create-ailk 0.1.0 → 0.2.0

package/templates/database/inbox/schema.prisma

@@ -11,21 +11,30 @@
 
 /// Lead — anonymous lead submission (Phase B submit_lead tool / B6 route)
 model Lead {
-  id        String   @id @default(cuid())
+  id        String   @id @default(dbgenerated("('lead_'::text || (uuidv7())::text)")) @db.Text
   siteId    String   @map("site_id")
   source    String
   email     String
   payload   Json
   createdAt DateTime @default(now()) @map("created_at")
 
+  // Lead → user promotion (#3586). Plain scalars — no cross-namespace
+  // @relation into auth.User (ADR 0009 invariant #1). Set by
+  // apps/api/src/services/lead-promotion.ts once the reconciling user's
+  // email is verified and the lead's siteId resolves to one of that user's
+  // own workspaces (tenant-safety, spec D3).
+  promotedUserId String?   @map("promoted_user_id")
+  promotedAt     DateTime? @map("promoted_at")
+
   @@index([siteId])
   @@index([createdAt])
+  @@index([email])
   @@map("leads")
 }
 
 /// Subscriber — newsletter subscription (Phase B subscribe_newsletter tool / B6 route)
 model Subscriber {
-  id        String   @id @default(cuid())
+  id        String   @id @default(dbgenerated("('subscr_'::text || (uuidv7())::text)")) @db.Text
   siteId    String   @map("site_id")
   email     String
   source    String
@@ -38,7 +47,7 @@ model Subscriber {
 
 /// Callback — callback request (Phase B request_callback tool / B6 route)
 model Callback {
-  id            String   @id @default(cuid())
+  id            String   @id @default(dbgenerated("('callbk_'::text || (uuidv7())::text)")) @db.Text
   siteId        String   @map("site_id")
   name          String
   phone         String
@@ -50,3 +59,565 @@ model Callback {
   @@index([createdAt])
   @@map("callbacks")
 }
+
+/// FlowDefinition — server-owned flow config, one live definition per
+/// (siteId, slug) (#3956 D2). No versioning at this layer — a session
+/// snapshots the config at start (see FlowSession.configSnapshot), so a
+/// mid-flight definition edit never corrupts a live session.
+model FlowDefinition {
+  id        String   @id @default(dbgenerated("('flow_'::text || (uuidv7())::text)")) @db.Text
+  siteId    String   @map("site_id")
+  slug      String
+  config    Json
+  // #5036 D6d — the listing this definition was projected from, when it was.
+  // Null for every flow that is not a listing diagnostic. Before this column
+  // the only link was that the generated flow's slug HAPPENED to equal the
+  // listing's slug, which nothing enforced; a slug collision would have
+  // attributed a submission to the wrong founder. ADR 0009 forbids a relation
+  // across the namespace boundary, so this is a plain string — but a stated
+  // one rather than a coincidence.
+  listingId String?  @map("listing_id")
+  createdAt DateTime @default(now()) @map("created_at")
+  updatedAt DateTime @updatedAt @map("updated_at")
+
+  @@unique([siteId, slug])
+  @@map("flow_definitions")
+}
+
+/// FlowSession — a flow walk in progress or completed; the server-side
+/// partial-lead record (#3956 D2/D9). `configSnapshot` pins the definition at
+/// session start; `state` accumulates each landed step's values immediately
+/// on submission (the per-step persistence this feature exists for).
+/// `email` is denormalized from the landed answers the moment a
+/// `mapsTo:'email'` field lands, so the #3962 abandon-email query
+/// (`email != null AND completedAt == null`) is one indexed read.
+model FlowSession {
+  id             String    @id @default(dbgenerated("('flsess_'::text || (uuidv7())::text)")) @db.Text
+  siteId         String    @map("site_id")
+  // Informational only — never joined on (ADR 0009 D1: logical, not FK,
+  // isolation). Session resumption + completion key on flowSlug, not this
+  // column; deliberate, per code-review finding on #3956's acceptance PR.
+  flowId         String    @map("flow_id")
+  flowSlug       String    @map("flow_slug")
+  configSnapshot Json      @map("config_snapshot")
+  state          Json      @default("{}")
+  email          String?
+  // The session's locale (#3962 D3) — set once at create from the first
+  // landed step's `input.locale ?? configSnapshot.defaultLocale`; not
+  // updated on later steps. Null on pre-migration rows (no backfill; the
+  // abandon-email sweep falls back to the live config's defaultLocale).
