@taodigital/database 0.0.0-stage → 1.2.0

package/README.md

@@ -1,3 +1,22 @@
-# Temporary Holding Version
+# @detiq/database — The Data Model & Zeta Core
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+This package defines the "sealed boxes" (Workspace -> Tenant -> Project) and
+the **Zeta Core** (Screens, Elements, Flows, Skill Files, Test artifacts).
+
+## Why a normal database (not a vector database)?
+Because the workspace is **closed and bounded**, we ground the AI by loading a
+project's knowledge **directly** (see `@detiq/app-brain`). A normal Postgres
+database is simpler, cheaper, precise, and easy to isolate per tenant. We add
+vector search later **only** for projects flagged `oversized = true`.
+
+## Tenant isolation is enforced HERE, at the database layer
+`migrations/0001_tenant_isolation/migration.sql` turns on Row-Level Security.
+Every query must run inside `withTenant(tenantId, ...)`. If you forget, the
+database returns nothing — the safe failure mode.
+
+## Commands
+```
+npm run -w @detiq/database generate   # build the Prisma client
+npm run -w @detiq/database migrate    # create/update tables
+npm run -w @detiq/database studio     # visual database browser
+```

package/dist/index.d.ts

@@ -0,0 +1,58 @@
+import { Prisma, PrismaClient } from '@prisma/client';
+/**
+ * A single shared Prisma client for the whole app.
+ * Runs as qip_app (subject to RLS — use withTenant() to set tenant context).
+ */
+export declare const prisma: PrismaClient<{
+    datasources: {
+        db: {
+            url: string;
+        };
+    };
+}, never, import("@prisma/client/runtime/library").DefaultArgs>;
+/**
+ * DANGER: Bypasses Row-Level Security. Returns data across ALL tenants.
+ *
+ * Cross-tenant data leak if used in a tenant-scoped route handler.
+ * Approved use sites ONLY:
+ *   - auth.ts       — user lookup before tenant is known (login/signup/password)
+ *   - admin.ts      — platform admin routes
+ *   - tenant.ts     — token resolution before tenant context established
+ *   - ci.ts         — API key resolution before tenant known
+ *   - session.service.ts — session management
+ *
+ * Everywhere else: use withTenant() + the RLS-scoped `prisma` client.
+ */
+export declare const prismaAdmin: PrismaClient<{
+    datasources: {
+        db: {
+            url: string;
+        };
+    };
+}, never, import("@prisma/client/runtime/library").DefaultArgs>;
+/**
+ * Evict a SILO client from the in-process cache (e.g. after re-provisioning).
+ * Call from the admin provisioning endpoint so the next withTenant() picks up
+ * the new connection string.
+ */
+export declare function evictSiloClient(tenantId: string): void;
+/**
+ * Run database work "as a tenant".
+ *
+ * POOL path (default): sets the Postgres session variable `app.current_tenant`
+ * so Row-Level Security policies filter every query to that tenant only.
+ *
+ * SILO path (when TenantSiloConfig exists): uses a dedicated PrismaClient
+ * pointed at the tenant's own database — RLS is not needed there because the
+ * database itself contains only that tenant's data.
+ *
+ * If you forget to wrap a query in withTenant(), the RLS policy returns
+ * NOTHING — which is the safe failure mode.
+ *
+ * Usage:
+ *   const screens = await withTenant(tenantId, (tx) =>
+ *     tx.screen.findMany({ where: { projectId } })
+ *   );
+ */
+export declare function withTenant<T>(tenantId: string, work: (tx: Prisma.TransactionClient) => Promise<T>): Promise<T>;
+export * from '@prisma/client';

