create-ailk 0.23.0 → 0.25.1

package/templates/database/config/schema.prisma

@@ -1,441 +0,0 @@
-// config namespace — site-wide settings and customer configuration (ADR-0009).
-//
-// SiteSetting is the site-wide key-value config store. Generator + datasource
-// live in database/schema.prisma (the folder's single config file).
-//
-// The three site-config models (WorkspaceTheme / WorkspaceSiteIdentity /
-// WorkspaceSEO) are workspace-scoped: keyed on a plain `workspaceId String` with
-// NO cross-namespace @relation to auth/Workspace (a stable-ID per ADR-0009
-// invariant #1). Cross-namespace integrity + cascade are the service layer's
-// (ADR-0009 D3), delivered by the Phase 4 workspace-scoped write surface. Every
-// model here is fenced by the architecture.yaml tenant-scope forbidden-pattern.
-//
-// SiteSetting and SiteListingConfig also carry the #6374 tenancy fence. The
-// placement rule stated in database/inbox/schema.prisma's header applies
-// here verbatim: `workspaceId` goes on the line immediately after `siteId`
-// (immediately after `id` where there is no `siteId`), and no comment
-// written for it contains a closing curly, because the drift guard's
-// model-body collector stops at the first one.
-
-/// SiteSetting - Key-value settings for the customer site
-/// Use for: feature flags, custom config, cached Platform data
-model SiteSetting {
-  id        String   @id @default(dbgenerated("('siteset_'::text || (uuidv7())::text)")) @db.Text
-  // #6374 D3 — the tenancy fence, in the shape this model's ABSENT site_id
-  // forces (operator disposition, 2026-09-20). This table is keyed BY the
-  // workspace: `key` loses its global @unique and the pair becomes unique
-  // instead, so two sellers may each hold a `feature_flags` row. Existing
-  // rows backfill to the SENTINEL workspace — a pre-fence row belonged to
-  // "the site", which is exactly what the alias `default` resolves to.
-  //
-  // The `key` TEXT itself does NOT change. `dunning-policy.ts` builds
-  // `commerce.dunning_policy:` + siteId from its UNRESOLVED siteId
-  // parameter, because this table never had a site_id column to scope by;
-  // the backfill leaves every key verbatim, so the read keeps building the
-  // key the same way and adds workspaceId from the resolver. Rebuilding the
-  // key from the RESOLVED id would match no row and silently hand every
-  // seller the built-in default policy.
-  //
-  // DO NOT MOVE this field — see the fence-fan-out note in
-  // database/inbox/schema.prisma's header: placement immediately after id is
-  // load-bearing, not cosmetic.
-  workspaceId String @map("workspace_id")
-  key       String   // "feature_flags", "cached_config", "custom_theme"
-  value     Json
-
-  createdAt DateTime @default(now()) @map("created_at")
-  updatedAt DateTime @updatedAt @map("updated_at")
-
-  @@unique([workspaceId, key])
-  @@index([workspaceId])
-  @@map("site_settings")
-}
-
-// ============================================================================
-// Workspace site config — workspace-scoped design-system persistence (#3641).
-//
-// Three tables, one per @working-theory/site-config schema. Each row stores the
-// Zod-validated JSON blob for a single workspace. Validation is enforced at the
-// API layer; the DB stores the already-validated blob in a Json column.
-//
-// Design decisions (site-config-reanchor-spec §3):
-//   - workspaceId is a plain String stable-ID — NO @relation to auth/Workspace
-//     (ADR-0009 invariant #1: no cross-namespace @relation).
-//   - One table per schema (not a polymorphic config table) — different update
-//     cadences + consumer access patterns.
-//   - Json column for the blob — schema evolves without a DB migration on change.
-//   - @unique(workspaceId) — one active record per workspace per config type.
