@trycompai/db 2.1.0 → 2.1.2

package/dist/schema.prisma

@@ -38,6 +38,7 @@ enum AttachmentEntityType {
   comment
   trust_nda
   task_item
+  background_check
 }
 
 enum AttachmentType {
@@ -169,6 +170,7 @@ model Member {
   jobTitle                        String?
   isActive                        Boolean                           @default(true)
   deactivated                     Boolean                           @default(false)
+  backgroundCheckExempt           Boolean                           @default(false)
   externalUserId                  String?
   externalUserSource              String?
   employeeTrainingVideoCompletion EmployeeTrainingVideoCompletion[]
@@ -194,6 +196,7 @@ model Member {
   performedFrameworkSyncOperations FrameworkSyncOperation[] @relation("FrameworkSyncOperationPerformer")
   approvedTasks                    Task[]                   @relation("TaskApprover")
   devices                          Device[]
+  backgroundCheckRequests          BackgroundCheckRequest[]
 }
 
 model Invitation {
@@ -343,6 +346,71 @@ model EvidenceAutomation {
   @@index([taskId])
 }
 
+// ===== background-check.prisma =====
+model BackgroundCheckRequest {
+  id                        String                @id @default(dbgenerated("generate_prefixed_cuid('bcr'::text)"))
+  organizationId            String
+  memberId                  String
+  employeeEmail             String
+  employeeName              String
+  requesterNotes            String?
+  identityBackgroundCheckId String?               @unique
+  candidateUrl              String?
+  status                    BackgroundCheckStatus @default(invited)
+  identityStatus            String?
+  employmentStatus          String?
+  referenceStatus           String?
+  rightToWorkStatus         String?
+  adjudicationStatus        String?
+  stripePaymentIntentId     String?
+  stripePaymentStatus       String?
+  stripeRefundId            String?
+  stripeAmountCents         Int?
+  stripeCurrency            String?
+  lastWebhookEventId        String?
+  lastSyncedAt              DateTime?
+  reportSnapshot            Json?
+  reportSyncedAt            DateTime?
+  createdAt                 DateTime              @default(now())
+  updatedAt                 DateTime              @updatedAt
+
+  organization  Organization                  @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  member        Member                        @relation(fields: [memberId], references: [id], onDelete: Cascade)
+  webhookEvents BackgroundCheckWebhookEvent[]
+
+  @@unique([organizationId, memberId])
+  @@index([organizationId])
+  @@index([memberId])
+  @@index([status])
+  @@map("background_check_requests")
+}
+
+model BackgroundCheckWebhookEvent {
+  id                        String   @id @default(dbgenerated("generate_prefixed_cuid('bcw'::text)"))
+  eventId                   String   @unique
+  eventType                 String
+  backgroundCheckRequestId  String?
+  identityBackgroundCheckId String?
+  payload                   Json
+  processedAt               DateTime @default(now())
+
+  backgroundCheckRequest BackgroundCheckRequest? @relation(fields: [backgroundCheckRequestId], references: [id], onDelete: SetNull)
+
+  @@index([backgroundCheckRequestId])
+  @@index([identityBackgroundCheckId])
+  @@map("background_check_webhook_events")
+}
+
+enum BackgroundCheckStatus {
+  invited
+  in_progress
+  in_review
+  completed
+  completed_with_flags
+  failed
+  cancelled
+}
+
 // ===== browserbase-context.prisma =====
 /// Stores Browserbase context IDs for browser-based automation
 /// One context per organization - shared like a normal browser
@@ -748,6 +816,21 @@ model EvidenceSubmission {
   @@index([submittedById, status])
 }
 
+model EvidenceFormSetting {
+  id             String           @id @default(dbgenerated("generate_prefixed_cuid('efs'::text)"))
+  organizationId String
+  formType       EvidenceFormType
+  isNotRelevant  Boolean          @default(false)
+  createdAt      DateTime         @default(now())
+  updatedAt      DateTime         @updatedAt
+
+  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+
+  @@unique([organizationId, formType])
+  @@index([organizationId])
+  @@index([organizationId, isNotRelevant])
+}
+
 // ===== finding.prisma =====
 enum FindingType {
   soc2
@@ -1664,18 +1747,146 @@ model OrganizationChart {
 