package/dist/index.js

@@ -0,0 +1,209 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.prismaAdmin = exports.prisma = void 0;
+exports.evictSiloClient = evictSiloClient;
+exports.withTenant = withTenant;
+const client_1 = require("@prisma/client");
+const node_crypto_1 = __importStar(require("node:crypto"));
+// Inline decrypt mirroring packages/core/src/secrets.ts — avoids a circular
+// dependency between @taodigital/database and @taodigital/core.
+function _decryptConnectionString(ciphertext) {
+    const raw = process.env.ENCRYPTION_KEY ?? '';
+    if (!raw)
+        throw new Error('ENCRYPTION_KEY is not set');
+    const salt = process.env.HKDF_SALT ? Buffer.from(process.env.HKDF_SALT, 'hex') : Buffer.alloc(32);
+    const key = Buffer.from((0, node_crypto_1.hkdfSync)('sha256', Buffer.from(raw, 'utf8'), salt, 'zeta-aes-256-gcm-v2', 32));
+    const buf = Buffer.from(ciphertext, 'base64');
+    const iv = buf.subarray(0, 12);
+    const tag = buf.subarray(12, 28);
+    const data = buf.subarray(28);
+    const decipher = node_crypto_1.default.createDecipheriv('aes-256-gcm', key, iv);
+    decipher.setAuthTag(tag);
+    return Buffer.concat([decipher.update(data), decipher.final()]).toString('utf8');
+}
+/**
+ * A single shared Prisma client for the whole app.
+ * Runs as qip_app (subject to RLS — use withTenant() to set tenant context).
+ */
+// Neon's PgBouncer transaction-mode pooler limits concurrent interactive transactions.
+// Default 25 is fine for API-only load but crawls issue ~4 writes/screen (saveScreen,
+// saveElement×N, saveScreenshot, saveActionRecipe) — at 30+ pages that's 120+ concurrent
+// writes. Raise via DATABASE_CONNECTION_LIMIT env var; 50 is safe for most Neon plans.
+exports.prisma = new client_1.PrismaClient({
+    datasources: { db: { url: process.env.DATABASE_URL + (process.env.DATABASE_URL?.includes('?') ? '&' : '?') + `connection_limit=${process.env.DATABASE_CONNECTION_LIMIT ?? '50'}&pool_timeout=${process.env.DATABASE_POOL_TIMEOUT ?? '60'}` } },
+});
+/**
+ * DANGER: Bypasses Row-Level Security. Returns data across ALL tenants.
+ *
+ * Cross-tenant data leak if used in a tenant-scoped route handler.
+ * Approved use sites ONLY:
+ *   - auth.ts       — user lookup before tenant is known (login/signup/password)
+ *   - admin.ts      — platform admin routes
+ *   - tenant.ts     — token resolution before tenant context established
+ *   - ci.ts         — API key resolution before tenant known
+ *   - session.service.ts — session management
+ *
+ * Everywhere else: use withTenant() + the RLS-scoped `prisma` client.
+ */
+exports.prismaAdmin = new client_1.PrismaClient({
+    datasources: { db: { url: (() => { const base = process.env.MIGRATION_DATABASE_URL || process.env.DATABASE_URL || ''; return base + (base.includes('?') ? '&' : '?') + 'connection_limit=10&pool_timeout=30'; })() } },
+});
+// ---- SILO routing -----------------------------------------------------------
+//
+// When a tenant has a TenantSiloConfig row, withTenant() routes their queries
+// to a dedicated Prisma client pointed at the tenant's own database instead of
+// the shared POOL. The cache avoids a DB lookup on every request.
+//
+// The SILO path is purely additive — absence of a TenantSiloConfig row falls
+// through to the existing POOL path unchanged. The connection string is stored
+// encrypted; the admin provisioning endpoint decrypts it before writing to the
+// cache here. See POST /admin/tenants/:tenantId/silo-provision.
+const siloClientCache = new Map();
+const SILO_CACHE_MAX = 50; // evict oldest when cap reached
+async function getSiloClient(tenantId) {
+    if (siloClientCache.has(tenantId))
+        return siloClientCache.get(tenantId);
+    let config;
+    try {
+        config = await exports.prismaAdmin.tenantSiloConfig.findUnique({
+            where: { tenantId },
+            select: { connectionString_enc: true },
+        });
+    }
+    catch {
+        // TenantSiloConfig table may not exist yet (migration pending) — fall back to POOL path.
+        return null;
+    }
+    if (!config)
+        return null;
