@omersx/bemms 0.0.0-stage → 1.0.0

package/src/lib/db/schema/maintenance-tasks.ts

@@ -0,0 +1,196 @@
+import { pgTable, uuid, text, timestamp, integer, boolean, jsonb, index } from 'drizzle-orm/pg-core';
+import { relations } from 'drizzle-orm';
+import {
+  maintenanceTypeCodeEnum,
+  technicalProblemCategoryCodeEnum,
+  ticketPriorityCodeEnum,
+  maintenanceTaskStatusCodeEnum,
+  checklistResultCodeEnum,
+} from './enums';
+import { organizations } from './organizations';
+import { hospitals } from './hospitals';
+import { departments } from './departments';
+import { locations } from './locations';
+import { deviceCategories } from './device-categories';
+import { devices } from './devices';
+import { serviceTickets } from './tickets';
+import { users } from './users';
+
+// ── Checklist Templates ────────────────────────────────────────────────────────
+
+export const checklistTemplates = pgTable('checklist_templates', {
+  id: uuid('id').primaryKey().$defaultFn(() => crypto.randomUUID()),
+  organizationId: uuid('organization_id').notNull().references(() => organizations.id),
+  deviceCategoryId: uuid('device_category_id').references(() => deviceCategories.id),
+  name: text('name').notNull(),
+  code: text('code').unique(),
+  maintenanceType: maintenanceTypeCodeEnum('maintenance_type'),
+  isActive: boolean('is_active').default(true).notNull(),
+  createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+  updatedAt: timestamp('updated_at', { withTimezone: true }).defaultNow().notNull(),
+}, (t) => ({
+  orgIdx: index('idx_checklist_templates_org').on(t.organizationId),
+  deviceCatIdx: index('idx_checklist_templates_category').on(t.deviceCategoryId),
+}));
+
+export const checklistTemplatesRelations = relations(checklistTemplates, ({ one, many }) => ({
+  organization: one(organizations, {
+    fields: [checklistTemplates.organizationId],
+    references: [organizations.id],
+  }),
+  deviceCategory: one(deviceCategories, {
+    fields: [checklistTemplates.deviceCategoryId],
+    references: [deviceCategories.id],
+  }),
+  versions: many(checklistTemplateVersions),
+}));
+
+// ── Checklist Template Versions ────────────────────────────────────────────────
+
+export const checklistTemplateVersions = pgTable('checklist_template_versions', {
+  id: uuid('id').primaryKey().$defaultFn(() => crypto.randomUUID()),
+  checklistTemplateId: uuid('checklist_template_id').notNull().references(() => checklistTemplates.id, { onDelete: 'cascade' }),
+  versionNumber: integer('version_number').notNull(),
+  itemsJsonb: jsonb('items_jsonb').notNull(),
+  isActive: boolean('is_active').default(true).notNull(),
+  createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+  createdByUserId: uuid('created_by_user_id').references(() => users.id),
+}, (t) => ({
+  templateVersionIdx: index('idx_checklist_template_versions_template').on(t.checklistTemplateId, t.versionNumber),
+}));
+
+export const checklistTemplateVersionsRelations = relations(checklistTemplateVersions, ({ one, many }) => ({
+  checklistTemplate: one(checklistTemplates, {
+    fields: [checklistTemplateVersions.checklistTemplateId],
+    references: [checklistTemplates.id],
+  }),
+  createdByUser: one(users, {
+    fields: [checklistTemplateVersions.createdByUserId],
+    references: [users.id],
+    relationName: 'checklistVersionsCreatedByUser',
+  }),
+  tasks: many(maintenanceTasks),
+}));
+
+// ── Maintenance Tasks ──────────────────────────────────────────────────────────
+
+export const maintenanceTasks = pgTable('maintenance_tasks', {
+  id: uuid('id').primaryKey().$defaultFn(() => crypto.randomUUID()),
+  taskNumber: text('task_number').notNull().unique(),
+  organizationId: uuid('organization_id').notNull().references(() => organizations.id),
+  hospitalId: uuid('hospital_id').notNull().references(() => hospitals.id),
+  departmentId: uuid('department_id').references(() => departments.id),
+  locationId: uuid('location_id').references(() => locations.id),
+  deviceId: uuid('device_id').notNull().references(() => devices.id),
+  serviceTicketId: uuid('service_ticket_id').references(() => serviceTickets.id),
+  maintenanceScheduleOccurrenceId: uuid('maintenance_schedule_occurrence_id'),
+  maintenanceType: maintenanceTypeCodeEnum('maintenance_type').notNull(),
+  technicalProblemCategory: technicalProblemCategoryCodeEnum('technical_problem_category'),
+  statusCode: maintenanceTaskStatusCodeEnum('status_code').default('assigned').notNull(),
+  title: text('title').notNull(),
+  description: text('description'),
+  assignedEngineerUserId: uuid('assigned_engineer_user_id').references(() => users.id),
