@prenta/core 0.118.0

package/prisma/schema.prisma

@@ -0,0 +1,995 @@
+generator client {
+  provider        = "prisma-client"
+  output          = "../generated"
+  // `relationJoins` is the Preview-feature flag that makes
+  // `relationLoadStrategy: 'join'` a recognised argument on
+  // findUnique / findMany / findFirst. Without it the option is
+  // silently rejected as an "Unknown argument" by Prisma — which
+  // is how the optimisation in PR #132 (dashboard recent-docs +
+  // versions list + bench `doc_get`) went unnoticed in production:
+  // `safeFindMany` swallowed the rejection and returned `[]`, the
+  // versions endpoint returned 500, and the bench reported "100/100
+  // errors" with no attached cause. Phase 5.5 #5 surfaced the
+  // failure once the bench harness started recording the first
+  // error message.
+  //
+  // The feature has been Preview since Prisma 5.7 and is documented
+  // at https://www.prisma.io/docs/orm/prisma-client/queries/relation-queries#relation-load-strategies
+  previewFeatures = ["fullTextSearchPostgres", "relationJoins"]
+}
+
+datasource db {
+  provider = "postgresql"
+}
+
+// ─── Enums ──────────────────────────────────────────────────────────
+
+enum DocumentStatus {
+  DRAFT
+  PUBLISHED
+  ARCHIVED
+  SCHEDULED
+  SCHEDULED_UNPUBLISH
+}
+
+enum UserRole {
+  ADMIN
+  EDITOR
+  AUTHOR
+  CLIENT
+  OWNER
+  VIEWER
+}
+
+enum InviteStatus {
+  PENDING
+  ACCEPTED
+  EXPIRED
+  CANCELLED
+}
+
+enum ChangeType {
+  CREATE
+  UPDATE
+  PUBLISH
+  RESTORE
+  DELETE
+}
+
+enum ContentIssueType {
+  // Document is published but missing a `metaDescription` /
+  // `seoDescription` field — the dashboard surfaces these so editors
+  // can fix the SERP snippet before a competitor outranks them.
+  MISSING_META_DESCRIPTION
+  // Document HTML contains <img> tags without alt attributes. Hurts
+  // both a11y and SEO. Counted per *document* not per image — so a
+  // page with 5 alt-less images is 1 row, not 5, with `details.count`
+  // capturing the per-document count.
+  MISSING_ALT_TEXT
+  // Internal link (same-origin URL or relative path) returned 404 /
+  // 410 / DNS-failure when the link checker probed it. `details.url`
+  // holds the offending URL.
+  BROKEN_INTERNAL_LINK
+  // Published document not touched in >90 days. Encourages refresh
+  // of stale content — particularly important for "best of YEAR"
+  // posts that decay rapidly.
+  OUTDATED_CONTENT
+}
+
+enum WorkflowStage {
+  DRAFT
+  IN_REVIEW
+  APPROVED
+  PUBLISHED
+  ARCHIVED
+}
+
+// ─── Models ─────────────────────────────────────────────────────────
+
+model User {
+  id            String    @id @default(cuid())
+  email         String    @unique
+  name          String
+  avatarUrl     String?
+  role          UserRole  @default(AUTHOR)
+  passwordHash  String?
+  totpSecret    String?
+  totpEnabled   Boolean   @default(false)
+  // Last consumed TOTP time-step — enforces single-use so a captured code can't
+  // be replayed within its validity window (#565). Null until the first TOTP login.
+  lastTotpStep  Int?
+  backupCodes   Json?
+  authProvider  String?
+  isActive      Boolean   @default(true)
+  isApproved    Boolean   @default(false)
+  emailVerified Boolean   @default(false)
+  lastLoginAt   DateTime?
+  createdAt     DateTime  @default(now())
+  updatedAt     DateTime  @updatedAt
+
+  // Access-control lifecycle (Users management subsystem). All additive and
+  // nullable/defaulted so existing rows migrate cleanly.
+  suspendedAt        DateTime?
+  lockedAt           DateTime?
