create-ailk 0.1.0 → 0.2.0

package/templates/database/migrations/20260912120000_listing_owner_link/migration.sql

@@ -0,0 +1,49 @@
+-- The verified owner link on `project_listings` (#5295).
+--
+-- A listing carried `founder_email` and `lead_id` and no user link, so there
+-- was no query for "the listings belonging to this signed-in person". The only
+-- join available was a session's email against `founder_email` — and
+-- `founder_email` is an UNVERIFIED string typed into an anonymous form, so that
+-- join hands a stranger someone else's submission the first time two people
+-- type the same address. These two columns are the ownership claim instead.
+--
+-- Plain scalars, no foreign key into `users`: ADR 0009 invariant #1 forbids a
+-- relation across the namespace boundary, and `leads.promoted_user_id` /
+-- `promoted_at` (20260714000000_add_lead_promotion_fields) are the same shape
+-- for the same reason. The join is stable-id matching in the service layer.
+--
+-- `apps/api/src/services/listing-promotion.ts` is the sole writer, and it sets
+-- the pair only when all three of these hold:
+--   1. the reconciling user's OWN email is verified (`users.email_verified`) —
+--      never a claimed or session-asserted address;
+--   2. that verified address matches the row's `founder_email`;
+--   3. the row's `site_id` is one of that user's own tenant workspaces.
+-- Any one failing writes nothing.
+--
+-- NO BACKFILL, deliberately and permanently. Every existing row predates
+-- verification, so deriving `owner_user_id` from `founder_email` here would
+-- assert exactly the link nobody proved — the bug the column exists to remove.
+-- Existing rows stay null, and a listing submitted by someone who never signs
+-- in stays null for the life of the row: that is a legitimate resting state,
+-- not a backlog to clean up.
+--
+-- The index backs the self-scoped read's whole WHERE clause
+-- (`GET /v1/project-listings/me` — `owner_user_id = $1`, and nothing else: the
+-- owner link IS the scope, so no site term joins it). Single-column by design —
+-- the promotion match (`founder_email` + `site_id` + a null owner) is already
+-- served by the existing (site_id, founder_email) index.
+--
+-- Forward-additive only: both columns are nullable with no default, so every
+-- existing read and write is unaffected.
+--
+-- Rollback:
+--   DROP INDEX "project_listings_owner_user_id_idx";
+--   ALTER TABLE "project_listings" DROP COLUMN "owner_linked_at";
+--   ALTER TABLE "project_listings" DROP COLUMN "owner_user_id";
+
+-- AlterTable
+ALTER TABLE "project_listings" ADD COLUMN     "owner_user_id" TEXT,
+ADD COLUMN     "owner_linked_at" TIMESTAMP(3);
+
+-- CreateIndex
+CREATE INDEX "project_listings_owner_user_id_idx" ON "project_listings"("owner_user_id");

package/templates/database/ops/schema.prisma

@@ -0,0 +1,27 @@
+// ops namespace — AEO scores, audit log, analytics/telemetry (ADR-0009).
+//
+// Generator + datasource live in database/schema.prisma (the folder's single
+// config file); this file holds only model definitions.
+//
+// TelemetryRecord (vendor seat-usage telemetry) moved out of this namespace to
+// apps-paid/license-issuer/prisma/schema.prisma — the vendor service is the
+// table's sole writer and nothing in the product schema reads it, so it is a
+// vendor-owned concern rather than a product-schema model. See
+// docs/internal/proposals/agentic-services-control-plane-proposal.md.
+
+/// AuditLog — workspace-scoped "who did what, when" audit trail (queryable + retained).
+model AuditLog {
+  id          String   @id @default(dbgenerated("('audit_'::text || (uuidv7())::text)")) @db.Text
+  workspaceId String   @map("workspace_id") // tenant scope — stable-id ref, NO @relation (ADR-0009)
+  actorId     String   @map("actor_id") // who acted (a User / agent / system id) — stable-id ref
+  actorType   String   @map("actor_type") // "user" | "agent" | "system"
+  action      String // e.g. "workspace.settings.updated", "lead.deleted"
+  targetType  String?  @map("target_type") // what was acted on: "workspace" | "lead" | "user" | …
+  targetId    String?  @map("target_id") // stable-id ref to the target (nullable)
+  metadata    Json? // structured detail (before/after, request context)
+  createdAt   DateTime @default(now()) @map("created_at") @db.Timestamptz
+
+  @@index([workspaceId, createdAt(sort: Desc)])
+  @@index([workspaceId, targetType, targetId])
+  @@map("audit_logs")
+}