+    // Decrypt the connection string before use. The admin provisioning endpoint
+    // encrypts with @taodigital/core encrypt() (AES-256-GCM) before storing, so we
+    // must decrypt here. Falls back to the raw value for any unencrypted legacy rows.
+    let connectionUrl;
+    try {
+        connectionUrl = _decryptConnectionString(config.connectionString_enc);
+    }
+    catch {
+        // Not a valid ciphertext — treat as plain text (backwards compat for any
+        // rows written before encryption was enforced).
+        connectionUrl = config.connectionString_enc;
+    }
+    const client = new client_1.PrismaClient({
+        datasources: { db: { url: connectionUrl + (connectionUrl.includes('?') ? '&' : '?') + 'connection_limit=10&pool_timeout=30' } },
+    });
+    siloClientCache.set(tenantId, client);
+    if (siloClientCache.size > SILO_CACHE_MAX) {
+        const [oldestKey, oldestClient] = siloClientCache.entries().next().value;
+        siloClientCache.delete(oldestKey);
+        oldestClient.$disconnect().catch(() => { });
+    }
+    return client;
+}
+/**
+ * Evict a SILO client from the in-process cache (e.g. after re-provisioning).
+ * Call from the admin provisioning endpoint so the next withTenant() picks up
+ * the new connection string.
+ */
+function evictSiloClient(tenantId) {
+    siloClientCache.delete(tenantId);
+}
+// ---- withTenant -------------------------------------------------------------
+/**
+ * Run database work "as a tenant".
+ *
+ * POOL path (default): sets the Postgres session variable `app.current_tenant`
+ * so Row-Level Security policies filter every query to that tenant only.
+ *
+ * SILO path (when TenantSiloConfig exists): uses a dedicated PrismaClient
+ * pointed at the tenant's own database — RLS is not needed there because the
+ * database itself contains only that tenant's data.
+ *
+ * If you forget to wrap a query in withTenant(), the RLS policy returns
+ * NOTHING — which is the safe failure mode.
+ *
+ * Usage:
+ *   const screens = await withTenant(tenantId, (tx) =>
+ *     tx.screen.findMany({ where: { projectId } })
+ *   );
+ */
+async function withTenant(tenantId, work) {
+    // Check for a dedicated SILO database for this tenant.
+    const siloClient = await getSiloClient(tenantId);
+    if (siloClient) {
+        // SILO path: the dedicated DB has no RLS, so just wrap in a transaction.
+        return siloClient.$transaction((tx) => work(tx));
+    }
+    // POOL path — retry up to 3 times on Neon connection-reset errors.
+    // Neon's serverless pooler occasionally drops idle connections mid-transaction
+    // ("Transaction not found", "prepared statement does not exist"), requiring a retry.
+    const isRetryable = (e) => {
+        const msg = e?.message ?? '';
+        const code = e?.code ?? '';
+        return (code === 'P2028' || // pool timeout / tx start failed
+            msg.includes('Transaction not found') ||
+            msg.includes('Transaction ID is invalid') ||
+            msg.includes('Unable to start a transaction') ||
+            msg.includes('prepared statement') ||
+            msg.includes('Connection reset') ||
+            msg.includes('ECONNRESET'));
+    };
+    let lastError;
+    for (let attempt = 0; attempt < 4; attempt++) {
+        try {
+            return await exports.prisma.$transaction(async (tx) => {
+                await tx.$executeRawUnsafe(`SELECT set_config('app.current_tenant', $1, true)`, tenantId);
+                return work(tx);
+            }, {
+                maxWait: parseInt(process.env.DATABASE_TX_MAX_WAIT ?? '15000'),
+                timeout: parseInt(process.env.DATABASE_TX_TIMEOUT ?? '90000'),
+            });
+        }
+        catch (e) {
+            if (attempt < 3 && isRetryable(e)) {
+                lastError = e;
+                // Exponential backoff: 200ms, 400ms, 800ms
+                await new Promise((r) => setTimeout(r, 200 * Math.pow(2, attempt)));
+                continue;
+            }
+            throw e;
+        }
+    }
+    throw lastError;
+}
+__exportStar(require("@prisma/client"), exports);

