@teamscala/service-boot 0.23.430 → 0.23.432

package/src/fn-routers/agreement-send-router.ts

@@ -32,6 +32,7 @@ import {
 import { sendResendEmail } from "./resend-client.ts";
 import { applyTemplateVars, lookupTemplate } from "@teamscala/email/templates/lookup";
 import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
+import type { PrismaClient } from "@teamscala/db/client";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { signAgreementAccessToken } from "@teamscala/document-signing/agreement-access-token";
 import { resetRlsContext, setRlsContext } from "@teamscala/db/rls-context";
@@ -49,8 +50,8 @@ interface User {
 interface Context {
 	user: User | null | undefined;
 	headers: Headers;
-	resolveUser?: (headers: Headers, prisma: any) => Promise<User | null>;
-	prisma: any;
+	resolveUser?: (headers: Headers, prisma: PrismaClient) => Promise<User | null>;
+	prisma: PrismaClient;
 }
 
 const authed = os.$context<Context>().use(async (opt) => {
@@ -120,7 +121,7 @@ function bareAddress(sender: string): string {
  * platform's verified Resend address; reply_to is the org's contact email.
  */
 async function resolveSender(
-	prisma: any,
+	prisma: PrismaClient,
 	organisationId: string,
 ): Promise<{ from: string; replyTo?: string; orgName: string }> {
 	const templates = await loadRegistryConfig(
@@ -180,7 +181,7 @@ export const agreementSendRouter = {
 };
 
 async function runSend(
-	prisma: any,
+	prisma: PrismaClient,
 	agreementId: string,
 	baseUrl: string,
 	log: ReturnType<typeof getAppLogger>,

package/src/fn-routers/agreement-sign-side-effects.ts

@@ -11,8 +11,33 @@
  * byte-for-byte move; import paths adjusted only.
  */
 
+/**
+ * Self-resetting demo harness. If the signed agreement's `proposal_id` is in
+ * the `demo-reset-agreements.proposalIds` allow-list, reset its parties to
+ * UNSIGNED (signedAt/signature cleared) + clear signed_at/signed_by + status
+ * 'sent', so the next person gets a fresh form to test the UI.
+ *
+ * Keyed on the stable PROPOSAL id, NOT the agreement id: the demo agreement is
+ * regenerated under a fresh id whenever the demo proposal is re-accepted, but
+ * its `proposal_id` FK is constant — so the allow-list cannot dangle. This
+ * deletes the drift class (prevention, not a patrol): the prior design keyed on
+ * `agreementIds`, and when the demo was regenerated the list silently pointed
+ * at a dead id and the reset became a no-op for weeks. A `proposal_id`-
+ * referenced row that doesn't exist is a real proposal being deleted, not a
+ * regeneration — a negligible residual the operator would notice directly.
+ *
+ * Gated strictly by the allow-list — a real agreement is never reset.
+ * Best-effort: any failure is swallowed (a demo-reset must never fail the
+ * signer's own response). The current signer already has their response (incl.
+ * payUrl) before this runs; only the stored record is reset.
+ */
+
+// Why: Self-resetting demo harness. If the signed agreement's `prop…
+// (full note hoisted to this file's leading header — kept out of the body per
+// no-inline-prose-blocks / prose-stays-in-docs)
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { queryRows } from "@teamscala/db/query-rows";
+import type { PrismaClient } from "@teamscala/db/client";
 import type { AgreementParty } from "@teamscala/document-signing/agreement-parties";
 
 /** On full agreement completion, delegate to the payment service over HTTP to
@@ -63,28 +88,8 @@ export async function invoicePayUrl(
 	}
 }
 
