create-ailk 0.24.0 → 0.25.1

package/templates/database/auth/schema.prisma

@@ -1,641 +0,0 @@
-// auth namespace — tenancy models (Organization, Workspace, Membership, Invitation)
-//
-// The multi-tenant module's Organization → Workspace → Membership layer
-// (FEAT-042). Per ADR 0009, the auth namespace's charter is identity + tenancy
-// membership, so these live beside User/Session — @relation to User is allowed
-// here (same namespace).
-//
-// Organization is the tenant boundary (members, billing, security key on
-// organizationId). Workspace is the working context (operational config + all
-// domain content key on workspaceId). Membership is org-level; workspace
-// visibility follows org membership (per-workspace ACL is a future additive
-// concern — do not add a workspace-member table without a new design pass).
-//
-// Organization / Membership / Invitation are managed by the Better Auth
-// organization plugin (apps/workspace auth config maps member → Membership via
-// modelName). Workspace is AILK's own model: the plugin's teams feature was
-// evaluated and rejected because setActiveTeam requires per-team membership
-// rows, contradicting org-level membership (see
-// docs/research/ploy-capture/lessons/better-auth-teams-rejected-for-workspaces.md).
-//
-// Generator + datasource blocks live in database/schema.prisma (the root schema
-// file). This file holds only model definitions for the auth-namespace tenancy
-// tables; the same models are registered in the root schema for generation.
-
-/// Role — membership role within an Organization. Hierarchy: owner > admin > member.
-/// Values are lowercase to match the Better Auth organization plugin's role
-/// strings ("owner" | "admin" | "member") so plugin writes pass Prisma enum
-/// validation unmapped. Distinct from User.role (a per-deployment String).
-enum Role {
-  owner
-  admin
-  member
-}
-
-/// Organization — the tenant boundary. Owns membership, billing, security.
-model Organization {
-  id        String   @id @default(dbgenerated("('org_'::text || (uuidv7())::text)")) @db.Text
-  name      String
-  slug      String   @unique
-  logo      String?
-  metadata  String?
-  createdAt DateTime @default(now()) @map("created_at")
-  updatedAt DateTime @updatedAt @map("updated_at")
-
-  // Org-level billing identity + tier/subscription projection (org-scoped
-  // billing, #3601). Mirrors the User billing shape (see User L134-144) at the
-  // Organization level: in a multi-tenant deployment the Organization is the
-  // billing entity (individuals are billed as orgs-of-one on their sentinel
-  // default Organization). The Stripe webhook is the only writer (see
-  // apps/api/src/routes/webhooks/stripe.ts, keyed on checkout
-  // metadata.organizationId). Single-tenant deployments keep User-scoped
-  // billing (User fields above) and never touch these.
-  billingProvider   String?  @map("billing_provider")     // "stripe"; provider-agnostic
-  billingCustomerId String?  @map("billing_customer_id")  // cus_xxx or equivalent
-  tier              String   @default("free")             // "free" | "pro" | "pro_plus" | "enterprise"
-  hasCarePlan       Boolean  @default(false) @map("has_care_plan")
-  seatCount         Int      @default(1) @map("seat_count")
-  // #9067 D13 — the one plan Checkout this Organization has open, recorded by
-  // POST /v1/billing/plan-checkout. The webhook binds billingCustomerId only
-  // for this session, into an empty column, and clears it. Server-side only.
-  planCheckoutSessionId String? @unique @map("plan_checkout_session_id")
-
-  // Usage-billing balance counters — the Company-counter live on-demand
-  // credit model (FEAT-047 P1.S2, #3710 — capture D6, NOT a CreditUsagePeriod
-  // ledger table). Same-namespace additions to the existing billing identity
-  // fields above — no new relation. Read/written by the credit waterfall
-  // (apps/api/src/services/usage-credits.ts, #3716, the sanctioned
-  // tenant-scope exception) and the entitlement resolver (P1.S3).
