create-ailk 0.24.0 → 0.26.0

package/templates/database/inbox/schema.prisma

@@ -1,1447 +0,0 @@
-// inbox namespace — Lead, Subscriber, Callback
-//
-// Backs the Phase B anonymous-write MCP tools (submit_lead, subscribe_newsletter,
-// request_callback) and their corresponding POST routes (B6).
-//
-// Per ADR 0009 D2: no @relation directives cross namespace boundaries.
-// siteId is a plain String identifier — no FK to auth/users.
-//
-// Generator + datasource blocks live in database/schema.prisma (the root schema
-// file). This file holds only model definitions for the inbox namespace.
-//
-// ── The fence fan-out (#6374) — why `workspaceId` sits where it does ────────
-// Eleven models in this file carry the tenancy fence: a NOT NULL
-// `workspaceId` mapped to `workspace_id`, an `@@index([workspaceId])`, and a
-// `<table>_workspace_site_agree` CHECK added by
-// database/migrations/20260922120000_tenancy_fence. No Prisma relation is
-// declared for it (no Prisma relation directive) and no raw-SQL foreign key
-// is added (ADR-0009 invariant #1) — the CHECK is the fence, and it is
-// strictly tighter than an FK, because `site_id` IS the resolved workspace id.
-
-/// Lead — anonymous lead submission (Phase B submit_lead tool / B6 route)
-model Lead {
-  id        String   @id @default(dbgenerated("('lead_'::text || (uuidv7())::text)")) @db.Text
-  siteId    String   @map("site_id")
-  // #6203 — the isolation key `tenantDb(tenant).leads` filters on. Plain
-  // scalar, no @relation (ADR 0009 D1, the same reasoning `promotedUserId`
-  // below already applies). Backfilled by
-  // database/migrations/20260919140000_inbox_workspace_key.
-  //
-  // #6254 AC-3/AC-4/AC-7 — NOT NULL as of
-  // database/migrations/20260922120000_tenancy_fence, which also normalizes
-  // `siteId` to the resolved workspace id and adds
-  // `leads_workspace_site_agree CHECK ("workspace_id" = "site_id")`: since
-  // `siteId` IS the workspace id (never a WorkspaceSiteIdentity id — see
-  // that model's docblock), Postgres itself now rejects a row whose two
-  // columns disagree, in place of the issue's literal (and unbuildable,
-  // ADR-0009-crossing) composite FK — docs/database/namespaces.md. Every
-  // write site derives this value server-side from the resolved site
-  // alias; never from a request body (AC-6).
-  workspaceId String @map("workspace_id")
-  source    String
-  email     String
-  payload   Json
-  createdAt DateTime @default(now()) @map("created_at")
-
-  // #6204 — the triage stamp. NOT `promotedAt`'s sibling: `promotedAt` below
-  // is the lead→user PROMOTION stamp, written by the email-verification
-  // reconciler and true of a lead regardless of whether anyone has answered
-  // it. `handledAt` is written by an operator (or an agent acting for one)
-  // clearing a MESSAGE out of the Needs-you queue (spec D8). Nullable, no
-  // default — every existing row reads NULL, i.e. unhandled (spec D5).
-  // `handledBy` is the actor, mirroring `ProjectListing.decidedBy` below
-  // (spec D4/S-7) — plain scalar, no @relation (ADR 0009 D2), the same
-  // posture `promotedUserId` already takes.
-  handledAt DateTime? @map("handled_at")
-  handledBy String?   @map("handled_by")
-
-  // Lead → user promotion (#3586). Plain scalars — no cross-namespace
-  // @relation into auth.User (ADR 0009 invariant #1). Set by
-  // apps/api/src/services/lead-promotion.ts once the reconciling user's
-  // email is verified and the lead's siteId resolves to one of that user's
-  // own workspaces (tenant-safety, spec D3).
-  promotedUserId String?   @map("promoted_user_id")
-  promotedAt     DateTime? @map("promoted_at")
-
-  // #7869 (roadmap D5) — the caller's `Idempotency-Key` header on
-  // `POST /v1/leads/submit`, stored verbatim so a retried write finds the
-  // first lead. Written only by `apps/api/src/services/lead-routing.ts`'s
-  // submit branch and read only by its two scoped lookups. Untrusted,
-  // client-supplied text — never echo it. Nullable, no default: every
-  // pre-#7869 row and every keyless lead reads NULL, and Postgres treats
-  // NULLs as distinct under the unique below. Same shape as
-  // `FlowCheckout.idempotencyKey` (#4912).
-  idempotencyKey String? @map("idempotency_key")
-
-  // #852 D1 — the Person this lead belongs to: one client of this workspace,
-  // stamped at creation by `apps/api/src/services/lead-routing.ts` through
-  // `findOrCreatePerson`. Plain scalar, no @relation (the inbox house style,
-  // `FlowCheckout.leadId`). NULL only when the email is not a storable
-  // address or the Person step failed — a Person step never refuses a lead.
-  // Backfilled by database/migrations/20261010121000_person_backfill.
-  personId String? @map("person_id")
-
-  // #8185 D1 — the hub's conclusion, at write time, that this lead is a
-  // spoke's LIVE paid checkout: the submit carried a registered spoke's key,
-  // was not relayed for a visitor, and passed the #7877 checkout plan rule's
-  // own predicate (a `cs_live_` Idempotency-Key and the checkout shape).
-  // Written only by `apps/api/src/services/lead-routing.ts`'s submit create
-  // and never updated; read only by `apps/api/src/lib/member-store.ts`'s
-  // `listMemberPurchases`, which serves a marked lead as a purchase. A lead
-  // written before the column existed reads false: `viaSpoke` was never
-  // stored, so its provenance cannot be proven (no backfill). No index: the
-  // read filters by the already-indexed `personId`.
-  spokeCheckout Boolean @default(false) @map("spoke_checkout")
-
-  // #7869 — the idempotency guarantee, scoped per workspace so a key can
-  // never reach another tenant's row.
-  @@unique([workspaceId, idempotencyKey])
-  @@index([siteId])
-  @@index([createdAt])
-  @@index([email])
-  @@index([workspaceId])
-  // #6204 — the message-inbox read: workspaceId = $1 AND handledAt IS NULL
-  // AND source = ANY($2), ordered by createdAt desc. Two columns, not three
-  // (spec D10): `source` is an IN over four values Postgres applies cheaply
-  // after this narrowing, so it is not worth widening the index on every
-  // write.
-  @@index([workspaceId, handledAt])
-  // #6246 — the per-magnet read: workspaceId = $1 AND source = $2, ordered
-  // by createdAt desc (spec § 1.5/D1). `source` here is an EXACT-equality
-  // `'flow:' + <magnet slug>` value, not the `handledAt` index's allowlist
-  // `IN` — a distinct query shape that composite does not serve.
-  @@index([workspaceId, source])
-  @@index([personId])
-  @@map("leads")
-}
-
-/// Person — one client of one workspace (#852). Created only by
-/// apps/api/src/services/person.ts's findOrCreatePerson. Plain scalars, no
-/// @relation (ADR 0009): workspaceId and userId name rows in the auth
-/// namespace.
-///
-/// `email` is the lowercased, trimmed address (the `people_email_normalized`
-/// CHECK holds it to printable ASCII). `userId` is written only on a verified
-/// email match (`stampPersonUser`) and never overwritten. `billingCustomerId`
-/// is NOT unique — the spokes share one Stripe account — and the first
-/// writer wins. `planOffering` is written by a later phase (Epic 2's
-/// checkout-lead rule); this slice only carries the column.
-model Person {
-  id                 String    @id @default(dbgenerated("('person_'::text || (uuidv7())::text)")) @db.Text
-  workspaceId        String    @map("workspace_id")
-  email              String    @db.VarChar(254)
-  name               String?   @db.VarChar(200)
-  userId             String?   @map("user_id")
-  billingProvider    String?   @map("billing_provider") @db.VarChar(32)
-  billingCustomerId  String?   @map("billing_customer_id") @db.VarChar(255)
-  planOffering       String?   @map("plan_offering") @db.VarChar(100)
-  // #8435 D1 — contact details, to the standard (option A). Every column is
-  // nullable: a capture fills only a blank one (D4), an edit overwrites (D9,
-  // D11). The address is the magnet's six parts, stored whole or not at all
-  // (people_address_complete).
-  givenName          String?   @map("given_name") @db.VarChar(100)
-  familyName         String?   @map("family_name") @db.VarChar(100)
-  telephone          String?   @db.VarChar(16)
-  addressLine1       String?   @map("address_line1") @db.VarChar(100)
-  addressLine2       String?   @map("address_line2") @db.VarChar(60)
-  addressCity        String?   @map("address_city") @db.VarChar(60)
-  addressRegion      String?   @map("address_region") @db.VarChar(40)
-  addressPostalCode  String?   @map("address_postal_code") @db.VarChar(20)
-  addressCountry     String?   @map("address_country") @db.Char(2)
-  companyName        String?   @map("company_name") @db.VarChar(200)
-  jobTitle           String?   @map("job_title") @db.VarChar(100)
-  // Who last saved the contact by hand — "operator" (the Person page) or
-  // "client" (their account) — and when. NULL until a human saves it; while
-  // NULL and `userId` is NULL, a capture may fill a blank field (D4).
-  contactConfirmedAt DateTime? @map("contact_confirmed_at")
-  contactConfirmedBy String?   @map("contact_confirmed_by") @db.VarChar(16)
-  // #8514 D1 — the team's private note on this client: one per Person, never
-  // served to the client. Who last saved it (a user id of the auth namespace,
-  // no foreign key — ADR 0009) and when; both NULL until the first save.
-  // When an agent saved it, which agent (its person is notesUpdatedBy).
-  notes               String?   @db.VarChar(5000)
-  notesUpdatedAt      DateTime? @map("notes_updated_at")
-  notesUpdatedBy      String?   @map("notes_updated_by")
-  notesUpdatedByAgent String?   @map("notes_updated_by_agent")
-  createdAt          DateTime  @default(now()) @map("created_at")
-  updatedAt          DateTime  @updatedAt @map("updated_at")
-
-  pieces       Piece[]
-  interactions Interaction[]
-  callbacks    Callback[]
-  subscribers  Subscriber[]
-
-  @@unique([workspaceId, email])
-  @@unique([workspaceId, userId])
-  // #7877 D1 — redundant with the PK, load-bearing as the target of the
-  // composite (person_id, workspace_id) FKs from pieces and interactions:
-  // "a Person of the same workspace" is a database fact.
