@wardby/cli 0.1.0

package/prisma/schema.prisma

@@ -0,0 +1,723 @@
+// Hand-written per CLEANROOM.md — never generated from another project's
+// schema. Targets PostgreSQL even for the laptop demo; "portable" means any
+// Postgres (see deploy/local/docker-compose.yml), not a cloud dependency.
+
+generator client {
+  provider = "prisma-client-js"
+}
+
+datasource db {
+  provider = "postgresql"
+  url      = env("DATABASE_URL")
+}
+
+model Agent {
+  id            String              @id @default(cuid())
+  name          String              @unique
+  systemPrompt  String
+  model         String
+  budgetUsd     Decimal             @db.Decimal(10, 4)
+  createdAt     DateTime            @default(now())
+  updatedAt     DateTime            @updatedAt
+  runs          Run[]
+  kind          AgentKind           @default(native)
+  codingProfile CodingAgentProfile?
+
+  // Phase 2: scheduling. `schedule` is a cron expression; null = manual-only.
+  schedule        String?
+  timezone        String    @default("UTC")
+  scheduleEnabled Boolean   @default(true)
+  /// Start of the most recent due window this agent was fired for.
+  lastScheduledAt DateTime?
+
+  // Phase 3: tools + multi-turn loop.
+  tools    AgentTool[]
+  maxTurns Int         @default(10)
+
+  // Phase 4: ownership. Null = public/unowned (pre-Phase-4 agents migrate this way).
+  ownerId    String?
+  owner      Principal?       @relation(fields: [ownerId], references: [id])
+  secrets    AgentSecret[]
+  datastores AgentDatastore[]
+  webhooks   Webhook[]
+
+  // Phase 7: at most one budget group. Null = uncapped beyond its own budgetUsd.
+  budgetGroupId String?
+  budgetGroup   BudgetGroup? @relation(fields: [budgetGroupId], references: [id])
+
+  /// Un-phased: gates the memory_get/memory_set/memory_list/memory_search
+  /// built-in tools (see AgentMemory below). Off by default — a memory-less
+  /// agent sees no memory tools at all, and no AgentMemory rows are ever
+  /// created for it.
+  memoryEnabled Boolean @default(false)
+
+  /// Un-phased: sub-agent composition edges (see AgentSubAgent below). An
+  /// agent can be a parent (has children it can delegate to) and/or a
+  /// child (is delegated to by others) independently.
+  subAgentEdgesAsParent AgentSubAgent[] @relation("SubAgentParent")
+  subAgentEdgesAsChild  AgentSubAgent[] @relation("SubAgentChild")
+}
+
+/// Un-phased: agent-composition edge, referenced by agent name at the
+/// import boundary (capabilities/subagents.json) but id-based here to
+/// match that Tier-1 convention. Cycle-checked in the MCP tool handler at
+/// creation time, not enforced by the database (Postgres has no native
+/// "no cycles" constraint).
+model AgentSubAgent {
+  parentAgentId String
+  childAgentId  String
+  /// Local name the parent's dispatch tool is exposed under
+  /// (delegate_to_<boundName>) — decoupled from the child's own possibly-
+  /// renamed Agent.name, same convention as AgentDatastore.boundName.
+  boundName     String
+  parent        Agent  @relation("SubAgentParent", fields: [parentAgentId], references: [id], onDelete: Cascade)
+  child         Agent  @relation("SubAgentChild", fields: [childAgentId], references: [id], onDelete: Cascade)
+
+  @@id([parentAgentId, childAgentId])
+  @@unique([parentAgentId, boundName])
+}
+
+/// Phase 7: an optional recurring spend cap across a group of agents,
+/// layered on top of each agent's own per-run budgetUsd (which stays
+/// required and unchanged). All three period caps are independently
+/// optional -- unset means "no cap for that period." warnThresholdRatio
+/// is per-group so different groups can choose their own early-warning
+/// point; enforcement itself never lives here -- see
+/// src/core/budget-groups.ts and runner.ts's executeRun, which turn a
+/// group's remaining period budget into a tightened *effective* per-run
+/// budget the existing engine budget machinery enforces unchanged.