-  usageBillingEnabled        Boolean   @default(false) @map("usage_billing_enabled")
-  stripeUsageMeterItemId     String?   @map("stripe_usage_meter_item_id")
-  includedCreditsCents       Int       @default(0) @map("included_credits_cents")
-  includedCreditsUsedCents   Int       @default(0) @map("included_credits_used_cents")
-  onDemandLimitCents         Int?      @map("on_demand_limit_cents")
-  onDemandUsedCents          Int       @default(0) @map("on_demand_used_cents")
-  onDemandPrechargedCents    Int       @default(0) @map("on_demand_precharged_cents")
-  /// Carry-forward credit balance. DB CHECK `>= 0`
-  /// (`organizations_on_demand_credit_balance_non_negative`, migration
-  /// 20260714030000) — Prisma cannot model CHECK, so the migration is the
-  /// source of truth. Debited only via the credit waterfall's compare-and-swap
-  /// (apps/api/src/services/usage-credits.ts, #3730); a negative balance would
-  /// INVERT the debit and hand out free credits.
-  onDemandCreditBalanceCents Int       @default(0) @map("on_demand_credit_balance_cents")
-  creditsCycleEnd            DateTime? @map("credits_cycle_end")
-  limitAllocationMode        String    @default("COMPANY_WIDE") @map("limit_allocation_mode") // "COMPANY_WIDE" | "INDIVIDUAL"
-
-  memberships Membership[]
-  invitations Invitation[]
-  workspaces  Workspace[]
-  // #3591 — the agents (delegates) of this organization's members.
-  agents      Agent[]
-
-  @@unique([billingProvider, billingCustomerId])
-  @@map("organizations")
-}
-
-/// Workspace — working context under an Organization. URL scope for all
-/// domain content; operational config keys on workspaceId. Flat (org →
-/// workspaces): no nesting — a future positioning-entity tree is a separate
-/// feature and must not require tenancy rework.
-model Workspace {
-  id             String   @id @default(dbgenerated("('wksp_'::text || (uuidv7())::text)")) @db.Text
-  organizationId String   @map("organization_id")
-  name           String
-  slug           String
-  createdAt      DateTime @default(now()) @map("created_at")
-  updatedAt      DateTime @updatedAt @map("updated_at")
-
-  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
-  // #7532 — the hub's spoke registry rows bound to this workspace.
-  spokes       Spoke[]
-  // #3591 — the agents bound to this workspace.
-  agents       Agent[]
-  // #7803 — the people who last activated this workspace (User.lastWorkspaceId).
-  // Read and written only by apps/api/src/services/tenant-context.ts.
-  lastActiveUsers User[] @relation("UserLastWorkspace")
-
-  @@unique([organizationId, slug])
-  @@index([organizationId])
-  @@map("workspaces")
-}
-
-/// Spoke — one separately deployed site (a spoke) that calls this hub API
-/// server-to-server, bound to exactly ONE workspace (#7532, spec
-/// docs/specs/7532-a-spoke-s-public-reads-spec.md D1).
-///
-/// The spoke authenticates with a hub-minted key sent in `x-ailk-spoke-key`.
-/// Only the key's SHA-256 digest is stored (`credentialHash`) plus a short
-/// recognisable `credentialPrefix`; the key itself never is. Several rows may
-/// bind one workspace, so a key rotates by registering a second spoke and
-/// revoking the first. `revokedAt` set refuses the key on the next request.
-///
-/// Room to extend (operator amendment; built by neither this unit): REL-002's
-/// sign-in client and #7533's SchedulingConnection each add ONE nullable,
-/// unique column in their own migration, so a spoke stays one record.
-model Spoke {
-  id               String    @id @default(dbgenerated("('spoke_'::text || (uuidv7())::text)")) @db.Text
-  workspaceId      String    @map("workspace_id")
-  name             String    @db.VarChar(120)
-  credentialHash   String    @unique @map("credential_hash") @db.Char(64)
-  credentialPrefix String    @map("credential_prefix") @db.VarChar(24)
-  revokedAt        DateTime? @map("revoked_at")
-  createdAt        DateTime  @default(now()) @map("created_at")
-  updatedAt        DateTime  @updatedAt @map("updated_at")
-
-  workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade)
-
-  @@index([workspaceId])
-  @@map("spokes")
-}
-
-/// AgentPermissionLevel — an agent's ceiling (#3591, spec
-/// docs/specs/3591-tenant-scoped-agent-auth-secure-spec.md D1, D5). The agent
-/// acts with the LOWER of its person's `Role` and this. One value in v1;
-/// raising the ceiling later is a new value here and in
-/// `@working-theory/validation`'s `AGENT_PERMISSION_LEVELS`.