-  @@unique([id, workspaceId])
-  @@index([workspaceId, billingCustomerId])
-  @@index([workspaceId, createdAt])
-  @@map("people")
-}
-
-/// Piece — one deliverable or proposal for one client (#7877, #8516). Written only through
-/// tenantDb(tenant).memberArea; read by a client only through
-/// lib/member-store.ts. `stage` is one of the workspace's declared stages
-/// (WorkspacePieceStages), checked at write time, never an enum.
-///
-/// #8168 D5 — `approvedAt` is set in the same transaction as an `approved`
-/// review of the latest PieceVersion and freezes review: once set, no further
-/// review lands. Approval is a piece-level fact; the version's own `review`
-/// records which version was approved.
-model Piece {
-  id                String    @id @default(dbgenerated("('piece_'::text || (uuidv7())::text)")) @db.Text
-  workspaceId       String    @map("workspace_id")
-  personId          String    @map("person_id")
-  title             String    @db.VarChar(200)
-  stage             String    @db.VarChar(40)
-  needsClient       Boolean   @default(false) @map("needs_client")
-  updatedBy         String    @map("updated_by")
-  approvedAt        DateTime? @map("approved_at")
-  // #8516 D1 — what the piece is: a `deliverable` (every row before #8516) or a
-  // `proposal` the client approves or sends back. Never changes after create.
-  kind              String    @default("deliverable") @db.VarChar(16)
-  // A proposal's price, in minor units of a two-decimal currency; both or
-  // neither, and only on a proposal.
-  priceAmount       Int?      @map("price_amount")
-  priceCurrency     String?   @map("price_currency") @db.Char(3)
-  // The client's current Stripe Checkout Session (#8516 D11) — its id, URL and
-  // expiry. Never served to the operator. Replaced once five minutes or less
-  // remain; the replaced session is expired at Stripe.
-  checkoutSessionId String?   @unique @map("checkout_session_id")
-  checkoutUrl       String?   @map("checkout_url") @db.VarChar(2048)
-  checkoutExpiresAt DateTime? @map("checkout_expires_at")
-  // When Stripe reported the proposal paid, and the session that paid it (D13).
-  paidAt            DateTime? @map("paid_at")
-  paidSessionId     String?   @map("paid_session_id")
-  createdAt         DateTime  @default(now()) @map("created_at")
-  updatedAt         DateTime  @updatedAt @map("updated_at")
-
-  person   Person         @relation(fields: [personId, workspaceId], references: [id, workspaceId], onDelete: Restrict, map: "pieces_person_fk")
-  versions PieceVersion[]
-
-  @@index([workspaceId, personId, createdAt])
-  // #8168 D1 — redundant with the PK, load-bearing as the target of
-  // piece_versions_piece_fk: a version names a piece of THIS Person in THIS
-  // workspace, as one database fact.
-  @@unique([id, personId, workspaceId])
-  @@map("pieces")
-}
-
-/// PieceVersion — one delivery of a piece to its client (#8168 D1, D2): a
-/// file (`assetId`, a private library asset of the same workspace) or a link
-/// (`link`, https only), never both, numbered from 1 per piece. The client's
-/// review of it (`review`, `reviewComment`, `reviewedAt`) is recorded on the
-/// version itself. There is NO round count, limit or remaining-count column,
-/// by design (#8140 disposition 3).
-///
-/// Its one relation is the three-column FK onto `pieces(id, person_id,
-/// workspace_id)`, so the piece, its Person and the workspace are all one
-/// database fact. `assetId` and `deliveredBy` name rows of other namespaces:
-/// plain columns with format CHECKs, no foreign key (ADR 0009).
-model PieceVersion {
-  id            String    @id @default(dbgenerated("('pver_'::text || (uuidv7())::text)")) @db.Text
-  workspaceId   String    @map("workspace_id")
-  personId      String    @map("person_id")
-  pieceId       String    @map("piece_id")
-  version       Int
-  assetId       String?   @map("asset_id")
-  link          String?   @db.VarChar(2048)
-  note          String?   @db.Text
-  deliveredBy   String    @map("delivered_by")
-  deliveredAt   DateTime  @default(now()) @map("delivered_at")
-  review        String?   @db.VarChar(24)
-  reviewComment String?   @map("review_comment") @db.Text
-  reviewedAt    DateTime? @map("reviewed_at")
-
-  piece Piece @relation(fields: [pieceId, personId, workspaceId], references: [id, personId, workspaceId], onDelete: Restrict, map: "piece_versions_piece_fk")
-
-  @@unique([pieceId, version])
-  // A client's artifacts: workspace_id = $1 AND person_id = $2 ORDER BY delivered_at DESC.
-  @@index([workspaceId, personId, deliveredAt])
-  // The public asset read's "is this asset a version file" check (AC-MAA-21).
-  @@index([assetId])
-  @@map("piece_versions")
-}
-
-/// Interaction — one entry on a client's record (#7877): the original CRM
-/// spec's Interaction cut to one channel. `readAt` is when a member read
-/// FIRST served the row to the client's spoke — a delivery stamp, not proof a
-/// human read it.
-///
-/// #8168 D3/D4 — `direction` is `outbound` (an operator's message, #7877) or
-/// `inbound` (a client's own write); `kind` is `message`, `quote` or
-/// `review`. An outbound row is always a `message` whose `payload` is null
-/// or, since #8515 D6, exactly `{ "action": "onboarding" }` — the one outbound
-/// action, rendered by the client's site as a link to `/account/onboarding`
-/// (`interactions_outbound_shape`); a `quote` or `review` row carries the
-/// stored payload `packages/validation`'s member.ts types. Every existing
-/// reader filters to `direction: "outbound"`, so an inbound row is invisible
-/// to them until a reader opts in.
-model Interaction {
-  id          String    @id @default(dbgenerated("('intx_'::text || (uuidv7())::text)")) @db.Text
-  workspaceId String    @map("workspace_id")
-  personId    String    @map("person_id")
-  channel     String    @db.VarChar(16)
-  direction   String    @db.VarChar(16)
-  kind        String    @default("message") @db.VarChar(16)
-  subject     String    @db.VarChar(200)
-  body        String    @db.Text
-  payload     Json?
-  assetId     String?   @map("asset_id")
-  createdBy   String    @map("created_by")
-  createdAt   DateTime  @default(now()) @map("created_at")
-  readAt      DateTime? @map("read_at")
-
-  person Person @relation(fields: [personId, workspaceId], references: [id, workspaceId], onDelete: Restrict, map: "interactions_person_fk")
-
-  @@index([workspaceId, personId, createdAt])
-  @@index([assetId])
-  @@map("interactions")
-}
-
-/// Subscriber — newsletter subscription (Phase B subscribe_newsletter tool / B6 route)
-model Subscriber {
-  id        String   @id @default(dbgenerated("('subscr_'::text || (uuidv7())::text)")) @db.Text
-  siteId    String   @map("site_id")
-  // #6374 — the tenancy fence, extended to this model (spec
-  // docs/specs/6374-the-fence-schema-wave-spec.md D1). NOT NULL, no
-  // Prisma relation directive (ADR-0009 invariant #1), and
-  // subscribers_workspace_site_agree CHECK (workspace_id = site_id) — since
-  // siteId IS the resolved workspace id, Postgres itself rejects a row
-  // whose two columns disagree. Every write site stamps a SERVER-RESOLVED
-  // value, never one from a request body (AC-6).
-  workspaceId String @map("workspace_id")
-  email     String
-  source    String
-  createdAt DateTime @default(now()) @map("created_at")
-  // #8435 D1/D5 — the Person this subscription belongs to; composite FK onto
-  // people(id, workspace_id), the #7877 shape. NULL is not checked.
-  personId  String?  @map("person_id")
-  person    Person?  @relation(fields: [personId, workspaceId], references: [id, workspaceId], onDelete: Restrict, map: "subscribers_person_fk")
-
-  @@unique([siteId, email])
-  @@index([siteId])
-  @@index([personId])
-  @@index([workspaceId])
-  @@map("subscribers")
-}
-
-/// Callback — callback request (Phase B request_callback tool / B6 route),
-/// plus the request-and-confirm lifecycle (#5970, D-67 / SUB-100).
-///
-/// The eleven trailing members are the confirm/pay lifecycle. They are
-/// deliberately ON THIS MODEL rather than on a second `ServiceRequest` row
-/// (spec #5970 D1), and the cost of that choice is stated rather than hidden:
-/// every ORDINARY callback row — the overwhelming majority — now carries
-/// eleven NULL columns it will never use. The alternative duplicates
-/// siteId/name/phone/preferredTime/payload or carries a cross-row join for a
-/// one-to-one relationship, and it puts a SECOND write inside the anonymous
-/// lead-capture path, which is a never-gate surface. Eleven nullable columns
-/// is the cheaper side.
-model Callback {
-  id            String   @id @default(dbgenerated("('callbk_'::text || (uuidv7())::text)")) @db.Text
-  siteId        String   @map("site_id")
-  // #6374 — the tenancy fence, extended to this model (spec
-  // docs/specs/6374-the-fence-schema-wave-spec.md D1). NOT NULL, no
-  // Prisma relation directive (ADR-0009 invariant #1), and
-  // callbacks_workspace_site_agree CHECK (workspace_id = site_id) — since
-  // siteId IS the resolved workspace id, Postgres itself rejects a row
-  // whose two columns disagree. Every write site stamps a SERVER-RESOLVED
-  // value, never one from a request body (AC-6).
-  workspaceId String @map("workspace_id")
-  name          String
-  phone         String
-  preferredTime String?  @map("preferred_time")
-  payload       Json
-  createdAt     DateTime @default(now()) @map("created_at")
-
-  // ── request-and-confirm lifecycle (#5970) ──────────────────────────────
-  /// sha-256 hex digest of the tenant's confirm token. The token itself is
-  /// emailed once and never stored; NULLED when the credential is spent,
-  /// which is the single-use mechanism. `@unique` mirrors `resumeTokenHash` —
-  /// a digest collision is a bug, not a state.
-  confirmTokenHash        String?   @unique @map("confirm_token_hash")
-  /// When the credential stops resolving (mint + 7 days).
-  confirmTokenExpiresAt   DateTime? @map("confirm_token_expires_at")
-  /// Stamped by the tenant's confirm POST. Also the "already confirmed" predicate.
-  confirmedAt             DateTime? @map("confirmed_at")
-  /// What the tenant agreed to, as they typed it — a string like
-  /// `preferredTime` above, not a parsed instant.