+  forcePasswordReset Boolean   @default(false)
+  mfaRequired        Boolean   @default(false)
+  failedLoginCount   Int       @default(0)
+  lastActiveAt       DateTime?
+  invitedById        String?
+  acceptedInviteAt   DateTime?
+
+  sessions            Session[]
+  oauthAccounts       OAuthAccount[]
+  apiKeys             ApiKey[]
+  documents           Document[]           @relation("CreatedDocuments")
+  updatedDocuments    Document[]           @relation("UpdatedDocuments")
+  versions            Version[]
+  media               Media[]
+  contentLocks        ContentLock[]
+  notifications       InAppNotification[]
+  contentTemplates    ContentTemplate[]
+  workflowAssigned    WorkflowState[]
+  passwordResetTokens PasswordResetToken[]
+
+  @@map("prenta_users")
+}
+
+model OAuthAccount {
+  id                String    @id @default(cuid())
+  userId            String
+  provider          String
+  providerAccountId String
+  accessToken       String?
+  refreshToken      String?
+  expiresAt         DateTime?
+  createdAt         DateTime  @default(now())
+
+  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@unique([provider, providerAccountId])
+  @@map("prenta_oauth_accounts")
+}
+
+model Session {
+  id              String    @id @default(cuid())
+  userId          String
+  token           String    @unique
+  expiresAt       DateTime
+  revokedAt       DateTime?
+  ipAddress       String?
+  userAgent       String?
+  fingerprintHash String?
+  createdAt       DateTime  @default(now())
+
+  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@index([userId])
+  @@index([expiresAt])
+  @@map("prenta_sessions")
+}
+
+model ApiKey {
+  id             String    @id @default(cuid())
+  name           String
+  keyHash        String    @unique
+  keyPrefix      String
+  userId         String
+  scopes         Json
+  ipRestrictions Json?
+  expiresAt      DateTime?
+  lastUsedAt     DateTime?
+  revokedAt      DateTime?
+  createdAt      DateTime  @default(now())
+
+  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@map("prenta_api_keys")
+}
+
+model AuditLog {
+  id        String   @id @default(cuid())
+  event     String
+  userId    String?
+  ipAddress String?
+  userAgent String?
+  details   Json?
+  timestamp DateTime @default(now())
+
+  @@index([event])
+  @@index([userId])
+  @@index([timestamp])
+  @@map("prenta_audit_logs")
+}
+
+model Folder {
+  id        String   @id @default(cuid())
+  name      String
+  scope     String
+  parentId  String?
+  position  Int      @default(0)
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+
+  parent   Folder?  @relation("FolderTree", fields: [parentId], references: [id], onDelete: Cascade)
+  children Folder[] @relation("FolderTree")
+
+  documents Document[]
+  media     Media[]
+
+  @@index([scope])
+  @@index([parentId])
+  @@map("prenta_folders")
+}
+
+model Document {
+  id                   String         @id @default(cuid())
+  collection           String
+  title                String?
+  slug                 String?
+  data                 Json
+  status               DocumentStatus @default(DRAFT)
+  locale               String?
+  localeGroupId        String?
+  createdById          String
+  updatedById          String
+  publishedAt          DateTime?
+  scheduledAt          DateTime?
+  scheduledUnpublishAt DateTime?
+  deletedAt            DateTime?
+  plainText            String?
+  contentHash          String?
+  structuredData       Json?
+  contentGraph         Json?
+  siteId               String?
+  templateId           String?
+  workflowStage        WorkflowStage  @default(DRAFT)
+  reviewerId           String?
+  reviewNote           String?
+  folderId             String?
+  createdAt            DateTime       @default(now())
+  updatedAt            DateTime       @updatedAt
+
+  createdBy     User           @relation("CreatedDocuments", fields: [createdById], references: [id])
+  updatedBy     User           @relation("UpdatedDocuments", fields: [updatedById], references: [id])
+  folder        Folder?        @relation(fields: [folderId], references: [id], onDelete: SetNull)
+  versions      Version[]
+  mediaUsages   MediaUsage[]
+  contentLocks  ContentLock[]
+  contentIssues ContentIssue[]
+  workflowState WorkflowState?