+  assignedTeamId: uuid('assigned_team_id'),
+  priorityCode: ticketPriorityCodeEnum('priority_code').default('p3_normal'),
+  dueDate: timestamp('due_date', { withTimezone: true }),
+  acceptedAt: timestamp('accepted_at', { withTimezone: true }),
+  startedAt: timestamp('started_at', { withTimezone: true }),
+  completedAt: timestamp('completed_at', { withTimezone: true }),
+  waitingReason: text('waiting_reason'),
+  waitingDependencyType: text('waiting_dependency_type'),
+  checklistTemplateVersionId: uuid('checklist_template_version_id').references(() => checklistTemplateVersions.id),
+  deviceSnapshot: jsonb('device_snapshot'),
+  locationSnapshot: jsonb('location_snapshot'),
+  resultRecordId: uuid('result_record_id'),
+  createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+  createdByUserId: uuid('created_by_user_id').references(() => users.id),
+  updatedAt: timestamp('updated_at', { withTimezone: true }).defaultNow().notNull(),
+  updatedByUserId: uuid('updated_by_user_id').references(() => users.id),
+}, (t) => ({
+  lookupIdx: index('idx_maintenance_tasks_lookup').on(t.organizationId, t.hospitalId, t.departmentId, t.statusCode),
+  taskNumIdx: index('idx_maintenance_tasks_number').on(t.organizationId, t.taskNumber),
+  deviceIdx: index('idx_maintenance_tasks_device').on(t.deviceId, t.statusCode),
+  assigneeIdx: index('idx_maintenance_tasks_assignee').on(t.assignedEngineerUserId, t.statusCode),
+  ticketIdx: index('idx_maintenance_tasks_ticket').on(t.serviceTicketId),
+  dueIdx: index('idx_maintenance_tasks_due').on(t.organizationId, t.dueDate),
+}));
+
+export const maintenanceTasksRelations = relations(maintenanceTasks, ({ one, many }) => ({
+  organization: one(organizations, {
+    fields: [maintenanceTasks.organizationId],
+    references: [organizations.id],
+  }),
+  hospital: one(hospitals, {
+    fields: [maintenanceTasks.hospitalId],
+    references: [hospitals.id],
+  }),
+  department: one(departments, {
+    fields: [maintenanceTasks.departmentId],
+    references: [departments.id],
+  }),
+  location: one(locations, {
+    fields: [maintenanceTasks.locationId],
+    references: [locations.id],
+  }),
+  device: one(devices, {
+    fields: [maintenanceTasks.deviceId],
+    references: [devices.id],
+  }),
+  serviceTicket: one(serviceTickets, {
+    fields: [maintenanceTasks.serviceTicketId],
+    references: [serviceTickets.id],
+  }),
+  checklistTemplateVersion: one(checklistTemplateVersions, {
+    fields: [maintenanceTasks.checklistTemplateVersionId],
+    references: [checklistTemplateVersions.id],
+  }),
+  assignedEngineer: one(users, {
+    fields: [maintenanceTasks.assignedEngineerUserId],
+    references: [users.id],
+    relationName: 'tasksAssignedToEngineer',
+  }),
+  createdByUser: one(users, {
+    fields: [maintenanceTasks.createdByUserId],
+    references: [users.id],
+    relationName: 'tasksCreatedByUser',
+  }),
+  updatedByUser: one(users, {
+    fields: [maintenanceTasks.updatedByUserId],
+    references: [users.id],
+    relationName: 'tasksUpdatedByUser',
+  }),
+  checklistResults: many(maintenanceChecklistResults),
+}));
+
+// ── Maintenance Checklist Results ─────────────────────────────────────────────
+
+export const maintenanceChecklistResults = pgTable('maintenance_checklist_results', {
+  id: uuid('id').primaryKey().$defaultFn(() => crypto.randomUUID()),
+  maintenanceTaskId: uuid('maintenance_task_id').notNull().references(() => maintenanceTasks.id, { onDelete: 'cascade' }),
+  maintenanceRecordId: uuid('maintenance_record_id'),
+  templateItemId: text('template_item_id').notNull(),
+  itemLabelSnapshot: text('item_label_snapshot').notNull(),
+  itemOrder: integer('item_order').notNull(),
+  resultCode: checklistResultCodeEnum('result_code'),
+  measuredValue: text('measured_value'),
+  unit: text('unit'),
+  notes: text('notes'),
+  performedByUserId: uuid('performed_by_user_id').references(() => users.id),
+  completedAt: timestamp('completed_at', { withTimezone: true }),
+}, (t) => ({
+  taskItemIdx: index('idx_checklist_results_task').on(t.maintenanceTaskId, t.itemOrder),
+  recordIdx: index('idx_checklist_results_record').on(t.maintenanceRecordId),
+}));
+
+export const maintenanceChecklistResultsRelations = relations(maintenanceChecklistResults, ({ one }) => ({
+  maintenanceTask: one(maintenanceTasks, {
+    fields: [maintenanceChecklistResults.maintenanceTaskId],
+    references: [maintenanceTasks.id],
+  }),
+  performedByUser: one(users, {
+    fields: [maintenanceChecklistResults.performedByUserId],
+    references: [users.id],
+    relationName: 'checklistResultsPerformedByUser',
+  }),
+}));
+