package/templates/database/package.json

@@ -1,6 +1,23 @@
 {
   "name": "@working-theory/database",
-  "version": "0.1.2",
+  "version": "0.20.0",
+  "license": "Apache-2.0",
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "schema.prisma",
+    "migrations",
+    "config",
+    "content",
+    "flows",
+    "auth",
+    "inbox",
+    "ops",
+    "tenancy.ts",
+    "prisma.config.ts"
+  ],
   "description": "AI Launch Kit database schema (single-tenant Prisma)",
   "type": "module",
   "main": "./dist/client/client.js",
@@ -15,28 +32,49 @@
       "types": "./dist/client/client.d.ts",
       "import": "./dist/client/client.js",
       "default": "./dist/client/client.js"
+    },
+    "./tenancy": {
+      "types": "./dist/tenancy.d.ts",
+      "import": "./dist/tenancy.js",
+      "default": "./dist/tenancy.js"
+    },
+    "./flows/presets": {
+      "types": "./dist/flows/presets.d.ts",
+      "import": "./dist/flows/presets.js",
+      "default": "./dist/flows/presets.js"
+    },
+    "./flows/listing-diagnostic": {
+      "types": "./dist/flows/listing-diagnostic.d.ts",
+      "import": "./dist/flows/listing-diagnostic.js",
+      "default": "./dist/flows/listing-diagnostic.js"
     }
   },
   "scripts": {
-    "build": "tsc -b tsconfig.build.json",
+    "lint": "tsx ../scripts/lint-package.ts",
+    "build": "tsc -b tsconfig.build.json && tsc -b tsconfig.tenancy.json && tsc -b tsconfig.flows.json",
     "db:generate": "prisma generate && pnpm run build",
     "db:migrate": "prisma migrate dev",
     "db:migrate:deploy": "prisma migrate deploy",
     "db:push": "prisma db push",
-    "db:seed": "prisma db seed",
+    "db:seed": "tsx seed.ts",
     "db:seed:test": "tsx seed-test.ts",
     "db:studio": "prisma studio",
     "test": "jest --config jest.config.cjs",
     "test:watch": "jest --config jest.config.cjs --watch"
   },
   "dependencies": {
-    "@prisma/client": "^7.8.0"
+    "@prisma/adapter-pg": "^7.8.0",
+    "@prisma/client": "^7.8.0",
+    "@working-theory/ids": "workspace:*",
+    "@working-theory/validation": "workspace:*"
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",
     "@types/node": "^22.20.0",
+    "@types/pg": "^8.20.0",
     "dotenv": "^17.4.2",
     "jest": "^30.4.2",
+    "pg": "^8.22.0",
     "prisma": "^7.8.0",
     "ts-jest": "^29.4.11",
     "tsx": "^4.22.4",

package/templates/database/prisma.config.ts

@@ -13,7 +13,7 @@ import "dotenv/config";
 import { defineConfig } from "prisma/config";
 
 export default defineConfig({
-  schema: "./schema.prisma",
+  schema: ".",
   datasource: {
     url: process.env.DATABASE_URL_NON_POOLED,
   },

