userId     String?          @map("user_id") @db.Uuid
+  status     DeviceCodeStatus @default(pending)
+  clientInfo Json?            @map("client_info")
+  scopes     String[]
+  // The code's own expiry (RFC 8628 `expires_in`) — when the user/device
+  // codes stop being redeemable if never approved. Distinct from
+  // `credentialExpiresAt`, which is the lifetime of what got issued once
+  // approval happened (issue #518).
+  expiresAt  DateTime         @map("expires_at") @db.Timestamptz
+  createdAt  DateTime         @default(now()) @map("created_at") @db.Timestamptz
+  updatedAt  DateTime         @updatedAt @map("updated_at") @db.Timestamptz
+
+  // The PAT minted for this device once the polling client collected it
+  // (issue #518). Nullable until collection; `SetNull` so deleting the PAT
+  // (or the PAT row aging out) never cascades into deleting the device-code
+  // history. This is what lets "revoke this device session" reach the
+  // credential the device is actually holding.
+  patId String? @map("pat_id") @db.Uuid
+
+  // When the polling client (`POST /api/auth/device/token`) collected the
+  // credential above. Null until collection. Distinguishes "approved,
+  // waiting to be picked up" from "picked up and in active use" for the
+  // sessions list.
+  collectedAt DateTime? @map("collected_at") @db.Timestamptz
+
+  // The collected credential's own expiry, copied from the PAT at
+  // collection time so the sessions list can filter "still valid" without a
+  // join. Null until collection.
+  credentialExpiresAt DateTime? @map("credential_expires_at") @db.Timestamptz
+
+  // Set when this device session (and the credential it issued, if any) is
+  // revoked — from the code itself if revoked before collection, from the
+  // session-revocation endpoint after. Null means still active.
+  revokedAt DateTime? @map("revoked_at") @db.Timestamptz
+
+  // The organization the approved device session acts in (PP-6.1). Nullable
+  // (expand step); backfilled to the default organization. `Cascade`: see
+  // `RefreshToken.orgId`.
+  orgId String? @map("org_id") @db.Uuid
+
+  // Relations
+  user User?                @relation("UserDeviceCodes", fields: [userId], references: [id], onDelete: Cascade)
+  org  Organization?        @relation(fields: [orgId], references: [id], onDelete: Cascade)
+  pat  PersonalAccessToken? @relation(fields: [patId], references: [id], onDelete: SetNull)
+
+  // Back-relation: refresh tokens minted through this device-authorization
+  // session (issue #518). See `RefreshToken.deviceCodeId`.
+  refreshTokens RefreshToken[]
+
+  @@index([deviceCode])
+  @@index([userCode])
+  @@index([status, expiresAt])
+  @@index([userId])
+  // Serves the sessions list (`GET /api/auth/device/sessions`, issue #518):
+  // "this user's device sessions that are not revoked" —
+  // approved-but-uncollected and collected-unexpired both live under
+  // `revokedAt IS NULL`; the remaining collected/expiry filtering happens
+  // in the query predicate, not a second index.
+  @@index([userId, revokedAt])
+  @@index([orgId])
+  @@map("device_codes")
+}
+
+// =============================================================================
+// Organizations (tenancy foundation, PP-6.1)
+// =============================================================================
+//
+// Identity tables, read across organizations at login and guarded by service
+// code: no RLS here (ADR 0002). The default organization is unique by the
+// raw-SQL partial index `organizations_default_uniq_idx` (migration SQL only;
+// Prisma cannot express it). A membership carries its org role (PP-6.3); an
+// invite may name the org role the invitee will get.
+
+enum MembershipStatus {
+  active
+  suspended
+}
+
+enum InviteStatus {
+  pending
+  accepted
+  revoked
+  expired
+}
+
+// @extensible — back-relations only, added with "extend model Organization { ... }" in a fragment
+model Organization {
+  id          String   @id @default(uuid()) @db.Uuid
+  name        String
+  // Lower-case [a-z0-9-], 2..63 characters (validated by the service).
+  slug        String   @unique
+  // Exactly one row is true: organizations_default_uniq_idx.
+  isDefault   Boolean  @default(false) @map("is_default")
+  createdById String?  @map("created_by_id") @db.Uuid
+  createdAt   DateTime @default(now()) @map("created_at") @db.Timestamptz
+  updatedAt   DateTime @updatedAt @map("updated_at") @db.Timestamptz
+  // App-owned, namespaced fields (`registerOrganizationMetadataSchema`, PP-14.27); same
+  // contract as `User.metadata`: validated per namespace, no secrets, 16 KiB per row
+  // (32 KiB backstop `organizations_metadata_size_check`), never returned by the
+  // platform's routes.