-// ============================================================================
-
-/// WorkspaceTheme — per-workspace ThemeSchema blob (#3641)
-model WorkspaceTheme {
-  id          String   @id @default(dbgenerated("('theme_'::text || (uuidv7())::text)")) @db.Text
-  workspaceId String   @unique @map("workspace_id")
-  data        Json
-  createdAt   DateTime @default(now()) @map("created_at") @db.Timestamptz
-  updatedAt   DateTime @updatedAt @map("updated_at") @db.Timestamptz
-
-  @@map("workspace_themes")
-}
-
-/// WorkspaceSiteIdentity — per-workspace SiteIdentitySchema blob (#3641).
-///
-/// #6254 AC-2 — carries `@@unique([id, workspaceId])`, a named Postgres
-/// unique constraint over a pair already unique today (`id` is the PK, so
-/// the pair is trivially unique too) — redundant now, load-bearing the
-/// moment `workspaceId` ever drops its own `@unique` above (§2.3 of
-/// docs/specs/6254-the-composite-fk-pattern-workspacesiteidentity-spec.md).
-/// It is NOT the target of a Prisma `@relation` from the inbox-namespace
-/// fenced models (Lead, ProjectListing, FlowDefinition, FlowSession):
-/// ADR-0009 invariant #1 forbids a cross-namespace relation (this model is
-/// `config`, they are `inbox`), and `site_id` never holds this model's
-/// `siteid_<uuidv7>` id — it holds the WORKSPACE id, so a real FK would be
-/// unsatisfiable for every existing row. Those four models enforce
-/// site<->workspace agreement instead via a same-table equality CHECK
-/// (`<table>_workspace_site_agree`) — see database/inbox/schema.prisma and
-/// docs/database/namespaces.md.
-model WorkspaceSiteIdentity {
-  id          String   @id @default(dbgenerated("('siteid_'::text || (uuidv7())::text)")) @db.Text
-  workspaceId String   @unique @map("workspace_id")
-  data        Json
-  createdAt   DateTime @default(now()) @map("created_at") @db.Timestamptz
-  updatedAt   DateTime @updatedAt @map("updated_at") @db.Timestamptz
-
-  @@unique([id, workspaceId])
-  @@map("workspace_site_identities")
-}
-
-/// WorkspaceSEO — per-workspace SEOSchema blob (#3641)
-model WorkspaceSEO {
-  id          String   @id @default(dbgenerated("('seo_'::text || (uuidv7())::text)")) @db.Text
-  workspaceId String   @unique @map("workspace_id")
-  data        Json
-  createdAt   DateTime @default(now()) @map("created_at") @db.Timestamptz
-  updatedAt   DateTime @updatedAt @map("updated_at") @db.Timestamptz
-
-  @@map("workspace_seos")
-}
-
-/// WorkspaceMeetings — per-workspace MeetingsSchema blob: the operator's
-/// enabled-slug gate for meeting types (#6183 S9b, D1). Structurally
-/// identical to its three siblings above — same `@unique` key, same
-/// Json-column convention, validation at the API layer. The field-level
-/// `@map`s are load-bearing (not merely style, unlike the siblings' own
-/// comment implies): `prisma validate` accepts a model without them, and
-/// only `pnpm check:prisma-migration-drift` catches the resulting
-/// camelCase/snake_case mismatch against a hand-written migration — the
-/// exact class that shipped a P2022 on every `Appointment.noShow` write
-/// (#6162). Keep every `@map` in lockstep with the migration's column names.
-model WorkspaceMeetings {
-  id          String   @id @default(dbgenerated("('meet_'::text || (uuidv7())::text)")) @db.Text
-  workspaceId String   @unique @map("workspace_id")
-  data        Json
-  createdAt   DateTime @default(now()) @map("created_at") @db.Timestamptz
-  updatedAt   DateTime @updatedAt @map("updated_at") @db.Timestamptz
-
-  @@map("workspace_meetings")
-}
-
-/// WorkspacePieceStages — a workspace's declared piece stages, in order
-/// (#7877). One row per workspace, the WorkspaceMeetings shape; no row means
-/// the product default (apps/api, tenant-db.ts DEFAULT_PIECE_STAGES).