+model BudgetGroup {
+  id                 String     @id @default(cuid())
+  name               String
+  ownerId            String?
+  owner              Principal? @relation(fields: [ownerId], references: [id])
+  dailyBudgetUsd     Decimal?   @db.Decimal(10, 4)
+  weeklyBudgetUsd    Decimal?   @db.Decimal(10, 4)
+  monthlyBudgetUsd   Decimal?   @db.Decimal(10, 4)
+  warnThresholdRatio Decimal    @default(0.8) @db.Decimal(3, 2)
+  createdAt          DateTime   @default(now())
+  updatedAt          DateTime   @updatedAt
+  agents             Agent[]
+
+  @@unique([ownerId, name])
+}
+
+enum AgentKind {
+  native
+  coding
+}
+
+enum RunStatus {
+  pending
+  running
+  succeeded
+  failed
+  refused
+  /// Phase 2: orphaned by a dead executor, recovered by the reconciler.
+  lost
+  /// Phase 3: budget ran out mid-loop; graceful wind-down (or hard-stop)
+  /// already applied. Distinct from `refused` (turn-1, zero spend) and
+  /// `failed` (an actual error).
+  budget_exhausted
+  /// Phase 5: explicitly stopped by an authenticated caller.
+  cancelled
+}
+
+/// Phase 3: a WASM-sandboxed, Zod-validated tool a model can call.
+model Tool {
+  id          String      @id @default(cuid())
+  name        String      @unique
+  description String
+  /// Zod schema *source text*; compiled and evaluated inside the sandbox,
+  /// never in the host process.
+  paramsZod   String
+  /// JSON Schema derived from paramsZod at registration time (deriveJsonSchema)
+  /// and cached here — re-deriving it on every run would spin a fresh QuickJS
+  /// runtime and evaluate the whole vendored zod bundle per attached tool,
+  /// before the first LLM call, on every single run. Safe to cache because
+  /// there's no "update tool" path — paramsZod can't change without a new row.
+  jsonSchema  Json
+  /// Tool body source; run inside the sandbox with the validated params.
+  code        String
+  createdAt   DateTime    @default(now())
+  updatedAt   DateTime    @updatedAt
+  agents      AgentTool[]
+
+  // Phase 4: ownership. Null = public/unowned.
+  ownerId String?
+  owner   Principal? @relation(fields: [ownerId], references: [id])
+}
+
+/// Phase 3: explicit many-to-many join between Agent and Tool.
+/// Phase 6: per-attachment capability scoping (OWASP LLM08 fix — Excessive
+/// Agency). Empty array = no access to that resource class; a tool must be
+/// explicitly granted secrets/datastore-prefixes/hosts at attach time. A
+/// literal "*" element in allowedHosts lifts the fetch allowlist entirely
+/// (existing SSRF protection against private/link-local addresses still
+/// applies) — the back-compat escape hatch for pre-existing attachments and
+/// deliberate full-web-access tools. See src/sandbox/tool-capabilities.ts.
+model AgentTool {
+  agentId String
+  toolId  String
+  agent   Agent  @relation(fields: [agentId], references: [id])
+  tool    Tool   @relation(fields: [toolId], references: [id])
+
+  allowedSecrets                 Json @default("[]")
+  allowedDatastorePrefixes       Json @default("[]")
+  allowedHosts                   Json @default("[]")
+  allowedSharedDatastorePrefixes Json @default("{}")
+
+  @@id([agentId, toolId])
+}
+
+/// Named, owned resource shared across agents via AgentDatastore (Un-phased
+/// roadmap item "Named / shared datastores"). Null ownerId = public/unowned,
+/// matching Tool's convention.
+model Datastore {
+  id        String           @id @default(cuid())
+  name      String
+  ownerId   String?