-/**
- * Self-resetting demo harness. If the signed agreement's `proposal_id` is in
- * the `demo-reset-agreements.proposalIds` allow-list, reset its parties to
- * UNSIGNED (signedAt/signature cleared) + clear signed_at/signed_by + status
- * 'sent', so the next person gets a fresh form to test the UI.
- *
- * Keyed on the stable PROPOSAL id, NOT the agreement id: the demo agreement is
- * regenerated under a fresh id whenever the demo proposal is re-accepted, but
- * its `proposal_id` FK is constant — so the allow-list cannot dangle. This
- * deletes the drift class (prevention, not a patrol): the prior design keyed on
- * `agreementIds`, and when the demo was regenerated the list silently pointed
- * at a dead id and the reset became a no-op for weeks. A `proposal_id`-
- * referenced row that doesn't exist is a real proposal being deleted, not a
- * regeneration — a negligible residual the operator would notice directly.
- *
- * Gated strictly by the allow-list — a real agreement is never reset.
- * Best-effort: any failure is swallowed (a demo-reset must never fail the
- * signer's own response). The current signer already has their response (incl.
- * payUrl) before this runs; only the stored record is reset.
- */
 export async function maybeResetDemoAgreement(
-	prisma: any,
+	prisma: PrismaClient,
 	agreementId: string,
 	proposalId: string | null,
 	parties: AgreementParty[],
@@ -129,7 +134,7 @@ export async function maybeResetDemoAgreement(
  * legal act; CRM connection is bookkeeping).
  */
 export async function connectSignerToCrm(
-	prisma: any,
+	prisma: PrismaClient,
 	agreement: { id: string; organisation_id?: string | null; contact_id?: string | null },
 	email: string,
 	signerName?: string | null,

package/src/fn-routers/assessment-report-email.ts

@@ -19,6 +19,7 @@ import { applyTemplateVars, lookupTemplate } from "@teamscala/email/templates/lo
 import { resolveEmailSender } from "@teamscala/email/identity/resolve-email-sender";
 import { decryptSecretConfig } from "@teamscala/encryption/crypto/secret-config";
 import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
+import type { PrismaClient } from "@teamscala/db/client";
 import { fetchOrgBrand } from "@teamscala/resolver-engine/data-resolvers/fetch-org-brand";
 import type { StageBand } from "./assessment-report-data.ts";
 import {
@@ -36,7 +37,7 @@ export async function sendAuthorityReportEmail(opts: {
 	categoryScores: Record<string, number>;
 	ctaUrl?: string;
 	organisationId?: string | null;
-	prisma: any;
+	prisma: PrismaClient;
 	/**
 	 * Absolute origin (e.g. "https://quiz.scala.business") of the service that
 	 * received the submit — the origin that serves /api/assets. Mail clients
@@ -63,7 +64,7 @@ export async function sendAuthorityReportEmail(opts: {
 	const brandRow =
 		opts.organisationId && opts.prisma
 			? await fetchOrgBrand(
-					opts.prisma as Parameters<typeof fetchOrgBrand>[0],
+					opts.prisma as unknown as Parameters<typeof fetchOrgBrand>[0],
 					opts.organisationId,
 				).catch(() => null)
 			: null;

package/src/fn-routers/auth-router.ts

@@ -10,6 +10,8 @@
 
 import { os } from "@orpc/server";
 import { createCache } from "@teamscala/cache/create-cache";
+import type { PrismaClient } from "@teamscala/db/client";
+import { queryRows } from "@teamscala/db/query-rows";
 import { resetRlsContext, setRlsContext } from "@teamscala/db/rls-context";
 
 interface User {
@@ -22,8 +24,8 @@ interface User {
 interface Context {
 	user: User | null | undefined;
 	headers: Headers;
-	resolveUser?: (headers: Headers, prisma: any) => Promise<User | null>;
-	prisma: any;
+	resolveUser?: (headers: Headers, prisma: PrismaClient) => Promise<User | null>;
+	prisma: PrismaClient;
 	orgId?: string | null;
 }
 
@@ -64,22 +66,23 @@ const adminCache = createCache<boolean>("service-boot:org-admin", {
 async function isOrgAdminCached(
 	userId: string,
 	organisationId: string,
-	prisma: any,
 ): Promise<boolean> {
 	const cacheKey = `${userId}:${organisationId}`;
 	const cached = adminCache.get(cacheKey);
 	if (cached !== undefined) return cached;
 