package/src/lib/db/schema/manufacturers.ts

@@ -0,0 +1,60 @@
+import { pgTable, uuid, text, timestamp, index } from 'drizzle-orm/pg-core';
+import { relations } from 'drizzle-orm';
+import { refDataStatusEnum } from './enums';
+import { organizations } from './organizations';
+import { users } from './users';
+
+export const manufacturers = pgTable('manufacturers', {
+  id: uuid('id').primaryKey().$defaultFn(() => crypto.randomUUID()),
+  organizationId: uuid('organization_id').notNull().references(() => organizations.id),
+  name: text('name').notNull(),
+  code: text('code'),
+  country: text('country'),
+  supportEmail: text('support_email'),
+  supportPhone: text('support_phone'),
+  website: text('website'),
+  status: refDataStatusEnum('status').default('active'),
+  createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+  createdByUserId: uuid('created_by_user_id').references(() => users.id),
+  updatedAt: timestamp('updated_at', { withTimezone: true }).defaultNow().notNull(),
+  archivedAt: timestamp('archived_at', { withTimezone: true }),
+}, (t) => ({
+  orgNameIdx: index('mfr_org_name_idx').on(t.organizationId, t.name),
+}));
+
+export const manufacturersRelations = relations(manufacturers, ({ one }) => ({
+  organization: one(organizations, {
+    fields: [manufacturers.organizationId],
+    references: [organizations.id],
+  }),
+  createdByUser: one(users, {
+    fields: [manufacturers.createdByUserId],
+    references: [users.id],
+    relationName: 'manufacturersCreatedByUser',
+  }),
+}));
+
+export const deviceModels = pgTable('device_models', {
+  id: uuid('id').primaryKey().$defaultFn(() => crypto.randomUUID()),
+  organizationId: uuid('organization_id').notNull().references(() => organizations.id),
+  manufacturerId: uuid('manufacturer_id').notNull().references(() => manufacturers.id),
+  modelName: text('model_name').notNull(),
+  modelNumber: text('model_number'),
+  specifications: text('specifications'),
+  status: refDataStatusEnum('status').default('active'),
+  createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+}, (t) => ({
+  mfrModelIdx: index('model_mfr_idx').on(t.manufacturerId, t.modelName),
+}));
+
+export const deviceModelsRelations = relations(deviceModels, ({ one }) => ({
+  organization: one(organizations, {
+    fields: [deviceModels.organizationId],
+    references: [organizations.id],
+  }),
+  manufacturer: one(manufacturers, {
+    fields: [deviceModels.manufacturerId],
+    references: [manufacturers.id],
+  }),
+}));
+