package/templates/database/schema.prisma

@@ -3,19 +3,12 @@
 // MINIMAL BUT EXTENSIBLE - Only stores auth and customer extensions
 // All business data (leads, orders, analytics) lives on the Platform
 //
-// Tables (14 total — 11 auth/config + 3 inbox added in B1):
-//   - Better Auth (4): User, Session, Account, Verification    (post-#587)
-//   - API Auth (2): ApiToken, RefreshToken
-//   - OAuth (2): OAuthClient, OAuthAuthorization
-//   - Push (1): PushToken
-//   - Extensions (2): UserData, SiteSetting
-//   - Inbox (3): Lead, Subscriber, Callback  [namespace: database/inbox/]
-//
-// Aggregation strategy: Namespace-local schema files (e.g. database/inbox/schema.prisma)
-// define models canonically for lint and documentation. Those same models are
-// registered here so Prisma can generate from the single root schema.prisma.
-// Phase 2 (ADR 0009 D4) will migrate to prismaSchemaFolder once multi-file
-// generation is adopted repo-wide.
+// Schema layout: prismaSchemaFolder (ADR 0009 D4 Phase 2, #3607). Prisma reads
+// the whole database/ folder — each model is defined ONCE in its namespace file
+// (database/{auth,config,ops,inbox,content}/schema.prisma). This file holds ONLY
+// the single generator + datasource blocks — it is model-free (#3607 AC-1). The
+// former per-User site-config models (TenantTheme/TenantSiteIdentity/TenantSEO)
+// were re-anchored to the config namespace keyed on workspaceId (#3641).
 
 generator client {
   provider            = "prisma-client"
@@ -27,327 +20,26 @@ datasource db {
   provider = "postgresql"
 }
 