package/package.json

@@ -1,6 +1,31 @@
 {
   "name": "@taodigital/database",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.2.0",
+  "private": false,
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "files": [
+    "dist",
+    "prisma"
+  ],
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "prisma": {
+    "seed": "tsx prisma/seed.ts"
+  },
+  "scripts": {
+    "generate": "prisma generate",
+    "migrate": "prisma migrate dev",
+    "studio": "prisma studio",
+    "build": "prisma generate && tsc",
+    "test": "tsx --test src/**/*.test.ts"
+  },
+  "dependencies": {
+    "@prisma/client": "^5.18.0"
+  },
+  "devDependencies": {
+    "prisma": "^5.18.0"
+  }
+}

package/prisma/migrations/0000_init/migration.sql

@@ -0,0 +1,220 @@
+-- Initial schema for the Quality Intelligence Platform.
+-- Prisma generates cuid() ids in the client, so ids are TEXT primary keys.
+
+CREATE TABLE "Workspace" (
+  "id" TEXT NOT NULL,
+  "name" TEXT NOT NULL,
+  "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  CONSTRAINT "Workspace_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "Tenant" (
+  "id" TEXT NOT NULL,
+  "workspaceId" TEXT NOT NULL,
+  "name" TEXT NOT NULL,
+  "isolation" TEXT NOT NULL DEFAULT 'POOL',
+  "region" TEXT NOT NULL DEFAULT 'GLOBAL',
+  "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  CONSTRAINT "Tenant_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "User" (
+  "id" TEXT NOT NULL,
+  "workspaceId" TEXT NOT NULL,
+  "email" TEXT NOT NULL,
+  "name" TEXT,
+  "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  CONSTRAINT "User_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "Membership" (
+  "id" TEXT NOT NULL,
+  "userId" TEXT NOT NULL,
+  "tenantId" TEXT NOT NULL,
+  "role" TEXT NOT NULL,
+  CONSTRAINT "Membership_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "Project" (
+  "id" TEXT NOT NULL,
+  "tenantId" TEXT NOT NULL,
+  "name" TEXT NOT NULL,
+  "appUrl" TEXT,
+  "figmaUrl" TEXT,
+  "oversized" BOOLEAN NOT NULL DEFAULT false,
+  "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  CONSTRAINT "Project_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "Screen" (
+  "id" TEXT NOT NULL,
+  "tenantId" TEXT NOT NULL,
+  "projectId" TEXT NOT NULL,
+  "name" TEXT NOT NULL,
+  "url" TEXT,
+  "version" INTEGER NOT NULL DEFAULT 1,
+  "figmaMatch" INTEGER,
+  "a11yScore" INTEGER,
+  "lastSeenAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  CONSTRAINT "Screen_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "Element" (
+  "id" TEXT NOT NULL,
+  "tenantId" TEXT NOT NULL,
+  "projectId" TEXT NOT NULL,
+  "screenId" TEXT NOT NULL,
+  "meaning" TEXT NOT NULL,
+  "role" TEXT NOT NULL,
+  "expectedData" TEXT,
+  "notes" TEXT,
+  CONSTRAINT "Element_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "Flow" (
+  "id" TEXT NOT NULL,
+  "tenantId" TEXT NOT NULL,
+  "projectId" TEXT NOT NULL,
+  "name" TEXT NOT NULL,
+  "steps" JSONB NOT NULL,
+  CONSTRAINT "Flow_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "Screenshot" (
+  "id" TEXT NOT NULL,
+  "tenantId" TEXT NOT NULL,
+  "projectId" TEXT NOT NULL,
+  "screenId" TEXT NOT NULL,
+  "viewport" TEXT NOT NULL DEFAULT 'DESKTOP',
+  "storagePath" TEXT NOT NULL,
+  "version" INTEGER NOT NULL DEFAULT 1,