-model WorkspacePieceStages {
-  id          String   @id @default(dbgenerated("('pstages_'::text || (uuidv7())::text)")) @db.Text
-  workspaceId String   @unique @map("workspace_id")
-  stages      String[]
-  createdAt   DateTime @default(now()) @map("created_at") @db.Timestamptz
-  updatedAt   DateTime @updatedAt @map("updated_at") @db.Timestamptz
-
-  @@map("workspace_piece_stages")
-}
-
-/// SchedulingConnection — a workspace's own scheduling provider account
-/// (#7533 D1): the provider id, its credential and the per-connection webhook
-/// entry point + secret, so each workspace reads and receives bookings through
-/// its own account. One row per workspace, mirroring WorkspaceMeetings above:
-/// a plain `workspaceId @unique` scalar, no relation, no foreign key (ADR 0009
-/// invariant 1). The credential and the webhook secret are AES-256-GCM
-/// ciphertext (`v1.<iv>.<tag>.<ct>`) under SCHEDULING_CREDENTIAL_KEY, bound to
-/// the workspace and the column; only apps/api's
-/// services/scheduling/connections.ts reads or writes them. `webhookToken` is
-/// a 256-bit routing id, not an authenticator. `provider` has no CHECK — the
-/// API accepts only the ids its factory table knows. Keep every `@map` in
-/// lockstep with the migration's column names (see WorkspaceMeetings).
-model SchedulingConnection {
-  id                      String   @id @default(dbgenerated("('schconn_'::text || (uuidv7())::text)")) @db.Text
-  workspaceId             String   @unique @map("workspace_id")
-  provider                String   @db.VarChar(32)
-  credentialCiphertext    String   @map("credential_ciphertext") @db.Text
-  webhookToken            String   @unique @map("webhook_token") @db.VarChar(64)
-  webhookSecretCiphertext String   @map("webhook_secret_ciphertext") @db.Text
-  baseUrl                 String?  @map("base_url") @db.Text
-  createdAt               DateTime @default(now()) @map("created_at") @db.Timestamptz
-  updatedAt               DateTime @updatedAt @map("updated_at") @db.Timestamptz
-
-  @@map("scheduling_connections")
-}
-
-/// StripeConnection — an Organization's own Stripe account, by a restricted
-/// key (#8876 D1; contract docs/specs/8879-the-offerings-security-contract-key-spec.md
-/// C1). One row per Organization on the SchedulingConnection shape: a plain
-/// `organizationId @unique` scalar, no relation, no foreign key (ADR 0009
-/// invariant 1). In hub-and-spoke every workspace reads its Organization's
-/// one row; a single-tenant site's sentinel Organization holds its own — no
-/// workspace-scoped key column exists anywhere. The key and the webhook
-/// secret are `v1.<iv>.<tag>.<ct>` ciphertext (contract C2), written only by
-/// apps/api's services/offerings/connection.ts; the migration's envelope
-/// CHECKs refuse a value stored in clear. Every reader sees `mode` and
-/// `keyLast4` only. `webhookToken` is a 256-bit routing id, not an
-/// authenticator. Keep every `@map` in lockstep with the migration's column
-/// names (see WorkspaceMeetings).
-model StripeConnection {
-  id                      String    @id @default(dbgenerated("('stripecon_'::text || (uuidv7())::text)")) @db.Text
-  organizationId          String    @unique @map("organization_id")
-  mode                    String    @db.VarChar(8)
-  keyLast4                String    @map("key_last4") @db.VarChar(4)
-  credentialCiphertext    String    @map("credential_ciphertext") @db.Text
-  webhookToken            String    @unique @map("webhook_token") @db.VarChar(64)
-  webhookSecretCiphertext String?   @map("webhook_secret_ciphertext") @db.Text
-  liveAt                  DateTime? @map("live_at") @db.Timestamptz
-  createdAt               DateTime  @default(now()) @map("created_at") @db.Timestamptz
-  updatedAt               DateTime  @updatedAt @map("updated_at") @db.Timestamptz
-
-  @@map("stripe_connections")
-}
-
-/// OrganizationOfferings — the Stripe Products an Organization has switched
-/// on for its sites (#8876 D1, C2): the org-enabled set. Its own row, not a
-/// column on the connection, because disconnecting deletes the connection and
-/// keeps this set (contract C8). One row per Organization; no row is the
-/// empty set.