-// ============================================================================
-// Better Auth Models (Web Dashboard Authentication — #587)
-// ============================================================================
-
-/// User - Dashboard users (site owners, admins, end-users)
-///
-/// emailVerified is a Boolean per Better Auth's contract (NextAuth previously
-/// stored the verification timestamp as DateTime?). The five custom relations
-/// — ApiToken, RefreshToken, OAuthAuthorization, PushToken, UserData — keep
-/// their onDelete: Cascade semantics so user removal cleanly tears down all
-/// dependent rows.
-model User {
-  id            String    @id @default(cuid())
-  email         String    @unique
-  name          String?
-  image         String?
-  emailVerified Boolean   @default(false) @map("email_verified")
-
-  // Profile extensions
-  role          String    @default("user") // "user", "admin", "owner"
-
-  // Billing identity — provider-agnostic so Stripe is v1 value, not baked-in name.
-  // Webhook is the only writer (see apps/api/src/routes/webhooks/stripe.ts).
-  // #771 self-serve dashboard reads billingCustomerId for Stripe customer-portal URL.
-  billingProvider   String?  @map("billing_provider")    // "stripe"; future: "lemonsqueezy", "paddle"
-  billingCustomerId String?  @map("billing_customer_id") // cus_xxx (Stripe) or equivalent
-
-  // Subscription tier projection — derived from the Stripe webhook's product-aware
-  // routing (#898). Defaults to "free" until a customer.subscription.created event
-  // fires; flips to "pro" / "pro_plus" / etc. based on the line item's product.
-  // hasCarePlan is true only for pro_plus today; seatCount mirrors the line item
-  // quantity from Stripe's adjustable-quantity widget (1–50).
-  tier         String   @default("free")                  // "free" | "pro" | "pro_plus" | "enterprise" (retired "agency"/"commercial" rows migrated to "enterprise" — #3516)
-  hasCarePlan  Boolean  @default(false) @map("has_care_plan")
-  seatCount    Int      @default(1) @map("seat_count")
-
-  createdAt     DateTime  @default(now()) @map("created_at")
-  updatedAt     DateTime  @updatedAt @map("updated_at")
-
-  // Better Auth relations
-  sessions      Session[]
-  accounts      Account[]
-
-  // API & OAuth
-  apiTokens           ApiToken[]
-  refreshTokens       RefreshToken[]
-  oauthAuthorizations OAuthAuthorization[]
-  pushTokens          PushToken[]
-
-  // Extensions
-  userData      UserData[]
-
-  // Theme Wiring (TWP3-MAT #1359)
-  tenantTheme        TenantTheme?
-  tenantSiteIdentity TenantSiteIdentity?
-  tenantSeo          TenantSEO?
-
-  @@unique([billingProvider, billingCustomerId])
-  @@map("users")
-}
-
-/// Session - Active user sessions (Better Auth schema)
-///
-/// Session.token is the opaque cookie value the dual-mode preHandler reads.
-/// Deleting a row revokes the session; deleting the parent User cascades.
-model Session {
-  id        String   @id
-  expiresAt DateTime @map("expires_at")
-  token     String   @unique
-  createdAt DateTime @default(now()) @map("created_at")
-  updatedAt DateTime @updatedAt @map("updated_at")
-  ipAddress String?  @map("ip_address")
-  userAgent String?  @map("user_agent")
-  userId    String   @map("user_id")
-
-  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
-
-  @@index([userId])
-  @@index([token])
-  @@map("sessions")
-}
-
-/// Account - OAuth provider connections (Google, GitHub, etc.)
-///
-/// Better Auth's account shape: one row per (providerId, accountId) pair.
-/// Cascade on User removal keeps OAuth links from orphaning.
-model Account {
-  id                    String    @id
-  accountId             String    @map("account_id")
-  providerId            String    @map("provider_id")
-  userId                String    @map("user_id")
-  accessToken           String?   @map("access_token") @db.Text
-  refreshToken          String?   @map("refresh_token") @db.Text
-  idToken               String?   @map("id_token") @db.Text
-  accessTokenExpiresAt  DateTime? @map("access_token_expires_at")
-  refreshTokenExpiresAt DateTime? @map("refresh_token_expires_at")
-  scope                 String?
-  password              String?
-  createdAt             DateTime  @default(now()) @map("created_at")
-  updatedAt             DateTime  @updatedAt @map("updated_at")
-
-  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
-
-  @@unique([providerId, accountId])
-  @@index([userId])
-  @@map("accounts")
-}
-
-/// Verification - Email / magic-link verification tokens (Better Auth schema)
-model Verification {
-  id         String   @id
-  identifier String
-  value      String
-  expiresAt  DateTime @map("expires_at")
-  createdAt  DateTime @default(now()) @map("created_at")
-  updatedAt  DateTime @updatedAt @map("updated_at")
-
-  @@index([identifier])
-  @@map("verifications")
-}
-
 // ============================================================================
 // API Token Authentication (Mobile Apps, CLI, External Clients)
 // ============================================================================
 