+  locale         String?
+  // Server-derived segment (#3959 D3) — set from the segmentation step's
+  // band map at landing time, persisted in the same write as `state`. No
+  // index: #3960/#3961/#3962 read it off rows they already fetch by
+  // existing indexes (subtraction-first, spec Clarifications).
+  segment        String?
+  // D2 (#4663) — every derived flag, re-derived and persisted at each
+  // landing (`{ [flagName]: true }`). `{}` on a snapshot declaring no
+  // `flags` (the regression floor — byte-identical to a pre-#4663 row).
+  flags          Json      @default("{}")
+  // D6 (#4663) — the mid-flow aeo_score step's persisted result (`ready` /
+  // `unavailable`). Null until the step lands, or after a URL change resets
+  // it (D3). Never `computing` — that status never reaches the wire from
+  // this repo (packages/validation/src/schemas/aeo-score.ts).
+  aeoScore       Json?     @map("aeo_score")
+  leadId         String?   @map("lead_id")
+  // #5036 D6d — copied from the FlowDefinition at session create, so a
+  // submission is attributable to ONE listing without going through the slug.
+  // Null for every session on a flow that is not a listing diagnostic.
+  listingId      String?   @map("listing_id")
+  completedAt    DateTime? @map("completed_at")
+  // Abandon-email audit stamp (#3962 D5) — set at most once by the sweep,
+  // per outcome ('sent' | 'dark' | 'failed'). The `abandonEmailStatus ==
+  // null` selection term is what makes the sweep idempotent across any
+  // number of overlapping runs; 'failed' is terminal (no auto-retry).
+  abandonEmailStatus String?   @map("abandon_email_status")
+  abandonEmailAt     DateTime? @map("abandon_email_at")
+  createdAt      DateTime  @default(now()) @map("created_at")
+  updatedAt      DateTime  @updatedAt @map("updated_at")
+
+  @@index([siteId])
+  @@index([siteId, completedAt])
+  @@index([email])
+  // Backs the abandon-email sweep's per-definition selection query
+  // (apps/api/src/services/abandon-email.ts — flowId equality + completedAt
+  // null + abandonEmailStatus null + updatedAt window), run once per
+  // FlowDefinition on every sweep — code-review finding on #3962's
+  // acceptance PR (without this, that filter set is a full table scan).
+  @@index([flowId, completedAt, abandonEmailStatus])
+  // #5036 D6d — backs the listing-to-submissions read the explicit reference
+  // exists to make possible.
+  @@index([listingId])
+  @@map("flow_sessions")
+}
+
+/// DeliverableAsset — an operator-uploaded asset the funnel's `deliverables`
+/// config block references by `key` (#3961 D1). Bytes live IN THE DATABASE
+/// (Postgres bytea) behind one internal resolver — zero new infrastructure;
+/// reversibility is structural (a later blob-storage swap changes only the
+/// resolver + the upload CLI, never the config contract, grant model, or
+/// email link shape). Uploaded via the `deliverable:upload` CLI
+/// (apps/api/src/bin/deliverable-upload.ts) only — no HTTP upload route.
+model DeliverableAsset {
+  id          String   @id @default(dbgenerated("('dasset_'::text || (uuidv7())::text)")) @db.Text
+  siteId      String   @map("site_id")
+  // The assetKey a flow config's deliverables.assets entry references.
+  key         String
+  // Download filename (Content-Disposition). Stored RAW at upload time
+  // (the `deliverable:upload` CLI writes the operator's `--filename` or the
+  // uploaded file's own basename verbatim) — sanitization to a safe charset
+  // happens at SERVE time only, in the download route's `sanitizeFilename`
+  // (apps/api/src/routes/deliverables/index.ts, #4002). Never trust this
+  // column as pre-sanitized; the serve-time guard is load-bearing, not
+  // redundant.