 // ===== organization-billing.prisma =====
 model OrganizationBilling {
-  id               String   @id @default(dbgenerated("generate_prefixed_cuid('obil'::text)"))
-  organizationId   String   @unique @map("organization_id")
-  stripeCustomerId String   @map("stripe_customer_id")
-  createdAt        DateTime @default(now()) @map("created_at")
-  updatedAt        DateTime @updatedAt @map("updated_at")
+  id                     String    @id @default(dbgenerated("generate_prefixed_cuid('obil'::text)"))
+  organizationId         String    @unique @map("organization_id")
+  stripeCustomerId       String    @map("stripe_customer_id")
+  stripePaymentMethodId  String?   @map("stripe_payment_method_id")
+  paymentMethodUpdatedAt DateTime? @map("payment_method_updated_at")
+  createdAt              DateTime  @default(now()) @map("created_at")
+  updatedAt              DateTime  @updatedAt @map("updated_at")
 
-  organization        Organization         @relation(fields: [organizationId], references: [id], onDelete: Cascade)
-  pentestSubscription PentestSubscription?
+  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
 
   @@map("organization_billing")
 }
 
+model OrganizationBillingSubscription {
+  id                       String    @id @default(dbgenerated("generate_prefixed_cuid('obs'::text)"))
+  organizationId           String    @map("organization_id")
+  skuKey                   String    @map("sku_key")
+  stripeSubscriptionId     String    @map("stripe_subscription_id")
+  stripeSubscriptionItemId String    @map("stripe_subscription_item_id")
+  stripePriceId            String    @map("stripe_price_id")
+  stripeStatus             String    @map("stripe_status")
+  currentPeriodStart       DateTime? @map("current_period_start")
+  currentPeriodEnd         DateTime? @map("current_period_end")
+  includedQuantity         Int       @map("included_quantity")
+  usedQuantity             Int       @default(0) @map("used_quantity")
+  cancelAtPeriodEnd        Boolean   @default(false) @map("cancel_at_period_end")
+  canceledAt               DateTime? @map("canceled_at")
+  createdAt                DateTime  @default(now()) @map("created_at")
+  updatedAt                DateTime  @updatedAt @map("updated_at")
+
+  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+
+  @@unique([organizationId, skuKey])
+  @@unique([stripeSubscriptionId, stripeSubscriptionItemId], map: "org_billing_subs_stripe_sub_item_key")
+  @@index([organizationId])
+  @@index([stripeSubscriptionId])
+  @@index([skuKey])
+  @@map("organization_billing_subscriptions")
+}
+
+model BillingUsageEvent {
+  id                       String    @id @default(dbgenerated("generate_prefixed_cuid('bue'::text)"))
+  organizationId           String    @map("organization_id")
+  skuKey                   String    @map("sku_key")
+  eventType                String    @map("event_type")
+  quantity                 Int
+  sourceResourceId         String?   @map("source_resource_id")
+  idempotencyKey           String    @unique @map("idempotency_key")
+  stripeEventId            String?   @map("stripe_event_id")
+  stripeInvoiceId          String?   @map("stripe_invoice_id")
+  stripeSubscriptionItemId String?   @map("stripe_subscription_item_id")
+  periodStart              DateTime? @map("period_start")
+  periodEnd                DateTime? @map("period_end")
+  createdAt                DateTime  @default(now()) @map("created_at")
+
+  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+
+  @@index([organizationId, skuKey])
+  @@index([stripeEventId])
+  @@index([stripeInvoiceId])
+  @@map("billing_usage_events")
+}
+
+model StripeWebhookEvent {
+  id            String   @id @default(dbgenerated("generate_prefixed_cuid('swe'::text)"))
+  stripeEventId String   @unique @map("stripe_event_id")
+  eventType     String   @map("event_type")
+  payload       Json
+  status        String   @default("processed")
+  error         String?
+  processedAt   DateTime @default(now()) @map("processed_at")
+  createdAt     DateTime @default(now()) @map("created_at")
+
+  @@index([eventType])
+  @@index([status])
+  @@map("stripe_webhook_events")
+}
+
+model BillingAuditEvent {
+  id             String   @id @default(dbgenerated("generate_prefixed_cuid('bae'::text)"))
+  organizationId String   @map("organization_id")
+  eventType      String   @map("event_type")
+  skuKey         String?  @map("sku_key")
+  stripeEventId  String?  @map("stripe_event_id")
+  metadata       Json?
+  createdAt      DateTime @default(now()) @map("created_at")
+
+  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+
+  @@index([organizationId])
+  @@index([stripeEventId])
+  @@index([skuKey])
+  @@map("billing_audit_events")
+}
+
+model BillingCreditBalance {
+  id             String   @id @default(dbgenerated("generate_prefixed_cuid('bcb'::text)"))
+  organizationId String   @map("organization_id")
+  productKey     String   @map("product_key")
+  skuKey         String?  @map("sku_key")
+  balance        Int      @default(0)
+  totalGranted   Int      @default(0) @map("total_granted")
+  totalConsumed  Int      @default(0) @map("total_consumed")
+  totalRefunded  Int      @default(0) @map("total_refunded")
+  lastSource     String   @default("manual") @map("last_source")
+  createdAt      DateTime @default(now()) @map("created_at")
+  updatedAt      DateTime @updatedAt @map("updated_at")
+
+  organization Organization         @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  events       BillingCreditEvent[]
+
+  @@index([organizationId, productKey])
+  @@map("billing_credit_balances")
+}
+
+model BillingCreditEvent {
+  id                String   @id @default(dbgenerated("generate_prefixed_cuid('bce'::text)"))
+  organizationId    String   @map("organization_id")
+  balanceId         String   @map("balance_id")
+  productKey        String   @map("product_key")
+  skuKey            String?  @map("sku_key")
+  eventType         String   @map("event_type")
+  quantity          Int
+  source            String
+  note              String?
+  adminUserId       String?  @map("admin_user_id")
+  sourceResourceId  String?  @map("source_resource_id")
+  linkedEventId     String?  @map("linked_event_id")
+  idempotencyKey    String   @unique @map("idempotency_key")
+  createdAt         DateTime @default(now()) @map("created_at")
+
+  organization Organization         @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  balance      BillingCreditBalance @relation(fields: [balanceId], references: [id], onDelete: Cascade)
+
+  @@index([organizationId, productKey])
+  @@index([sourceResourceId])
+  @@index([linkedEventId])
+  @@map("billing_credit_events")
+}
+
 // ===== organization.prisma =====
 model Organization {
   id                          String      @id @default(dbgenerated("generate_prefixed_cuid('org'::text)"))
@@ -1692,6 +1903,7 @@ model Organization {
   evidenceApprovalEnabled     Boolean     @default(false)
   deviceAgentStepEnabled      Boolean     @default(true)
   securityTrainingStepEnabled Boolean     @default(true)
+  backgroundCheckStepEnabled  Boolean     @default(true)
   whistleblowerReportEnabled  Boolean     @default(true)
   accessRequestFormEnabled    Boolean     @default(true)
 
