@damn-dev/cli 0.15.1 → 0.19.4

package/runtime/apps/backend/prisma/schema.prisma

@@ -13,6 +13,7 @@ model User {
   email              String            @unique
   emailVerified      Boolean           @default(false)
   image              String?
+  phone              String?
   defaultWorkspaceId String?
   createdAt          DateTime          @default(now())
   updatedAt          DateTime          @updatedAt
@@ -162,6 +163,7 @@ model Channel {
   messages        Message[]
   readReceipts    ReadReceipt[]
   participants    ChannelParticipant[]
+  attachments     Attachment[]
 
   @@index([watchingAgentId])
   @@index([parentChannelId])
@@ -250,11 +252,15 @@ model Attachment {
   id        String   @id @default(cuid())
   messageId String?
   message   Message? @relation(fields: [messageId], references: [id], onDelete: Cascade)
+  channelId String?
+  channel   Channel? @relation(fields: [channelId], references: [id], onDelete: Cascade)
   filename  String
   mimeType  String
   path      String
   size      Int
   createdAt DateTime @default(now())
+
+  @@index([channelId])
 }
 
 model Skill {
@@ -510,6 +516,37 @@ model TelegramPairing {
   @@index([workspaceId])
 }
 
+model WhatsAppPairing {
+  id                String   @id @default(cuid())
+  workspaceId       String
+  userId            String
+  waUserId          String
+  waPushName        String?
+  channelId         String
+  externalChannelId String
+  pairedAt          DateTime @default(now())
+
+  // Contact identity layer (read-only card; NOT a CRM — chut.co owns CRM depth).
+  // phoneNumber is best-effort: present when WhatsApp surfaces the PN alongside a
+  // LID address (msg.key.remoteJidAlt/participantAlt), null for strict-privacy.
+  // knownUserId links the contact to a workspace member (auto via User.phone match,
+  // or manual); null ⇒ prospect. isProspect is derived in the router, not stored.
+  phoneNumber       String?
+  firstSeenAt       DateTime @default(now())
+  lastSeenAt        DateTime @default(now())
+  messageCount      Int      @default(0)
+  knownUserId       String?
+
+  // One pairing per WhatsApp identity (waUserId) is the real invariant. We do NOT
+  // constrain (externalChannelId, userId) unique: in "open" inbox mode every
+  // external WhatsApp sender is pinned to the workspace owner's userId but lives in
+  // its own per-sender thread, so a single damn.dev user legitimately holds many
+  // WhatsApp pairings on the same channel. The old userId-unique blocked the 2nd
+  // sender with a P2002 (the "my other number got no reply" bug).
+  @@unique([externalChannelId, waUserId])
+  @@index([workspaceId])
+}
+
 model AgentTask {
   id              String    @id @default(cuid())
   parentTaskId    String?
@@ -734,3 +771,62 @@ model RemoteAgent {
   @@unique([nodeId, remoteAgentId])
   @@index([nodeId])
 }
+
+model SupportAccessGrant {
+  id              String    @id @default(cuid())
+  workspaceId     String
+  grantedByUserId String
+  ttlMinutes      Int
+  reason          String?
+  status          String    @default("active") // active | expired | revoked
+  createdAt       DateTime  @default(now())
+  expiresAt       DateTime
+  revokedAt       DateTime?
+  revokedByUserId String?
+
+  @@index([workspaceId, createdAt])
+}
+
+// Tamper-evident audit log — the operator/CISO "Trace" surface. Append-only by
+// discipline + hash-chained per workspace (each row's `hash` covers its content
+// + the previous row's hash), so any tampering with a past row breaks the chain
+// and is detectable. Distinct from AgentEvent (mutable telemetry): this is
+// governance-grade, immutable, exportable. Int autoincrement id = monotonic
+// ordering for the chain. See lib/audit.ts.
+model AuditEvent {
+  id          Int      @id @default(autoincrement())
+  workspaceId String
+  actorType   String   // 'user' | 'agent' | 'system'
+  actorId     String
+  actorName   String?
+  action      String   // 'shell_exec' | 'config_change' | 'approval_decision' | 'policy_change' | 'agent_invoke' | ...
+  category    String   // 'activity' | 'config' | 'approval' | 'policy' | 'security'
+  targetType  String?
+  targetId    String?
+  summary     String   // plain-language one-line for the timeline
+  detail      String?  // JSON: raw payload / scopes / model / cost / decision
+  inputHash   String?
+  outputHash  String?
+  decision    String?  // 'allowed' | 'denied' | 'escalated' | 'approved' | 'rejected'
+  prevHash    String?
+  hash        String
+  createdAt   DateTime @default(now())
+
+  @@index([workspaceId, id])
+  @@index([workspaceId, category, id])
+  @@index([workspaceId, actorId, id])
+}
+
+// The CISO-configurable governance policy — one per workspace, all dimensions in
+// policyJson (validated by the Zod schema in lib/governancePolicy.ts). Seeded
+// from a template at setup; editable by operators anytime. Absent row = the
+// secure Regulated baseline default. See lib/governancePolicy.ts.
+model GovernancePolicy {
+  id          String   @id @default(cuid())
+  workspaceId String   @unique
+  template    String   @default("regulated")
+  policyJson  String
+  updatedBy   String?
+  createdAt   DateTime @default(now())
+  updatedAt   DateTime @updatedAt
+}