 	try {
-		const membership = await prisma.user_organisation_memberships.findFirst({
-			where: {
-				user_id: userId,
-				organisation_id: organisationId,
-				role: { in: ["admin", "owner"] },
-			},
-			select: { id: true },
-		});
-		const result = !!membership;
+		// Raw SQL, not the model API: user_organisation_memberships lives in host
+		// schemas (not the shared client), so a typed model access would only
+		// compile on the hosts that declare it. queryRows is the sanctioned read
+		// surface and is host-portable by table name.
+		const membership = await queryRows<{ id: string }>`
+			SELECT id FROM user_organisation_memberships
+			WHERE user_id = ${userId}
+			  AND organisation_id = ${organisationId}
+			  AND role IN ('admin', 'owner')
+			LIMIT 1`;
+		const result = membership.length > 0;
 		adminCache.set(cacheKey, result);
 		return result;
 	} catch {
@@ -91,7 +94,7 @@ export const authRouter = {
 	isOrgAdmin: authed.handler(async ({ input, context }) => {
 		const data = input as { userId: string; organisationId: string };
 		if (!data.userId || !data.organisationId) return false;
-		return isOrgAdminCached(data.userId, data.organisationId, context.prisma);
+		return isOrgAdminCached(data.userId, data.organisationId);
 	}),
 	resolveAdminOverride: authed.handler(async ({ input, context }) => {
 		const data = input as {
@@ -100,24 +103,20 @@ export const authRouter = {
 		};
 		const targetUserId = data.targetUserId as string | undefined;
 		if (!targetUserId) return null;
-		if (targetUserId === (context.user as any)?.id) return null;
+		if (targetUserId === context.user?.id) return null;
 		if (!data.adminOverride) {
 			throw new Error(
 				`This tool does not support admin override. Remove targetUserId from the request.`,
 			);
 		}
-		const userId = (context.user as any)?.id;
-		const organisationId = (context as any).orgId;
+		const userId = context.user?.id;
+		const organisationId = context.orgId;
 		if (!userId || !organisationId) {
 			throw new Error(
 				`Admin override requires both user and organisation context.`,
 			);
 		}
-		const admin = await isOrgAdminCached(
-			userId,
-			organisationId,
-			context.prisma,
-		);
+		const admin = await isOrgAdminCached(userId, organisationId);
 		if (!admin) {
 			throw new Error(
 				`Access denied: you must be an org admin or owner to view another user's data.`,

package/src/fn-routers/chat-session-router-shared.ts

@@ -91,10 +91,19 @@ export async function throwForbidden(message: string): Promise<never> {
 }
 
 /** Map stored message rows to the wire shape the chat client restores. */
-export function mapMessages(msgs: unknown[]) {
+export function mapMessages(
+	msgs: Array<{
+		id: string;
+		role: string | null;
+		content: string | null;
+		channel_data: unknown;
+		created_at: Date | null;
+		occurred_at: Date | null;
+	}>,
+) {
 	return msgs
-		.filter((m: any) => m.role === "user" || m.role === "assistant")
-		.map((m: any) => ({
+		.filter((m) => m.role === "user" || m.role === "assistant")
+		.map((m) => ({
 			// Restore the stable row id so the client re-seeds useChat with the
 			// SAME ids it persisted — a later re-save then upserts instead of
 			// duplicating (chat-message-ids-server-stable).

package/src/fn-routers/chat-session-router.ts

@@ -91,8 +91,8 @@ export const chatSessionRouter = {
 					orderBy: { created_at: "desc" },
 				});
 
-				let existing: any =
-					candidates.find((c: any) => c.status === "active") ?? null;
+				let existing =
+					candidates.find((c) => c.status === "active") ?? null;
 				// A returning user whose only thread is archived → reactivate the
 					// most-recent one so their history continues (matches the GPT
 					// "session gone" fix).
@@ -244,7 +244,9 @@ export const chatSessionRouter = {
 			data: { status: "archived" },
 		});
 
-		const cd = (old.channel_data ?? {}) as Record<string, unknown>;
+		const cd = (old.channel_data ?? {}) as {
+			assistant_type?: string;
+		};
 		const conversation = await prisma.conversations.create({
 			data: {
 				channel: "ai",
@@ -303,7 +305,7 @@ export const chatSessionRouter = {
 