+  filename    String
+  contentType String   @map("content_type")
+  bytes       Bytes
+  size        Int
+  createdAt   DateTime @default(now()) @map("created_at")
+  updatedAt   DateTime @updatedAt @map("updated_at")
+
+  @@unique([siteId, key])
+  @@map("deliverable_assets")
+}
+
+/// DeliverableGrant — the capability token minted per fulfilled lead (#3961
+/// D5). The grant's id IS the token: the download route
+/// (GET /v1/deliverables/:grantId) looks up bytes by grant id alone, so
+/// nothing is publicly enumerable by key, filename, or any other guessable
+/// value — only the uuidv7-random grant id, delivered once via the lead's
+/// own email. `assetId`/`leadId` are stable-id refs (ADR 0009 invariant 1
+/// posture) — no cross-model `@relation`.
+model DeliverableGrant {
+  id        String   @id @default(dbgenerated("('dgrant_'::text || (uuidv7())::text)")) @db.Text
+  siteId    String   @map("site_id")
+  assetId   String   @map("asset_id")
+  leadId    String   @map("lead_id")
+  sessionId String   @map("session_id")
+  createdAt DateTime @default(now()) @map("created_at")
+  // Post-mint send-outcome stamp (#3998 D1) — set at most once, by the
+  // send-and-stamp tail shared between fulfillDeliverable and the
+  // deliverable:resend CLI. 'sent' | 'send_failed' | 'sender_unconfigured' —
+  // the exact post-mint subset of deliverable-fulfillment.ts's
+  // FulfillmentOutcome union; carried here (not a Prisma enum — this repo
+  // uses none), mirroring FlowSession.abandonEmailStatus/abandonEmailAt.
+  // NULL means the process never reached a post-mint outcome — the crash
+  // window between mint and send (#3961 D5's unhandled consequence) that
+  // this column makes queryable. This is the SELECTION term for the resend
+  // CLI's list mode only; a resend itself is an explicit operator act on one
+  // named grant and is NOT guarded by this column (#3998 D3).
+  sendStatus String?   @map("send_status")
+  sendAt     DateTime? @map("send_at")
+
+  // Backs the deliverable:resend CLI's list-mode query (siteId + sendStatus
+  // IS NULL) — without this, that filter set is a full table scan (the same
+  // lesson #3962's code-review finding established for FlowSession).
+  @@index([siteId, sendStatus])
+  @@map("deliverable_grants")
+}
+
+/// WaitlistExperiment — one ratified experiment config per (siteId, key), the
+/// runtime twin of a site-plan waitlistExperiments[] entry (#4661 D3/D7).
+/// `config` is the validated experimentConfig (D1) with the three registers
+/// EMBEDDED. Written only via upsertWaitlistExperiment (D5).
+model WaitlistExperiment {
+  id        String   @id @default(dbgenerated("('wlexp_'::text || (uuidv7())::text)")) @db.Text
+  siteId    String   @map("site_id")
+  key       String
+  mode      String                        // lead-capture | qualifying | paid
+  status    String                        // draft | live | closed
+  config    Json
+  createdAt DateTime @default(now()) @map("created_at")
+  updatedAt DateTime @updatedAt @map("updated_at")
+
+  @@unique([siteId, key])
+  @@map("waitlist_experiments")
+}
+
+/// WaitlistScore — the rules layer's output for one signup (#4661 D3; written
+/// by A2 #4662). leadId is a plain scalar into inbox.Lead (ADR 0009). One row
+/// per lead — re-scoring overwrites, never appends.
+model WaitlistScore {
+  id             String   @id @default(dbgenerated("('wlscore_'::text || (uuidv7())::text)")) @db.Text
+  siteId         String   @map("site_id")
+  leadId         String   @map("lead_id")
+  experimentKey  String   @map("experiment_key")
+  waitlistKey    String   @map("waitlist_key")
+  tier           String
+  score          Int
+  categoryScores Json     @map("category_scores")
+  ruleTrace      Json     @map("rule_trace")
+  createdAt      DateTime @default(now()) @map("created_at")
+  updatedAt      DateTime @updatedAt @map("updated_at")
+
+  // #5036 D6d — one score row per (lead, EXPERIMENT), not per lead.
+  //
+  // `@@unique([leadId])` was right for a single instrument and wrong for a
+  // marketplace of them: a visitor who joins two founders' waitlists is one
+  // lead with two scores, and the narrower constraint permitted one. The
+  // second write silently overwrote the first, so one founder's evidence
+  // disappeared and their weekly CSV under-reported with no error raised.
+  // Scoping the key to the experiment keeps the overwrite-on-retake behaviour
+  // that `scoreCompletedSignup` relies on, per project rather than globally.