-enum AgentPermissionLevel {
-  member
-}
-
-/// Agent — a stored delegate of ONE person, bound to ONE workspace (#3591,
-/// spec docs/specs/3591-tenant-scoped-agent-auth-secure-spec.md D1, D2).
-///
-/// The agent signs in with a key (`ailk_agt_…`, shown once) and passes the
-/// same tenant guard a browser session does, through its person's live
-/// `Membership` (`responsibleMembershipId`). Removing that membership deletes
-/// the agent (the FK below), so a re-invite cannot revive it.
-///
-/// Only the key's SHA-256 digest is stored (`credentialHash`) plus a short
-/// recognisable `credentialPrefix`; the key itself never is.
-/// `keyIssuedToMembershipId` is the owner or admin who created or last
-/// re-keyed the agent — the only person who has seen its key. Removing that
-/// membership sets the column null and the guard refuses the agent until it
-/// is re-keyed. `createdByUserId` is a plain column with no relation, so
-/// deleting the creator does not delete the agents they made for others.
-/// `apps/api/src/lib/agent-store.ts` is the only file that names
-/// `prisma.agent`.
-///
-/// `grants` (#7864, spec docs/specs/7864-agent-key-grants-spec.md D2, D3)
-/// lists the permissions an owner or admin granted this agent one by one —
-/// only the seven `@working-theory/validation` names in
-/// `AGENT_GRANTABLE_PERMISSIONS` (content-edit, content-publish, assets-write,
-/// magnets-manage, meeting-types-manage, people-read since #852,
-/// member-pieces-manage since #7878), held to that set by the
-/// `agents_grants_allowed` CHECK. A grant never raises the ceiling above. The
-/// agent holds a stored grant only while its person's own role holds it too:
-/// the tenant guards clamp it on every request, so a demoted person's agent
-/// keeps the row but loses the permission.
-model Agent {
-  id                      String               @id @default(dbgenerated("('agent_'::text || (uuidv7())::text)")) @db.Text
-  organizationId          String               @map("organization_id")
-  workspaceId             String               @map("workspace_id")
-  responsibleMembershipId String               @map("responsible_membership_id")
-  name                    String               @db.VarChar(80)
-  permissionLevel         AgentPermissionLevel @default(member) @map("permission_level")
-  grants                  String[]             @default([]) @map("grants")
-  enabled                 Boolean              @default(true)
-  credentialHash          String               @unique @map("credential_hash") @db.Char(64)
-  credentialPrefix        String               @map("credential_prefix") @db.VarChar(24)
-  lastActiveAt            DateTime?            @map("last_active_at")
-  createdByUserId         String               @map("created_by_user_id")
-  keyIssuedToMembershipId String?              @map("key_issued_to_membership_id")
-  createdAt               DateTime             @default(now()) @map("created_at")
-  updatedAt               DateTime             @updatedAt @map("updated_at")
-
-  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
-  workspace    Workspace    @relation(fields: [workspaceId], references: [id], onDelete: Cascade)
-  responsible  Membership   @relation("AgentResponsible", fields: [responsibleMembershipId], references: [id], onDelete: Cascade)
-  keyIssuedTo  Membership?  @relation("AgentKeyIssuedTo", fields: [keyIssuedToMembershipId], references: [id], onDelete: SetNull)
-
-  @@index([organizationId])
-  @@index([workspaceId])
-  @@index([responsibleMembershipId])
-  @@map("agents")
-}
-
-/// Membership — User ↔ Organization with a Role. Managed by the Better Auth
-/// organization plugin (modelName "membership"). Org-level: grants visibility
-/// into every workspace of the organization.
-model Membership {
-  id             String   @id @default(dbgenerated("('member_'::text || (uuidv7())::text)")) @db.Text
-  organizationId String   @map("organization_id")
-  userId         String   @map("user_id")
-  role           Role     @default(member)
-  createdAt      DateTime @default(now()) @map("created_at")
-
-  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
-  user         User         @relation(fields: [userId], references: [id], onDelete: Cascade)
-  // #3591 — the agents this person is responsible for, and the agents whose
-  // current key this person was the one shown.
-  agents          Agent[] @relation("AgentResponsible")
-  agentKeysIssued Agent[] @relation("AgentKeyIssuedTo")
-
-  @@unique([organizationId, userId])
-  @@index([userId])
-  @@index([organizationId])
-  @@map("memberships")
-}
-
-/// Invitation — pending invite of an email address into an Organization.