+  "capturedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  CONSTRAINT "Screenshot_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "SkillFile" (
+  "id" TEXT NOT NULL,
+  "tenantId" TEXT NOT NULL,
+  "projectId" TEXT NOT NULL,
+  "kind" TEXT NOT NULL,
+  "content" TEXT NOT NULL,
+  "version" INTEGER NOT NULL DEFAULT 1,
+  "approvedBy" TEXT,
+  "updatedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  CONSTRAINT "SkillFile_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "TestSuite" (
+  "id" TEXT NOT NULL,
+  "tenantId" TEXT NOT NULL,
+  "projectId" TEXT NOT NULL,
+  "name" TEXT NOT NULL,
+  "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  CONSTRAINT "TestSuite_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "TestCase" (
+  "id" TEXT NOT NULL,
+  "tenantId" TEXT NOT NULL,
+  "projectId" TEXT NOT NULL,
+  "suiteId" TEXT NOT NULL,
+  "title" TEXT NOT NULL,
+  "kind" TEXT NOT NULL,
+  "steps" JSONB NOT NULL,
+  "status" TEXT NOT NULL DEFAULT 'PENDING_REVIEW',
+  "groundedOn" JSONB NOT NULL,
+  CONSTRAINT "TestCase_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "TestData" (
+  "id" TEXT NOT NULL,
+  "tenantId" TEXT NOT NULL,
+  "projectId" TEXT NOT NULL,
+  "testCaseId" TEXT NOT NULL,
+  "kind" TEXT NOT NULL,
+  "payload" JSONB NOT NULL,
+  CONSTRAINT "TestData_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "TestScript" (
+  "id" TEXT NOT NULL,
+  "tenantId" TEXT NOT NULL,
+  "projectId" TEXT NOT NULL,
+  "testCaseId" TEXT NOT NULL,
+  "language" TEXT NOT NULL DEFAULT 'playwright-ts',
+  "code" TEXT NOT NULL,
+  CONSTRAINT "TestScript_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "Connector" (
+  "id" TEXT NOT NULL,
+  "tenantId" TEXT NOT NULL,
+  "projectId" TEXT NOT NULL,
+  "kind" TEXT NOT NULL,
+  "secretRef" TEXT NOT NULL,
+  "config" JSONB,
+  "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  CONSTRAINT "Connector_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "AuditLog" (
+  "id" TEXT NOT NULL,
+  "tenantId" TEXT NOT NULL,
+  "projectId" TEXT,
+  "actorId" TEXT,
+  "action" TEXT NOT NULL,
+  "detail" JSONB,
+  "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  CONSTRAINT "AuditLog_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "ChangeLog" (
+  "id" TEXT NOT NULL,
+  "tenantId" TEXT NOT NULL,
+  "projectId" TEXT NOT NULL,
+  "changeType" TEXT NOT NULL,
+  "summary" TEXT NOT NULL,
+  "detail" JSONB,
+  "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  CONSTRAINT "ChangeLog_pkey" PRIMARY KEY ("id")
+);
+
+CREATE UNIQUE INDEX "User_email_key" ON "User"("email");
+CREATE UNIQUE INDEX "Membership_userId_tenantId_key" ON "Membership"("userId", "tenantId");
+
+CREATE INDEX "Project_tenantId_idx" ON "Project"("tenantId");
+CREATE INDEX "Screen_tenantId_projectId_idx" ON "Screen"("tenantId", "projectId");
+CREATE INDEX "Element_tenantId_projectId_idx" ON "Element"("tenantId", "projectId");
+CREATE INDEX "Element_tenantId_screenId_idx" ON "Element"("tenantId", "screenId");
+CREATE INDEX "Flow_tenantId_projectId_idx" ON "Flow"("tenantId", "projectId");
+CREATE INDEX "Screenshot_tenantId_projectId_idx" ON "Screenshot"("tenantId", "projectId");
+CREATE INDEX "Screenshot_tenantId_screenId_idx" ON "Screenshot"("tenantId", "screenId");