-  confirmedTime           String?   @map("confirmed_time")
-  /// Where the hosted payment URL is sent. Typed on the confirm form,
-  /// prefilled from `payload.email` when the capture form carried one.
-  buyerEmail              String?   @map("buyer_email")
-  /// MINOR units, never major — Stripe's own `unit_amount` convention.
-  amountMinor             Int?      @map("amount_minor")
-  /// Lowercase ISO-4217.
-  currency                String?
-  /// The Payment Link the confirm step minted — THE artifact id the webhook
-  /// stamp matches on (`session.payment_link`).
-  stripePaymentLinkId     String?   @map("stripe_payment_link_id")
-  /// The session written from the same event, for support lookups. NOT a
-  /// match key, which is why it carries no index.
-  stripeCheckoutSessionId String?   @map("stripe_checkout_session_id")
-  /// NULL-forever at #5970's boundary — present so the hosted-invoice rung
-  /// lands additively, with no second migration.
-  stripeInvoiceId         String?   @map("stripe_invoice_id")
-  /// Stamped exactly once by the Stripe webhook; the `paidAt: null` guard on
-  /// that update IS the durable idempotency key.
-  paidAt                  DateTime? @map("paid_at")
-
-  // #8435 D1/D5 — the Person this request belongs to (its payload.email, or
-  // the buyer email at confirm). Composite FK onto people(id, workspace_id):
-  // "a Person of the same workspace" is a database fact. NULL is not checked.
-  personId                String?   @map("person_id")
-  person                  Person?   @relation(fields: [personId, workspaceId], references: [id, workspaceId], onDelete: Restrict, map: "callbacks_person_fk")
-
-  @@index([siteId])
-  @@index([personId])
-  @@index([createdAt])
-  @@index([stripePaymentLinkId])
-  @@index([stripeInvoiceId])
-  @@index([workspaceId])
-  @@map("callbacks")
-}
-
-/// FlowDefinition — server-owned flow config, one live definition per
-/// (siteId, slug) (#3956 D2). No versioning at this layer — a session
-/// snapshots the config at start (see FlowSession.configSnapshot), so a
-/// mid-flight definition edit never corrupts a live session.
-model FlowDefinition {
-  id        String   @id @default(dbgenerated("('flow_'::text || (uuidv7())::text)")) @db.Text
-  siteId    String   @map("site_id")
-  /// #6155 AD-2 — the workspace isolation key. Backfilled from `siteId`: the
-  /// literal "default" resolves to the seeded sentinel workspace
-  /// (wksp_00000000-0000-7000-8000-000000000001); any other value resolves
-  /// only by exact `workspaces.id` match. Plain string, no `@relation`: ADR
-  /// 0009 forbids a Prisma relation across the inbox -> auth (and, per
-  /// #6254, inbox -> config) namespace boundary, the same reason
-  /// `Asset.workspaceId` (database/content/schema.prisma) carries none.
-  ///
-  /// #6254 AC-3/AC-4/AC-7 — NOT NULL as of
-  /// database/migrations/20260922120000_tenancy_fence, which also
-  /// normalizes `siteId` to the resolved workspace id and adds
-  /// `flow_definitions_workspace_site_agree CHECK ("workspace_id" =
-  /// "site_id")` — see `Lead.workspaceId` above for the full rationale
-  /// (identical here). Every write site derives this value server-side;
-  /// never from a request body (AC-6).
-  workspaceId String @map("workspace_id")
-  slug      String
-  config    Json
-  /// #6156 D1/D3 — the magnet's classification, derived structurally (never
-  /// from slug) by `deriveFlowKind` on CREATE only: special-report |
-  /// diagnostic | listicle | waitlist | contact | newsletter. Keeps its
-  /// column default ('contact') — unlike `status`, a mis-classified magnet
-  /// is a mislabel, not a publication or security control.
-  kind      String   @default("contact")
-  /// #6156 D1 — the operator-facing name; the slug is not a name. NOT NULL
-  /// with NO column default (D1): a nameless magnet must never enter the
-  /// table silently, so every future writer is required by `tsc` to state
-  /// one, exactly as `status` below is required to state a status.
-  title     String
-  /// #6156 D1/D4 — an operator-declared publish address, site-relative only
-  /// (`flowLandingPageSchema`, packages/validation/src/schemas/flow.ts).
-  /// NULL means "no operator-declared landing page; the canonical
-  /// `/{locale}/flows/{slug}` route serves it" — never a derived guess, since
-  /// a magnet has THREE public addresses (the indexed landing route, the
-  /// walk route one segment deeper, and the results route), and only the
-  /// operator can say which one they are publishing.
-  landingPage String? @db.Text @map("landing_page")
-  /// #6156 D1/D2/D10 — draft | live. NOT NULL with NO column default (D1,
-  /// SEC-08): silence must never publish, so every future writer is required
-  /// by `tsc` to name a status. Existing rows are backfilled 'live' by the
-  /// migration (every row that exists today is already serving). The
-  /// `flow_definitions_status_domain` CHECK (D2) closes the deny-list gate in
-  /// `resolveSession` (D10): an unknown value is unstorable, so "not
-  /// 'draft'" and "'live'" are the same set at the database level.
-  status    String
-  // #5036 D6d — the listing this definition was projected from, when it was.
-  // Null for every flow that is not a listing diagnostic. Before this column
-  // the only link was that the generated flow's slug HAPPENED to equal the
-  // listing's slug, which nothing enforced; a slug collision would have
-  // attributed a submission to the wrong founder. ADR 0009 forbids a relation
-  // across the namespace boundary, so this is a plain string — but a stated
-  // one rather than a coincidence.
-  listingId String?  @map("listing_id")
-  /// #8168 D7 — whether a signed-in client may submit this magnet from the
-  /// member area. A column, not a config block, because a spoke seed refuses
-  /// non-seedable config (#7876); `upsertFlowDefinition` never names it, so a
-  /// seed never changes it. Independent of `status`: the seeded
-  /// `request-quote` magnet is `draft` (never served anonymously) with
-  /// `customersEnabled = true`.
-  customersEnabled Boolean @default(false) @map("customers_enabled")
-  /// #8757 D1/D2 — what happens after someone submits the magnet: `lead`
-  /// (the thank-you only), `invite` (an account link with the email
-  /// prefilled) or `checkout` (continue to `checkoutOffering`). A column, on
-  /// the `customersEnabled` footing: no seed or config names it. Closed by
-  /// the `flow_definitions_completion_domain` CHECK; the standard defaults are
-  /// the migration's backfill by slug (`STANDARD_MAGNET_COMPLETIONS`).
-  completion String @default("lead") @db.VarChar(16)
-  /// #8757 D1/D2 — the offering key a `checkout` magnet continues to; NULL
-  /// exactly when `completion` is not `checkout`
-  /// (`flow_definitions_checkout_offering_pair`), in the spoke checkout slug
-  /// format (`flow_definitions_checkout_offering_format`).
-  checkoutOffering String? @map("checkout_offering") @db.VarChar(40)
-  createdAt DateTime @default(now()) @map("created_at")
-  updatedAt DateTime @updatedAt @map("updated_at")
-
-  @@unique([siteId, slug])
-  @@index([workspaceId])
-  @@map("flow_definitions")
-}
-
-/// FlowSession — a flow walk in progress or completed; the server-side
-/// partial-lead record (#3956 D2/D9). `configSnapshot` pins the definition at
-/// session start; `state` accumulates each landed step's values immediately
-/// on submission (the per-step persistence this feature exists for).
-/// `email` is denormalized from the landed answers the moment a
-/// `mapsTo:'email'` field lands, so the #3962 abandon-email query
-/// (`email != null AND completedAt == null`) is one indexed read.
-model FlowSession {
-  id             String    @id @default(dbgenerated("('flsess_'::text || (uuidv7())::text)")) @db.Text
-  siteId         String    @map("site_id")
-  /// #6155 AD-2 — the workspace isolation key, same backfill contract as
-  /// `FlowDefinition.workspaceId` above; #6254 makes it NOT NULL plus the
-  /// same `flow_sessions_workspace_site_agree` equality CHECK — see
-  /// `Lead.workspaceId` (database/inbox/schema.prisma, top of file) for the
-  /// full rationale. Declared here, immediately after `siteId` and before
-  /// `state`'s empty-object-literal default below: the drift guard's model
-  /// regex (`tests/architecture/tenant-scope-pattern.test.ts`) truncates a
-  /// model's captured body at its first closing brace — including one
-  /// inside a comment or a string literal, not only in code — so a field
-  /// placed after that point (or a stray brace pair written ABOVE it, as
-  /// this very note must avoid) would be invisible to it.
-  workspaceId    String    @map("workspace_id")
-  // Informational only — never joined on (ADR 0009 D1: logical, not FK,
-  // isolation). Session resumption + completion key on flowSlug, not this
-  // column; deliberate, per code-review finding on #3956's acceptance PR.
-  flowId         String    @map("flow_id")
-  flowSlug       String    @map("flow_slug")
-  configSnapshot Json      @map("config_snapshot")
-  state          Json      @default("{}")
-  email          String?
-  // The session's locale (#3962 D3) — set once at create from the first
-  // landed step's `input.locale ?? configSnapshot.defaultLocale`; not
-  // updated on later steps. Null on pre-migration rows (no backfill; the
-  // abandon-email sweep falls back to the live config's defaultLocale).
-  locale         String?
-  // Server-derived segment (#3959 D3) — set from the segmentation step's
-  // band map at landing time, persisted in the same write as `state`. No
-  // index: #3960/#3961/#3962 read it off rows they already fetch by
-  // existing indexes (subtraction-first, spec Clarifications).
-  segment        String?
-  // D2 (#4663) — every derived flag, re-derived and persisted at each
-  // landing (`{ [flagName]: true }`). `{}` on a snapshot declaring no
-  // `flags` (the regression floor — byte-identical to a pre-#4663 row).
-  flags          Json      @default("{}")
-  // D6 (#4663) — the mid-flow aeo_score step's persisted result (`ready` /
-  // `unavailable`). Null until the step lands, or after a URL change resets
-  // it (D3). Never `computing` — that status never reaches the wire from
-  // this repo (packages/validation/src/schemas/aeo-score.ts).
-  aeoScore       Json?     @map("aeo_score")
-  leadId         String?   @map("lead_id")
-  // #5036 D6d — copied from the FlowDefinition at session create, so a
-  // submission is attributable to ONE listing without going through the slug.
-  // Null for every session on a flow that is not a listing diagnostic.