-/// ApiToken - Bearer tokens for non-web clients (mobile apps, API integrations)
-model ApiToken {
-  id          String    @id @default(cuid())
-  userId      String    @map("user_id")
-  
-  // Token identification
-  name        String    // "iPhone", "Android App", "API Integration"
-  token       String    @unique // Hashed token
-  tokenPrefix String    @map("token_prefix") // First 8 chars for identification
-  
-  // Client info
-  clientType  String    @default("api") @map("client_type") // "mobile", "api", "cli"
-  deviceInfo  String?   @map("device_info") // "iPhone 15 Pro", "Android 14"
-  
-  // Permissions
-  scopes      String[]  @default([]) // ["read:profile", "write:data"]
-  
-  // Lifecycle
-  expiresAt   DateTime? @map("expires_at")
-  lastUsedAt  DateTime? @map("last_used_at")
-  lastUsedIp  String?   @map("last_used_ip")
-  revokedAt   DateTime? @map("revoked_at")
-  
-  createdAt   DateTime  @default(now()) @map("created_at")
-
-  user          User           @relation(fields: [userId], references: [id], onDelete: Cascade)
-  refreshTokens RefreshToken[]
-
-  @@index([userId])
-  @@index([token])
-  @@index([tokenPrefix])
-  @@map("api_tokens")
-}
-
-/// RefreshToken - Long-lived tokens for mobile session refresh
-model RefreshToken {
-  id          String    @id @default(cuid())
-  userId      String    @map("user_id")
-  apiTokenId  String    @map("api_token_id")
-  
-  token       String    @unique // Hashed
-  
-  // Lifecycle
-  expiresAt   DateTime  @map("expires_at")
-  usedAt      DateTime? @map("used_at")      // Last time used to get new access token
-  revokedAt   DateTime? @map("revoked_at")
-  
-  createdAt   DateTime  @default(now()) @map("created_at")
-
-  user     User     @relation(fields: [userId], references: [id], onDelete: Cascade)
-  apiToken ApiToken @relation(fields: [apiTokenId], references: [id], onDelete: Cascade)
-
-  @@index([userId])
-  @@index([apiTokenId])
-  @@index([token])
-  @@map("refresh_tokens")
-}
-
 // ============================================================================
 // OAuth 2.0 (ChatGPT Plugin, Slack Bot, External Integrations)
 // ============================================================================
 
-/// OAuthClient - Registered OAuth applications (ChatGPT, Slack, etc.)
-model OAuthClient {
-  id           String   @id @default(cuid())
-  
-  // Client identification
-  name         String   // "ChatGPT Plugin", "Slack Bot"
-  description  String?
-  logoUrl      String?  @map("logo_url")
-  
-  // OAuth credentials
-  clientId     String   @unique @map("client_id")   // Public identifier
-  clientSecret String   @map("client_secret")       // Hashed secret
-  
-  // OAuth config
-  redirectUris String[] @map("redirect_uris")       // Allowed callback URLs
-  scopes       String[] @default([])                // Allowed scopes
-  
-  // Settings
-  enabled      Boolean  @default(true)
-  trusted      Boolean  @default(false)             // Skip consent screen
-  
-  createdAt    DateTime @default(now()) @map("created_at")
-  updatedAt    DateTime @updatedAt @map("updated_at")
-
-  authorizations OAuthAuthorization[]
-
-  @@map("oauth_clients")
-}
-
-/// OAuthAuthorization - User grants to OAuth clients
-model OAuthAuthorization {
-  id            String   @id @default(cuid())
-  userId        String   @map("user_id")
-  clientId      String   @map("client_id")
-  
-  // Granted scopes (may be subset of client's allowed scopes)
-  scopes        String[]
-  
-  // Tokens
-  accessToken   String   @unique @map("access_token")   // Hashed
-  refreshToken  String?  @unique @map("refresh_token")  // Hashed
-  
-  // Lifecycle
-  expiresAt     DateTime @map("expires_at")
-  revokedAt     DateTime? @map("revoked_at")
-  
-  createdAt     DateTime @default(now()) @map("created_at")
-  updatedAt     DateTime @updatedAt @map("updated_at")
-
-  user   User        @relation(fields: [userId], references: [id], onDelete: Cascade)
-  client OAuthClient @relation(fields: [clientId], references: [id], onDelete: Cascade)
-
-  @@unique([userId, clientId])
-  @@index([userId])
-  @@index([clientId])
-  @@index([accessToken])
-  @@map("oauth_authorizations")
-}
-
 // ============================================================================
 // Push Notifications (Mobile Apps, Web Push)
 // ============================================================================
 