@@ -1718,6 +1930,7 @@ model Organization {
   comments                           Comment[]
   attachments                        Attachment[]
   evidenceSubmissions                EvidenceSubmission[]
+  evidenceFormSettings               EvidenceFormSetting[]
   trust                              Trust[]
   context                            Context[]
   secrets                            Secret[]
@@ -1739,9 +1952,16 @@ model Organization {
   integrationOAuthApps   IntegrationOAuthApp[]
   integrationSyncLogs    IntegrationSyncLog[]
 
-  // Pentest Subscription
-  pentestSubscription PentestSubscription?
-  billing             OrganizationBilling?
+  // Pentest credits — wallet of run-credits an org can spend.
+  // Source of credits (trial / future Stripe subscription / top-up)
+  // is metadata on the row; balance is unified.
+  pentestCredits       PentestCredits?
+  billing              OrganizationBilling?
+  billingSubscriptions OrganizationBillingSubscription[]
+  billingUsageEvents   BillingUsageEvent[]
+  billingAuditEvents   BillingAuditEvent[]
+  billingCreditBalances BillingCreditBalance[]
+  billingCreditEvents   BillingCreditEvent[]
 
   // Browser Automation
   browserbaseContext BrowserbaseContext?
@@ -1753,6 +1973,9 @@ model Organization {
   // Device Agent
   devices Device[]
 
+  // Background Checks
+  backgroundCheckRequests BackgroundCheckRequest[]
+
   // Org Chart
   organizationChart OrganizationChart?
 