-model OrganizationOfferings {
-  id                String   @id @default(dbgenerated("('orgoffer_'::text || (uuidv7())::text)")) @db.Text
-  organizationId    String   @unique @map("organization_id")
-  enabledProductIds String[] @default([]) @map("enabled_product_ids")
-  createdAt         DateTime @default(now()) @map("created_at") @db.Timestamptz
-  updatedAt         DateTime @updatedAt @map("updated_at") @db.Timestamptz
-
-  @@map("organization_offerings")
-}
-
-/// WorkspaceOfferings — what one workspace shows of its Organization's
-/// enabled Products (#8876 D1): the shown set, Recommended per group, and the
-/// last-good Stripe snapshot anonymous readers serve (contract T7). One row
-/// per workspace, the WorkspaceMeetings shape. The two Recommended columns
-/// must name a shown product (a CHECK), and `snapshot` and `snapshotAt` are
-/// set together (a CHECK). `snapshot` is `offeringsSnapshotSchema`-shaped,
-/// validated on read and write, never trusted. `shownPriceIds` (#9070 D1) is
-/// the shown set at Price grain; empty means every Price of each shown
-/// Product, the grain of a row saved before #9070.
-model WorkspaceOfferings {
-  id                        String    @id @default(dbgenerated("('wsoffer_'::text || (uuidv7())::text)")) @db.Text
-  workspaceId               String    @unique @map("workspace_id")
-  shownProductIds           String[]  @default([]) @map("shown_product_ids")
-  shownPriceIds             String[]  @default([]) @map("shown_price_ids")
-  recommendedPlanProductId  String?   @map("recommended_plan_product_id")
-  recommendedAddonProductId String?   @map("recommended_addon_product_id")
-  snapshot                  Json?
-  snapshotAt                DateTime? @map("snapshot_at") @db.Timestamptz
-  createdAt                 DateTime  @default(now()) @map("created_at") @db.Timestamptz
-  updatedAt                 DateTime  @updatedAt @map("updated_at") @db.Timestamptz
-
-  @@map("workspace_offerings")
-}
-
-/// OfferingsCheckoutSession — the Offerings Checkout session record (#8930
-/// D1; contract docs/specs/8879-the-offerings-security-contract-key-spec.md
-/// A11, W5, A13). One row per Checkout Session the hub created, written
-/// before the checkout route answers, so the per-Organization webhook and the
-/// session read act only on a session this hub recorded — never on metadata
-/// alone. Exactly A11's six columns beside the id and createdAt; no
-/// updatedAt, because no path updates a record. Plain scalar keys, no
-/// relation, no foreign key (ADR 0009 invariant 1); the migration's CHECKs
-/// bound every column. Written and read only by apps/api's
-/// services/offerings/checkout-session-record.ts. Keep every `@map` in
-/// lockstep with the migration's column names (see WorkspaceMeetings).
-model OfferingsCheckoutSession {
-  id             String   @id @default(dbgenerated("('ocsess_'::text || (uuidv7())::text)")) @db.Text
-  sessionId      String   @unique @map("session_id") @db.Text
-  workspaceId    String   @map("workspace_id")
-  organizationId String   @map("organization_id")
-  priceId        String   @map("price_id") @db.VarChar(255)
-  lookupKey      String   @map("lookup_key") @db.VarChar(48)
-  mode           String   @db.VarChar(8)
-  createdAt      DateTime @default(now()) @map("created_at") @db.Timestamptz
-
-  @@map("offerings_checkout_sessions")
-}
-
-/// SiteListingConfig — per-SITE project-listings config blob (#5033).