package/src/lib/db/schema/notifications.ts

@@ -0,0 +1,48 @@
+import { pgTable, uuid, text, timestamp } from 'drizzle-orm/pg-core';
+import { relations } from 'drizzle-orm';
+import { notificationTypeEnum } from './enums';
+import { organizations } from './organizations';
+import { users } from './users';
+
+export const notifications = pgTable('notifications', {
+  id: uuid('id').primaryKey().$defaultFn(() => crypto.randomUUID()),
+  organizationId: uuid('organization_id').references(() => organizations.id).notNull(),
+  recipientUserId: uuid('recipient_user_id').references(() => users.id).notNull(),
+  notificationType: notificationTypeEnum('notification_type').notNull(),
+  title: text('title').notNull(),
+  body: text('body').notNull(),
+  relatedEntityType: text('related_entity_type'),
+  relatedEntityId: uuid('related_entity_id'),
+  actionUrl: text('action_url'),
+  readAt: timestamp('read_at', { withTimezone: true }),
+  createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+});
+
+export const notificationsRelations = relations(notifications, ({ one }) => ({
+  organization: one(organizations, {
+    fields: [notifications.organizationId],
+    references: [organizations.id],
+  }),
+  recipient: one(users, {
+    fields: [notifications.recipientUserId],
+    references: [users.id],
+  }),
+}));
+
+export const pushSubscriptions = pgTable('push_subscriptions', {
+  id: uuid('id').primaryKey().$defaultFn(() => crypto.randomUUID()),
+  userId: uuid('user_id').references(() => users.id).notNull(),
+  endpoint: text('endpoint').notNull(),
+  p256dh: text('p256dh').notNull(),
+  auth: text('auth').notNull(),
+  userAgent: text('user_agent'),
+  createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+});
+
+export const pushSubscriptionsRelations = relations(pushSubscriptions, ({ one }) => ({
+  user: one(users, {
+    fields: [pushSubscriptions.userId],
+    references: [users.id],
+  }),
+}));
+

package/src/lib/db/schema/organizations.ts

@@ -0,0 +1,24 @@
+import { pgTable, uuid, text, timestamp, jsonb } from 'drizzle-orm/pg-core';
+import { relations } from 'drizzle-orm';
+import { organizationStatusEnum } from './enums';
+import { users } from './users';
+import { hospitals } from './hospitals';
+
+export const organizations = pgTable('organizations', {
+  id: uuid('id').primaryKey().$defaultFn(() => crypto.randomUUID()),
+  name: text('name').notNull(),
+  code: text('code').notNull().unique(),
+  defaultTimezone: text('default_timezone').default('UTC'),
+  status: organizationStatusEnum('status').default('active'),
+  settings: jsonb('settings'),
+  createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+  updatedAt: timestamp('updated_at', { withTimezone: true }).defaultNow().notNull(),
+  createdByUserId: uuid('created_by_user_id'),
+  updatedByUserId: uuid('updated_by_user_id'),
+});
+
+export const organizationsRelations = relations(organizations, ({ many }) => ({
+  hospitals: many(hospitals),
+  users: many(users),
+}));
+