-/// Managed by the Better Auth organization plugin. status:
-/// "pending" | "accepted" | "rejected" | "canceled".
-model Invitation {
-  id             String    @id @default(dbgenerated("('invite_'::text || (uuidv7())::text)")) @db.Text
-  organizationId String    @map("organization_id")
-  email          String
-  role           Role      @default(member)
-  status         String    @default("pending")
-  expiresAt      DateTime? @map("expires_at")
-  inviterId      String    @map("inviter_id")
-  createdAt      DateTime  @default(now()) @map("created_at")
-
-  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
-  inviter      User         @relation("sent_invitations", fields: [inviterId], references: [id], onDelete: Cascade)
-
-  @@index([organizationId])
-  @@index([email])
-  @@map("invitations")
-}
-
-// ============================================================================
-// Usage-billing balances/subscription/plan (FEAT-047 P1.S2, #3710 — Epic
-// #3704). Per ADR 0009 D2 (roadmap §4), billing balances/subscription/plan
-// live in `auth` (identity+tenancy charter); pricing/markup/model config
-// lives in `config` (see database/config/schema.prisma). organizationId is a
-// plain String stable-id — no @relation to Organization, even though both
-// live in this namespace (spec D4: cross-namespace assembly + billing writes
-// are keyed on explicit id, not relation traversal — mirrors the sanctioned
-// usage-credits.ts / entitlements.ts / webhooks/stripe.ts read/write shape).
-// Field roster ported from docs/research/wt-billing-capture/schema.md.
-// ============================================================================
-
-/// Subscription — one per Organization; the plan link + Stripe subscription
-/// identity + enterprise contract terms. contractType/paymentMode are
-/// nullable — "enterprise contract fields" only apply to sales-assisted /
-/// enterprise deals; a self-serve subscription leaves them unset (no
-/// business default invented — see spec §5.3).
-model Subscription {
-  id             String @id @default(dbgenerated("('orgsub_'::text || (uuidv7())::text)")) @db.Text
-  organizationId String @unique @map("organization_id")
-  planId         String @map("plan_id")
-
-  stripeSubscriptionId String? @map("stripe_subscription_id")
-  stripePriceId        String? @map("stripe_price_id")
-  stripeCustomerId     String? @map("stripe_customer_id")
-
-  contractType       ContractType?            @map("contract_type")
-  netTermsDays       Int?                     @map("net_terms_days")
-  contractValueCents Int?                     @map("contract_value_cents")
-  paymentMode        SubscriptionPaymentMode? @map("payment_mode")
-
-  createdAt DateTime @default(now()) @map("created_at")
-  updatedAt DateTime @updatedAt @map("updated_at")
-
-  @@map("subscriptions")
-}
-
-/// Plan — the plan catalog (allowances, limits, Stripe price). Global
-/// (not org-scoped) — the definitions a Subscription.planId references by
-/// stable id, no @relation (spec D4).
-model Plan {
-  id    String @id @default(dbgenerated("('plan_'::text || (uuidv7())::text)")) @db.Text
-  slug  String @unique
-  tier  Int
-
-  baseTokens               Int     @map("base_tokens")
-  // Decimal, never Float: usageMultiplier scales a money amount. DOUBLE
-  // PRECISION admits NaN/Infinity, and NaN compares false against every
-  // spend-limit comparison — a float here fails OPEN past the limit gate.
-  // Matches the sibling money-multiplier convention (LlmModel.
-  // consumptionMultiplier, database/config/schema.prisma).
-  usageMultiplier          Decimal @map("usage_multiplier") @db.Decimal(5, 2)
-  isPooled                 Boolean @map("is_pooled")
-  monthlyDollarCreditCents Int     @map("monthly_dollar_credit_cents")
-
-  features Json
-  limits   Json
-
-  stripePriceId String? @map("stripe_price_id")
-
-  createdAt DateTime @default(now()) @map("created_at")
-  updatedAt DateTime @updatedAt @map("updated_at")
-
-  @@map("plans")
-}
-
-/// UsageSettings — one per Organization; the usage-based-billing opt-in +
-/// monthly spend-limit gate (read by the spend-limit check, P2).