-///
-/// The fourth site-config model, and the one keyed on `siteId` rather than
-/// `workspaceId`. `ProjectListing` is scoped by `siteId`, and its create path
-/// is anonymous (a public application form, no session) — at the moment a
-/// listing is created there is no workspace to resolve, so a tenant-guarded
-/// workspace config would be unreadable from the one place these values are
-/// needed. Otherwise identical to its three siblings above: `@unique` key,
-/// one Zod-validated JSON blob (`siteListingConfigSchema` in
-/// @working-theory/validation), validation at the API layer.
-///
-/// Carries the listing-window bounds and the featured switch — a site's own
-/// commercial terms, which is why they are here and not a constant in the
-/// published package. Never written from a request body; read server-side by
-/// the anonymous create handler.
-model SiteListingConfig {
-  id     String @id @default(dbgenerated("('sltcfg_'::text || (uuidv7())::text)")) @db.Text
-  siteId String @unique @map("site_id")
-  // #6374 — the tenancy fence, extended to this model (spec
-  // docs/specs/6374-the-fence-schema-wave-spec.md D1). NOT NULL, no
-  // Prisma relation directive (ADR-0009 invariant #1), and
-  // site_listing_configs_workspace_site_agree CHECK (workspace_id = site_id)
-  // — since siteId IS the resolved workspace id, Postgres itself rejects a
-  // row whose two columns disagree. Operator-seeded config: there is no
-  // create/upsert of this model in the tree, and its one read
-  // (apps/api/src/services/listing-config.ts) already resolves the alias.
-  // DO NOT MOVE this field — see the fence-fan-out note in
-  // database/inbox/schema.prisma's header: placement immediately after
-  // siteId is load-bearing, not cosmetic.
-  workspaceId String @map("workspace_id")
-
-  /// The site's PUBLIC site key (#5048 D2) — the addressing token an anonymous
-  /// application carries in place of a siteId, so the server resolves the site
-  /// rather than trusting a request body. Public by design: it ships in browser
-  /// JavaScript and in an agent's request, and grants nothing on its own.
-  ///
-  /// Nullable and @unique: a site that has not minted one is unreachable by key
-  /// and falls back to the single-tenant env path (AILK_LISTING_PUBLIC_KEY, see
-  /// apps/api/src/services/listing-config.ts), which is how the default
-  /// create-ailk scaffold works with no config row at all.
-  publicKey String? @unique @map("public_key")
-
-  data      Json
-  createdAt DateTime @default(now()) @map("created_at") @db.Timestamptz
-  updatedAt DateTime @updatedAt @map("updated_at") @db.Timestamptz
-
-  @@index([workspaceId])
-  @@map("site_listing_configs")
-}
-
-// ============================================================================
-// Usage-billing pricing/markup/model config (FEAT-047 P1.S2, #3710 — Epic
-// #3704). Per ADR 0009 D2 (roadmap §4), pricing/markup/model config lives in
-// `config`; balances/subscription/plan live in `auth` (see
-// database/auth/schema.prisma). organizationId is a plain String stable-id —
-// no @relation (ADR 0009 invariant 1). LlmModel.tier references ModelTier,
-// defined in database/content/schema.prisma (FEAT-047 P1.S1, #3709, spec
-// OQ-1) — an enum reference through the merged prismaSchemaFolder needs no
-// @relation, so this is not a cross-namespace FK; ModelTier is NOT
-// redefined here. Field roster ported from
-// docs/research/wt-billing-capture/schema.md.
-// ============================================================================
-
-/// BillingMode — org- vs individual-billed. Ported from the capture (schema.md
-/// § balance counters) for forward compatibility; no P1.S2 field consumes it
-/// yet (Organization's billing-mode projection is out of this spec's field
-/// roster — spec §2.1 item 1). Captured now so the enum name is stable when a
-/// later phase wires it.
-enum BillingMode {
-  INDIVIDUAL
-  ORGANIZATION
-}
-
-/// SubscriptionPaymentMode — how a Subscription is paid. Self-serve
-/// subscriptions default to CARD; Subscription.paymentMode is nullable
-/// (enterprise-only field, spec §5.3 — no business default invented).