+
+  @@unique([collection, slug])
+  @@index([collection])
+  @@index([status])
+  @@index([deletedAt])
+  @@index([publishedAt])
+  @@index([folderId])
+  @@index([scheduledAt])
+  @@index([localeGroupId])
+  @@index([createdById])
+  @@map("prenta_documents")
+}
+
+model Version {
+  id          String     @id @default(cuid())
+  documentId  String
+  data        Json
+  changedById String
+  changeType  ChangeType
+  createdAt   DateTime   @default(now())
+
+  document  Document @relation(fields: [documentId], references: [id], onDelete: Cascade)
+  changedBy User     @relation(fields: [changedById], references: [id])
+
+  @@index([documentId])
+  @@map("prenta_versions")
+}
+
+enum MediaStatus {
+  PROCESSING
+  READY
+  FAILED
+}
+
+model Media {
+  id            String   @id @default(cuid())
+  filename      String
+  storageKey    String   @unique
+  mimeType      String
+  fileSize      Int
+  width         Int?
+  height        Int?
+  altText       String?
+  title         String?
+  uploadedById  String
+  focalPointX   Float?
+  focalPointY   Float?
+  blurHash      String?
+  aiAltText     String?
+  aiTags        Json?
+  aiDescription String?
+  folderId      String?
+  createdAt     DateTime @default(now())
+  updatedAt     DateTime @updatedAt
+
+  // ── Media Center additions ──────────────────────────────────────
+  // All nullable / defaulted so they're safe to add to a populated DB
+  // with no backfill. SEO score/issues are intentionally NOT stored —
+  // they're derived on read by `calculateMediaSeoScore()` so they can
+  // never drift from the metadata below.
+  originalFileName   String?
+  caption            String?
+  description        String?
+  focusKeyword       String?
+  // WCAG decorative images use alt="" intentionally. Persisted so the
+  // media SEO scorer awards the alt weight instead of flagging missing-alt
+  // (#714). Cleared automatically when a non-empty alt is saved.
+  isDecorative       Boolean  @default(false)
+  tags               Json?
+  // SHA-256 hex of the final stored bytes (post-optimize). Used to make
+  // re-uploads / seed re-runs idempotent instead of creating byte-identical
+  // twins (#718). Nullable so legacy rows need no backfill.
+  contentHash        String?
+  // `storageKey` historically held the public URL; `publicUrl` splits
+  // that concern out. New uploads populate both; legacy rows keep the
+  // URL in `storageKey` and `mediaUrl()` still resolves it.
+  publicUrl          String?
+  storageProvider    String?
+  durationSeconds    Float?
+  thumbnailUrl       String?
+  responsiveVariants Json?
+  status             MediaStatus @default(READY)
+  deletedAt          DateTime?
+
+  uploadedBy  User         @relation(fields: [uploadedById], references: [id])
+  folder      Folder?      @relation(fields: [folderId], references: [id], onDelete: SetNull)
+  mediaUsages MediaUsage[]
+
+  @@index([folderId])
+  @@index([deletedAt])
+  @@index([mimeType])
+  @@index([contentHash])
+  @@map("prenta_media")
+}
+
+model MediaUsage {
+  id         String   @id @default(cuid())
+  mediaId    String
+  documentId String
+  fieldPath  String
+  createdAt  DateTime @default(now())
+
+  media    Media    @relation(fields: [mediaId], references: [id], onDelete: Cascade)
+  document Document @relation(fields: [documentId], references: [id], onDelete: Cascade)
+
+  @@unique([mediaId, documentId, fieldPath])
+  @@index([documentId])
+  @@map("prenta_media_usages")
+}
+
+model ContentLock {
+  id         String   @id @default(cuid())
+  documentId String
+  userId     String
+  lockedAt   DateTime @default(now())
+  expiresAt  DateTime
+
+  document Document @relation(fields: [documentId], references: [id], onDelete: Cascade)
+  user     User     @relation(fields: [userId], references: [id])
+
+  @@map("prenta_content_locks")
+}
+
+model InAppNotification {
+  id        String   @id @default(cuid())
+  userId    String
+  type      String
+  title     String
+  message   String?