-model UsageSettings {
-  id             String @id @default(dbgenerated("('usgset_'::text || (uuidv7())::text)")) @db.Text
-  organizationId String @unique @map("organization_id")
-
-  usageBasedBillingEnabled Boolean @default(false) @map("usage_based_billing_enabled")
-  monthlySpendLimitCents   Int?    @map("monthly_spend_limit_cents")
-
-  createdAt DateTime @default(now()) @map("created_at")
-  updatedAt DateTime @updatedAt @map("updated_at")
-
-  @@map("usage_settings")
-}
-
-
-// === Relocated from root schema.prisma (ADR-0009 D4 Phase 2, #3607) ===
-
-/// User - Dashboard users (site owners, admins, end-users)
-///
-/// emailVerified is a Boolean per Better Auth's contract (NextAuth previously
-/// stored the verification timestamp as DateTime?). The five custom relations
-/// — ApiToken, RefreshToken, OAuthAuthorization, PushToken, UserData — keep
-/// their onDelete: Cascade semantics so user removal cleanly tears down all
-/// dependent rows.
-model User {
-  id            String    @id @default(dbgenerated("('user_'::text || (uuidv7())::text)")) @db.Text
-  email         String    @unique
-  name          String?
-  image         String?
-  emailVerified Boolean   @default(false) @map("email_verified")
-
-  // Profile extensions
-  role          String    @default("user") // "user", "admin", "owner"
-
-  // Billing identity — provider-agnostic so Stripe is v1 value, not baked-in name.
-  // Webhook is the only writer (see apps/api/src/routes/webhooks/stripe.ts).
-  // #771 self-serve dashboard reads billingCustomerId for Stripe customer-portal URL.
-  billingProvider   String?  @map("billing_provider")    // "stripe"; future: "lemonsqueezy", "paddle"
-  billingCustomerId String?  @map("billing_customer_id") // cus_xxx (Stripe) or equivalent
-
-  // Subscription tier projection — derived from the Stripe webhook's product-aware
-  // routing (#898). Defaults to "free" until a customer.subscription.created event
-  // fires; flips to "pro" / "pro_plus" / etc. based on the line item's product.
-  // hasCarePlan is true only for pro_plus today; seatCount mirrors the line item
-  // quantity from Stripe's adjustable-quantity widget (1–50).
-  tier         String   @default("free")                  // "free" | "pro" | "pro_plus" | "enterprise" (retired "agency"/"commercial" rows migrated to "enterprise" — #3516)
-  hasCarePlan  Boolean  @default(false) @map("has_care_plan")
-  seatCount    Int      @default(1) @map("seat_count")
-
-  createdAt     DateTime  @default(now()) @map("created_at")
-  updatedAt     DateTime  @updatedAt @map("updated_at")
-
-  // Better Auth relations
-  sessions      Session[]
-  accounts      Account[]
-
-  // API & OAuth
-  apiTokens           ApiToken[]
-  refreshTokens       RefreshToken[]
-  oauthAuthorizations OAuthAuthorization[]
-  pushTokens          PushToken[]
-
-  // Extensions
-  userData      UserData[]
-
-  // Tenancy (multi-tenant module — database/auth/schema.prisma)
-  memberships     Membership[]
-  sentInvitations Invitation[] @relation("sent_invitations")
-
-  // #7803 — the workspace this person last activated, so a new sign-in lands
-  // there. Written only by activateWorkspace after its membership grant; read
-  // only by listTenancy, which reports it only when the workspace is in the
-  // caller's own listing (apps/api/src/services/tenant-context.ts). Deleting
-  // the workspace clears it. Never a Better Auth field, so no client can set it.
-  lastWorkspaceId String?    @map("last_workspace_id")
-  lastWorkspace   Workspace? @relation("UserLastWorkspace", fields: [lastWorkspaceId], references: [id], onDelete: SetNull)
-
-  @@unique([billingProvider, billingCustomerId])
-  @@index([lastWorkspaceId])
-  @@map("users")
-}
-
-/// Session - Active user sessions (Better Auth schema)
-///
-/// Session.token is the opaque cookie value the dual-mode preHandler reads.
-/// Deleting a row revokes the session; deleting the parent User cascades.