+  @@unique([leadId, experimentKey])
+  @@index([siteId, experimentKey, waitlistKey])
+  @@map("waitlist_scores")
+}
+
+/// PlaybookInstance — a compiled, person-scoped Playbook (FEAT-074 U4a,
+/// #4715). Append-only: `scoreCompletedSignup` (A2) fires the compile on
+/// every `targeting-maturity` completion, so a retake writes a NEW row
+/// rather than overwriting — unlike WaitlistScore, which is
+/// @@unique([leadId, experimentKey]) and overwritten on retake of the SAME
+/// experiment (D2; scoped per experiment by #5036 D6d). `tier`/`ruleTrace` are SNAPSHOTS of the
+/// WaitlistScore at compile time; `scoreId` is kept only as the provenance
+/// pointer to the (possibly since-overwritten) live row. `source` is the
+/// U1 `playbook-source` machine-block object; `markdown` is the rendered
+/// `PLAYBOOK-<slug>.md` body U4b (#4718) reads to render + deliver.
+model PlaybookInstance {
+  id            String   @id @default(dbgenerated("('pbk_'::text || (uuidv7())::text)")) @db.Text
+  siteId        String   @map("site_id")
+  leadId        String   @map("lead_id")
+  experimentKey String   @map("experiment_key")
+  scoreId       String   @map("score_id")
+  tier          String
+  level         Int
+  ruleTrace     Json     @map("rule_trace")
+  source        Json
+  markdown      String   @db.Text
+  createdAt     DateTime @default(now()) @map("created_at")
+
+  @@index([siteId, leadId, createdAt])
+  @@map("playbook_instances")
+}
+
+/// WaitlistFollowUpSend — the audit stamp for one attempted follow-up email
+/// (#4732 D1/D5). `@@unique([leadId, followUpKey])` IS the sweep's
+/// idempotency guarantee (mirrors WaitlistScore's own `@@unique([leadId])`
+/// shape) — the stateless `runWaitlistFollowUpSweep` (#4732)
+/// selects candidates by the ABSENCE of a matching row, so a re-run never
+/// double-sends. `status` is 'sent' | 'failed' (no Prisma enum — this repo
+/// uses none, mirroring DeliverableGrant.sendStatus's free-string
+/// convention); 'failed' is terminal, no auto-retry (the abandon-email
+/// sweep's own posture) — a suppressed/skipped candidate (wrong tier, not
+/// yet due, a booked call, or unsubscribed) is NEVER stamped here at all, so
+/// it is re-evaluated on every later sweep run until it either sends or its
+/// completedAt/offsetDays window is permanently past.
+model WaitlistFollowUpSend {
+  id          String   @id @default(dbgenerated("('wlfu_'::text || (uuidv7())::text)")) @db.Text
+  siteId      String   @map("site_id")
+  leadId      String   @map("lead_id")
+  followUpKey String   @map("follow_up_key")
+  sentAt      DateTime @map("sent_at")
+  status      String
+
+  @@unique([leadId, followUpKey])
+  @@index([siteId])
+  @@map("waitlist_followup_sends")
+}
+
+/// ListingCsvSend — the weekly founder-CSV send stamp (#5001). One row per
+/// DELIVERED CSV for one ProjectListing: `sentAt` is the watermark the next
+/// sweep selects after (signups whose WaitlistScore landed at or before it are
+/// already in a delivered CSV), `rowCount` is how many rows that CSV carried,
+/// and `grantId` is the DeliverableGrant whose id is the capability token in
+/// the founder's download link. Plain-scalar refs to ProjectListing /
+/// DeliverableGrant (ADR 0009 invariant 1) — no cross-model @relation. A
+/// listing with no new signups gets no row, so "no new rows ⇒ no send" is
+/// visible in the data, not only in the sweep's control flow.