+  link      String?
+  read      Boolean  @default(false)
+  createdAt DateTime @default(now())
+
+  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@map("prenta_notifications")
+}
+
+model ContentTemplate {
+  id           String   @id @default(cuid())
+  name         String
+  collection   String
+  templateData Json
+  createdById  String
+  createdAt    DateTime @default(now())
+  updatedAt    DateTime @updatedAt
+
+  createdBy User @relation(fields: [createdById], references: [id])
+
+  @@map("prenta_content_templates")
+}
+
+model Site {
+  id              String   @id @default(cuid())
+  domain          String   @unique
+  name            String
+  configOverrides Json?
+  isDefault       Boolean  @default(false)
+  createdAt       DateTime @default(now())
+  updatedAt       DateTime @updatedAt
+
+  @@map("prenta_sites")
+}
+
+model WorkflowState {
+  id           String   @id @default(cuid())
+  documentId   String   @unique
+  currentStep  Int      @default(0)
+  assignedToId String?
+  status       String   @default("pending")
+  definition   Json
+  createdAt    DateTime @default(now())
+  updatedAt    DateTime @updatedAt
+
+  document   Document @relation(fields: [documentId], references: [id], onDelete: Cascade)
+  assignedTo User?    @relation(fields: [assignedToId], references: [id])
+
+  @@map("prenta_workflow_states")
+}
+
+model Redirect {
+  id            String    @id @default(cuid())
+  source        String
+  destination   String
+  statusCode    Int       @default(301)
+  isRegex       Boolean   @default(false)
+  notes         String?
+  // Runtime + management metadata (added in 0009_seo). All defaulted so the
+  // migration is safe to apply to a populated table with no backfill.
+  enabled       Boolean   @default(true)
+  priority      Int       @default(0)
+  preserveQuery Boolean   @default(false)
+  // "manual" | "import" | "ai-404-recovery" | "chain-flatten"
+  source_kind   String    @default("manual")
+  hits          Int       @default(0)
+  lastHitAt     DateTime?
+  createdById   String?
+  createdAt     DateTime  @default(now())
+  updatedAt     DateTime  @updatedAt
+
+  @@unique([source])
+  @@index([enabled])
+  @@index([lastHitAt])
+  @@map("prenta_redirects")
+}
+
+// ─── SEO module (0009_seo) ──────────────────────────────────────────
+
+enum SeoAuditStatus {
+  RUNNING
+  COMPLETED
+  FAILED
+}
+
+enum SeoIssueSeverity {
+  critical
+  warning
+  info
+}
+
+enum SeoIssueStatus {
+  open
+  ignored
+  resolved
+  recurring
+}
+
+enum SeoIssueCategory {
+  content
+  technical
+  redirects
+  media
+  performance
+  schema
+  social
+  indexing
+}
+
+/// One execution of the SEO audit engine. Holds a snapshot of the site
+/// score and issue counts so the Audit tab can show run history without
+/// recomputing. Issues belong to a run via SEOIssue.auditRunId.
+model SeoAuditRun {
+  id              String         @id @default(cuid())
+  status          SeoAuditStatus @default(RUNNING)
+  scope           String         @default("full")
+  startedById     String?
+  startedAt       DateTime       @default(now())
+  finishedAt      DateTime?
+  siteScoreBefore Int?
+  siteScoreAfter  Int?
+  pagesScanned    Int            @default(0)
+  issuesFound     Int            @default(0)
+  criticalCount   Int            @default(0)
+  warningCount    Int            @default(0)
+  infoCount       Int            @default(0)
+  errorMessage    String?
+  metadata        Json?
+
+  issues SeoIssue[]
+
+  @@index([status])
+  @@index([startedAt])
+  @@map("prenta_seo_audit_runs")
+}
+
+/// A single SEO problem detected by an audit run. `issueKey` is a stable
+/// hash of (type + entityId/url) used to carry status across runs so a
+/// resolved/ignored issue stays resolved/ignored when re-detected.
+model SeoIssue {
+  id               String           @id @default(cuid())
+  auditRunId       String?
+  issueKey         String
+  entityType       String?
+  entityId         String?