-model Session {
-  id        String   @id @default(dbgenerated("('sess_'::text || (uuidv7())::text)")) @db.Text
-  expiresAt DateTime @map("expires_at")
-  token     String   @unique
-  createdAt DateTime @default(now()) @map("created_at")
-  updatedAt DateTime @updatedAt @map("updated_at")
-  ipAddress String?  @map("ip_address")
-  userAgent String?  @map("user_agent")
-  userId    String   @map("user_id")
-
-  // Active tenant context (multi-tenant module). activeOrganizationId is the
-  // Better Auth organization plugin's session field; activeWorkspaceId is
-  // AILK's thin session extension (session.additionalFields in the
-  // apps/workspace auth config). Null in single-tenant deployments.
-  activeOrganizationId String? @map("active_organization_id")
-  activeWorkspaceId    String? @map("active_workspace_id")
-
-  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
-
-  @@index([userId])
-  @@index([token])
-  @@map("sessions")
-}
-
-/// Account - OAuth provider connections (Google, GitHub, etc.)
-///
-/// Better Auth's account shape: one row per (providerId, accountId) pair.
-/// Cascade on User removal keeps OAuth links from orphaning.
-model Account {
-  id                    String    @id @default(dbgenerated("('acct_'::text || (uuidv7())::text)")) @db.Text
-  accountId             String    @map("account_id")
-  providerId            String    @map("provider_id")
-  userId                String    @map("user_id")
-  accessToken           String?   @map("access_token") @db.Text
-  refreshToken          String?   @map("refresh_token") @db.Text
-  idToken               String?   @map("id_token") @db.Text
-  accessTokenExpiresAt  DateTime? @map("access_token_expires_at")
-  refreshTokenExpiresAt DateTime? @map("refresh_token_expires_at")
-  scope                 String?
-  password              String?
-  createdAt             DateTime  @default(now()) @map("created_at")
-  updatedAt             DateTime  @updatedAt @map("updated_at")
-
-  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
-
-  @@unique([providerId, accountId])
-  @@index([userId])
-  @@map("accounts")
-}
-
-/// Verification - Email / magic-link verification tokens (Better Auth schema)
-model Verification {
-  id         String   @id @default(dbgenerated("('verify_'::text || (uuidv7())::text)")) @db.Text
-  identifier String
-  value      String
-  expiresAt  DateTime @map("expires_at")
-  createdAt  DateTime @default(now()) @map("created_at")
-  updatedAt  DateTime @updatedAt @map("updated_at")
-
-  @@index([identifier])
-  @@map("verifications")
-}
-
-/// ApiToken - Bearer tokens for non-web clients (mobile apps, API integrations)
-model ApiToken {
-  id          String    @id @default(dbgenerated("('apitok_'::text || (uuidv7())::text)")) @db.Text
-  userId      String    @map("user_id")
-  
-  // Token identification
-  name        String    // "iPhone", "Android App", "API Integration"
-  token       String    @unique // Hashed token
-  tokenPrefix String    @map("token_prefix") // First 8 chars for identification
-  
-  // Client info
-  clientType  String    @default("api") @map("client_type") // "mobile", "api", "cli"
-  deviceInfo  String?   @map("device_info") // "iPhone 15 Pro", "Android 14"
-  
-  // Permissions
-  scopes      String[]  @default([]) // ["read:profile", "write:data"]
-  
-  // Lifecycle
-  expiresAt   DateTime? @map("expires_at")
-  lastUsedAt  DateTime? @map("last_used_at")
-  lastUsedIp  String?   @map("last_used_ip")
-  revokedAt   DateTime? @map("revoked_at")
-  
-  createdAt   DateTime  @default(now()) @map("created_at")
-
-  user          User           @relation(fields: [userId], references: [id], onDelete: Cascade)
-  refreshTokens RefreshToken[]
-
-  @@index([userId])
-  @@index([token])
-  @@index([tokenPrefix])
-  @@map("api_tokens")
-}
-
-/// RefreshToken - Long-lived tokens for mobile session refresh
-model RefreshToken {
-  id          String    @id @default(dbgenerated("('reftok_'::text || (uuidv7())::text)")) @db.Text
-  userId      String    @map("user_id")
-  apiTokenId  String    @map("api_token_id")
-  
-  token       String    @unique // Hashed
-  
-  // Lifecycle
-  expiresAt   DateTime  @map("expires_at")
-  usedAt      DateTime? @map("used_at")      // Last time used to get new access token
-  revokedAt   DateTime? @map("revoked_at")
-  
-  createdAt   DateTime  @default(now()) @map("created_at")
-
-  user     User     @relation(fields: [userId], references: [id], onDelete: Cascade)
-  apiToken ApiToken @relation(fields: [apiTokenId], references: [id], onDelete: Cascade)
-
-  @@index([userId])
-  @@index([apiTokenId])
-  @@index([token])
-  @@map("refresh_tokens")
-}
-
-/// OAuthClient - Registered OAuth applications (ChatGPT, Slack, etc.)
