Can I vibe code SaaSquatch?

Build a complete, standalone Referral and Loyalty Service for an ecommerce application using Node.js, Express, PostgreSQL, and Prisma ORM.

1. DATA MODEL:
Create a Prisma schema with the following models:
- User: id, email, referralCode (unique, generated on signup), referredById (nullable self-relation), loyaltyPoints (integer, default 0), createdAt.
- Referral: id, referrerId, refereeId, status (PENDING, REWARDED, CANCELLED), orderId, createdAt.
- Reward: id, userId, type (DISCOUNT_CODE, CREDIT), value (float), code (unique string), redeemed (boolean), createdAt.
- FraudLog: id, userId, reason, ipAddress, createdAt.

2. REFERRAL TRACKING API:
- POST /api/referral/register: Accepts user registration data along with an optional 'ref' query parameter containing a referral code. Link the new user to the referrer if valid.
- POST /api/webhooks/order-completed: Accepts webhooks from the payment processor (orderId, customerEmail, orderTotal, customerIP). Verify payload signature.
  * Find the customer by email.
  * If the customer was referred and the referral status is PENDING, mark referral as REWARDED.
  * Run anti-fraud rules: Check if customer IP matches referrer IP, or if customer email domain matches disposable email provider blocklist. If suspicious, create a FraudLog and withhold rewards.
  * Issue a store discount code to the referrer (via Shopify API stub or internal database entry) and record the Reward.
  * Award loyalty points to the purchasing customer based on orderTotal (1 point per $1 spent).

3. CUSTOMER PORTAL API:
- GET /api/user/rewards: Returns total loyalty points, shareable referral URL (e.g., domain.com?ref=CODE), list of successful referrals, and active promo codes.
- POST /api/user/redeem-points: Converts available loyalty points into a discount code if points exceed 100 points ($5 reward value).

4. SECURITY & ROBUSTNESS:
- Handle duplicate webhook deliveries gracefully using orderId idempotency keys.
- Prevent self-referrals and circular referral loops.
- Output strict TypeScript, handle asynchronous database transactions cleanly, and provide full integration test coverage for the webhook event flow.

$ each button prefixes agent-specific run instructions · build your own product, never copy proprietary code, trademarks or designs