-  listingId      String?   @map("listing_id")
-  completedAt    DateTime? @map("completed_at")
-  // Abandon-email audit stamp (#3962 D5) — set at most once by the sweep,
-  // per outcome ('sent' | 'dark' | 'failed'). The `abandonEmailStatus ==
-  // null` selection term is what makes the sweep idempotent across any
-  // number of overlapping runs; 'failed' is terminal (no auto-retry).
-  abandonEmailStatus String?   @map("abandon_email_status")
-  abandonEmailAt     DateTime? @map("abandon_email_at")
-  createdAt      DateTime  @default(now()) @map("created_at")
-  updatedAt      DateTime  @updatedAt @map("updated_at")
-
-  @@index([siteId])
-  @@index([siteId, completedAt])
-  @@index([workspaceId])
-  @@index([email])
-  // Backs the abandon-email sweep's per-definition selection query
-  // (apps/api/src/services/abandon-email.ts — flowId equality + completedAt
-  // null + abandonEmailStatus null + updatedAt window), run once per
-  // FlowDefinition on every sweep — code-review finding on #3962's
-  // acceptance PR (without this, that filter set is a full table scan).
-  @@index([flowId, completedAt, abandonEmailStatus])
-  // #5036 D6d — backs the listing-to-submissions read the explicit reference
-  // exists to make possible.
-  @@index([listingId])
-  @@map("flow_sessions")
-}
-
-/// DeliverableAsset — LEGACY (#6310 D3/D11). An operator-uploaded asset the
-/// funnel's `deliverables` config block references by `key` (#3961 D1).
-/// Bytes live IN THE DATABASE (Postgres bytea) behind one internal
-/// resolver — zero new infrastructure; reversibility is structural (a later
-/// blob-storage swap changes only the resolver + the upload CLI, never the
-/// config contract, grant model, or email link shape). Uploaded via the
-/// `deliverable:upload` CLI (apps/api/src/bin/deliverable-upload.ts) only —
-/// no HTTP upload route.
-///
-/// Since #6310: a magnet deliverable resolves against the workspace-scoped
-/// `Asset` model (database/content/schema.prisma) FIRST; this store is the
-/// FALLBACK, tried only on an `Asset` miss (D2). No existing row is
-/// migrated — D3 grounds why in the two server-internal write/read paths —
-/// so every row here keeps delivering, unmigrated, until an operator
-/// confirms none remain (§2.3's exit condition).
-model DeliverableAsset {
-  id          String   @id @default(dbgenerated("('dasset_'::text || (uuidv7())::text)")) @db.Text
-  siteId      String   @map("site_id")
-  // #6374 — the tenancy fence, extended to this model (spec
-  // docs/specs/6374-the-fence-schema-wave-spec.md D1). NOT NULL, no
-  // Prisma relation directive (ADR-0009 invariant #1), and
-  // deliverable_assets_workspace_site_agree CHECK (workspace_id = site_id) — since
-  // siteId IS the resolved workspace id, Postgres itself rejects a row
-  // whose two columns disagree. Every write site stamps a SERVER-RESOLVED
-  // value, never one from a request body (AC-6).
-  workspaceId String @map("workspace_id")
-  // The assetKey a flow config's deliverables.assets entry references.
-  key         String
-  // Download filename (Content-Disposition). Stored RAW at upload time
-  // (the `deliverable:upload` CLI writes the operator's `--filename` or the
-  // uploaded file's own basename verbatim) — sanitization to a safe charset
-  // happens at SERVE time only, in the download route's `sanitizeFilename`
-  // (apps/api/src/routes/deliverables/index.ts, #4002). Never trust this
-  // column as pre-sanitized; the serve-time guard is load-bearing, not
-  // redundant.
-  filename    String
-  contentType String   @map("content_type")
-  bytes       Bytes
-  size        Int
-  createdAt   DateTime @default(now()) @map("created_at")
-  updatedAt   DateTime @updatedAt @map("updated_at")
-
-  @@unique([siteId, key])
-  @@index([workspaceId])
-  @@map("deliverable_assets")
-}
-
-/// DeliverableGrant — the capability token minted per fulfilled lead (#3961
-/// D5). The grant's id IS the token: the download route
-/// (GET /v1/deliverables/:grantId) looks up bytes by grant id alone, so
-/// nothing is publicly enumerable by key, filename, or any other guessable
-/// value — only the uuidv7-random grant id, delivered once via the lead's
-/// own email. `assetId`/`leadId` are stable-id refs (ADR 0009 invariant 1
-/// posture) — no cross-model `@relation`.
-///
-/// `assetId`'s three id classes (#6310): `asset_` (a workspace `Asset`,
-/// scoped serve via `workspaceId` below), `dasset_` (legacy
-/// `DeliverableAsset`, scoped by `siteId` above), `playbook:` (the FEAT-074
-/// U4b virtual asset — no store row at all).
-model DeliverableGrant {
-  id        String   @id @default(dbgenerated("('dgrant_'::text || (uuidv7())::text)")) @db.Text
-  siteId    String   @map("site_id")
-  assetId   String   @map("asset_id")
-  leadId    String   @map("lead_id")
-  sessionId String   @map("session_id")
-  /// The workspace that authorized this grant's asset resolution (#6310
-  /// D15). Plain string, no
-  /// @relation (ADR 0009 invariant 1) — the same shape
-  /// FlowDefinition.workspaceId carries. The serve path reads it ONLY for
-  /// the `asset_` class, and a NULL there is a 404, never an unscoped read.
-  ///
-  /// #6374 CHANGED WHO WRITES IT, AND THE SAFETY ARGUMENT MOVED WITH IT.
-  /// Before #6374 this was written ONLY when `assetId` was an `asset_` id,
-  /// and stayed NULL for a legacy `dasset_` grant and a `playbook:` virtual
-  /// one. As of #6374 BOTH mint sites stamp it unconditionally
-  /// (services/deliverable-fulfillment.ts, services/listing-csv-sweep.ts),
-  /// so NO newly-minted grant is NULL and the fail-closed sentinel below
-  /// now protects PRE-EXISTING rows only — the migration still touches none
-  /// of them.
-  ///
-  /// That is safe because of a DIFFERENT invariant than the one that used to
-  /// carry it, and the new one is more fragile, so it is written down here
-  /// rather than left implicit. What makes stamping safe is NOT "the column
-  /// is NULL on legacy grants" — it no longer is. It is that
-  /// routes/deliverables/index.ts branches on the `assetId` PREFIX, and only
-  /// the `asset_` arm ever reads this column: the `playbook:` arm scopes by
-  /// siteId + leadId, and the legacy `dasset_` arm scopes by
-  /// `asset.siteId === grant.siteId`. Neither reads `workspaceId`, so a
-  /// stamped legacy grant gains no reach it did not already have.
-  /// DO NOT make the legacy or playbook arm consult this column without
-  /// re-deriving that argument — doing so WOULD be an authorization
-  /// widening, which is exactly what the pre-#6374 NULL used to prevent.
-  ///
-  /// #6254 DELIBERATELY DOES NOT TOUCH THIS FIELD. It stays nullable, with
-  /// no equality CHECK — unlike Lead/ProjectListing/FlowDefinition/
-  /// FlowSession above, this column has no source column to derive from
-  /// (its own migration says so: "no source column to derive from ... a
-  /// wholly new fact, captured only at a FUTURE mint"), and `NULL` is the
-  /// serve path's fail-closed sentinel (`deliverable-asset-store.ts`
-  /// `readDeliverableAsset` opens `if (workspaceId === null) return null`).
-  /// Stamping `workspace_id := site_id` would hand a legacy grant an
-  /// authorization scope no mint ever granted, on a bearer-token download
-  /// path — a security regression, not a tightening. That reasoning still
-  /// holds for EXISTING rows, which is why the column stays nullable and why
-  /// #6374's migration adds no column and rewrites no row. Carved out of the
-  /// #6254 retrofit by the operator (spec §10.1 Q2 -> carve out); #6374
-  /// fences it at mint grain, where the workspace is actually known, and
-  /// adds the NULL-TOLERANT
-  /// deliverable_grants_workspace_site_agree CHECK — so a STAMPED grant can
-  /// never disagree with its site while a legacy grant stays storable.
-  workspaceId String? @map("workspace_id")
-  createdAt DateTime @default(now()) @map("created_at")
-  // Post-mint send-outcome stamp (#3998 D1) — set at most once, by the
-  // send-and-stamp tail shared between fulfillDeliverable and the
-  // deliverable:resend CLI. 'sent' | 'send_failed' | 'sender_unconfigured' —
-  // the exact post-mint subset of deliverable-fulfillment.ts's
-  // FulfillmentOutcome union; carried here (not a Prisma enum — this repo
-  // uses none), mirroring FlowSession.abandonEmailStatus/abandonEmailAt.
-  // NULL means the process never reached a post-mint outcome — the crash
-  // window between mint and send (#3961 D5's unhandled consequence) that
-  // this column makes queryable. This is the SELECTION term for the resend
-  // CLI's list mode only; a resend itself is an explicit operator act on one
-  // named grant and is NOT guarded by this column (#3998 D3).
-  sendStatus String?   @map("send_status")
-  sendAt     DateTime? @map("send_at")
-
-  // Backs the deliverable:resend CLI's list-mode query (siteId + sendStatus
-  // IS NULL) — without this, that filter set is a full table scan (the same
-  // lesson #3962's code-review finding established for FlowSession).
-  @@index([siteId, sendStatus])
-  @@map("deliverable_grants")
-}
-
-/// WaitlistExperiment — one ratified experiment config per (siteId, key), the
-/// runtime twin of a site-plan waitlistExperiments[] entry (#4661 D3/D7).
-/// `config` is the validated experimentConfig (D1) with the three registers
-/// EMBEDDED. Written only via upsertWaitlistExperiment (D5).
-model WaitlistExperiment {
-  id        String   @id @default(dbgenerated("('wlexp_'::text || (uuidv7())::text)")) @db.Text
-  siteId    String   @map("site_id")
-  // #6374 — the tenancy fence, extended to this model (spec
-  // docs/specs/6374-the-fence-schema-wave-spec.md D1). NOT NULL, no
-  // Prisma relation directive (ADR-0009 invariant #1), and
-  // waitlist_experiments_workspace_site_agree CHECK (workspace_id = site_id) — since
-  // siteId IS the resolved workspace id, Postgres itself rejects a row
-  // whose two columns disagree. Every write site stamps a SERVER-RESOLVED
-  // value, never one from a request body (AC-6).