-model OAuthClient {
-  id           String   @id @default(dbgenerated("('oauthc_'::text || (uuidv7())::text)")) @db.Text
-  
-  // Client identification
-  name         String   // "ChatGPT Plugin", "Slack Bot"
-  description  String?
-  logoUrl      String?  @map("logo_url")
-  
-  // OAuth credentials
-  clientId     String   @unique @map("client_id")   // Public identifier
-  clientSecret String   @map("client_secret")       // Hashed secret
-  
-  // OAuth config
-  redirectUris String[] @map("redirect_uris")       // Allowed callback URLs
-  scopes       String[] @default([])                // Allowed scopes
-  
-  // Settings
-  enabled      Boolean  @default(true)
-  trusted      Boolean  @default(false)             // Skip consent screen
-  
-  createdAt    DateTime @default(now()) @map("created_at")
-  updatedAt    DateTime @updatedAt @map("updated_at")
-
-  authorizations OAuthAuthorization[]
-
-  @@map("oauth_clients")
-}
-
-/// OAuthAuthorization - User grants to OAuth clients
-model OAuthAuthorization {
-  id            String   @id @default(dbgenerated("('oautha_'::text || (uuidv7())::text)")) @db.Text
-  userId        String   @map("user_id")
-  clientId      String   @map("client_id")
-  
-  // Granted scopes (may be subset of client's allowed scopes)
-  scopes        String[]
-  
-  // Tokens
-  accessToken   String   @unique @map("access_token")   // Hashed
-  refreshToken  String?  @unique @map("refresh_token")  // Hashed
-  
-  // Lifecycle
-  expiresAt     DateTime @map("expires_at")
-  revokedAt     DateTime? @map("revoked_at")
-  
-  createdAt     DateTime @default(now()) @map("created_at")
-  updatedAt     DateTime @updatedAt @map("updated_at")
-
-  user   User        @relation(fields: [userId], references: [id], onDelete: Cascade)
-  client OAuthClient @relation(fields: [clientId], references: [id], onDelete: Cascade)
-
-  @@unique([userId, clientId])
-  @@index([userId])
-  @@index([clientId])
-  @@index([accessToken])
-  @@map("oauth_authorizations")
-}
-
-/// PushToken - Device tokens for push notifications
-model PushToken {
-  id          String   @id @default(dbgenerated("('pushtok_'::text || (uuidv7())::text)")) @db.Text
-  userId      String   @map("user_id")
-  
-  // Token details
-  token       String   @unique              // FCM or APNs token
-  platform    String                        // "ios", "android", "web"
-  
-  // Device info
-  deviceId    String?  @map("device_id")    // Unique device identifier
-  deviceName  String?  @map("device_name")  // "iPhone 15 Pro"
-  appVersion  String?  @map("app_version")  // "1.2.3"
-  
-  // Status
-  enabled     Boolean  @default(true)
-  failedAt    DateTime? @map("failed_at")   // Last delivery failure
-  failCount   Int      @default(0) @map("fail_count")
-  
-  createdAt   DateTime @default(now()) @map("created_at")
-  updatedAt   DateTime @updatedAt @map("updated_at")
-
-  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
-
-  @@index([userId])
-  @@index([platform])
-  @@map("push_tokens")
-}
-
-/// UserData - Flexible key-value storage for customer extensions
-/// Use this for: preferences, saved items, custom fields, feature flags
-model UserData {
-  id        String   @id @default(dbgenerated("('userd_'::text || (uuidv7())::text)")) @db.Text
-  userId    String   @map("user_id")
-  
-  // Key-value storage
-  key       String   // "preferences", "saved_products", "notification_settings"
-  value     Json     // Flexible JSON storage
-  
-  createdAt DateTime @default(now()) @map("created_at")
-  updatedAt DateTime @updatedAt @map("updated_at")
-
-  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
-
-  @@unique([userId, key])
-  @@index([userId])
-  @@index([key])
-  @@map("user_data")
-}