+CREATE INDEX "SkillFile_tenantId_projectId_idx" ON "SkillFile"("tenantId", "projectId");
+CREATE INDEX "TestSuite_tenantId_projectId_idx" ON "TestSuite"("tenantId", "projectId");
+CREATE INDEX "TestCase_tenantId_projectId_idx" ON "TestCase"("tenantId", "projectId");
+CREATE INDEX "TestCase_tenantId_suiteId_idx" ON "TestCase"("tenantId", "suiteId");
+CREATE INDEX "TestData_tenantId_projectId_idx" ON "TestData"("tenantId", "projectId");
+CREATE INDEX "TestData_tenantId_testCaseId_idx" ON "TestData"("tenantId", "testCaseId");
+CREATE INDEX "TestScript_tenantId_projectId_idx" ON "TestScript"("tenantId", "projectId");
+CREATE INDEX "TestScript_tenantId_testCaseId_idx" ON "TestScript"("tenantId", "testCaseId");
+CREATE INDEX "Connector_tenantId_projectId_idx" ON "Connector"("tenantId", "projectId");
+CREATE INDEX "AuditLog_tenantId_createdAt_idx" ON "AuditLog"("tenantId", "createdAt");
+CREATE INDEX "ChangeLog_tenantId_projectId_idx" ON "ChangeLog"("tenantId", "projectId");
+
+ALTER TABLE "Tenant" ADD CONSTRAINT "Tenant_workspaceId_fkey" FOREIGN KEY ("workspaceId") REFERENCES "Workspace"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "User" ADD CONSTRAINT "User_workspaceId_fkey" FOREIGN KEY ("workspaceId") REFERENCES "Workspace"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "Membership" ADD CONSTRAINT "Membership_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "Membership" ADD CONSTRAINT "Membership_tenantId_fkey" FOREIGN KEY ("tenantId") REFERENCES "Tenant"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "Project" ADD CONSTRAINT "Project_tenantId_fkey" FOREIGN KEY ("tenantId") REFERENCES "Tenant"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "Screen" ADD CONSTRAINT "Screen_projectId_fkey" FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "Element" ADD CONSTRAINT "Element_screenId_fkey" FOREIGN KEY ("screenId") REFERENCES "Screen"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "Flow" ADD CONSTRAINT "Flow_projectId_fkey" FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "Screenshot" ADD CONSTRAINT "Screenshot_screenId_fkey" FOREIGN KEY ("screenId") REFERENCES "Screen"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "SkillFile" ADD CONSTRAINT "SkillFile_projectId_fkey" FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "TestSuite" ADD CONSTRAINT "TestSuite_projectId_fkey" FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "TestCase" ADD CONSTRAINT "TestCase_suiteId_fkey" FOREIGN KEY ("suiteId") REFERENCES "TestSuite"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "TestData" ADD CONSTRAINT "TestData_testCaseId_fkey" FOREIGN KEY ("testCaseId") REFERENCES "TestCase"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "TestScript" ADD CONSTRAINT "TestScript_testCaseId_fkey" FOREIGN KEY ("testCaseId") REFERENCES "TestCase"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "Connector" ADD CONSTRAINT "Connector_projectId_fkey" FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "AuditLog" ADD CONSTRAINT "AuditLog_projectId_fkey" FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+ALTER TABLE "ChangeLog" ADD CONSTRAINT "ChangeLog_projectId_fkey" FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE RESTRICT ON UPDATE CASCADE;