-/// PushToken - Device tokens for push notifications
-model PushToken {
-  id          String   @id @default(cuid())
-  userId      String   @map("user_id")
-  
-  // Token details
-  token       String   @unique              // FCM or APNs token
-  platform    String                        // "ios", "android", "web"
-  
-  // Device info
-  deviceId    String?  @map("device_id")    // Unique device identifier
-  deviceName  String?  @map("device_name")  // "iPhone 15 Pro"
-  appVersion  String?  @map("app_version")  // "1.2.3"
-  
-  // Status
-  enabled     Boolean  @default(true)
-  failedAt    DateTime? @map("failed_at")   // Last delivery failure
-  failCount   Int      @default(0) @map("fail_count")
-  
-  createdAt   DateTime @default(now()) @map("created_at")
-  updatedAt   DateTime @updatedAt @map("updated_at")
-
-  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
-
-  @@index([userId])
-  @@index([platform])
-  @@map("push_tokens")
-}
-
 // ============================================================================
 // User Data Extensions (Customer Customizations)
 // ============================================================================
 
-/// UserData - Flexible key-value storage for customer extensions
-/// Use this for: preferences, saved items, custom fields, feature flags
-model UserData {
-  id        String   @id @default(cuid())
-  userId    String   @map("user_id")
-  
-  // Key-value storage
-  key       String   // "preferences", "saved_products", "notification_settings"
-  value     Json     // Flexible JSON storage
-  
-  createdAt DateTime @default(now()) @map("created_at")
-  updatedAt DateTime @updatedAt @map("updated_at")
-
-  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
-
-  @@unique([userId, key])
-  @@index([userId])
-  @@index([key])
-  @@map("user_data")
-}
-
 // ============================================================================
 // Site Settings (Site-wide Configuration)
 // ============================================================================
 
-/// SiteSetting - Key-value settings for the customer site
-/// Use for: feature flags, custom config, cached Platform data
-model SiteSetting {
-  id        String   @id @default(cuid())
-  key       String   @unique // "feature_flags", "cached_config", "custom_theme"
-  value     Json
-
-  createdAt DateTime @default(now()) @map("created_at")
-  updatedAt DateTime @updatedAt @map("updated_at")
-
-  @@map("site_settings")
-}
-
 // ============================================================================
 // Inbox Namespace (database/inbox/schema.prisma — B1)
 //
@@ -356,132 +48,24 @@ model SiteSetting {
 // through apps/api/src/services/ (D3).
 // ============================================================================
 
-/// Lead - anonymous lead submission (Phase B submit_lead tool / B6 route)
-model Lead {
-  id        String   @id @default(cuid())
-  siteId    String   @map("site_id")
-  source    String
-  email     String
-  payload   Json
-  createdAt DateTime @default(now()) @map("created_at")
-
-  @@index([siteId])
-  @@index([createdAt])
-  @@map("leads")
-}
-
-/// Subscriber - newsletter subscription (Phase B subscribe_newsletter tool / B6 route)
-model Subscriber {
-  id        String   @id @default(cuid())
-  siteId    String   @map("site_id")
-  email     String
-  source    String
-  createdAt DateTime @default(now()) @map("created_at")
-
-  @@unique([siteId, email])
-  @@index([siteId])
-  @@map("subscribers")
-}
-
-/// Callback - callback request (Phase B request_callback tool / B6 route)
-model Callback {
-  id            String   @id @default(cuid())
-  siteId        String   @map("site_id")
-  name          String
-  phone         String
-  preferredTime String?  @map("preferred_time")
-  payload       Json
-  createdAt     DateTime @default(now()) @map("created_at")
-
-  @@index([siteId])
-  @@index([createdAt])
-  @@map("callbacks")
-}
-
 // ============================================================================
-// License Telemetry (apps-paid/license-issuer — S2 #1031)
+// Tenancy — multi-tenant module (database/auth/schema.prisma — FEAT-042)
 //
-// Time-series records of opt-in seat-usage telemetry from customer deployments.
-// Written by POST /telemetry on the license-issuer when AILK_TELEMETRY=1.
-// Enables queries computing the distribution of active_user_count / seat_count
-// across the customer base over a time window (S2 trigger condition monitoring).
-//
-// No PII beyond customer_id (Stripe customer ID — pseudo-anonymous).
+// Organization → Workspace → Membership. Same-namespace @relation to User is
+// allowed (auth namespace: identity + tenancy membership per ADR 0009).
+// Organization/Membership/Invitation are managed by the Better Auth
+// organization plugin (apps/workspace auth config); Workspace is AILK's own
+// model (plugin teams feature rejected — per-team membership contradicts
+// org-level membership; see docs/research/ploy-capture/lessons/).
 // ============================================================================
 