+  entityTitle      String?
+  url              String?
+  severity         SeoIssueSeverity
+  category         SeoIssueCategory
+  type             String
+  title            String
+  description      String?
+  impact           String?
+  recommendation   String?
+  status           SeoIssueStatus   @default(open)
+  fixable          Boolean          @default(false)
+  fixActionType    String?
+  relatedEntityIds Json?
+  source           String           @default("audit")
+  firstDetectedAt  DateTime         @default(now())
+  lastDetectedAt   DateTime         @default(now())
+  resolvedAt       DateTime?
+  resolvedById     String?
+  metadata         Json?
+
+  auditRun SeoAuditRun? @relation(fields: [auditRunId], references: [id], onDelete: SetNull)
+
+  @@index([auditRunId])
+  @@index([status])
+  @@index([severity])
+  @@index([category])
+  @@index([issueKey])
+  @@map("prenta_seo_issues")
+}
+
+/// A 404 hit observed by the redirect middleware. Aggregated per path so
+/// the Redirects tab can surface "broken URLs still getting traffic".
+model Redirect404Hit {
+  id          String    @id @default(cuid())
+  path        String
+  hits        Int       @default(1)
+  referrer    String?
+  resolvedAt  DateTime?
+  firstSeenAt DateTime  @default(now())
+  lastSeenAt  DateTime  @default(now())
+
+  @@unique([path])
+  @@index([lastSeenAt])
+  @@map("prenta_redirect_404_hits")
+}
+
+/// Aggregated AI-crawler activity for the admin "AI crawler activity" panel.
+/// One row per (bot token, surface), upserted on each hit so the table stays
+/// bounded (~known bots × surfaces) and needs no periodic pruning.
+/// `surface` ∈ "llms" | "llms-full" | "md" | "honeypot".
+/// `category` mirrors the ai-bots taxonomy: "training" | "retrieval" | "other".
+model AiCrawlerHit {
+  id          String   @id @default(cuid())
+  bot         String
+  surface     String
+  category    String   @default("other")
+  hits        Int      @default(1)
+  firstSeenAt DateTime @default(now())
+  lastSeenAt  DateTime @default(now())
+
+  @@unique([bot, surface])
+  @@index([lastSeenAt])
+  @@map("prenta_ai_crawler_hits")
+}
+
+/// An AI/heuristic suggestion for a 404 destination. Confidence-scored and
+/// never auto-applied below the configured threshold.
+model RedirectSuggestion {
+  id         String   @id @default(cuid())
+  fromPath   String
+  toPath     String
+  confidence Int      @default(0)
+  reason     String?
+  // "open" | "accepted" | "dismissed"
+  status     String   @default("open")
+  source     String   @default("ai-404-recovery")
+  metadata   Json?
+  createdAt  DateTime @default(now())
+  updatedAt  DateTime @updatedAt
+
+  @@index([status])
+  @@index([fromPath])
+  @@map("prenta_redirect_suggestions")
+}
+
+// A versioned snapshot of a form's field schema. Saving a form's schema in
+// the admin creates a new row here; submissions reference the version they
+// were captured against so historical entries always render with the fields
+// that existed at submit time, even after the live form schema changes.
+model FormSchemaVersion {
+  id          String   @id @default(cuid())
+  formId      String
+  version     Int
+  fields      Json
+  notes       String?
+  createdById String?
+  createdAt   DateTime @default(now())
+
+  @@unique([formId, version])
+  @@index([formId])
+  @@map("prenta_form_schema_versions")
+}
+
+model FormSubmission {
+  id              String    @id @default(cuid())
+  // Per-instance sequential number shown in the UI (e.g. #00001). Assigned by
+  // the submission service inside a transaction; nullable for legacy rows.
+  entryNumber     Int?
+  formId          String
+  schemaVersionId String?
+  data            Json
+  // Server-derived, type-coerced view of `data` (e.g. checkbox -> bool,
+  // number -> number) used for export/search. `data` keeps the raw payload.
+  normalizedData  Json?
+  attribution     Json?
+  senderName      String?
+  senderEmail     String?
+  senderPhone     String?