+  owner     Principal?       @relation(fields: [ownerId], references: [id])
+  agents    AgentDatastore[]
+  entries   DatastoreEntry[]
+  createdAt DateTime         @default(now())
+  updatedAt DateTime         @updatedAt
+
+  @@unique([ownerId, name])
+}
+
+/// Attaches a Datastore to an agent, addressed at sandbox point-of-use by
+/// `boundName` (sharedDatastore.get(boundName, key)) — same boundName
+/// convention as AgentSecret. Defaults to the datastore's own name.
+model AgentDatastore {
+  agentId     String
+  datastoreId String
+  boundName   String
+  agent       Agent     @relation(fields: [agentId], references: [id])
+  datastore   Datastore @relation(fields: [datastoreId], references: [id])
+
+  @@id([agentId, datastoreId])
+  @@unique([agentId, boundName])
+}
+
+/// Phase 3: the datastore seam's Postgres-backed default. Scoped by agentId
+/// (private, per-agent) or datastoreId (shared, see Datastore above) — a row
+/// carries exactly one, enforced by a hand-written CHECK in the migration
+/// (Prisma has no declarative "exactly one of two columns" constraint).
+/// Phase 6: optional per-entry PII encryption (see `pii`/`keyId` below).
+///
+/// `id` is a surrogate key required by Prisma's schema validator: with
+/// agentId and datastoreId both optional, neither `@@unique` below has an
+/// all-required-fields criterion, and Prisma rejects a model with no such
+/// criterion (P1012, "Each model must have at least one unique criteria
+/// that has only required fields") — `prisma generate`/`validate` refuse to
+/// run at all without it. Point lookups still go through the
+/// agentId_key/datastoreId_key compound uniques; `id` is not otherwise used.
+model DatastoreEntry {
+  id          String     @id @default(cuid())
+  agentId     String?
+  datastoreId String?
+  key         String
+  value       Json
+  pii         Boolean    @default(false)
+  keyId       String?
+  updatedAt   DateTime   @updatedAt
+  // onDelete: Restrict is explicit (Prisma's inferred default for an
+  // optional relation is SetNull) because the migration's FK is RESTRICT:
+  // nulling datastoreId on delete would leave both agentId and datastoreId
+  // null, violating the DatastoreEntry_scope_xor CHECK above.
+  datastore   Datastore? @relation(fields: [datastoreId], references: [id], onDelete: Restrict)
+
+  @@unique([agentId, key])
+  @@unique([datastoreId, key])
+}
+
+/// Un-phased: agent-controlled persistent memory (key/content per agent),
+/// gated by Agent.memoryEnabled. Deliberately a separate table rather than a
+/// Datastore convention — memory has its own access surface (built-in
+/// memory_get/memory_set/memory_list/memory_search tools, not user-authored
+/// sandbox code) and its own full-text search index, which would be an odd
+/// fit bolted onto Datastore's opaque-JSON-value shape. No FK to Agent,
+/// matching DatastoreEntry: deleting an agent leaves orphaned rows today,
+/// same pre-existing gap, not a new one.
+///
+/// `contentTsv` is maintained by application code (see
+/// PostgresAgentMemory.set), never a Postgres GENERATED column — a generated
+/// column's expression has no representation in `Unsupported()`, which risks
+/// the migration-vs-schema drift check (CLAUDE.md) never landing clean.
+model AgentMemory {
+  agentId    String
+  key        String
+  content    String
+  contentTsv Unsupported("tsvector")?
+  updatedAt  DateTime                 @updatedAt
+
+  @@id([agentId, key])
+  @@index([contentTsv], type: Gin)
+}
+
+/// Phase 2: how a Run was created.
+enum RunTrigger {
+  manual
+  scheduled
+  webhook
+  subagent
+}
+
+model Run {
+  id               String     @id @default(cuid())
+  agent            Agent      @relation(fields: [agentId], references: [id])
+  agentId          String
+  status           RunStatus  @default(pending)
+  trigger          RunTrigger @default(manual)
+  tokensIn         Int        @default(0)
+  tokensOut        Int        @default(0)
+  costUsd          Decimal    @default(0) @db.Decimal(10, 6)
+  error            String?