 		// One grouped fetch for the latest user message per thread (preview),
 		// mapped in JS — avoids an N+1.
-		const ids = conversations.map((c: any) => c.id);
+		const ids = conversations.map((c) => c.id);
 		const lastMsgs = await prisma.messages.findMany({
 			where: { conversation_id: { in: ids }, role: "user" },
 			orderBy: { occurred_at: "desc" },
@@ -311,7 +313,7 @@ export const chatSessionRouter = {
 		});
 		const previewById = new Map<string, string>();
 		for (const m of lastMsgs) {
-			if (!previewById.has(m.conversation_id)) {
+			if (m.conversation_id && !previewById.has(m.conversation_id)) {
 				previewById.set(
 					m.conversation_id,
 					(m.content ?? "").slice(0, 120),
@@ -320,7 +322,7 @@ export const chatSessionRouter = {
 		}
 
 		return {
-			conversations: conversations.map((c: any) => ({
+			conversations: conversations.map((c) => ({
 				id: c.id,
 				title: c.title,
 				status: c.status,

package/src/fn-routers/conversation-ownership.ts

@@ -9,9 +9,10 @@
 
 import { throwForbidden, type SessionUser } from "./chat-session-router-shared.ts";
 
-/* eslint-disable @typescript-eslint/no-explicit-any */
+import type { PrismaClient } from "@teamscala/db/client";
+
 export async function assertOwns(
-	prisma: any,
+	prisma: PrismaClient,
 	conversationId: string,
 	user: SessionUser,
 ): Promise<unknown> {

package/src/fn-routers/messaging-whatsapp-router.test.ts

@@ -67,7 +67,9 @@ const client = createRouterClient(
 		context: {
 			user: { id: "system", organisationId: null },
 			headers: new Headers(),
-			prisma: {},
+			// The authed base now sets the RLS/audit context per request; the
+			// mock only needs to accept the SET statements.
+			prisma: { $executeRawUnsafe: async () => [] },
 		} as never,
 	},
 ) as { messagingWhatsappSend: (a: unknown) => Promise<unknown> };

package/src/fn-routers/messaging-whatsapp-router.ts

@@ -34,6 +34,8 @@ import {
 	type SecretConfigLike,
 } from "@teamscala/encryption/crypto/secret-config";
 import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
+import type { PrismaClient } from "@teamscala/db/client";
+import { resetRlsContext, setRlsContext } from "@teamscala/db/rls-context";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 
 interface User {
@@ -44,8 +46,8 @@ interface User {
 interface Context {
 	user: User | null | undefined;
 	headers: Headers;
-	resolveUser?: (headers: Headers, prisma: any) => Promise<User | null>;
-	prisma: any;
+	resolveUser?: (headers: Headers, prisma: PrismaClient) => Promise<User | null>;
+	prisma: PrismaClient;
 }
 
 const authed = os.$context<Context>().use(async (opt) => {
@@ -58,7 +60,19 @@ const authed = os.$context<Context>().use(async (opt) => {
 		const { ORPCError } = await import("@orpc/server");
 		throw new ORPCError("UNAUTHORIZED", { message: "Authentication required" });
 	}
-	return await opt.next({ context: { ...context, user } });
+	// Audit attribution: writes through this base must record the actor in
+	// audit_trail (app.current_user_name), not an empty actor (the 'by .' bug).
+	const u = user as { id: string; name?: string | null; organisationId: string | null };
+	await setRlsContext(context.prisma, {
+		userId: u.id,
+		userName: u.name || u.id,
+		organisationId: u.organisationId,
+	});
+	try {
+		return await opt.next({ context: { ...context, user } });
+	} finally {
+		await resetRlsContext(context.prisma);
+	}
 });
 
 /**

package/src/fn-routers/persist-chat-messages.ts

@@ -18,6 +18,8 @@
  * with a 1ms step preserving array order so same-second saves restore in order.
  */
 