+  metadata    Json     @default("{}") @db.JsonB
+
+  // Relations
+  createdBy            User?                 @relation("OrganizationCreatedBy", fields: [createdById], references: [id], onDelete: SetNull)
+  memberships          Membership[]
+  invites              Invite[]
+  refreshTokens        RefreshToken[]
+  personalAccessTokens PersonalAccessToken[]
+  deviceCodes          DeviceCode[]
+  // Audit history outlives the organization (`SetNull`); system events have none (#725).
+  auditEvents          AuditEvent[]
+
+  // composed from package:ai.prisma
+  // AI runs and usage events (#725): see `AiRun.orgId` and `AiUsageEvent.orgId`
+  // for why one is `Restrict` and the other `SetNull`.
+  aiRuns        AiRun[]
+  aiUsageEvents AiUsageEvent[]
+
+  // composed from package:credentials.prisma
+  orgCredentials OrgCredential[]
+
+  // composed from package:jobs.prisma
+  // The organization's jobs (issue #734): see `Job.orgId` for why `SetNull`.
+  jobs Job[]
+
+  // composed from package:notifications.prisma
+  notificationBroadcasts NotificationBroadcast[] @relation("BroadcastTargetOrg")
+
+  // composed from package:settings.prisma
+  settings OrgSettings?
+
+  // composed from package:sharing.prisma
+  groups       Group[]
+  groupMembers GroupMember[]
+  groupInvites GroupInvite[]
+  grants       Grant[]
+
+  // composed from package:storage.prisma
+  storageObjects      StorageObject[]
+  storageObjectChunks StorageObjectChunk[]
+
+  // composed from app:kvox.transcripts.prisma
+  // Back-relations onto the platform's Organization (an `extend model` block holds back-relation fields only).
+  // `transcripts.org_id` (issue #485): the organization the sharing slice decides a transcript's access in.
+  transcripts Transcript[]
+
+  @@map("organizations")
+}
+
+model Membership {
+  id           String           @id @default(uuid()) @db.Uuid
+  orgId        String           @map("org_id") @db.Uuid
+  userId       String           @map("user_id") @db.Uuid
+  status       MembershipStatus @default(active)
+  // Picks the default active organization at login (PP-6.4).
+  lastActiveAt DateTime?        @map("last_active_at") @db.Timestamptz
+  // The member's org-scoped role (PP-6.3). `Restrict`: a role in use cannot be
+  // deleted out from under its members.
+  roleId       String           @map("role_id") @db.Uuid
+  createdAt    DateTime         @default(now()) @map("created_at") @db.Timestamptz
+  updatedAt    DateTime         @updatedAt @map("updated_at") @db.Timestamptz
+
+  // Relations
+  org  Organization @relation(fields: [orgId], references: [id], onDelete: Cascade)
+  user User         @relation(fields: [userId], references: [id], onDelete: Cascade)
+  role Role         @relation(fields: [roleId], references: [id], onDelete: Restrict)
+
+  @@unique([orgId, userId])
+  @@index([userId])
+  @@index([roleId])
+  @@map("memberships")
+}
+
+model Invite {
+  id           String       @id @default(uuid()) @db.Uuid
+  orgId        String       @map("org_id") @db.Uuid
+  // Stored lower-cased.
+  email        String
+  status       InviteStatus @default(pending)
+  // sha256 of an emailed accept token, if one is used.
+  tokenHash    String?      @unique @map("token_hash")
+  expiresAt    DateTime?    @map("expires_at") @db.Timestamptz
+  invitedById  String?      @map("invited_by_id") @db.Uuid
+  acceptedById String?      @map("accepted_by_id") @db.Uuid
+  acceptedAt   DateTime?    @map("accepted_at") @db.Timestamptz
+  notes        String?
+  // The org role the invitee gets on acceptance (PP-6.3). NULL means the
+  // default org role (`viewer`). `Restrict`, as on `Membership.roleId`.
+  roleId       String?      @map("role_id") @db.Uuid
+  createdAt    DateTime     @default(now()) @map("created_at") @db.Timestamptz
+
+  // Relations
+  org        Organization @relation(fields: [orgId], references: [id], onDelete: Cascade)
+  role       Role?        @relation(fields: [roleId], references: [id], onDelete: Restrict)
+  invitedBy  User?        @relation("InviteInvitedBy", fields: [invitedById], references: [id], onDelete: SetNull)
+  acceptedBy User?        @relation("InviteAcceptedBy", fields: [acceptedById], references: [id], onDelete: SetNull)
+
+  // Re-inviting updates the row.
+  @@unique([orgId, email])
+  @@index([email])
+  @@index([roleId])
+  @@map("org_invites")
+}