+  startedAt        DateTime   @default(now())
+  finishedAt       DateTime?
+  /// Phase 2: beaten by the executor while running; a stale value past
+  /// HEARTBEAT_TIMEOUT is how the reconciler finds an orphaned run.
+  heartbeatAt      DateTime?
+  /// Phase 4: EngineResult.finalText, persisted so a Task (MCP) or later
+  /// inspection can read a completed run's answer. Previously only ever
+  /// streamed live via onText and dropped — no durable place to read it
+  /// from until this field existed.
+  finalText        String?
+  /// Phase 4: EngineResult.turns, persisted for the same reason as
+  /// finalText — MCP's list_runs/get_run need it and it was previously
+  /// dropped after the engine returned.
+  turns            Int        @default(0)
+  /// Detached executors are recovered by handle rather than inferred from trigger.
+  executionManaged Boolean    @default(false)
+  /// Phase 6: which durable executor backend holds this run, if any
+  /// ("dbos" = a DBOS workflow whose id equals this run's id). Null for
+  /// in-process runs. The reconciler consults the backend before declaring a
+  /// stale run lost, and can adopt one orphaned by a dead instance.
+  executionBackend String?
+  codingRun        CodingRun?
+
+  /// Un-phased: sub-agent dispatch (see AgentSubAgent). Null for a
+  /// top-level run; set when this run was created by a parent run's
+  /// delegate_to_<boundName> tool call. The run tree rooted at the
+  /// top-level ancestor shares one real-time budget scope (see
+  /// src/core/budget-groups.ts's pattern, generalized from BudgetGroup
+  /// membership to this tree).
+  parentRunId             String?
+  parentRun               Run?     @relation("RunTree", fields: [parentRunId], references: [id])
+  childRuns               Run[]    @relation("RunTree")
+  /// Ephemeral, per-dispatch grant: exactly the parent-memory keys this
+  /// one child run was handed permission to read via parent_memory_get.
+  /// Never a standing allowlist — re-granted on every dispatch call.
+  grantedParentMemoryKeys String[] @default([])
+  /// Per-run task text for a native agent, which otherwise has no
+  /// per-invocation input at all (only its fixed systemPrompt). Set only by
+  /// delegate_to_<boundName> dispatch today — never exposed as a public
+  /// trigger_agent/webhook parameter for native agents, unlike coding
+  /// agents' CodingTaskOverrideSchema. Appended (never prepended) to the
+  /// loaded systemPrompt at run time so the stable prefix stays
+  /// prompt-cache-eligible across dispatches.
+  taskOverride            String?
+}
+
+/// Phase 5: owner-configured coding behavior. Runtime credentials and opaque
+/// launcher handles never live on the reusable profile.
+model CodingAgentProfile {
+  agentId                  String  @id
+  agent                    Agent   @relation(fields: [agentId], references: [id], onDelete: Cascade)
+  provider                 String  @default("codex")
+  repository               String
+  baseRef                  String  @default("main")
+  defaultTask              String?
+  allowWebhookTaskOverride Boolean @default(false)
+  timeoutSec               Int     @default(1800)
+  allowedEgress            Json
+  protectedPaths           Json
+  toolchain                String  @default("node")
+  toolchainVersion         String?
+  workerImageRef           String?
+  /// Per-agent workspace size in MiB; null = CODING_DISK_MB.
+  workspaceDiskMb          Int?
+}
+
+/// Phase 5: immutable dispatch inputs plus opaque execution/result state for
+/// one coding run. Policy is copied from the profile before work starts.
+model CodingRun {
+  runId             String              @id
+  run               Run                 @relation(fields: [runId], references: [id], onDelete: Cascade)
+  task              String
+  repository        String
+  baseRef           String
+  headRef           String
+  provider          String
+  model             String
+  timeoutSec        Int
+  allowedEgress     Json
+  protectedPaths    Json
+  jobBackend        String?