-  workspaceId String @map("workspace_id")
-  key       String
-  mode      String                        // lead-capture | qualifying | paid
-  status    String                        // draft | live | closed
-  config    Json
-  createdAt DateTime @default(now()) @map("created_at")
-  updatedAt DateTime @updatedAt @map("updated_at")
-
-  @@unique([siteId, key])
-  @@index([workspaceId])
-  @@map("waitlist_experiments")
-}
-
-/// WaitlistScore — the rules layer's output for one signup (#4661 D3; written
-/// by A2 #4662). leadId is a plain scalar into inbox.Lead (ADR 0009). One row
-/// per lead — re-scoring overwrites, never appends.
-model WaitlistScore {
-  id             String   @id @default(dbgenerated("('wlscore_'::text || (uuidv7())::text)")) @db.Text
-  siteId         String   @map("site_id")
-  // #6374 — the tenancy fence, extended to this model (spec
-  // docs/specs/6374-the-fence-schema-wave-spec.md D1). NOT NULL, no
-  // Prisma relation directive (ADR-0009 invariant #1), and
-  // waitlist_scores_workspace_site_agree CHECK (workspace_id = site_id) — since
-  // siteId IS the resolved workspace id, Postgres itself rejects a row
-  // whose two columns disagree. Every write site stamps a SERVER-RESOLVED
-  // value, never one from a request body (AC-6).
-  workspaceId String @map("workspace_id")
-  leadId         String   @map("lead_id")
-  experimentKey  String   @map("experiment_key")
-  waitlistKey    String   @map("waitlist_key")
-  tier           String
-  score          Int
-  categoryScores Json     @map("category_scores")
-  ruleTrace      Json     @map("rule_trace")
-  createdAt      DateTime @default(now()) @map("created_at")
-  updatedAt      DateTime @updatedAt @map("updated_at")
-
-  // #5036 D6d — one score row per (lead, EXPERIMENT), not per lead.
-  //
-  // `@@unique([leadId])` was right for a single instrument and wrong for a
-  // marketplace of them: a visitor who joins two founders' waitlists is one
-  // lead with two scores, and the narrower constraint permitted one. The
-  // second write silently overwrote the first, so one founder's evidence
-  // disappeared and their weekly CSV under-reported with no error raised.
-  // Scoping the key to the experiment keeps the overwrite-on-retake behaviour
-  // that `scoreCompletedSignup` relies on, per project rather than globally.
-  @@unique([leadId, experimentKey])
-  @@index([siteId, experimentKey, waitlistKey])
-  @@index([workspaceId])
-  @@map("waitlist_scores")
-}
-
-/// PlaybookInstance — a compiled, person-scoped Playbook (FEAT-074 U4a,
-/// #4715). Append-only: `scoreCompletedSignup` (A2) fires the compile on
-/// every `targeting-maturity` completion, so a retake writes a NEW row
-/// rather than overwriting — unlike WaitlistScore, which is
-/// @@unique([leadId, experimentKey]) and overwritten on retake of the SAME
-/// experiment (D2; scoped per experiment by #5036 D6d). `tier`/`ruleTrace` are SNAPSHOTS of the
-/// WaitlistScore at compile time; `scoreId` is kept only as the provenance
-/// pointer to the (possibly since-overwritten) live row. `source` is the
-/// U1 `playbook-source` machine-block object; `markdown` is the rendered
-/// `PLAYBOOK-<slug>.md` body U4b (#4718) reads to render + deliver.
-model PlaybookInstance {
-  id            String   @id @default(dbgenerated("('pbk_'::text || (uuidv7())::text)")) @db.Text
-  siteId        String   @map("site_id")
-  // #6374 — the tenancy fence, extended to this model (spec
-  // docs/specs/6374-the-fence-schema-wave-spec.md D1). NOT NULL, no
-  // Prisma relation directive (ADR-0009 invariant #1), and
-  // playbook_instances_workspace_site_agree CHECK (workspace_id = site_id) — since
-  // siteId IS the resolved workspace id, Postgres itself rejects a row
-  // whose two columns disagree. Every write site stamps a SERVER-RESOLVED
-  // value, never one from a request body (AC-6).
-  workspaceId String @map("workspace_id")
-  leadId        String   @map("lead_id")
-  experimentKey String   @map("experiment_key")
-  scoreId       String   @map("score_id")
-  tier          String
-  level         Int
-  ruleTrace     Json     @map("rule_trace")
-  source        Json
-  markdown      String   @db.Text
-  createdAt     DateTime @default(now()) @map("created_at")
-
-  @@index([siteId, leadId, createdAt])
-  @@index([workspaceId])
-  @@map("playbook_instances")
-}
-
-/// WaitlistFollowUpSend — the audit stamp for one attempted follow-up email
-/// (#4732 D1/D5). `@@unique([leadId, followUpKey])` IS the sweep's
-/// idempotency guarantee (mirrors WaitlistScore's own `@@unique([leadId])`
-/// shape) — the stateless `runWaitlistFollowUpSweep` (#4732)
-/// selects candidates by the ABSENCE of a matching row, so a re-run never
-/// double-sends. `status` is 'sent' | 'failed' (no Prisma enum — this repo
-/// uses none, mirroring DeliverableGrant.sendStatus's free-string
-/// convention); 'failed' is terminal, no auto-retry (the abandon-email
-/// sweep's own posture) — a suppressed/skipped candidate (wrong tier, not
-/// yet due, a booked call, or unsubscribed) is NEVER stamped here at all, so
-/// it is re-evaluated on every later sweep run until it either sends or its
-/// completedAt/offsetDays window is permanently past.
-model WaitlistFollowUpSend {
-  id          String   @id @default(dbgenerated("('wlfu_'::text || (uuidv7())::text)")) @db.Text
-  siteId      String   @map("site_id")
-  // #6374 — the tenancy fence, extended to this model (spec
-  // docs/specs/6374-the-fence-schema-wave-spec.md D1). NOT NULL, no
-  // Prisma relation directive (ADR-0009 invariant #1), and
-  // waitlist_followup_sends_workspace_site_agree CHECK (workspace_id = site_id) — since
-  // siteId IS the resolved workspace id, Postgres itself rejects a row
-  // whose two columns disagree. Every write site stamps a SERVER-RESOLVED
-  // value, never one from a request body (AC-6).
-  workspaceId String @map("workspace_id")
-  leadId      String   @map("lead_id")
-  followUpKey String   @map("follow_up_key")
-  sentAt      DateTime @map("sent_at")
-  status      String
-
-  @@unique([leadId, followUpKey])
-  @@index([siteId])
-  @@index([workspaceId])
-  @@map("waitlist_followup_sends")
-}
-
-/// ListingCsvSend — the weekly founder-CSV send stamp (#5001). One row per
-/// DELIVERED CSV for one ProjectListing: `sentAt` is the watermark the next
-/// sweep selects after (signups whose WaitlistScore landed at or before it are
-/// already in a delivered CSV), `rowCount` is how many rows that CSV carried,
-/// and `grantId` is the DeliverableGrant whose id is the capability token in
-/// the founder's download link. Plain-scalar refs to ProjectListing /
-/// DeliverableGrant (ADR 0009 invariant 1) — no cross-model @relation. A
-/// listing with no new signups gets no row, so "no new rows ⇒ no send" is
-/// visible in the data, not only in the sweep's control flow.
-model ListingCsvSend {
-  id        String   @id @default(dbgenerated("('lcsv_'::text || (uuidv7())::text)")) @db.Text
-  // #6374 D2 — the tenancy fence, in the shape this model's ABSENT site_id
-  // forces (operator disposition, 2026-09-20). It gets NOT NULL plus the
-  // listing_csv_sends_workspace_id_format CHECK and NOTHING else: with no
-  // site_id column there is nothing for an equality CHECK to compare, and a
-  // composite FK to ProjectListing — legal, both models are inbox — was
-  // offered and declined in favour of ONE fence shape. Backfilled and
-  // stamped from the parent listing row, never from a request body (AC-6).
-  workspaceId String @map("workspace_id")
-  listingId String   @map("listing_id")
-  sentAt    DateTime @map("sent_at")
-  rowCount  Int      @map("row_count")
-  grantId   String   @map("grant_id")
-
-  @@index([listingId, sentAt])
-  @@index([workspaceId])
-  @@map("listing_csv_sends")
-}
-
-/// FlowCheckout — the recommender buyer record (#4837 D2/D4): one row per
-/// checkout ATTEMPT. `amountMinor` is the server's own `price().total` × 100
-/// (D6); `quote` is the full WaitlistPriceQuote beside it, so an onboarding
-/// reader sees the seat line and credit line, not only a total. `status` is
-/// 'created' | 'completed' | 'expired' (no Prisma enum — this repo uses none,
-/// mirroring DeliverableGrant.sendStatus's free-string convention); the
-/// webhook (#4838) advances it with a guarded update on 'created'. Plain-scalar
-/// refs to Lead / FlowSession (ADR 0009 invariant 1) — no cross-model
-/// @relation. `permalink` is the answers-only payload string the visitor's
-/// recommendation was rendered from (#4770). Written only by
-/// apps/api/src/services/recommender-capture.ts.
-model FlowCheckout {
-  id               String    @id @default(dbgenerated("('flchk_'::text || (uuidv7())::text)")) @db.Text
-  siteId           String    @map("site_id")
-  // #6374 — the tenancy fence, extended to this model (spec
-  // docs/specs/6374-the-fence-schema-wave-spec.md D1). NOT NULL, no
-  // Prisma relation directive (ADR-0009 invariant #1), and
-  // flow_checkouts_workspace_site_agree CHECK (workspace_id = site_id) — since
-  // siteId IS the resolved workspace id, Postgres itself rejects a row
-  // whose two columns disagree. Every write site stamps a SERVER-RESOLVED
-  // value, never one from a request body (AC-6).
-  workspaceId String @map("workspace_id")
-  flowSlug         String    @map("flow_slug")
-  experimentKey    String    @map("experiment_key")
-  sessionId        String    @map("session_id")
-  leadId           String    @map("lead_id")
-  offerKey         String    @map("offer_key")
-  seats            Int
-  period           String
-  creditStop       Json      @map("credit_stop")
-  amountMinor      Int       @map("amount_minor")
-  currency         String
-  quote            Json
-  permalink        String    @db.Text
-  stripeSessionId  String?   @map("stripe_session_id")
-  // The hosted Checkout page URL an identical resubmission is replayed with
-  // (#4912 D6) — stamped in the same write as `stripeSessionId`, because a
-  // Checkout Session URL cannot be reconstructed from its id.