package/src/lib/db/schema/report-history.ts

@@ -0,0 +1,28 @@
+import { pgTable, uuid, text, timestamp, integer, jsonb, index } from 'drizzle-orm/pg-core';
+import { relations } from 'drizzle-orm';
+import { organizations } from './organizations';
+import { users } from './users';
+
+export const generatedReports = pgTable('generated_reports', {
+  id: uuid('id').primaryKey().$defaultFn(() => crypto.randomUUID()),
+  organizationId: uuid('organization_id').notNull().references(() => organizations.id),
+  reportType: text('report_type').notNull(), // 'inventory', 'tickets', 'maintenance', 'costs', 'workload'
+  title: text('title').notNull(),
+  filtersJsonb: jsonb('filters_jsonb'),
+  dateRangeStart: timestamp('date_range_start', { withTimezone: true }),
+  dateRangeEnd: timestamp('date_range_end', { withTimezone: true }),
+  timezone: text('timezone').default('UTC'),
+  rowCount: integer('row_count'),
+  fileFormat: text('file_format').default('csv'), // 'csv', 'xlsx', 'pdf'
+  fileName: text('file_name').notNull(),
+  generatedByUserId: uuid('generated_by_user_id').notNull().references(() => users.id),
+  generatedAt: timestamp('generated_at', { withTimezone: true }).defaultNow().notNull(),
+}, (t) => ({
+  orgIdx: index('idx_generated_reports_org').on(t.organizationId, t.generatedAt),
+}));
+
+export const generatedReportsRelations = relations(generatedReports, ({ one }) => ({
+  organization: one(organizations, { fields: [generatedReports.organizationId], references: [organizations.id] }),
+  generatedByUser: one(users, { fields: [generatedReports.generatedByUserId], references: [users.id] }),
+}));
+

package/src/lib/db/schema/roles.ts

@@ -0,0 +1,59 @@
+import { pgTable, uuid, text, timestamp, boolean, uniqueIndex } from 'drizzle-orm/pg-core';
+import { relations } from 'drizzle-orm';
+import { roleStatusEnum, permissionModuleEnum, permissionActionEnum } from './enums';
+import { organizations } from './organizations';
+
+export const roles = pgTable('roles', {
+  id: uuid('id').primaryKey().$defaultFn(() => crypto.randomUUID()),
+  organizationId: uuid('organization_id').references(() => organizations.id),
+  code: text('code').notNull().unique(),
+  name: text('name').notNull(),
+  description: text('description'),
+  isSystemRole: boolean('is_system_role').default(false),
+  status: roleStatusEnum('status').default('active'),
+  createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
+  updatedAt: timestamp('updated_at', { withTimezone: true }).defaultNow().notNull(),
+  createdByUserId: uuid('created_by_user_id'),
+  updatedByUserId: uuid('updated_by_user_id'),
+});
+
+export const permissions = pgTable('permissions', {
+  id: uuid('id').primaryKey().$defaultFn(() => crypto.randomUUID()),
+  module: permissionModuleEnum('module').notNull(),
+  action: permissionActionEnum('action').notNull(),
+  description: text('description'),
+}, (t) => ({
+  moduleActionIdx: uniqueIndex('permission_module_action_idx').on(t.module, t.action),
+}));
+
+export const rolePermissions = pgTable('role_permissions', {
+  id: uuid('id').primaryKey().$defaultFn(() => crypto.randomUUID()),
+  roleId: uuid('role_id').notNull().references(() => roles.id, { onDelete: 'cascade' }),
+  permissionId: uuid('permission_id').notNull().references(() => permissions.id, { onDelete: 'cascade' }),
+}, (t) => ({
+  rolePermissionIdx: uniqueIndex('role_permission_idx').on(t.roleId, t.permissionId),
+}));
+
+export const rolesRelations = relations(roles, ({ one, many }) => ({
+  organization: one(organizations, {
+    fields: [roles.organizationId],
+    references: [organizations.id],
+  }),
+  rolePermissions: many(rolePermissions),
+}));
+
+export const permissionsRelations = relations(permissions, ({ many }) => ({
+  rolePermissions: many(rolePermissions),
+}));
+
+export const rolePermissionsRelations = relations(rolePermissions, ({ one }) => ({
+  role: one(roles, {
+    fields: [rolePermissions.roleId],
+    references: [roles.id],
+  }),
+  permission: one(permissions, {
+    fields: [rolePermissions.permissionId],
+    references: [permissions.id],
+  }),
+}));
+