+  preview         String?
+  // Legacy free-form status ('new'); superseded by the booleans below but
+  // retained so existing rows/integrations keep working.
+  status          String    @default("new")
+  unread          Boolean   @default(true)
+  starred         Boolean   @default(false)
+  archived        Boolean   @default(false)
+  spamStatus      String    @default("clean")
+  ipAddressHash   String?
+  userAgent       String?
+  referrer        String?
+  pageUrl         String?
+  utmSource       String?
+  utmMedium       String?
+  utmCampaign     String?
+  submittedAt     DateTime  @default(now())
+  readAt          DateTime?
+  archivedAt      DateTime?
+  createdAt       DateTime  @default(now())
+  updatedAt       DateTime  @updatedAt
+
+  files      FormSubmissionFile[]
+  deliveries FormDeliveryAttempt[]
+
+  @@index([formId])
+  @@index([status])
+  @@index([unread])
+  @@index([starred])
+  @@index([archived])
+  @@index([spamStatus])
+  @@index([submittedAt])
+  @@index([senderEmail])
+  @@map("prenta_form_submissions")
+}
+
+// File attachments for a submission. Files are stored via the configured
+// storage adapter (never inline in the DB); this row tracks metadata and the
+// storage key needed to mint a secure download link.
+model FormSubmissionFile {
+  id                String   @id @default(cuid())
+  submissionId      String
+  fieldKey          String
+  mediaAssetId      String?
+  fileName          String
+  mimeType          String
+  sizeBytes         Int
+  storageKey        String
+  publicUrl         String?
+  secureDownloadUrl String?
+  createdAt         DateTime @default(now())
+
+  submission FormSubmission @relation(fields: [submissionId], references: [id], onDelete: Cascade)
+
+  @@index([submissionId])
+  @@map("prenta_form_submission_files")
+}
+
+// Per-form outbound webhook configuration. Distinct from the global
+// WebhookEndpoint registry so form owners can wire delivery without admin
+// access to site-wide webhooks.
+model FormWebhook {
+  id                       String    @id @default(cuid())
+  formId                   String
+  url                      String
+  secret                   String
+  /// Previous signing secret (encrypted) kept during rotation grace (#679).
+  previousSecret           String?
+  previousSecretValidUntil DateTime?
+  enabled                  Boolean   @default(true)
+  events                   Json
+  retryCount               Int       @default(0)
+  lastDeliveryAt           DateTime?
+  lastDeliveryStatus       String?
+  createdAt                DateTime  @default(now())
+  updatedAt                DateTime  @updatedAt
+
+  @@index([formId])
+  @@map("prenta_form_webhooks")
+}
+
+/// Per-submission notify/webhook/email delivery attempts (#675).
+/// Fail-open: the lead is always persisted; this table tracks best-effort fan-out.
+model FormDeliveryAttempt {
+  id             String    @id @default(cuid())
+  submissionId   String
+  formId         String
+  /// email_notify | email_autoresponder | form_webhook
+  channel        String
+  /// Recipient email or webhook URL (never secrets).
+  destination    String
+  webhookId      String?
+  /// pending | retrying | success | failed | skipped
+  status         String    @default("pending")
+  attempts       Int       @default(0)
+  maxAttempts    Int       @default(3)
+  lastAttemptAt  DateTime?
+  nextRetryAt    DateTime?
+  error          String?
+  responseStatus Int?
+  skippedReason  String?
+  /// Webhook payload (or email meta) for retry without re-submitting.
+  payload        Json?
+  /// When an operator alert email was sent for a permanent failure.
+  alertedAt      DateTime?
+  createdAt      DateTime  @default(now())
+  updatedAt      DateTime  @updatedAt
+
+  submission FormSubmission @relation(fields: [submissionId], references: [id], onDelete: Cascade)
+
+  @@index([formId, status])
+  @@index([submissionId])
+  @@index([status, nextRetryAt])
+  @@map("prenta_form_delivery_attempts")
+}
+
+model BackupRecord {
+  id         String   @id @default(cuid())
+  filename   String
+  storageKey String
+  sizeBytes  Int
+  type       String
+  metadata   Json?
