@trycompai/db 2.3.0 → 2.3.1

package/dist/schema.prisma

@@ -630,20 +630,35 @@ model CustomRequirement {
   description String
   identifier  String
 
-  organizationId    String
-  organization      Organization    @relation(fields: [organizationId], references: [id], onDelete: Cascade)
-  customFrameworkId String
+  organizationId String
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+
+  // A custom requirement hangs off either a CustomFramework (the org authored
+  // a whole new framework) or a single FrameworkInstance (the org tacked an
+  // extra requirement onto a platform framework like ISO 27001). Exactly one
+  // of these is set — enforced by a DB CHECK constraint.
+  customFrameworkId String?
   // Composite FK onto (id, organizationId) so tenant consistency with the
   // referenced CustomFramework is enforced at the DB level.
-  customFramework   CustomFramework @relation(fields: [customFrameworkId, organizationId], references: [id, organizationId], onDelete: Cascade)
+  customFramework   CustomFramework? @relation(fields: [customFrameworkId, organizationId], references: [id, organizationId], onDelete: Cascade)
+
+  frameworkInstanceId String?
+  // Composite FK onto (id, organizationId) so a per-instance custom requirement
+  // can only point at an FI in its own org.
+  frameworkInstance   FrameworkInstance? @relation(fields: [frameworkInstanceId, organizationId], references: [id, organizationId], onDelete: Cascade)
 
   requirementMaps RequirementMap[]
 
   createdAt DateTime @default(now())
   updatedAt DateTime @default(now()) @updatedAt
 
+  // Identifier uniqueness scoped to whichever parent is set. Postgres treats
+  // NULLs as distinct in unique indexes, so the inactive parent column doesn't
+  // collide across rows.
   @@unique([customFrameworkId, identifier])
+  @@unique([frameworkInstanceId, identifier])
   @@index([organizationId])
+  @@index([frameworkInstanceId])
 }
 
 // ===== device.prisma =====
@@ -1139,7 +1154,14 @@ model FrameworkInstance {
   requirementsMapped RequirementMap[]
   timelineInstances  TimelineInstance[]
   syncOperations     FrameworkSyncOperation[]
+  // Per-instance custom requirements (used when an org tacks an extra requirement
+  // onto a platform framework instance). Custom requirements attached to a
+  // CustomFramework hang off CustomFramework.requirements instead.
+  customRequirements CustomRequirement[]
 
+  // (id, organizationId) is the composite-FK target for CustomRequirement.frameworkInstanceId
+  // so a per-instance custom requirement can only point at an FI in its own org.
+  @@unique([id, organizationId])
   @@unique([organizationId, frameworkId])
   @@unique([organizationId, customFrameworkId])
   @@index([customFrameworkId])
@@ -2983,6 +3005,8 @@ model Trust {
   hipaa         Boolean @default(false)
   pci_dss       Boolean @default(false)
   iso9001       Boolean @default(false)
+  pipeda        Boolean @default(false)
+  ccpa          Boolean @default(false)
 
   soc2_status      FrameworkStatus @default(started)
   soc2type1_status FrameworkStatus @default(started)
@@ -2995,6 +3019,8 @@ model Trust {
   hipaa_status     FrameworkStatus @default(started)
   pci_dss_status   FrameworkStatus @default(started)
   iso9001_status   FrameworkStatus @default(started)
+  pipeda_status    FrameworkStatus @default(started)
+  ccpa_status      FrameworkStatus @default(started)
 
   // Overview section for public trust portal
   overviewTitle   String?
@@ -3032,6 +3058,8 @@ enum TrustFramework {
   pci_dss
   nen_7510
   iso_9001
+  pipeda
+  ccpa
 }
 
 model TrustResource {

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@trycompai/db",
     "description": "Database package with Prisma client and schema for Comp AI",
-    "version": "2.3.0",
+    "version": "2.3.1",
     "dependencies": {
         "@prisma/adapter-pg": "7.6.0",
         "@prisma/client": "7.6.0",