package/src/lib/db/schema/sessions.ts

@@ -0,0 +1,46 @@
+import { pgTable, uuid, text, timestamp, integer, primaryKey } from 'drizzle-orm/pg-core';
+import { relations } from 'drizzle-orm';
+import { users } from './users';
+
+export const sessions = pgTable('sessions', {
+  sessionToken: text('sessionToken').primaryKey(),
+  userId: uuid('userId').notNull().references(() => users.id, { onDelete: 'cascade' }),
+  expires: timestamp('expires', { mode: 'date' }).notNull(),
+});
+
+export const accounts = pgTable('accounts', {
+  id: uuid('id').primaryKey().$defaultFn(() => crypto.randomUUID()),
+  userId: uuid('userId').notNull().references(() => users.id, { onDelete: 'cascade' }),
+  type: text('type').notNull(),
+  provider: text('provider').notNull(),
+  providerAccountId: text('providerAccountId').notNull(),
+  refresh_token: text('refresh_token'),
+  access_token: text('access_token'),
+  expires_at: integer('expires_at'),
+  token_type: text('token_type'),
+  scope: text('scope'),
+  id_token: text('id_token'),
+});
+
+export const verificationTokens = pgTable('verification_tokens', {
+  identifier: text('identifier').notNull(),
+  token: text('token').notNull(),
+  expires: timestamp('expires', { mode: 'date' }).notNull(),
+}, (vt) => ({
+  compoundKey: primaryKey({ columns: [vt.identifier, vt.token] }),
+}));
+
+export const sessionsRelations = relations(sessions, ({ one }) => ({
+  user: one(users, {
+    fields: [sessions.userId],
+    references: [users.id],
+  }),
+}));
+
+export const accountsRelations = relations(accounts, ({ one }) => ({
+  user: one(users, {
+    fields: [accounts.userId],
+    references: [users.id],
+  }),
+}));
+

package/src/lib/db/schema/signature-events.ts

@@ -0,0 +1,48 @@
+import { pgTable, uuid, text, timestamp, index } from 'drizzle-orm/pg-core';
+import { relations } from 'drizzle-orm';
+import {
+  signatureEventTypeEnum,
+  signatureStatusEnum,
+} from './enums';
+import { organizations } from './organizations';
+import { electronicSignatures } from './signatures';
+import { users } from './users';
+
+// ── Signature Events (append-only hash chain) ─────────────────────────────────
+// Per spec §10.4: Append-only trace events for signature creation, review,
+// rejection, amendment, supersession, and voiding.
+
+export const signatureEvents = pgTable('signature_events', {
+  id: uuid('id').defaultRandom().primaryKey().$defaultFn(() => crypto.randomUUID()),
+  organizationId: uuid('organization_id').notNull().references(() => organizations.id),
+  signatureId: uuid('signature_id').notNull().references(() => electronicSignatures.id),
+  eventType: signatureEventTypeEnum('event_type').notNull(),
+  actorUserId: uuid('actor_user_id').notNull().references(() => users.id),
+  timestamp: timestamp('timestamp', { withTimezone: true, mode: 'date' }).defaultNow().notNull(),
+  previousStatus: signatureStatusEnum('previous_status'),
+  newStatus: signatureStatusEnum('new_status'),
+  reason: text('reason'),
+  previousEventHash: text('previous_event_hash'),
+  currentEventHash: text('current_event_hash').notNull(),
+}, (t) => ({
+  signatureIdx: index('idx_sig_events_signature').on(t.signatureId),
+  orgTimeIdx: index('idx_sig_events_org_time').on(t.organizationId, t.timestamp),
+  actorIdx: index('idx_sig_events_actor').on(t.actorUserId, t.timestamp),
+}));
+
+export const signatureEventsRelations = relations(signatureEvents, ({ one }) => ({
+  organization: one(organizations, {
+    fields: [signatureEvents.organizationId],
+    references: [organizations.id],
+  }),
+  signature: one(electronicSignatures, {
+    fields: [signatureEvents.signatureId],
+    references: [electronicSignatures.id],
+  }),
+  actor: one(users, {
+    fields: [signatureEvents.actorUserId],
+    references: [users.id],
+    relationName: 'signatureEventsActor',
+  }),
+}));
+