+  createdAt  DateTime @default(now())
+
+  @@map("prenta_backup_records")
+}
+
+model WebhookEndpoint {
+  id                       String    @id @default(cuid())
+  url                      String
+  events                   Json
+  secret                   String
+  /// Previous signing secret (encrypted) kept during rotation grace (#679).
+  previousSecret           String?
+  previousSecretValidUntil DateTime?
+  active                   Boolean   @default(true)
+  name                     String?
+  createdAt                DateTime  @default(now())
+  updatedAt                DateTime  @updatedAt
+
+  deliveries WebhookDeliveryLog[]
+
+  @@map("prenta_webhook_endpoints")
+}
+
+model WebhookDeliveryLog {
+  id             String    @id @default(cuid())
+  endpointId     String
+  event          String
+  payload        Json
+  status         String    @default("pending")
+  attempts       Int       @default(0)
+  maxAttempts    Int       @default(3)
+  lastAttemptAt  DateTime?
+  nextRetryAt    DateTime?
+  responseStatus Int?
+  responseBody   String?
+  createdAt      DateTime  @default(now())
+
+  endpoint WebhookEndpoint @relation(fields: [endpointId], references: [id], onDelete: Cascade)
+
+  @@index([endpointId])
+  @@index([status])
+  @@index([nextRetryAt])
+  @@map("prenta_webhook_deliveries")
+}
+
+model PasswordResetToken {
+  id        String    @id @default(cuid())
+  userId    String
+  tokenHash String
+  expiresAt DateTime
+  usedAt    DateTime?
+  createdAt DateTime  @default(now())
+
+  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@index([tokenHash])
+  @@index([userId])
+  @@map("prenta_password_reset_tokens")
+}
+
+model Invite {
+  id              String       @id @default(cuid())
+  email           String
+  role            UserRole
+  status          InviteStatus @default(PENDING)
+  tokenHash       String
+  message         String?
+  // Stored as a bare id (not an FK relation) to mirror AuditLog: an inviter
+  // being removed must never cascade-delete the invite history.
+  invitedByUserId String?
+  acceptedUserId  String?
+  expiresAt       DateTime
+  acceptedAt      DateTime?
+  cancelledAt     DateTime?
+  createdAt       DateTime     @default(now())
+  updatedAt       DateTime     @updatedAt
+
+  @@index([email])
+  @@index([tokenHash])
+  @@index([status])
+  @@map("prenta_invites")
+}
+
+model ScriptTag {
+  id               String   @id @default(cuid())
+  name             String
+  code             String   @db.Text
+  placement        String
+  scope            String
+  targetPaths      String[]
+  priority         Int      @default(100)
+  enabled          Boolean  @default(true)
+  /// Inject `async` into external <script src> tags so they don't block render.
+  loadAsync        Boolean  @default(false)
+  /// Skip this tag when the page is rendered inside CMS preview mode.
+  disableInPreview Boolean  @default(true)
+  /// Cookie-consent category gate: none | analytics | marketing | functional | preferences.
+  consentCategory  String   @default("none")
+  createdAt        DateTime @default(now())
+  updatedAt        DateTime @updatedAt
+
+  @@index([enabled])
+  @@index([placement])
+  @@map("prenta_script_tags")
+}
+
+model PageTemplate {
+  id          String   @id @default(cuid())
+  name        String
+  description String?
+  category    String   @default("content")
+  tree        Json
+  thumbnail   String?
+  builtIn     Boolean  @default(false)
+  createdAt   DateTime @default(now())
+  updatedAt   DateTime @updatedAt
+
+  @@index([category])
+  @@index([builtIn])
+  @@map("prenta_page_templates")
+}
+
+model SavedSection {
+  id          String   @id @default(cuid())
+  name        String
+  description String?
+  category    String   @default("content")
+  tree        Json
+  thumbnail   String?
+  usageCount  Int      @default(0)
+  createdAt   DateTime @default(now())
+  updatedAt   DateTime @updatedAt
+
+  @@index([category])
+  @@map("prenta_saved_sections")
+}
+
+// ─── Dashboard metrics ─────────────────────────────────────────────────────
+
+/// Per-minute pre-aggregated request counters that power the
+/// "Delivery API" dashboard tiles (request volume, error rate,
+/// average latency, p95). One row per (bucketStart × route × statusBucket).