-  checkoutUrl      String?   @db.Text @map("checkout_url")
-  // The server-derived fingerprint of the checkout request (#4912 D5): a
-  // SHA-256 hex digest, never the request fields themselves. Null on
-  // pre-#4912 rows and on a row whose key a reconcile released.
-  idempotencyKey   String?   @map("idempotency_key")
-  stripeCustomerId String?   @map("stripe_customer_id")
-  status           String
-  completedAt      DateTime? @map("completed_at")
-  createdAt        DateTime  @default(now()) @map("created_at")
-  updatedAt        DateTime  @updatedAt @map("updated_at")
-
-  // The webhook's join (#4838) — nullable, so `created` rows with no session
-  // id yet never collide.
-  @@unique([stripeSessionId])
-  // The /checkout idempotency guarantee (#4912 D5), tenant-scoped so a
-  // fingerprint can never reach another site's row. Nullable, so pre-#4912
-  // rows and reconciled rows never collide.
-  @@unique([siteId, idempotencyKey])
-  // The dashboard's checkedOut read (#4839 D3): siteId + experimentKey + status.
-  @@index([siteId, experimentKey, status])
-  // Onboarding's read: everything a lead bought.
-  @@index([leadId])
-  @@index([workspaceId])
-  @@map("flow_checkouts")
-}
-
-/// ProjectListing — the founder's application row for the project-listings
-/// workflow (#4998): apply → Slack approve/reject → build issue → data-driven
-/// page + diagnostic → weekly CSV. `leadId` is a plain scalar ref into this
-/// namespace's own `Lead` (ADR 0009 invariant 1) — the POST route writes both
-/// rows via `routeLead` (kind `submit`, source `projects-apply`) then this
-/// row, never the reverse. `questions` is the diagnostic template instance
-/// (Q2–Q7 + up to 3 extras, bounded by `projectListingQuestionsSchema` in
-/// `@working-theory/validation`) per
-/// docs/decisions/2026-09-07-project-listings-workflow.md (consumer repo,
-/// salessmyth/samhenry — this row and its routes vendor down, operator
-/// 2026-09-07 option 2). `status` is a free string (`applied` | `approved` |
-/// `rejected` | `active`, no Prisma enum — this repo uses none, mirroring
-/// `FlowCheckout.status`'s convention). Those are the four STORED values
-/// (#5033): the fifth lifecycle state, `closed`, is COMPUTED in the read
-/// from `windowEndsAt` and never written, so an expired listing cannot stay
-/// publicly open because a scheduled job failed. `draft` is defined so the
-/// vocabulary never migrates again and is reachable through no route today.
-/// `decidedAt`/`decidedBy` stamp the approve/reject moment, and an approve
-/// also stamps `windowEndsAt = decidedAt + windowDays`. `windowDays` is the
-/// applicant's requested window ALREADY CLAMPED at create against the site's
-/// `SiteListingConfig` (database/config/schema.prisma) — the config itself
-/// is never accepted from a request body. `issueUrl` (the build issue,
-/// #5000) and `experimentId` (the generated flow's waitlist experiment,
-/// #5001) are null until their respective downstream unit lands.
-/// `featured` is the operator-set shelf flag, surfaced on the public read
-/// only where the site's config enables it. `headline`, `logoMarkUrl` and
-/// `logoWordmarkUrl` are the listing card's presentation fields; the two
-/// logo columns ship nullable with NO upload path (#5033 D5 — no storage
-/// dependency exists, and accepting arbitrary files from anonymous
-/// strangers deserves its own review), and a card with both absent renders
-/// a designed name-only treatment. `slackChannel`/`slackTs`
-/// (#4999) are the posted application message's coordinates, stamped by
-/// `postListingApplication` right after `chat.postMessage` succeeds, so the
-/// decision handler can `chat.update` the same message in place; null when
-/// Slack is unconfigured or the post failed. Still out of scope here: the
-/// GitHub issue (#5000), the diagnostic flow + weekly CSV (#5001).
-model ProjectListing {
-  id             String    @id @default(dbgenerated("('prjl_'::text || (uuidv7())::text)")) @db.Text
-  siteId         String    @map("site_id")
-  // #6203 — the isolation key `tenantDb(tenant).projectListings` filters on.
-  // Plain scalar, no @relation (ADR 0009 D1, same reasoning as ownerUserId
-  // below).
-  //
-  // #6254 AC-3/AC-4/AC-7 — NOT NULL as of
-  // database/migrations/20260922120000_tenancy_fence, which also normalizes
-  // `siteId` to the resolved workspace id and adds
-  // `project_listings_workspace_site_agree CHECK ("workspace_id" =
-  // "site_id")` — see `Lead.workspaceId` (top of database/inbox/schema.prisma)
-  // for the full rationale. Every write site derives this value
-  // server-side; never from a request body (AC-6).
-  workspaceId    String    @map("workspace_id")
-  // #5036 — written at SUBMIT, not at start. The founder's contact details are
-  // already captured on THIS row at step one, so a `Lead` at step one adds no
-  // capture; what it does add is an operator notification email per abandoned
-  // first step, on an anonymous route (PR #5042 security review, finding 4).
-  // `routeLead` remains the one Lead write path; it just runs later.
-  leadId         String?   @map("lead_id")
-  // #5036 D1 — every field the SUBMIT payload requires is nullable at rest.
-  // Validation moved from write-time to submit-time when the application
-  // became a ten-step draft that saves as it goes; a half-filled draft is a
-  // legitimate row, and a NOT NULL here would make one unstorable. Only
-  // `submit` asserts completeness.
-  slug           String?
-  name           String?
-  oneLiner       String?   @map("one_liner")
-  problem        String?   @db.Text
-  // #5096 — `problem`'s narrative other half ("how are you solving it?").
-  // OPT-IN, not required: it is absent from the platform's default
-  // `collectedFields` mask, so a site collects it only by naming it.
-  solution       String?   @db.Text
-  url            String?
-  // #5036 D2 — the six-rung product ladder that replaced the four-value
-  // `stage`. The migration remaps every old value by an explicit map; there
-  // is no shim, because the two ladders do not align rung-for-rung.
-  product        String?
-  // #5036 D3/D5 — the two segmentation axes shared with the diagnostic.
-  commitment       String?
-  teamComposition  String?  @map("team_composition")
-  // #5036 D5 — exactly three {question, answer} entries, the detail page's
-  // fixed FAQ slot.
-  faqs           Json?
-  anythingElse   String?   @db.Text @map("anything_else")
-  // #5036 D6 — a legal control, not a contact detail: visitors answering this
-  // founder's diagnostic are owed the identity and address of the party
-  // collecting their data. Carried on the PUBLIC read for that reason.
-  //
-  // #5279 — still the single-line DISPLAY string. Where the six part columns
-  // below are written, this is COMPOSED from them server-side; where they are
-  // not, it is the line the founder typed, verbatim.
-  address        String?
-  // #5279 — the structured parts of the address above, beside it rather than
-  // instead of it. Nullable for the same reason as the #5036 D1 block above: a
-  // row written before #5279 has no parts, and none may ever be GUESSED from
-  // its `address` string. Parts compose into a line deterministically; a line
-  // does not decompose into parts, and a wrong split silently corrupts the
-  // party identification the listing's privacy notice points at — so the
-  // migration deliberately backfills nothing and a null part stays null for
-  // the life of the row. Composition runs one way only, in `draftUpdateData`
-  // (apps/api/src/services/project-listings.ts).
-  addressLine1      String? @map("address_line1")
-  addressLine2      String? @map("address_line2")
-  addressCity       String? @map("address_city")
-  addressRegion     String? @map("address_region")
-  addressPostalCode String? @map("address_postal_code")
-  addressCountry    String? @map("address_country")
-  questions      Json?
-  // #5285 — the answers to the site's OWN questions: one flat JSON object of
-  // `{ questionId: answer }` for everything a site asks that the PLATFORM does
-  // not read. The field contract (packages/validation/.../listing-
-  // application-contract.ts) names what the platform reads and therefore what
-  // earns a column; everything else was previously unaskable without a
-  // migration and a release, which is what this column removes.
-  //
-  // BOUNDED, not free-form, and that is the point: the write path is
-  // anonymous (a resume token and nothing else), so an unbounded JSON bag on
-  // it is a place for a stranger to park arbitrary text in the table. The
-  // server accepts only ids the SITE declared in its own `SiteListingConfig`,
-  // at that site's own count and length caps, and refuses the whole request
-  // otherwise — so what lands here is never larger than the questions the
-  // operator chose to ask. Null on every row written before #5285 and on
-  // every site that asks nothing of its own.
-  //
-  // Only the `public`-visibility subset rides the public read; an
-  // `operator-only` answer reaches the dashboard and the review payload and
-  // stops there.
-  siteAnswers    Json?     @map("site_answers")
-  // #5407 — still the single-line DISPLAY name, and still NOT NULL: `start`
-  // has always required one and every reader below expects one. Where the two
-  // part columns beside it are written, this is COMPOSED from them
-  // server-side (`startProjectListingDraft`); where they are not, it is the
-  // line the founder typed, verbatim.
-  //
-  // Read by: the submit-time slug fallback, the approve/reject email's
-  // greeting, the Slack review card's Founder row, the build issue, and the
-  // `routeLead` identity. None of them changes.
-  founderName    String    @map("founder_name")
-  // #5407 — the structured parts of the display name above, beside it rather
-  // than instead of it, exactly as #5279 put the six address parts beside
-  // `address`. Nullable for the #5036 D1 reason and one more: a row written
-  // before #5407 has no parts, and none may ever be GUESSED from its
-  // `founder_name`. "First Last" composes one way only; a name does not
-  // decompose (a two-word split mangles "van der Berg", "Maria del Carmen"
-  // and every mononym), so the migration backfills nothing and a null part
-  // stays null for the life of the row.
-  founderFirstName String? @map("founder_first_name")
-  founderLastName  String? @map("founder_last_name")
-  founderEmail   String    @map("founder_email")
-  // #5407 — the founder's phone, collected on the default contact screen
-  // alongside the email (samhenry spec 316 D1). Nullable at rest for the
-  // #5036 D1 reason AND permanently: a row written before #5407 has none, and
-  // a site may declare the question optional through its own config.
-  //
-  // NEVER on the public read: `projectListingPublicSchema` omits it beside
-  // `founderEmail`. The address on this row is a legal control a visitor is
-  // owed; a phone number is a contact detail nobody outside the operator is.