-enum SubscriptionPaymentMode {
-  CARD
-  INVOICE
-}
-
-/// BillingCycle — MONTHLY vs YEARLY. Ported from the capture for forward
-/// compatibility; no P1.S2 field consumes it yet (Plan's Stripe price id is
-/// singular in this spec's field roster — a monthly/yearly price-id split is
-/// a future additive column, not invented here).
-enum BillingCycle {
-  MONTHLY
-  YEARLY
-}
-
-/// ContractType — how a Subscription's deal was made. Subscription.contractType
-/// is nullable (enterprise-only field — self-serve subscriptions leave it
-/// unset).
-enum ContractType {
-  SELF_SERVE
-  SALES_ASSISTED
-  ENTERPRISE
-}
-
-/// AiMarkupConfig — hierarchical per-org markup config: null provider+model =
-/// org default; null model = provider-wide; both set = model-specific
-/// (spec §2.1 item 5).
-model AiMarkupConfig {
-  id             String @id @default(dbgenerated("('markup_'::text || (uuidv7())::text)")) @db.Text
-  organizationId String @map("organization_id")
-  provider       String?
-  model          String?
-
-  markupPercent Decimal @map("markup_percent") @db.Decimal(5, 2)
-
-  createdAt DateTime @default(now()) @map("created_at")
-  updatedAt DateTime @updatedAt @map("updated_at")
-
-  @@unique([organizationId, provider, model])
-  @@map("ai_markup_configs")
-}
-
-/// LlmModelPricing — per-token provider rates, time-versioned by
-/// effectiveFrom/effectiveTo (spec §2.1 item 6).
-model LlmModelPricing {
-  id       String @id @default(dbgenerated("('llmprc_'::text || (uuidv7())::text)")) @db.Text
-  provider String
-  model    String
-
-  inputPricePerMillion       Decimal  @map("input_price_per_million") @db.Decimal(10, 4)
-  outputPricePerMillion      Decimal  @map("output_price_per_million") @db.Decimal(10, 4)
-  cachedInputPricePerMillion Decimal? @map("cached_input_price_per_million") @db.Decimal(10, 4)
-
-  effectiveFrom DateTime  @map("effective_from")
-  effectiveTo   DateTime? @map("effective_to")
-
-  createdAt DateTime @default(now()) @map("created_at")
-  updatedAt DateTime @updatedAt @map("updated_at")
-
-  @@unique([provider, model, effectiveFrom])
-  @@map("llm_model_pricing")
-}
-
-/// LlmModel — the active model catalog: tier, consumption weighting, context
-/// window (spec §2.1 item 7). provider+model is the natural key (not
-/// time-versioned, unlike LlmModelPricing — this is the current-state
-/// catalog row per model).
-model LlmModel {
-  id       String @id @default(dbgenerated("('llmmdl_'::text || (uuidv7())::text)")) @db.Text
-  provider String
-  model    String
-
-  tier                      ModelTier
-  consumptionMultiplier     Decimal   @default(1.0) @map("consumption_multiplier") @db.Decimal(5, 2)
-  chargeExtendedContextAt2x Boolean   @map("charge_extended_context_at_2x")
-  isAutoModel               Boolean   @map("is_auto_model")
-  defaultContext            Int       @map("default_context")
-  maxContext                Int       @map("max_context")
-
-  createdAt DateTime @default(now()) @map("created_at")
-  updatedAt DateTime @updatedAt @map("updated_at")
-
-  @@unique([provider, model])
-  @@map("llm_models")
-}
-
-/// HobbyResetTracker — drives the 90-day Hobby-tier reset (P4, spec §2.1
-/// item 8).
-model HobbyResetTracker {
-  id             String   @id @default(dbgenerated("('hbyrst_'::text || (uuidv7())::text)")) @db.Text
-  organizationId String   @unique @map("organization_id")
-  lastResetAt    DateTime @map("last_reset_at")
-  nextResetAt    DateTime @map("next_reset_at")
-
-  createdAt DateTime @default(now()) @map("created_at")
-
-  @@map("hobby_reset_trackers")
-}