Data model

The single source of truth is packages/db/prisma/schema.prisma. All services import the generated client as @axon/db. This page summarises the models by domain and lists the enums verbatim.

Identity

• User — one per human. walletAddress (unique, lowercased) is the SIWE identity; email, kycStatus, role (UserRole).
• Profile — the dual‑mode discriminator. A user has a PERSONAL profile (auto‑created at signup) and optionally BUSINESS profiles. Each profile has its own walletAddress, kycStatus, and (for business) companyName + Sumsub applicant id. This is the id carried in X-AXON-Profile-Id.
• ProfileWallet — wallets attached to a profile, EMBEDDED or EXTERNAL (WalletKind). A unique address constraint prevents commingling.
• Nonce — single‑use SIWE nonce, short TTL, consumed race‑safely on login.
• RefreshToken — SHA‑256‑hashed, rotating, with family + reuse detection.

Agreements

• Agreement — senderId/recipientId (+ senderProfileId/recipientProfileId, so personal↔business mixes are allowed), status (AgreementStatus), type (AgreementType: ESCROW or FUNDING_FACILITY), onChainId, operationHash (links to the contract's offChainId), optional AI contract body + jurisdiction.
• AgreementMilestone — title, amount, status (MilestoneStatus), fundedAt / markedCompleteAt / releasedAt, and the fee rate snapshotted at funding.
• Notification — typed (NotificationType), always delivered to the counterparty (never the actor), with read state.

Movements & ledger

• Transaction — type (TransactionType), status (TransactionStatus), asset (TransactionAsset), amount, addresses, txHash, profile scope, and parent‑operation linkage (operationType/operationId/operationHash).
• Settlement — the generic money‑movement record: source (SettlementSource), sourceId, status (SettlementStatus), vendor reference, profile, and operation linkage. Ledger rows are hash‑chained (sequence, entryHash, prevHash).
• LedgerAnchor — a checkpoint of the chain head (sequence, headHash, Base block + txHash), status (LedgerAnchorStatus).

Distributions

• Distribution — a batch payout, status (DistributionStatus), operationHash.
• DistributionRoute — one corridor of a batch: vendor, country, amount, status (DistributionRouteStatus), reconciliation fields (failureReason, isStuck).
• RoutingDecision — the auto‑pick audit: candidates, winner, reason (RoutingDecisionReason).
• PolicyConfig — admin‑tunable levers (auto‑select strategy DrAutoSelectStrategy, stuck SLA, retries, overage strategy OverageRateStrategy, fee rates).

Instant Funding

• FundingFacility — status (FundingFacilityStatus), cap, base fee, expiresAt, cumulativeUsed/cumulativeFee, auto‑expand metadata, the backing FUNDING_FACILITY agreement.
• FundingCoverage — one covered inbound transfer: gross/fee/net, sourceTxId (unique), status (FundingCoverageStatus), and the orthogonal collectionStatus (CoverageCollectionStatus) + collectedAt. Fully settled = status SETTLED and collectionStatus COLLECTED.
• CollectionLedgerEntry — the collection wallet's audit trail: direction (CollectionLedgerDirection), amount, coverage/settlement links, txHash.

Ops & audit

• AuditLog — append‑only action log (never deleted).
• AdminAlert — kind (AdminAlertKind), severity (AdminAlertSeverity), ack state.
• WebhookEvent — dedupe + audit for inbound webhooks (@@unique(provider, externalEventId)).
• OnboardingGrant — idempotency record for testnet auto‑funding (one grant per wallet).
• SellSession — off‑ramp session, status (SellSessionStatus).
• KycVerification — Sumsub applicant + status (KycVerificationStatus).

Enums (verbatim)

Money math

Never use JavaScript floats for money. Use packages/db/src/money.ts (toMicroUsdc, fromMicroUsdc, applyFeePct, applyBps, sumMicroUsdc, formatUsdcDisplay) — BigInt‑only, contract‑parity. Amounts cross service boundaries as decimal strings, never numbers.