@@ -1770,26 +1993,51 @@ model Organization {
   @@index([slug])
 }
 
-// ===== pentest-subscription.prisma =====
-model PentestSubscription {
-  id                    String   @id @default(dbgenerated("generate_prefixed_cuid('psub'::text)"))
-  organizationId        String   @unique @map("organization_id")
-  organizationBillingId String   @unique @map("organization_billing_id")
-  stripeSubscriptionId  String   @map("stripe_subscription_id")
-  stripePriceId         String   @map("stripe_price_id")
-  stripeOveragePriceId  String?  @map("stripe_overage_price_id")
-  status                String   @default("active") // active | cancelled | past_due
-  includedRunsPerPeriod Int      @default(3) @map("included_runs_per_period")
-  currentPeriodStart    DateTime @map("current_period_start")
-  currentPeriodEnd      DateTime @map("current_period_end")
-  createdAt             DateTime @default(now()) @map("created_at")
-  updatedAt             DateTime @updatedAt @map("updated_at")
-
-  organization        Organization        @relation(fields: [organizationId], references: [id], onDelete: Cascade)
-  organizationBilling OrganizationBilling @relation(fields: [organizationBillingId], references: [id])
+// ===== pentest-credits.prisma =====
+/// Pentest credit wallet — one row per organization, holding the org's
+/// current quota for penetration test runs.
+///
+/// `balance` is the operative number: decremented atomically when a run is
+/// created, granted by trial bootstrap, future Stripe subscription renewals,
+/// future top-up purchases, etc. The wallet does not differentiate by
+/// source — credits are credits. The most recent grant source is recorded
+/// for support visibility, not for spend logic.
+///
+/// For a full audit trail of every grant/consume, a future
+/// `pentest_credit_entries` ledger table can be layered in. v1 sticks with
+/// running totals (`totalGranted` / `totalConsumed`) for simplicity.
+model PentestCredits {
+  id             String @id @default(dbgenerated("generate_prefixed_cuid('pcr'::text)"))
+  organizationId String @unique @map("organization_id")
+
+  /// Spendable balance. Never negative.
+  /// Enforced both in code (atomic `updateMany WHERE balance > 0` in
+  /// PentestCreditsService.debitOrThrow) AND at the DB level via a
+  /// CHECK constraint added in migration
+  /// `20260429120000_pentest_credits_balance_check`. Prisma's schema
+  /// DSL doesn't currently support CHECK constraints, hence the
+  /// SQL-only migration.
+  balance Int @default(0)
+
+  /// Lifetime totals — useful for analytics and "why do I have N credits?"
+  /// support questions without needing a full ledger.
+  totalGranted  Int @default(0) @map("total_granted")
+  totalConsumed Int @default(0) @map("total_consumed")
+
+  /// Where the most recent grant came from. Free-form string so v2 can add
+  /// new sources (`subscription`, `topup`, `promo`, `refund`, …) without a
+  /// schema change. `trial` is the v1 default.
+  lastGrantSource String @default("trial") @map("last_grant_source")
+
+  createdAt DateTime @default(now()) @map("created_at")
+  updatedAt DateTime @updatedAt @map("updated_at")
 
-  @@index([organizationId])
-  @@map("pentest_subscriptions")
+  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+
+  // No explicit @@index([organizationId]) — `@unique` on organizationId
+  // already creates a btree index, and a duplicate would just consume
+  // disk + write amplification with no read benefit.
+  @@map("pentest_credits")
 }
 
 // ===== policy.prisma =====
@@ -2037,20 +2285,6 @@ model Risk {
   residualImpact               Impact            @default(insignificant)
   treatmentStrategyDescription String?
   treatmentStrategy            RiskTreatmentType @default(accept)
-  // Per-strategy text store. When the user switches strategies, the current
-  // `treatmentStrategyDescription` is moved into this map under the OLD
-  // strategy key, and the NEW strategy's saved value is loaded back into the
-  // active field. Lets users keep an independent Mitigate plan + Accept
-  // rationale + Transfer rationale on the same risk.
-  // Shape: { mitigate?: string, accept?: string, transfer?: string, avoid?: string }
-  strategyDescriptions         Json?
-
-  // Active auto-link suggestion run (trigger.dev). Set when the user kicks
-  // off an AI suggest scan; cleared when the user applies or discards. Lets
-  // the UI resume an in-flight or completed-but-unreviewed scan after a
-  // page reload so progress isn't lost.
-  autoLinkRunId        String?
-  autoLinkRunStartedAt DateTime?
 