+model ListingCsvSend {
+  id        String   @id @default(dbgenerated("('lcsv_'::text || (uuidv7())::text)")) @db.Text
+  listingId String   @map("listing_id")
+  sentAt    DateTime @map("sent_at")
+  rowCount  Int      @map("row_count")
+  grantId   String   @map("grant_id")
+
+  @@index([listingId, sentAt])
+  @@map("listing_csv_sends")
+}
+
+/// FlowCheckout — the recommender buyer record (#4837 D2/D4): one row per
+/// checkout ATTEMPT. `amountMinor` is the server's own `price().total` × 100
+/// (D6); `quote` is the full WaitlistPriceQuote beside it, so an onboarding
+/// reader sees the seat line and credit line, not only a total. `status` is
+/// 'created' | 'completed' | 'expired' (no Prisma enum — this repo uses none,
+/// mirroring DeliverableGrant.sendStatus's free-string convention); the
+/// webhook (#4838) advances it with a guarded update on 'created'. Plain-scalar
+/// refs to Lead / FlowSession (ADR 0009 invariant 1) — no cross-model
+/// @relation. `permalink` is the answers-only payload string the visitor's
+/// recommendation was rendered from (#4770). Written only by
+/// apps/api/src/services/recommender-capture.ts.
+model FlowCheckout {
+  id               String    @id @default(dbgenerated("('flchk_'::text || (uuidv7())::text)")) @db.Text
+  siteId           String    @map("site_id")
+  flowSlug         String    @map("flow_slug")
+  experimentKey    String    @map("experiment_key")
+  sessionId        String    @map("session_id")
+  leadId           String    @map("lead_id")
+  offerKey         String    @map("offer_key")
+  seats            Int
+  period           String
+  creditStop       Json      @map("credit_stop")
+  amountMinor      Int       @map("amount_minor")
+  currency         String
+  quote            Json
+  permalink        String    @db.Text
+  stripeSessionId  String?   @map("stripe_session_id")
+  // The hosted Checkout page URL an identical resubmission is replayed with
+  // (#4912 D6) — stamped in the same write as `stripeSessionId`, because a
+  // Checkout Session URL cannot be reconstructed from its id.
+  checkoutUrl      String?   @db.Text @map("checkout_url")
+  // The server-derived fingerprint of the checkout request (#4912 D5): a
+  // SHA-256 hex digest, never the request fields themselves. Null on
+  // pre-#4912 rows and on a row whose key a reconcile released.
+  idempotencyKey   String?   @map("idempotency_key")
+  stripeCustomerId String?   @map("stripe_customer_id")
+  status           String
+  completedAt      DateTime? @map("completed_at")
+  createdAt        DateTime  @default(now()) @map("created_at")
+  updatedAt        DateTime  @updatedAt @map("updated_at")
+
+  // The webhook's join (#4838) — nullable, so `created` rows with no session
+  // id yet never collide.
+  @@unique([stripeSessionId])
+  // The /checkout idempotency guarantee (#4912 D5), tenant-scoped so a
+  // fingerprint can never reach another site's row. Nullable, so pre-#4912
+  // rows and reconciled rows never collide.
+  @@unique([siteId, idempotencyKey])
+  // The dashboard's checkedOut read (#4839 D3): siteId + experimentKey + status.
+  @@index([siteId, experimentKey, status])
+  // Onboarding's read: everything a lead bought.
+  @@index([leadId])
+  @@map("flow_checkouts")
+}
+
+/// ProjectListing — the founder's application row for the project-listings
+/// workflow (#4998): apply → Slack approve/reject → build issue → data-driven
+/// page + diagnostic → weekly CSV. `leadId` is a plain scalar ref into this
+/// namespace's own `Lead` (ADR 0009 invariant 1) — the POST route writes both
+/// rows via `routeLead` (kind `submit`, source `projects-apply`) then this
+/// row, never the reverse. `questions` is the diagnostic template instance
+/// (Q2–Q7 + up to 3 extras, bounded by `projectListingQuestionsSchema` in
+/// `@working-theory/validation`) per
+/// docs/decisions/2026-09-07-project-listings-workflow.md (consumer repo,
+/// salessmyth/samhenry — this row and its routes vendor down, operator
+/// 2026-09-07 option 2). `status` is a free string (`applied` | `approved` |
+/// `rejected` | `active`, no Prisma enum — this repo uses none, mirroring
+/// `FlowCheckout.status`'s convention). Those are the four STORED values
+/// (#5033): the fifth lifecycle state, `closed`, is COMPUTED in the read
+/// from `windowEndsAt` and never written, so an expired listing cannot stay
+/// publicly open because a scheduled job failed. `draft` is defined so the
+/// vocabulary never migrates again and is reachable through no route today.