package/src/lib/db/schema/signature-policies.ts

@@ -0,0 +1,60 @@
+import { pgTable, uuid, text, timestamp, boolean, jsonb, index, uniqueIndex } from 'drizzle-orm/pg-core';
+import { relations } from 'drizzle-orm';
+import {
+  signaturePolicyActionEnum,
+  criticalityLevelEnum,
+} from './enums';
+import { organizations } from './organizations';
+import { hospitals } from './hospitals';
+import { deviceCategories } from './device-categories';
+
+// ── Signature Policies ────────────────────────────────────────────────────────
+// Per spec §10.3 & §6: Configurable rules defining which roles and signatures
+// are required for a particular action, scoped by organization, criticality,
+// and device category.
+
+export interface SignaturePolicyRequirement {
+  purpose: 'accept' | 'perform' | 'review' | 'approve' | 'release' | 'resolve' | 'close';
+  allowedRoles: string[];
+  required: boolean;
+}
+
+export const signaturePolicies = pgTable('signature_policies', {
+  id: uuid('id').defaultRandom().primaryKey().$defaultFn(() => crypto.randomUUID()),
+  organizationId: uuid('organization_id').notNull().references(() => organizations.id),
+  hospitalId: uuid('hospital_id').references(() => hospitals.id),
+  actionType: signaturePolicyActionEnum('action_type').notNull(),
+  criticalityLevel: criticalityLevelEnum('criticality_level'),
+  deviceCategoryId: uuid('device_category_id').references(() => deviceCategories.id),
+  requiredSignatures: jsonb('required_signatures').$type<SignaturePolicyRequirement[]>().notNull(),
+  requireIndependentReview: boolean('require_independent_review').default(false).notNull(),
+  performerCanRelease: boolean('performer_can_release').default(true).notNull(),
+  requireReauth: boolean('require_reauth').default(true).notNull(),
+  effectiveDate: timestamp('effective_date', { withTimezone: true, mode: 'date' }).defaultNow().notNull(),
+  isActive: boolean('is_active').default(true).notNull(),
+  policyVersion: text('policy_version').default('1.0').notNull(),
+  createdAt: timestamp('created_at', { withTimezone: true, mode: 'date' }).defaultNow().notNull(),
+  updatedAt: timestamp('updated_at', { withTimezone: true, mode: 'date' }).defaultNow().notNull(),
+  createdByUserId: uuid('created_by_user_id'),
+}, (t) => ({
+  orgActionIdx: uniqueIndex('idx_sig_policies_org_action').on(
+    t.organizationId, t.actionType, t.criticalityLevel, t.deviceCategoryId
+  ),
+  activeIdx: index('idx_sig_policies_active').on(t.organizationId, t.isActive),
+}));
+
+export const signaturePoliciesRelations = relations(signaturePolicies, ({ one }) => ({
+  organization: one(organizations, {
+    fields: [signaturePolicies.organizationId],
+    references: [organizations.id],
+  }),
+  hospital: one(hospitals, {
+    fields: [signaturePolicies.hospitalId],
+    references: [hospitals.id],
+  }),
+  deviceCategory: one(deviceCategories, {
+    fields: [signaturePolicies.deviceCategoryId],
+    references: [deviceCategories.id],
+  }),
+}));
+