package/prisma/migrations/0001_tenant_isolation/migration.sql

@@ -0,0 +1,43 @@
+-- ============================================================================
+--  TENANT ISOLATION AT THE DATABASE LAYER (Row-Level Security)
+--
+--  This is the "sacred" rule from the Project Constitution. Even if app code
+--  has a bug, the database itself refuses to return another tenant's rows.
+--
+--  How it works:
+--   1. Every tenant-scoped table gets RLS enabled.
+--   2. A policy says: a row is only visible if its "tenantId" matches the
+--      current request's tenant, set via  SET app.current_tenant = '<id>'.
+--   3. The API sets app.current_tenant at the start of every request
+--      (see packages/database/src/index.ts -> withTenant()).
+--
+--  Run this after the Prisma migration that creates the tables.
+-- ============================================================================
+
+DO $$
+DECLARE
+  t text;
+  tenant_tables text[] := ARRAY[
+    'Tenant','Membership','Project','Screen','Element','Flow','Screenshot','SkillFile',
+    'TestSuite','TestCase','TestData','TestScript','Connector',
+    'AuditLog','ChangeLog'
+  ];
+BEGIN
+  FOREACH t IN ARRAY tenant_tables LOOP
+    EXECUTE format('ALTER TABLE "%s" ENABLE ROW LEVEL SECURITY;', t);
+    EXECUTE format('ALTER TABLE "%s" FORCE ROW LEVEL SECURITY;', t);
+    IF t = 'Tenant' THEN
+      EXECUTE format($f$
+        CREATE POLICY tenant_isolation ON "%s"
+        USING ("id" = current_setting('app.current_tenant', true))
+        WITH CHECK ("id" = current_setting('app.current_tenant', true));
+      $f$, t);
+    ELSE
+      EXECUTE format($f$
+        CREATE POLICY tenant_isolation ON "%s"
+        USING ("tenantId" = current_setting('app.current_tenant', true))
+        WITH CHECK ("tenantId" = current_setting('app.current_tenant', true));
+      $f$, t);
+    END IF;
+  END LOOP;
+END $$;

package/prisma/migrations/0002_app_runtime_role/migration.sql

@@ -0,0 +1,14 @@
+-- Runtime role used by the application and tests.
+-- The migration/admin role may be a superuser; the app role must not be,
+-- otherwise Postgres Row-Level Security can be bypassed.
+
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'qip_app') THEN
+    CREATE ROLE qip_app LOGIN PASSWORD 'qip_app_password' NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT;
+  END IF;
+END $$;
+
+GRANT USAGE ON SCHEMA public TO qip_app;
+GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO qip_app;
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO qip_app;

package/prisma/migrations/0003_skill_taxonomy/migration.sql

@@ -0,0 +1,30 @@
+-- Migration: 0003_skill_taxonomy
+-- Extends SkillFile with Application Intelligence taxonomy fields.
+-- New columns support the 6-level knowledge taxonomy (PLATFORM/FUNCTION/DESIGN/THEME/COMPONENT/ELEMENT)
+-- and graduated retrieval (global vs selective vs vector-search).
+
+-- Add scope column (PROJECT | WORKSPACE)
+ALTER TABLE "SkillFile" ADD COLUMN IF NOT EXISTS "scope" TEXT NOT NULL DEFAULT 'PROJECT';
+
+-- Add summary: short description for UI display and keyword search
+ALTER TABLE "SkillFile" ADD COLUMN IF NOT EXISTS "summary" TEXT;
+
+-- Add tags: JSON array of searchable labels e.g. ["login-form", "email-validation"]
+ALTER TABLE "SkillFile" ADD COLUMN IF NOT EXISTS "tags" JSONB NOT NULL DEFAULT '[]';
+
+-- Add screenIds: JSON array of screen IDs this COMPONENT/ELEMENT file covers ([] = all)
+ALTER TABLE "SkillFile" ADD COLUMN IF NOT EXISTS "screenIds" JSONB NOT NULL DEFAULT '[]';
+
+-- Add source: AUTO | MANUAL | SEEDED
+ALTER TABLE "SkillFile" ADD COLUMN IF NOT EXISTS "source" TEXT NOT NULL DEFAULT 'AUTO';
+
+-- Unique constraint: one skill file per (project, kind, scope) — upsert key
+ALTER TABLE "SkillFile" DROP CONSTRAINT IF EXISTS "SkillFile_projectId_kind_scope_key";
+ALTER TABLE "SkillFile" ADD CONSTRAINT "SkillFile_projectId_kind_scope_key"
+  UNIQUE ("projectId", "kind", "scope");
+
+-- Index for kind-based retrieval (global tier lookup)
+CREATE INDEX IF NOT EXISTS "SkillFile_tenantId_kind_idx" ON "SkillFile" ("tenantId", "kind");
+
+-- RLS: SkillFile already covered by the tenant isolation policy on all tables.
+-- No additional policy needed — existing "SkillFile_tenantId" rows remain valid.