+  jobHandle         String?
+  result            Json?
+  resultSchema      Int                 @default(1)
+  /// Sanitized terminal classification and an opaque log correlation reference.
+  /// Neither field may contain task, repository, environment, or credential data.
+  failureCategory   String?
+  diagnosticId      String?
+  workerImage       String?
+  budgetReservedUsd Decimal             @db.Decimal(10, 6)
+  /// Phase 12 concurrency queue: set when start() found every coding slot
+  /// taken (CODING_MAX_CONCURRENT), cleared when the run claims a slot. A
+  /// pending run with queuedAt set is waiting, not orphaned.
+  queuedAt          DateTime?
+  /// Per-agent workspace size in MiB; null = CODING_DISK_MB.
+  workspaceDiskMb   Int?
+  createdAt         DateTime            @default(now())
+  updatedAt         DateTime            @updatedAt
+  proxySession      CodingProxySession?
+
+  /// Revision-in-place for continuing an existing coding pull request.
+  /// Points directly at the ROOT CodingRun that actually owns the branch/PR
+  /// this run's headRef reuses -- never a chain to "whichever run
+  /// immediately preceded this one." Deliberately not restricted to the
+  /// same agent: a plan run's PR can be continued by an implement run on
+  /// the same branch. Null means this run owns its own fresh branch/PR.
+  rootCodingRunId String?
+  rootCodingRun   CodingRun?  @relation("CodingRunContinuation", fields: [rootCodingRunId], references: [runId])
+  continuations   CodingRun[] @relation("CodingRunContinuation")
+
+  @@index([jobBackend, jobHandle])
+  @@index([failureCategory])
+  @@index([queuedAt])
+  @@index([rootCodingRunId])
+}
+
+enum CodingProxySessionStatus {
+  active
+  cancelled
+}
+
+enum CodingProxyRequestStatus {
+  reserved
+  completed
+  released
+  uncertain
+}
+
+/// Trusted-boundary state for one coding run. Only a capability digest and an
+/// upstream credential reference are persisted; neither secret value enters the DB.
+model CodingProxySession {
+  id             String                   @id @default(cuid())
+  runId          String                   @unique
+  run            CodingRun                @relation(fields: [runId], references: [runId], onDelete: Cascade)
+  capabilityHash String                   @unique
+  credentialRef  String
+  protocol       String                   @default("openai-responses")
+  allowedModels  Json
+  deadlineAt     DateTime
+  budgetUsd      Decimal                  @db.Decimal(18, 10)
+  status         CodingProxySessionStatus @default(active)
+  createdAt      DateTime                 @default(now())
+  updatedAt      DateTime                 @updatedAt
+  requests       CodingProxyRequest[]
+
+  @@index([deadlineAt])
+}
+
+/// Monotonic per-upstream-call ledger. Uncertain reservations remain held so a
+/// crash or truncated provider stream can never create new spendable budget.
+model CodingProxyRequest {
+  id                 String                   @id @default(cuid())
+  sessionId          String
+  session            CodingProxySession       @relation(fields: [sessionId], references: [id], onDelete: Cascade)
+  requestKey         String
+  requestFingerprint String
+  model              String
+  status             CodingProxyRequestStatus @default(reserved)
+  reservationUsd     Decimal                  @db.Decimal(18, 10)
+  actualCostUsd      Decimal?                 @db.Decimal(18, 10)
+  pricingVersion     String
+  pricingSnapshot    Json
+  inputTokens        Int?
+  outputTokens       Int?
+  cachedInputTokens  Int?
+  cacheWriteTokens   Int?
+  reasoningTokens    Int?
+  upstreamStatus     Int?
+  createdAt          DateTime                 @default(now())
+  updatedAt          DateTime                 @updatedAt
+  completedAt        DateTime?