+/// `decidedAt`/`decidedBy` stamp the approve/reject moment, and an approve
+/// also stamps `windowEndsAt = decidedAt + windowDays`. `windowDays` is the
+/// applicant's requested window ALREADY CLAMPED at create against the site's
+/// `SiteListingConfig` (database/config/schema.prisma) — the config itself
+/// is never accepted from a request body. `issueUrl` (the build issue,
+/// #5000) and `experimentId` (the generated flow's waitlist experiment,
+/// #5001) are null until their respective downstream unit lands.
+/// `featured` is the operator-set shelf flag, surfaced on the public read
+/// only where the site's config enables it. `headline`, `logoMarkUrl` and
+/// `logoWordmarkUrl` are the listing card's presentation fields; the two
+/// logo columns ship nullable with NO upload path (#5033 D5 — no storage
+/// dependency exists, and accepting arbitrary files from anonymous
+/// strangers deserves its own review), and a card with both absent renders
+/// a designed name-only treatment. `slackChannel`/`slackTs`
+/// (#4999) are the posted application message's coordinates, stamped by
+/// `postListingApplication` right after `chat.postMessage` succeeds, so the
+/// decision handler can `chat.update` the same message in place; null when
+/// Slack is unconfigured or the post failed. Still out of scope here: the
+/// GitHub issue (#5000), the diagnostic flow + weekly CSV (#5001).
+model ProjectListing {
+  id             String    @id @default(dbgenerated("('prjl_'::text || (uuidv7())::text)")) @db.Text
+  siteId         String    @map("site_id")
+  // #5036 — written at SUBMIT, not at start. The founder's contact details are
+  // already captured on THIS row at step one, so a `Lead` at step one adds no
+  // capture; what it does add is an operator notification email per abandoned
+  // first step, on an anonymous route (PR #5042 security review, finding 4).
+  // `routeLead` remains the one Lead write path; it just runs later.
+  leadId         String?   @map("lead_id")
+  // #5036 D1 — every field the SUBMIT payload requires is nullable at rest.
+  // Validation moved from write-time to submit-time when the application
+  // became a ten-step draft that saves as it goes; a half-filled draft is a
+  // legitimate row, and a NOT NULL here would make one unstorable. Only
+  // `submit` asserts completeness.
+  slug           String?
+  name           String?
+  oneLiner       String?   @map("one_liner")
+  problem        String?   @db.Text
+  url            String?
+  // #5036 D2 — the six-rung product ladder that replaced the four-value
+  // `stage`. The migration remaps every old value by an explicit map; there
+  // is no shim, because the two ladders do not align rung-for-rung.
+  product        String?
+  // #5036 D3/D5 — the two segmentation axes shared with the diagnostic.
+  commitment       String?
+  teamComposition  String?  @map("team_composition")
+  // #5036 D5 — exactly three {question, answer} entries, the detail page's
+  // fixed FAQ slot.
+  faqs           Json?
+  anythingElse   String?   @db.Text @map("anything_else")
+  // #5036 D6 — a legal control, not a contact detail: visitors answering this
+  // founder's diagnostic are owed the identity and address of the party
+  // collecting their data. Carried on the PUBLIC read for that reason.
+  //
+  // #5279 — still the single-line DISPLAY string. Where the six part columns
+  // below are written, this is COMPOSED from them server-side; where they are
+  // not, it is the line the founder typed, verbatim.
+  address        String?
+  // #5279 — the structured parts of the address above, beside it rather than
+  // instead of it. Nullable for the same reason as the #5036 D1 block above: a
+  // row written before #5279 has no parts, and none may ever be GUESSED from
+  // its `address` string. Parts compose into a line deterministically; a line
+  // does not decompose into parts, and a wrong split silently corrupts the
+  // party identification the listing's privacy notice points at — so the
+  // migration deliberately backfills nothing and a null part stays null for
+  // the life of the row. Composition runs one way only, in `draftUpdateData`
+  // (apps/api/src/services/project-listings.ts).
+  addressLine1      String? @map("address_line1")
+  addressLine2      String? @map("address_line2")
+  addressCity       String? @map("address_city")
+  addressRegion     String? @map("address_region")
+  addressPostalCode String? @map("address_postal_code")
+  addressCountry    String? @map("address_country")
+  questions      Json?
+  // #5285 — the answers to the site's OWN questions: one flat JSON object of
+  // `{ questionId: answer }` for everything a site asks that the PLATFORM does
+  // not read. The field contract (packages/validation/.../listing-
+  // application-contract.ts) names what the platform reads and therefore what
+  // earns a column; everything else was previously unaskable without a
+  // migration and a release, which is what this column removes.