+import type { Prisma, PrismaClient } from "@teamscala/db/client";
+
 export interface ChatMessageInput {
 	id?: string;
 	role: string;
@@ -32,7 +34,7 @@ export interface ChatMessageInput {
 }
 
 export async function persistChatMessages(
-	prisma: any,
+	prisma: PrismaClient,
 	opts: {
 		conversationId: string;
 		organisationId: string | null;
@@ -69,9 +71,9 @@ export async function persistChatMessages(
 					direction,
 					content: msg.content,
 					occurred_at,
-					channel_data: channelData,
+					channel_data: channelData as Prisma.InputJsonValue,
 				},
-				update: { content: msg.content, channel_data: channelData },
+				update: { content: msg.content, channel_data: channelData as Prisma.InputJsonValue },
 			});
 		} else {
 			await prisma.messages.create({
@@ -83,7 +85,7 @@ export async function persistChatMessages(
 					direction,
 					content: msg.content,
 					occurred_at,
-					channel_data: channelData,
+					channel_data: channelData as Prisma.InputJsonValue,
 				},
 			});
 		}

package/src/fn-routers/proposal-send-router.ts

@@ -18,6 +18,7 @@ import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { signAccessToken } from "../content-gate/token.ts";
 import { resetRlsContext, setRlsContext } from "@teamscala/db/rls-context";
+import type { PrismaClient } from "@teamscala/db/client";
 import { getDefaultEmailSender } from "./email-defaults.ts";
 import { getEmailLinkTtlMs } from "./email-link-ttl.ts";
 
@@ -33,9 +34,9 @@ interface Context {
 	user: User | null | undefined;
 	headers: Headers;
 	// matches agreement-send-router Context
-	resolveUser?: (headers: Headers, prisma: any) => Promise<User | null>;
+	resolveUser?: (headers: Headers, prisma: PrismaClient) => Promise<User | null>;
 	// prisma client type is service-injected
-	prisma: any;
+	prisma: PrismaClient;
 }
 
 const authed = os.$context<Context>().use(async (opt) => {
@@ -70,7 +71,7 @@ function bareAddress(sender: string): string {
 
 async function resolveSender(
 	// prisma client type is service-injected
-	prisma: any,
+	prisma: PrismaClient,
 	organisationId: string,
 ): Promise<{ from: string; replyTo?: string; orgName: string }> {
 	const templates = await loadRegistryConfig(

package/src/fn-routers/public-agreement-router.ts

@@ -25,6 +25,7 @@ import { os } from "@orpc/server";
 import * as v from "valibot";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { queryRows } from "@teamscala/db/query-rows";
+import type { PrismaClient } from "@teamscala/db/client";
 import { signAgreementAccessToken } from "@teamscala/document-signing/agreement-access-token";
 import {
 	parseAgreementParties as parseParties,
@@ -47,9 +48,9 @@ export { buildCertificateData } from "./agreement-certificate.ts";
 export type { CertificateData, CertificateCopy } from "./agreement-certificate.ts";
 
 interface Context {
-	prisma: any;
+	prisma: PrismaClient;
 	headers: Headers;
-	resolveUser?: (headers: Headers, prisma: any) => Promise<unknown>;
+	resolveUser?: (headers: Headers, prisma: PrismaClient) => Promise<unknown>;
 }
 
 const pub = os.$context<Context>();
@@ -357,7 +358,7 @@ export const publicAgreementRouter = {
 					signed_at: Date | null;
 					signature_data: unknown;
 					page_id: string | null;
-				}[]
+				}
 			>`
 				SELECT id, name, signed_at, signature_data, page_id
 				  FROM agreements
@@ -370,7 +371,7 @@ export const publicAgreementRouter = {
 				!!agreement.signed_at || (parties?.every((p) => p.signedAt) ?? false);
 			let recomputedHash: string | null = null;
 			if (evidence?.documentHash && parties && agreement.page_id) {
-				const [doc] = await queryRows<{ puck_data: unknown }[]>`
+				const [doc] = await queryRows<{ puck_data: unknown }>`
 					SELECT puck_data FROM builda_pages WHERE id = ${agreement.page_id} LIMIT 1`;
 				recomputedHash = computeDocumentHash(doc?.puck_data ?? null, parties);
 			}

package/src/fn-routers/public-assessment-router.ts

@@ -25,11 +25,12 @@ import {
 } from "./assessment-report-data.ts";
 import { sendAuthorityReportEmail } from "./assessment-report-email.ts";
 import { scoreAnswers, toBandSlug, type StoredQuestion } from "./assessment-scoring.ts";
+import type { PrismaClient } from "@teamscala/db/client";
 
 interface Context {
-	prisma: any;
+	prisma: PrismaClient;
 	headers: Headers;
-	resolveUser?: (headers: Headers, prisma: any) => Promise<unknown>;
+	resolveUser?: (headers: Headers, prisma: PrismaClient) => Promise<unknown>;
 }
 
 const pub = os.$context<Context>();
@@ -76,9 +77,9 @@ export const publicAssessmentRouter = {
 			});
 			if (!assessment) return { error: "Assessment not found" } as const;
 