+///
+/// Why pre-aggregated minute buckets and not per-request rows:
+///   - 24h of traffic at 10 req/s on 20 routes ≈ 17M raw rows; the
+///     equivalent minute-bucketed table is ≤ 28,800 rows (1440 × 20).
+///   - Vercel Functions are concurrency-bounded; an O(1) UPSERT per
+///     request is cheaper than O(write+query) per dashboard load.
+///   - 7-day retention is enforced by the
+///     `/api/cms/cron/api-metrics-prune` cron, so the table stays
+///     bounded.
+///
+/// `latencyHistogram` is a fixed 12-bucket log-scale array (ms):
+///   [<1, 1-2, 2-4, 4-8, 8-16, 16-32, 32-64, 64-128, 128-256,
+///    256-512, 512-1024, >1024]
+/// Cumulative-sum to estimate p95 with ~10% accuracy without
+/// per-request samples. The `delivery-stats` reader merges
+/// histograms across buckets before estimating.
+model ApiRequestMetric {
+  id               String   @id @default(cuid())
+  /// UTC minute boundary (`floor(time, '1 minute')`). The unique
+  /// constraint on `(bucketStart, route, statusBucket)` lets the
+  /// request logger UPSERT in one round-trip per request.
+  bucketStart      DateTime
+  /// Normalised request route (e.g. `/collections/posts` — never
+  /// the per-document `/collections/posts/abc123`). Normalisation
+  /// happens in `instrumentation.ts` so the cardinality stays
+  /// bounded.
+  route            String
+  /// HTTP status family — one of `2xx`, `3xx`, `4xx`, `5xx`,
+  /// `other`. Storing the bucket rather than the raw status lets
+  /// us answer "error rate?" with a single GROUP BY.
+  statusBucket     String
+  count            Int      @default(0)
+  /// Sum of `responseMs` across `count` requests. Average latency
+  /// = `sum(sumLatencyMs) / sum(count)` over the window.
+  sumLatencyMs     Float    @default(0)
+  /// Max single-request latency in this bucket. Useful as a
+  /// fast-path tail-latency indicator and as a sanity check on
+  /// the histogram estimator.
+  maxLatencyMs     Float    @default(0)
+  /// 12-bucket log-scale histogram (see model doc). Stored as
+  /// `Json` so the schema doesn't have to change when we revise
+  /// bucket boundaries.
+  latencyHistogram Json
+  updatedAt        DateTime @updatedAt
+
+  @@unique([bucketStart, route, statusBucket])
+  @@index([bucketStart])
+  @@map("prenta_api_request_metrics")
+}
+
+/// Persisted content-quality issues surfaced by the nightly
+/// content-health scan. The Dashboard's "Content Health" card
+/// aggregates these rows by `type` to produce the issue list.
+///
+/// Upsert key is `(documentId, type)` so the scanner is
+/// idempotent — re-running yields the same row count, and a row
+/// "self-resolves" by being absent from the next scan (the
+/// scanner uses a `firstScanAt`-watermark + delete pattern).
+model ContentIssue {
+  id          String           @id @default(cuid())
+  documentId  String
+  type        ContentIssueType
+  /// Per-issue count (e.g. 5 alt-less images = `count: 5` even
+  /// though it's 1 row). Lets the dashboard show real numbers
+  /// without re-scanning the document HTML on each page load.
+  count       Int              @default(1)
+  /// Type-specific payload — the broken URL, the page's
+  /// `updatedAt`, the offending image src, etc. JSON so each
+  /// issue type can carry its own shape without schema churn.
+  details     Json?
+  firstSeenAt DateTime         @default(now())
+  lastSeenAt  DateTime         @default(now())
+
+  document Document @relation(fields: [documentId], references: [id], onDelete: Cascade)
+
+  @@unique([documentId, type])
+  @@index([type])
+  @@index([documentId])
+  @@map("prenta_content_issues")
+}