+  //
+  // BOUNDED, not free-form, and that is the point: the write path is
+  // anonymous (a resume token and nothing else), so an unbounded JSON bag on
+  // it is a place for a stranger to park arbitrary text in the table. The
+  // server accepts only ids the SITE declared in its own `SiteListingConfig`,
+  // at that site's own count and length caps, and refuses the whole request
+  // otherwise — so what lands here is never larger than the questions the
+  // operator chose to ask. Null on every row written before #5285 and on
+  // every site that asks nothing of its own.
+  //
+  // Only the `public`-visibility subset rides the public read; an
+  // `operator-only` answer reaches the dashboard and the review payload and
+  // stops there.
+  siteAnswers    Json?     @map("site_answers")
+  founderName    String    @map("founder_name")
+  founderEmail   String    @map("founder_email")
+  founderCompany String?   @map("founder_company")
+  status         String
+  // #5036 D1/D6 — when the founder ticked step one's consent box. Never null:
+  // a row cannot exist without it, because `start` requires it.
+  consentAt      DateTime  @default(now()) @map("consent_at")
+  // #5036 D1 — sha-256 of the opaque resume token, never the token itself.
+  // The token is the ONLY credential on an anonymous surface, so the column
+  // holds a digest an attacker who reads the table still cannot present.
+  // Cleared at submit, which makes a leaked token inert the moment the draft
+  // stops being a draft.
+  resumeTokenHash String?  @unique @map("resume_token_hash")
+  headline       String?
+  logoMarkUrl    String?   @map("logo_mark_url")
+  logoWordmarkUrl String?  @map("logo_wordmark_url")
+  featured       Boolean   @default(false)
+  decidedAt      DateTime? @map("decided_at")
+  decidedBy      String?   @map("decided_by")
+  // The operator's copy-edit audit trio. A listing that is `requested` or
+  // `active` can have its PUBLISHED COPY trimmed by the operator (headline,
+  // oneLiner, problem, faqs, questions) — the third review outcome beside
+  // approve and reject. `copyEditedAt`/`copyEditedBy` mirror the decision pair
+  // directly above and are re-stamped on every edit.
+  //
+  // `submittedCopy` is WRITE-ONCE, on the FIRST edit only: it holds those five
+  // fields exactly as the applicant submitted them. Null for the untouched
+  // majority, which is why "what did the applicant actually send" reads as the
+  // snapshot if present and the row itself otherwise. Never cleared, so the
+  // submitted copy stays recoverable for the life of the row.
+  submittedCopy  Json?     @map("submitted_copy")
+  copyEditedAt   DateTime? @map("copy_edited_at")
+  copyEditedBy   String?   @map("copy_edited_by")
+  issueUrl       String?   @map("issue_url")
+  // #5036 D6d — the experiment's KEY, not its id. `WaitlistScore` holds
+  // `experimentKey`, so holding the id here meant every listing-to-submissions
+  // read fetched the experiment purely to learn its key. One hop, the same
+  // string on both sides. ADR 0009 forbids a relation across the namespace
+  // boundary, so this is a plain string matched by convention — which is
+  // exactly why it has to be the string the other side actually stores.
+  experimentKey  String?   @map("experiment_key")
+  windowDays     Int?      @map("window_days")
+  windowEndsAt   DateTime? @map("window_ends_at")
+  // The posted application message's coordinates (#4999) — set by
+  // `postListingApplication` right after `chat.postMessage` succeeds, so the
+  // Approve/Reject decision handler can `chat.update` the SAME message in
+  // place. Null when Slack is unconfigured or the post failed (create never
+  // rolls back on a Slack failure).
+  slackChannel   String?   @map("slack_channel")
+  slackTs        String?   @map("slack_ts")
+  // Listing -> owner-user link (#5295). Plain scalars — no cross-namespace
+  // @relation into auth.User (ADR 0009 invariant #1), exactly as
+  // `Lead.promotedUserId` / `promotedAt` above. Set by
+  // apps/api/src/services/listing-promotion.ts once the reconciling user's own
+  // email is VERIFIED, that verified address matches `founderEmail`, and this
+  // row's `siteId` resolves to one of that user's own workspaces.