package/src/lib/db/schema/signatures.ts

@@ -0,0 +1,87 @@
+import { pgTable, uuid, text, timestamp, integer, jsonb, index, uniqueIndex, type AnyPgColumn } from 'drizzle-orm/pg-core';
+import { relations } from 'drizzle-orm';
+import {
+  recordVersionEntityTypeEnum,
+  signaturePurposeEnum,
+  signatureAuthMethodEnum,
+  signatureStatusEnum,
+} from './enums';
+import { organizations } from './organizations';
+import { users } from './users';
+
+export const recordVersions = pgTable('record_versions', {
+  id: uuid('id').defaultRandom().primaryKey().$defaultFn(() => crypto.randomUUID()),
+  organizationId: uuid('organization_id').notNull().references(() => organizations.id),
+  entityType: recordVersionEntityTypeEnum('entity_type').notNull(),
+  entityId: uuid('entity_id').notNull(),
+  versionNumber: integer('version_number').notNull(),
+  canonicalSnapshotJsonb: jsonb('canonical_snapshot_jsonb').notNull(),
+  contentHashSha256: text('content_hash_sha256').notNull(),
+  amendmentReason: text('amendment_reason'),
+  supersedesVersionId: uuid('supersedes_version_id').references((): AnyPgColumn => recordVersions.id),
+  createdByUserId: uuid('created_by_user_id').notNull().references(() => users.id),
+  createdAt: timestamp('created_at', { withTimezone: true, mode: 'date' }).defaultNow().notNull(),
+}, (t) => ({
+  entityVersionIdx: uniqueIndex('idx_record_versions_entity_version').on(t.entityType, t.entityId, t.versionNumber),
+  orgEntityIdx: index('idx_record_versions_org_entity').on(t.organizationId, t.entityType, t.entityId),
+}));
+
+export const electronicSignatures = pgTable('electronic_signatures', {
+  id: uuid('id').defaultRandom().primaryKey().$defaultFn(() => crypto.randomUUID()),
+  organizationId: uuid('organization_id').notNull().references(() => organizations.id),
+  recordVersionId: uuid('record_version_id').notNull().references(() => recordVersions.id),
+  entityType: recordVersionEntityTypeEnum('entity_type').notNull(),
+  entityId: uuid('entity_id').notNull(),
+  signaturePurpose: signaturePurposeEnum('signature_purpose').notNull(),
+  signerUserId: uuid('signer_user_id').notNull().references(() => users.id),
+  signerNameSnapshot: text('signer_name_snapshot').notNull(),
+  signerRoleSnapshot: text('signer_role_snapshot').notNull(),
+  signerScopeSnapshot: text('signer_scope_snapshot'),
+  attestationTextVersion: text('attestation_text_version').notNull(),
+  authMethod: signatureAuthMethodEnum('auth_method').notNull(),
+  signedAt: timestamp('signed_at', { withTimezone: true, mode: 'date' }).notNull(),
+  displayTimezone: text('display_timezone').default('UTC'),
+  signedContentHashSha256: text('signed_content_hash_sha256').notNull(),
+  signatureStatus: signatureStatusEnum('signature_status').default('active').notNull(),
+  comments: text('comments'),
+}, (t) => ({
+  entityIdx: index('idx_signatures_entity').on(t.entityType, t.entityId),
+  recordVersionIdx: index('idx_signatures_record_version').on(t.recordVersionId),
+  signerIdx: index('idx_signatures_signer').on(t.signerUserId, t.signedAt),
+  orgTimeIdx: index('idx_signatures_org_time').on(t.organizationId, t.signedAt),
+}));
+
+export const recordVersionsRelations = relations(recordVersions, ({ one, many }) => ({
+  organization: one(organizations, {
+    fields: [recordVersions.organizationId],
+    references: [organizations.id],
+  }),
+  createdByUser: one(users, {
+    fields: [recordVersions.createdByUserId],
+    references: [users.id],
+    relationName: 'recordVersionsCreatedByUser',
+  }),
+  supersedesVersion: one(recordVersions, {
+    fields: [recordVersions.supersedesVersionId],
+    references: [recordVersions.id],
+    relationName: 'supersededVersions',
+  }),
+  signatures: many(electronicSignatures),
+}));
+
+export const electronicSignaturesRelations = relations(electronicSignatures, ({ one }) => ({
+  organization: one(organizations, {
+    fields: [electronicSignatures.organizationId],
+    references: [organizations.id],
+  }),
+  recordVersion: one(recordVersions, {
+    fields: [electronicSignatures.recordVersionId],
+    references: [recordVersions.id],
+  }),
+  signerUser: one(users, {
+    fields: [electronicSignatures.signerUserId],
+    references: [users.id],
+    relationName: 'signaturesBySigner',
+  }),
+}));
+