-  founderPhone   String?   @map("founder_phone")
-  // #5407 — sha-256 of the EMAIL VERIFICATION NONCE, never the nonce itself.
-  //
-  // A second credential beside `resumeTokenHash`, and the reason
-  // `emailVerifiedAt` below means what its name says. The resume token is
-  // returned to WHOEVER POSTED `start`'s FORM, so presenting it proves only
-  // that you opened the draft. This nonce is minted at `start`, digested
-  // here, and handed to nothing except the resume-email builder
-  // (`services/project-listing-resume-email.ts`): it is never in a response
-  // body, never in a log, and never in the browser that filled the form. The
-  // only way to hold it is to have read mail sent to `founder_email`.
-  //
-  // Null on every row written before #5407, and on every row whose site has
-  // not switched the resume email on — there the nonce exists and is simply
-  // never delivered, so nothing can verify, which is the correct outcome.
-  // Cleared at `submit` beside `resumeTokenHash`, for the same reason: a
-  // credential that leaks after the draft stops being a draft is inert twice
-  // over.
-  emailVerifyNonceHash String? @unique @map("email_verify_nonce_hash")
-  // #5407 — when the founder proved control of `founder_email`, by opening
-  // the link mailed to it.
-  //
-  // WRITE-ONCE. `verifyProjectListingDraftEmail` sets it only where it is
-  // still null, so a founder who opens the link five times is stamped with
-  // the FIRST opening rather than the latest.
-  //
-  // WHAT IT PROVES, and its exact limit. The stamp requires the nonce above,
-  // which left this server only inside the email. So it says the holder can
-  // read mail sent to `founder_email` — which is the whole of what "email
-  // verified" claims. It says nothing about WHO they are: `owner_user_id`
-  // (#5295) is the column that carries an identity claim, and it still needs
-  // a signed-in user whose own address the auth system verified. A row can
-  // carry either, both, or neither.
-  //
-  // Permanently nullable, and NOT a backfill target. Every row written before
-  // #5407 predates the stamp; asserting verification on one would assert
-  // exactly the thing nobody proved. Null means "not verified", never
-  // "verification failed", and it is also what a site running no resume email
-  // reads forever.
-  emailVerifiedAt DateTime? @map("email_verified_at")
-  founderCompany String?   @map("founder_company")
-  status         String
-  // #5036 D1/D6 — when the founder ticked step one's consent box. Never null:
-  // a row cannot exist without it, because `start` requires it.
-  consentAt      DateTime  @default(now()) @map("consent_at") @db.Timestamptz(3)
-  // #5036 D1 — sha-256 of the opaque resume token, never the token itself.
-  // The token is the ONLY credential on an anonymous surface, so the column
-  // holds a digest an attacker who reads the table still cannot present.
-  // Cleared at submit, which makes a leaked token inert the moment the draft
-  // stops being a draft.
-  resumeTokenHash String?  @unique @map("resume_token_hash")
-  headline       String?
-  logoMarkUrl    String?   @map("logo_mark_url")
-  logoWordmarkUrl String?  @map("logo_wordmark_url")
-  featured       Boolean   @default(false)
-  decidedAt      DateTime? @map("decided_at")
-  decidedBy      String?   @map("decided_by")
-  // The operator's copy-edit audit trio. A listing that is `requested` or
-  // `active` can have its PUBLISHED COPY trimmed by the operator (headline,
-  // oneLiner, problem, faqs, questions) — the third review outcome beside
-  // approve and reject. `copyEditedAt`/`copyEditedBy` mirror the decision pair
-  // directly above and are re-stamped on every edit.
-  //
-  // `submittedCopy` is WRITE-ONCE, on the FIRST edit only: it holds those five
-  // fields exactly as the applicant submitted them. Null for the untouched
-  // majority, which is why "what did the applicant actually send" reads as the
-  // snapshot if present and the row itself otherwise. Never cleared, so the
-  // submitted copy stays recoverable for the life of the row.
-  submittedCopy  Json?     @map("submitted_copy")
-  copyEditedAt   DateTime? @map("copy_edited_at")
-  copyEditedBy   String?   @map("copy_edited_by")
-  issueUrl       String?   @map("issue_url")
-  // #5036 D6d — the experiment's KEY, not its id. `WaitlistScore` holds
-  // `experimentKey`, so holding the id here meant every listing-to-submissions
-  // read fetched the experiment purely to learn its key. One hop, the same
-  // string on both sides. ADR 0009 forbids a relation across the namespace
-  // boundary, so this is a plain string matched by convention — which is
-  // exactly why it has to be the string the other side actually stores.
-  experimentKey  String?   @map("experiment_key")
-  windowDays     Int?      @map("window_days")
-  windowEndsAt   DateTime? @map("window_ends_at")
-  // The posted application message's coordinates (#4999) — set by
-  // `postListingApplication` right after `chat.postMessage` succeeds, so the
-  // Approve/Reject decision handler can `chat.update` the SAME message in
-  // place. Null when Slack is unconfigured or the post failed (create never
-  // rolls back on a Slack failure).
-  slackChannel   String?   @map("slack_channel")
-  slackTs        String?   @map("slack_ts")
-  // Listing -> owner-user link (#5295). Plain scalars — no cross-namespace
-  // @relation into auth.User (ADR 0009 invariant #1), exactly as
-  // `Lead.promotedUserId` / `promotedAt` above. Set by
-  // apps/api/src/services/listing-promotion.ts once the reconciling user's own
-  // email is VERIFIED, that verified address matches `founderEmail`, and this
-  // row's `siteId` resolves to one of that user's own workspaces.
-  //
-  // `founderEmail` is an UNVERIFIED string typed into an anonymous form, so it
-  // can never by itself say who owns the row: two people who type the same
-  // address are two people. This column is the only ownership claim any read
-  // may join on, and nothing derives it from `founderEmail` at read time.
-  //
-  // Nullable PERMANENTLY, not pending a backfill. A listing submitted by
-  // someone who never signs in has no owner for the life of the row, and that
-  // is a legitimate resting state: a backfill from `founderEmail` would assert
-  // a link nobody proved, which is the bug this column exists to remove.
-  ownerUserId    String?   @map("owner_user_id")
-  ownerLinkedAt  DateTime? @map("owner_linked_at")
-  // #6314 — the listicle-kind `FlowDefinition` that CAPTURED this
-  // application: the magnet the visitor arrived through, so a magnet's own
-  // Applications list can be scoped to its own submissions rather than to the
-  // whole workspace (nothing constrains a workspace to one listicle magnet —
-  // `FlowDefinition` carries `@@unique([siteId, slug])` and no
-  // `@@unique([siteId, kind])`, so workspace-only scoping would conflate two).
-  //
-  // NOT `FlowDefinition.listingId` reversed: that column is written at
-  // APPROVAL time by `services/project-listing-flow.ts`, when an approved
-  // listing is projected into its own per-listing diagnostic sub-flow. A
-  // different link, at a different time, in the other direction.
-  //
-  // AN ID, NOT A SLUG (operator ruling 2026-09-19): a slug is a natural key
-  // `@@unique([siteId, slug])` implies is mutable, and `Lead.source`'s
-  // `'flow:' + slug` pattern is the weaker one, used there only because that
-  // write path has no resolve step. This one does — the wire carries a slug
-  // (no public surface hands a visitor a `flow_<uuidv7>`), and
-  // `startProjectListingDraft` resolves it server-side against `siteId` +
-  // `workspaceId` + `kind: "listicle"` before storing the id.
-  //
-  // PLAIN SCALAR REF — no `@relation`, no foreign key, no `onDelete`
-  // (operator decision 2026-09-20, withdrawing the ruling's "on-delete
-  // set-null" clause). Both models live in `inbox/`, so ADR 0009 invariant #1
-  // (which bans CROSS-namespace relations) does not reach this column and
-  // permission was never the question — the convention is: every
-  // intra-`inbox` reference on this model and its siblings (`leadId`,
-  // `listingId`, `grantId`, `flowSessionId`) is a plain scalar, and of the 24
-  // FOREIGN KEY constraints in `database/migrations/**` every one targets
-  // `auth`. The composite shape specifically was offered and declined on
-  // `ListingCsvSend` below.
-  //
-  // WHAT THAT GIVES UP, stated rather than argued away: the database does not
-  // constrain this to name a real magnet, nor one in the same workspace. Three
-  // things bound it — the resolve carries `siteId` and `kind`, so storing a
-  // foreign id needs the service layer to actively misbehave; nothing deletes
-  // a `FlowDefinition` (`routes/magnets/index.ts` D5: "No DELETE"), so
-  // `SET NULL` would have described no live code path; and the read carries
-  // the injected `workspaceId` alongside this id, so a dangling or foreign
-  // value yields NO rows, never another workspace's.
-  //
-  // WRITE-ONCE, at START. The magnet a visitor arrived through is knowable
-  // only on arrival — by submit, ten steps and possibly a resume-email
-  // round-trip later, the referring context is gone. `draftUpdateData` never
-  // learns this key, so no patch body can re-attribute a draft after the fact,
-  // the same shape `emailVerifiedAt`'s write-once stamp has.
-  //
-  // PERMANENTLY NULLABLE, and NOT a backfill target. Every row written before
-  // this column has no evidence naming the magnet that captured it — no
-  // referrer, no session link, no slug — so a backfill would have to guess
-  // "the workspace's only listicle magnet", which is exactly the conflation
-  // this column exists to remove, made permanent and unauditable. It is the
-  // reason `founder_name` parts (#5407), the address parts (#5279) and
-  // `owner_user_id` (#5295) each backfill nothing: a value that can only be
-  // guessed must not be asserted. NULL means "not attributed" — never
-  // "attribution failed" and never "captured directly": an application
-  // started through a direct link AFTER this ships is NULL for the same
-  // reason and is indistinguishable from a legacy row.
-  capturedByFlowId String? @map("captured_by_flow_id")
-  createdAt      DateTime  @default(now()) @map("created_at")
-  updatedAt      DateTime  @updatedAt @map("updated_at")
-
-  @@unique([siteId, slug])
-  @@index([siteId, status])
-  // #5036 D7 — the concurrent-listing limit counts a founder's non-terminal
-  // rows on every submit, from an anonymous route. Indexed so a stranger
-  // cannot make that count a table scan.
-  @@index([siteId, founderEmail])
-  // The self-scoped read's whole WHERE clause (#5295) is `{ ownerUserId }` —
-  // the owner link IS the scope, so no site term joins it. Single-column by
-  // design: the promotion match (`founderEmail` + `siteId` + null owner) is
-  // already served by the (site_id, founder_email) index above.