+  //
+  // `founderEmail` is an UNVERIFIED string typed into an anonymous form, so it
+  // can never by itself say who owns the row: two people who type the same
+  // address are two people. This column is the only ownership claim any read
+  // may join on, and nothing derives it from `founderEmail` at read time.
+  //
+  // Nullable PERMANENTLY, not pending a backfill. A listing submitted by
+  // someone who never signs in has no owner for the life of the row, and that
+  // is a legitimate resting state: a backfill from `founderEmail` would assert
+  // a link nobody proved, which is the bug this column exists to remove.
+  ownerUserId    String?   @map("owner_user_id")
+  ownerLinkedAt  DateTime? @map("owner_linked_at")
+  createdAt      DateTime  @default(now()) @map("created_at")
+  updatedAt      DateTime  @updatedAt @map("updated_at")
+
+  @@unique([siteId, slug])
+  @@index([siteId, status])
+  // #5036 D7 — the concurrent-listing limit counts a founder's non-terminal
+  // rows on every submit, from an anonymous route. Indexed so a stranger
+  // cannot make that count a table scan.
+  @@index([siteId, founderEmail])
+  // The self-scoped read's whole WHERE clause (#5295) is `{ ownerUserId }` —
+  // the owner link IS the scope, so no site term joins it. Single-column by
+  // design: the promotion match (`founderEmail` + `siteId` + null owner) is
+  // already served by the (site_id, founder_email) index above.
+  @@index([ownerUserId])
+  @@map("project_listings")
+}
+
+/// ConsentGrant — one person's answer to one consent purpose, with the exact
+/// wording they read (#5275). APPEND-ONLY: current state is the newest row
+/// per (subject, purpose), so a later withdrawal never destroys the evidence
+/// of the earlier grant (D9) — no `updatedAt`, and deliberately NO unique
+/// constraint on subject + purpose. DECLINES ARE STORED as `granted: false`
+/// (D8): an absent row cannot distinguish "they said no" from "we never
+/// asked", and on an optional purpose that distinction is the only thing the
+/// record is for. The subject is a type + id pair of plain scalars
+/// (`project_listing` / `subscriber` / …) with NO cross-namespace @relation
+/// (D10, ADR 0009 invariant 1) — which is what lets a new surface adopt
+/// consent with a service call and no migration. `statement` is the resolved
+/// text DENORMALIZED at write time (D7): a pointer into the site's config row
+/// would prove nothing once that row is edited, and `statementHash` groups
+/// identical wordings. `locale` is the locale the statement was actually
+/// served in, not the one requested. `purposeId` is the site-config registry
+/// id — the join key across surfaces. Written only by
+/// apps/api/src/services/consent.ts.
+model ConsentGrant {
+  id            String   @id @default(dbgenerated("('cnsnt_'::text || (uuidv7())::text)")) @db.Text
+  siteId        String   @map("site_id")
+  subjectType   String   @map("subject_type")
+  subjectId     String   @map("subject_id")
+  purposeId     String   @map("purpose_id")
+  granted       Boolean
+  locale        String
+  statement     String   @db.Text
+  statementHash String   @map("statement_hash")
+  createdAt     DateTime @default(now()) @map("created_at")
+
+  // "What did this subject agree to" — every row for one subject, newest last.
+  @@index([siteId, subjectType, subjectId])
+  // "Who agreed to this purpose" — the cross-surface count the id exists for (D1/D2).
+  @@index([siteId, purposeId])
+  @@map("consent_grants")
+}

package/templates/database/jest.config.cjs

@@ -6,6 +6,14 @@ module.exports = {
   testPathIgnorePatterns: ["/node_modules/", "/generated/"],
   moduleFileExtensions: ["ts", "js", "json"],
   moduleNameMapper: {
+    // Map the validation workspace package to its TypeScript source so
+    // ts-jest compiles it directly (#3958) — mirrors apps/api/jest.config.cjs's
+    // identical mapping. The published dist is ESM-only and this package's
+    // CJS ts-jest transform can't load it; database/flows/presets.ts's test
+    // needs the real flowConfigSchema value at runtime (a value import, not a
+    // type-only one — unlike ../tenancy.ts's `import type { Id }` from
+    // @working-theory/ids, which erases to nothing and needs no mapping).
+    "^@working-theory/validation$": "<rootDir>/../packages/validation/src/index.ts",
     "^(\\.{1,2}/.*)\\.js$": "$1",
   },
   transform: {