   // Dates
   createdAt DateTime @default(now())
@@ -2117,11 +2351,25 @@ model Secret {
 
 // ===== security-penetration-test-run.prisma =====
 model SecurityPenetrationTestRun {
-  id             String   @id @default(dbgenerated("generate_prefixed_cuid('ptr'::text)"))
-  organizationId String   @map("organization_id")
-  providerRunId  String   @map("provider_run_id")
-  createdAt      DateTime @default(now()) @map("created_at")
-  updatedAt      DateTime @updatedAt @map("updated_at")
+  id                   String   @id @default(dbgenerated("generate_prefixed_cuid('ptr'::text)"))
+  organizationId       String   @map("organization_id")
+  providerRunId        String   @map("provider_run_id")
+  billingUsageSourceId String?  @map("billing_usage_source_id")
+  createdAt            DateTime @default(now()) @map("created_at")
+  updatedAt            DateTime @updatedAt @map("updated_at")
+
+  /// Set the first time we refund this run's credit (e.g. on
+  /// `pentest.failed` / `pentest.cancelled` webhooks). Used to make the
+  /// refund idempotent — webhook redelivery cannot double-credit because
+  /// the second attempt sees a non-null value here.
+  creditRefundedAt DateTime? @map("credit_refunded_at")
+
+  /// Set the first time we write a `pentest_completed` audit-log entry
+  /// for this run. Webhook redelivery would otherwise create duplicate
+  /// rows in `audit_log` because Maced retries `pentest.completed` on
+  /// transient delivery failures. The atomic claim on this column
+  /// guarantees one audit row per run regardless of retry count.
+  completedAuditAt DateTime? @map("completed_audit_at")
 
   organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
 
@@ -2216,6 +2464,7 @@ enum AuditLogEntityType {
   integration
   trust
   finding
+  pentest
 }
 
 enum EvidenceFormType {
@@ -2699,6 +2948,7 @@ model Trust {
   soc2          Boolean @default(false)
   soc2type1     Boolean @default(false)
   soc2type2     Boolean @default(false)
+  soc3          Boolean @default(false)
   iso27001      Boolean @default(false)
   iso42001      Boolean @default(false)
   nen7510       Boolean @default(false)
@@ -2706,10 +2956,13 @@ model Trust {
   hipaa         Boolean @default(false)
   pci_dss       Boolean @default(false)
   iso9001       Boolean @default(false)
+  pipeda        Boolean @default(false)
+  ccpa          Boolean @default(false)
 
   soc2_status      FrameworkStatus @default(started)
   soc2type1_status FrameworkStatus @default(started)
   soc2type2_status FrameworkStatus @default(started)
+  soc3_status      FrameworkStatus @default(started)
   iso27001_status  FrameworkStatus @default(started)
   iso42001_status  FrameworkStatus @default(started)
   nen7510_status   FrameworkStatus @default(started)
@@ -2717,6 +2970,8 @@ model Trust {
   hipaa_status     FrameworkStatus @default(started)
   pci_dss_status   FrameworkStatus @default(started)
   iso9001_status   FrameworkStatus @default(started)
+  pipeda_status    FrameworkStatus @default(started)
+  ccpa_status      FrameworkStatus @default(started)
 
   // Overview section for public trust portal
   overviewTitle   String?
@@ -2750,6 +3005,7 @@ enum TrustFramework {
   hipaa
   soc2_type1
   soc2_type2
+  soc3
   pci_dss
   nen_7510
   iso_9001
@@ -2943,10 +3199,6 @@ model Vendor {
   inherentImpact      Impact         @default(insignificant)
   residualProbability Likelihood     @default(very_unlikely)
   residualImpact      Impact         @default(insignificant)
-  treatmentStrategy            RiskTreatmentType @default(accept)
-  treatmentStrategyDescription String?
-  // See `Risk.strategyDescriptions`.
-  strategyDescriptions         Json?
   website             String?
   isSubProcessor      Boolean        @default(false)
 
@@ -2956,11 +3208,6 @@ model Vendor {
   trustPortalOrder  Int?
   complianceBadges  Json? // Array of { type: 'soc2' | 'iso27001' | etc, verified: boolean }
 
-  // Active auto-link suggestion run (trigger.dev). Same semantics as
-  // Risk.autoLinkRunId — lets the UI resume an in-flight scan on reload.
-  autoLinkRunId        String?
-  autoLinkRunStartedAt DateTime?
-
   createdAt DateTime @default(now())
   updatedAt DateTime @updatedAt
 

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@trycompai/db",
     "description": "Database package with Prisma client and schema for Comp AI",
-    "version": "2.1.0",
+    "version": "2.1.2",
     "dependencies": {
         "@prisma/adapter-pg": "7.6.0",
         "@prisma/client": "7.6.0",