-  @@index([ownerUserId])
-  // #6203 — backs a per-workspace list (tenantDb(tenant).projectListings.list).
-  @@index([workspaceId])
-  // #6314 — backs the per-magnet Applications read
-  // (tenantDb(tenant).projectListings.listByCapturingFlow), whose WHERE is
-  // exactly these two columns. Leading on `workspaceId`, matching the
-  // `@@index([workspaceId])` convention the fence set on this table. ONE
-  // index: no read reaches `capturedByFlowId` without a tenant, and with no
-  // foreign key there is no cascade wanting a referencing-side index either.
-  @@index([workspaceId, capturedByFlowId])
-  @@map("project_listings")
-}
-
-/// ConsentGrant — one person's answer to one consent purpose, with the exact
-/// wording they read (#5275). APPEND-ONLY: current state is the newest row
-/// per (subject, purpose), so a later withdrawal never destroys the evidence
-/// of the earlier grant (D9) — no `updatedAt`, and deliberately NO unique
-/// constraint on subject + purpose. DECLINES ARE STORED as `granted: false`
-/// (D8): an absent row cannot distinguish "they said no" from "we never
-/// asked", and on an optional purpose that distinction is the only thing the
-/// record is for. The subject is a type + id pair of plain scalars
-/// (`project_listing` / `subscriber` / …) with NO cross-namespace @relation
-/// (D10, ADR 0009 invariant 1) — which is what lets a new surface adopt
-/// consent with a service call and no migration. `statement` is the resolved
-/// text DENORMALIZED at write time (D7): a pointer into the site's config row
-/// would prove nothing once that row is edited, and `statementHash` groups
-/// identical wordings. `locale` is the locale the statement was actually
-/// served in, not the one requested. `purposeId` is the site-config registry
-/// id — the join key across surfaces. Two writers: apps/api/src/services/consent.ts
-/// (every source), and the web sign-up hook apps/web/lib/sign-up-agreements.ts
-/// (#8765 D4), which writes only `sign_up` rows (subject `user`) of a user it
-/// creates in the same Better Auth transaction, from evidence the API built
-/// with consent.ts's own functions.
-model ConsentGrant {
-  id            String   @id @default(dbgenerated("('cnsnt_'::text || (uuidv7())::text)")) @db.Text
-  siteId        String   @map("site_id")
-  // #6374 — the tenancy fence, extended to this model (spec
-  // docs/specs/6374-the-fence-schema-wave-spec.md D1). NOT NULL, no
-  // Prisma relation directive (ADR-0009 invariant #1), and
-  // consent_grants_workspace_site_agree CHECK (workspace_id = site_id) — since
-  // siteId IS the resolved workspace id, Postgres itself rejects a row
-  // whose two columns disagree. Every write site stamps a SERVER-RESOLVED
-  // value, never one from a request body (AC-6).
-  workspaceId String @map("workspace_id")
-  subjectType   String   @map("subject_type")
-  subjectId     String   @map("subject_id")
-  purposeId     String   @map("purpose_id")
-  granted       Boolean
-  locale        String
-  statement     String   @db.Text
-  statementHash String   @map("statement_hash")
-  // #8438 D2 — the Person this row counts toward. A plain scalar with no
-  // foreign key (this table's own D10 posture): a row about a visitor or a
-  // listing has none, and a ledger row must outlive anything it names.
-  personId      String?  @map("person_id")
-  // #8438 D2 — where the answer came from (CONSENT_SOURCES). NOT NULL with no
-  // default after the migration: every new row must say. Rows stored before
-  // this column read `legacy`.
-  source        String   @db.Text
-  // The magnet slug when `source` is `magnet`.
-  sourceRef     String?  @map("source_ref") @db.VarChar(200)
-  // The registry's policy version the person read. NULL only for `legacy` rows.
-  policyVersion Int?     @map("policy_version")
-  createdAt     DateTime @default(now()) @map("created_at")
-
-  // "What did this subject agree to" — every row for one subject, newest last.
-  @@index([siteId, subjectType, subjectId])
-  // "Who agreed to this purpose" — the cross-surface count the id exists for (D1/D2).
-  @@index([siteId, purposeId])
-  @@index([workspaceId])
-  // #8438 D2 — "current state per purpose" for one Person (DISTINCT ON).
-  @@index([workspaceId, personId, purposeId, createdAt])
-  @@map("consent_grants")
-}
-
-// #8438 D2 — links a banner visitor (a random browser-held id) to the Person a
-// later form or sign-in identifies, so the Person's cookie history can include
-// the visitor's own rows without ever editing them. Append-only like the
-// ledger: a database trigger refuses any change to a stored row. No relation
-// directive (ADR-0009 invariant #1); no IP, user-agent or device column.
-model ConsentVisitorLink {
-  id          String   @id @default(dbgenerated("('cvlink_'::text || (uuidv7())::text)")) @db.Text
-  workspaceId String   @map("workspace_id")
-  visitorId   String   @map("visitor_id")
-  personId    String   @map("person_id")
-  source      String   @db.Text
-  createdAt   DateTime @default(now()) @map("created_at")
-
-  @@unique([workspaceId, visitorId, personId])
-  @@index([workspaceId, personId])
-  @@map("consent_visitor_links")
-}
-
-/// Appointment — a Cal.com booking, normalized from the webhook receiver (#6085, brief H7).
-///
-/// siteId-scoped with no FK, like every other inbox model (ADR 0009 D2). The
-/// (siteId, provider, providerBookingUid) unique constraint IS the idempotency
-/// key: every write is a guarded updateMany, and the create that follows a zero
-/// match races on THIS index — which is what makes "exactly one row per booking
-/// uid" a DATABASE property rather than a property of a process that may have
-/// restarted. `provider` is in the key because a deployment may one day run two
-/// providers against one receiver and their uid spaces do not coordinate (#4288).
-model Appointment {
-  id                  String    @id @default(dbgenerated("('appt_'::text || (uuidv7())::text)")) @db.Text
-  siteId              String    @map("site_id") @db.VarChar(200)
-  // #6374 — the tenancy fence, extended to this model (spec
-  // docs/specs/6374-the-fence-schema-wave-spec.md D1). NOT NULL, no
-  // Prisma relation directive (ADR-0009 invariant #1), and
-  // appointments_workspace_site_agree CHECK (workspace_id = site_id) — since
-  // siteId IS the resolved workspace id, Postgres itself rejects a row
-  // whose two columns disagree. Every write site stamps a SERVER-RESOLVED
-  // value, never one from a request body (AC-6).
-  workspaceId String @map("workspace_id")
-  /// Cal.com's own booking `uid` — stable across reschedules of the same booking.
-  /// Bounded: a value above Postgres's btree entry limit cannot be indexed at all.
-  providerBookingUid  String    @map("provider_booking_uid") @db.VarChar(200)
-  /// Provider identifier, part of the unique key (#4288).
-  provider            String    @default("cal") @db.VarChar(32)
-  startTime           DateTime  @map("start_time")
-  endTime             DateTime  @map("end_time")
-  /// The event's own title as the provider stated it. PII-adjacent: never logged (NFR-1).
-  title               String?   @db.VarChar(300)
-  /// Free text typed by an anonymous prospect — bounded at the same 120/254 the
-  /// outbound seam already bounds them at (packages/validation SchedulingAttendeeSchema).
-  attendeeName        String    @map("attendee_name") @db.VarChar(120)
-  attendeeEmail       String    @map("attendee_email") @db.VarChar(254)
-  attendeeTimeZone    String?   @map("attendee_time_zone") @db.VarChar(64)
-  /// Normalized lifecycle state — see § D5. One of: pending | confirmed | cancelled.
-  status              String    @db.VarChar(32)
-  /// The payment flag. BOOKING_PAID sets it true; nothing else in this issue reads it.
-  paid                Boolean   @default(false)
-  /// Set by BOOKING_PAYMENT_INITIATED; a checkout was opened on Cal's side.
-  paymentInitiatedAt  DateTime? @map("payment_initiated_at")
-  /// Set by BOOKING_NO_SHOW_UPDATED.
-  noShow              Boolean   @default(false) @map("no_show")
-  cancelledAt         DateTime? @map("cancelled_at")
-  /// Three INDEPENDENT watermarks, one per event family (§ D7). One shared column
-  /// forced a choice between dropping a late payment fact and letting a replayed
-  /// one revert state; three columns make each family monotonic on its own terms.
-  lifecycleEventAt    DateTime  @map("lifecycle_event_at")
-  paymentEventAt      DateTime? @map("payment_event_at")
-  noShowEventAt       DateTime? @map("no_show_event_at")
-  createdAt           DateTime  @default(now()) @map("created_at")
-  updatedAt           DateTime  @updatedAt @map("updated_at")
-  /// #852 D1 — the Person of the attendee, in this row's workspace. Stamped
-  /// at create (and on a spoke bind's move) by appointments.ts through
-  /// findOrCreatePerson. Plain scalar, no @relation. NULL when the attendee
-  /// email is not a storable address.
-  personId            String?   @map("person_id")
-
-  @@unique([siteId, provider, providerBookingUid])
-  @@index([siteId, startTime])
-  @@index([createdAt])
-  @@index([workspaceId])
-  @@index([personId])
-  @@map("appointments")
-}
-
-/// AppointmentOrigin — which workspace a booking made THROUGH A SPOKE belongs
-/// to (#7532, spec D5). Written by `POST /v1/schedule/book` the moment Cal
-/// answers, and consulted by the deployment-wide Cal.com webhook BEFORE the
-/// site alias, so a spoke's booking is stored in the spoke's workspace.
-///
-/// One origin per booking uid: the unique key leaves `site_id` out. No
-/// relation directive (ADR 0009) — `workspace_id` and `spoke_id` are plain
-/// columns with format CHECKs, joined in apps/api/src/services/.
-model AppointmentOrigin {
-  id                 String   @id @default(dbgenerated("('apptorg_'::text || (uuidv7())::text)")) @db.Text
-  provider           String   @default("cal") @db.VarChar(32)
-  providerBookingUid String   @map("provider_booking_uid") @db.VarChar(200)
-  workspaceId        String   @map("workspace_id")
-  spokeId            String   @map("spoke_id")
-  createdAt          DateTime @default(now()) @map("created_at")
-
-  @@unique([provider, providerBookingUid])
-  @@index([workspaceId])
-  @@map("appointment_origins")
-}