-			const questions = (Array.isArray(assessment.questions)
+			const questions = ((Array.isArray(assessment.questions)
 				? assessment.questions
-				: []) as StoredQuestion[];
+				: []) as unknown) as StoredQuestion[];
 			const { totalScore, categoryScores } = scoreAnswers(
 				questions,
 				input.answers,

package/src/fn-routers/public-gpt-session-router.ts

@@ -9,15 +9,16 @@
 
 import { os } from "@orpc/server";
 import * as v from "valibot";
+import type { PrismaClient } from "@teamscala/db/client";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { queryRows } from "@teamscala/db/query-rows";
 import { getClient } from "@teamscala/object-storage/create/client/get-client";
 import { persistChatMessages } from "./persist-chat-messages.ts";
 
 interface Context {
-	prisma: any;
+	prisma: PrismaClient;
 	headers: Headers;
-	resolveUser?: (headers: Headers, prisma: any) => Promise<unknown>;
+	resolveUser?: (headers: Headers, prisma: PrismaClient) => Promise<unknown>;
 }
 
 const pub = os.$context<Context>();
@@ -128,10 +129,8 @@ const uploadSchema = v.object({
 		const contactName = contact.full_name ?? data.contactName;
 		const contactPhone = contact.mobile_phone ?? undefined;
 
-		// Restore the visitor's existing conversation on re-login by EMAIL —
-		// regardless of status. Previously this filtered status:'active', so any
-		// thread that had been archived (e.g. by a prior Clear) was invisible and
-		// the visitor got a brand-new empty conversation every time ("session
+		// Restore the visitor's existing conversation on re-login by EMAIL — regardless of status. Previously this filtered status:'active', so any
+		// thread that had been archived (e.g. by a prior Clear) was invisible and the visitor got a brand-new empty conversation every time ("session
 		// gone"). Restore the thread whose MOST RECENT MESSAGE is newest, found
 		// via the messages themselves (last_message_at is unreliable on older
 		// threads), reactivating it if archived. Only fall back to an active
@@ -163,10 +162,10 @@ const uploadSchema = v.object({
 		// there is NO active thread do we reactivate the most-recent archived one (a
 		// returning visitor whose thread was archived — preserving the earlier
 		// "session gone" fix), and finally fall through to creating a new thread.
-		const byCreatedDesc = (a: any, b: any) =>
+		const byCreatedDesc = (a: (typeof candidates)[number], b: (typeof candidates)[number]) =>
 			new Date(b.created_at).getTime() - new Date(a.created_at).getTime();
 		let existing: (typeof candidates)[number] | null =
-			candidates.filter((c: any) => c.status === "active").sort(byCreatedDesc)[0] ?? null;
+			candidates.filter((c) => c.status === "active").sort(byCreatedDesc)[0] ?? null;
 		if (!existing && candidates.length > 0) {
 			existing = [...candidates].sort(byCreatedDesc)[0] ?? null;
 			if (existing) {
@@ -193,8 +192,8 @@ const uploadSchema = v.object({
 				// filter it out so already-poisoned conversations restore cleanly.
 				// Tool output is preserved inside the assistant message's parts[].
 				messages: msgs
-					.filter((m: any) => m.role === "user" || m.role === "assistant")
-					.map((m: any) => ({ id: m.id, role: m.role, content: m.content, parts: (m.channel_data as { parts?: unknown[] } | null)?.parts, metadata: (m.channel_data as { metadata?: Record<string, unknown> } | null)?.metadata, created_at: m.created_at })),
+					.filter((m: { role: string | null }) => m.role === "user" || m.role === "assistant")
+					.map((m: { id: string; role: string | null; content: string | null; channel_data: unknown; created_at: Date }) => ({ id: m.id, role: m.role, content: m.content, parts: (m.channel_data as { parts?: unknown[] } | null)?.parts, metadata: (m.channel_data as { metadata?: Record<string, unknown> } | null)?.metadata, created_at: m.created_at })),
 				tokenTotals: {
 					inputTokens: (channelData?.total_input_tokens as number) ?? 0,
 					outputTokens: (channelData?.total_output_tokens as number) ?? 0,
@@ -254,7 +253,7 @@ const uploadSchema = v.object({
 			conversationId: conversation.id,
 			contactName: (channelData?.contact_name as string) ?? "",
 			contactEmail: (channelData?.contact_email as string) ?? "",
-			messages: msgs.map((m: any) => ({ id: m.id, role: m.role, content: m.content, parts: (m.channel_data as { parts?: unknown[] } | null)?.parts, metadata: (m.channel_data as { metadata?: Record<string, unknown> } | null)?.metadata, created_at: m.created_at })),
+			messages: msgs.map((m: { id: string; role: string | null; content: string | null; channel_data: unknown; created_at: Date }) => ({ id: m.id, role: m.role, content: m.content, parts: (m.channel_data as { parts?: unknown[] } | null)?.parts, metadata: (m.channel_data as { metadata?: Record<string, unknown> } | null)?.metadata, created_at: m.created_at })),
 			tokenTotals: {
 				inputTokens: (channelData?.total_input_tokens as number) ?? 0,
 				outputTokens: (channelData?.total_output_tokens as number) ?? 0,
@@ -313,7 +312,13 @@ const uploadSchema = v.object({
 		}
 