-/// TelemetryRecord - opt-in seat-usage telemetry from customer deployments.
-///
-/// timestamp is the client-side observation time (from the telemetry payload).
-/// recordedAt is the server-side receipt time (default now()).
-/// The (customerId, recordedAt DESC) index supports "latest record per customer"
-/// queries; the recordedAt DESC index supports time-window aggregate queries.
-model TelemetryRecord {
-  id              String   @id @default(cuid())
-  customerId      String   @map("customer_id")
-  activeUserCount Int      @map("active_user_count")
-  seatCount       Int      @map("seat_count")
-  timestamp       DateTime
-  recordedAt      DateTime @default(now()) @map("recorded_at")
-
-  @@index([customerId, recordedAt(sort: Desc)])
-  @@index([recordedAt(sort: Desc)])
-  @@map("telemetry_records")
-}
-
 // ============================================================================
-// Theme Wiring — Per-tenant design system persistence (TWP3-MAT #1359)
-//
-// Three tables, one per @working-theory/site-config schema. Each row stores the
-// Zod-validated JSON blob for a single tenant (identified by userId from the
-// Better Auth session). Validation is enforced at the API layer; the DB stores
-// the already-validated blob in a Json column.
+// Chat/Artifact substrate (database/content/schema.prisma)
 //
-// Design decisions (spec §3):
-//   - One table per schema (not a polymorphic config table) — different update
-//     cadences + consumer access patterns.
-//   - Json column for the blob — schema evolves without DB migration on change;
-//     Zod validates at API boundary.
-//   - userId is the Better Auth User id — plain String FK; onDelete Cascade
-//     ensures rows are removed when the user account is deleted.
-//   - @@unique([userId]) enforces one active record per tenant per config type
-//     (upsert semantics at the API layer).
+// Event-sourced conversation transport + artifact persistence per
+// docs/research/ploy-capture/BACKEND-REQUIREMENTS.md. Every table carries a
+// non-null workspaceId tenant scope as a plain String — no cross-namespace
+// FK into auth (ADR 0009 invariant 1). Cross-namespace assembly (tenant
+// guard, unread counts per user) routes through apps/api/src/services/.
 // ============================================================================
 
-/// TenantTheme — per-tenant ThemeSchema blob (TWP3-MAT #1359)
-model TenantTheme {
-  id        String   @id @default(cuid())
-  userId    String   @unique @map("user_id")
-  data      Json
-  createdAt DateTime @default(now()) @map("created_at")
-  updatedAt DateTime @updatedAt @map("updated_at")
-
-  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
-
-  @@map("tenant_themes")
-}
-
-/// TenantSiteIdentity — per-tenant SiteIdentitySchema blob (TWP3-MAT #1359)
-model TenantSiteIdentity {
-  id        String   @id @default(cuid())
-  userId    String   @unique @map("user_id")
-  data      Json
-  createdAt DateTime @default(now()) @map("created_at")
-  updatedAt DateTime @updatedAt @map("updated_at")
-
-  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
-
-  @@map("tenant_site_identities")
-}
-
-/// TenantSEO — per-tenant SEOSchema blob (TWP3-MAT #1359)
-model TenantSEO {
-  id        String   @id @default(cuid())
-  userId    String   @unique @map("user_id")
-  data      Json
-  createdAt DateTime @default(now()) @map("created_at")
-  updatedAt DateTime @updatedAt @map("updated_at")
-
-  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
-
-  @@map("tenant_seos")
-}