 		// Carry the old thread's identity into the fresh one.
-		const cd = (old.channel_data ?? {}) as Record<string, unknown>;
+		const cd = (old.channel_data ?? {}) as {
+			assistant_type?: string;
+			contact_name?: string | null;
+			contact_email?: string | null;
+			contact_phone?: string | null;
+			source_url?: string | null;
+		};
 		const conversation = await prisma.conversations.create({
 			data: {
 				channel: "ai",

package/src/fn-routers/user-preferences-router.ts

@@ -24,19 +24,11 @@
  * org is part of the compound key (per-org isolation) but is client-supplied
  * (the session carries the user, not the active org).
  *
- * DECISION — host-scoping of `user_preferences`: the table is NOT yet a shared
- * `@teamscala/db` model (it lives in scala-projects's schema today), so this proc
- * is genuinely host-scoped: it runs correctly on services whose Prisma client
- * declares `user_preferences` (scala-projects is the first host) + is inert
- * elsewhere. `Context.prisma` is `any`-typed, so the proc COMPILES workspace-
- * wide (no type error on a model a host may not declare) — the `any` is the
- * deliberate seam that lets one generic proc serve hosts incrementally as they
- * adopt the table. Per-user preferences are platform-universal, so the tracked
- * follow-on is to promote `user_preferences` to a shared `@teamscala/db` model
- * (open-migration: `user_preferences→shared-model`, exit: every kind:ui host
- * can mount this proc with no schema precondition) — at which point the proc is
- * universally hostable + the `any` seam can tighten to the shared client. Until
- * then the proc is opt-in per host (declare the table → get the capability).
+ * DECISION — host-scoping of `user_preferences` is RETIRED: the table is a
+ * shared `@teamscala/db` model now, so `Context.prisma` is the typed shared
+ * PrismaClient and the proc is universally hostable — every host's generated
+ * client declares the table. (Previously `Context.prisma` was `any`-typed as a
+ * deliberate seam while only scala-projects declared the table.)
  */
 
 import * as v from "valibot";
@@ -68,7 +60,6 @@ const getSchema = v.object({
  * never block a write (matches the generated create/update notify guard).
  */
 async function notifyDataChange(
-	prisma: any,
 	organisationId: string,
 	op: string,
 ): Promise<void> {
@@ -109,7 +100,7 @@ export const userPreferencesRouter = {
 				},
 				update: { value },
 			});
-			await notifyDataChange(prisma, organisationId, "upsert");
+			await notifyDataChange(organisationId, "upsert");
 			return { success: true };
 		} catch (err) {
 			log.error(