+
+  @@unique([sessionId, requestKey])
+  @@index([sessionId, status])
+}
+
+/// Phase 2: single-row-per-scope lease so exactly one scheduler process
+/// ticks at a time. `holder` is a process instance id (crypto.randomUUID()).
+model SchedulerLease {
+  scope     String   @id
+  holder    String
+  expiresAt DateTime
+  updatedAt DateTime @updatedAt
+}
+
+/// Phase 4: an authenticated caller. `subject` is the IdP subject claim
+/// (delegating mode) or the configured LOCAL_PRINCIPAL (stdio, no token).
+/// Created on first sight (find-or-create by subject).
+model Principal {
+  id           String        @id @default(cuid())
+  subject      String        @unique
+  createdAt    DateTime      @default(now())
+  agents       Agent[]
+  tools        Tool[]
+  secrets      Secret[]
+  datastores   Datastore[]
+  webhooks     Webhook[]
+  authUser     AuthUser?
+  budgetGroups BudgetGroup[]
+}
+
+/// Phase 4: durable handle backing both a triggered run and (reserved,
+/// unused this phase) guided tool authoring. Persisted before the
+/// tools/call response is returned, so a client's first tasks/get always
+/// finds it.
+enum TaskKind {
+  run
+  tool_authoring
+}
+
+enum TaskStatus {
+  working
+  input_required
+  completed
+  failed
+  cancelled
+}
+
+model Task {
+  id             String     @id @default(cuid())
+  kind           TaskKind
+  runId          String?
+  principalId    String?
+  status         TaskStatus @default(working)
+  inputRequests  Json?
+  inputResponses Json?
+  result         Json?
+  error          Json?
+  ttlAt          DateTime
+  createdAt      DateTime   @default(now())
+  updatedAt      DateTime   @updatedAt
+}
+
+/// Phase 4: a secret value, encrypted at rest via the SecretCipher seam.
+/// `ciphertext` is opaque to Prisma; only the cipher's decrypt() ever
+/// produces plaintext, and only at point-of-use inside the sandbox.
+model Secret {
+  id         String        @id @default(cuid())
+  name       String
+  ciphertext String
+  keyId      String
+  ownerId    String?
+  owner      Principal?    @relation(fields: [ownerId], references: [id])
+  createdAt  DateTime      @default(now())
+  updatedAt  DateTime      @updatedAt
+  agents     AgentSecret[]
+
+  @@unique([ownerId, name])
+}
+
+/// Phase 4: attaches a secret to an agent, addressed at sandbox point-of-use
+/// by `boundName` (secrets.get(boundName)). `boundName` defaults to the
+/// secret's canonical name; it differs only when the agent binds the secret
+/// under an alias, letting two agents resolve the same logical name to
+/// different underlying secrets.
+model AgentSecret {
+  agentId   String
+  secretId  String
+  boundName String
+  agent     Agent  @relation(fields: [agentId], references: [id])
+  secret    Secret @relation(fields: [secretId], references: [id])
+
+  @@id([agentId, secretId])
+  @@unique([agentId, boundName])
+}
+
+/// Cross-instance persistence for the out-of-band secret-entry flow
+/// (mcp/tools/secret-elicitation.ts) — was an in-process Map, which stranded
+/// a browser-form submission on the wrong instance under a multi-instance
+/// HTTP deployment. `outcome` holds the SecretElicitationOutcome JSON;
+/// `expiresAt` mirrors the old TTL sweep, now a `DELETE WHERE expiresAt <=
+/// now()` instead of a Map scan.
+model SecretElicitationOutcome {
+  ownerId    String
+  secretName String
+  outcome    Json
+  expiresAt  DateTime
+
+  @@id([ownerId, secretName])
+}
+
+enum WebhookStatus {
+  enabled
+  disabled
+}
+
+/// Phase 4: inbound trigger for an agent. `secretHash` is an HMAC/hash of
+/// the validation secret shown to the caller once at creation; the raw
+/// secret itself is never stored.
+model Webhook {
+  id          String        @id @default(cuid())
+  agentId     String
+  agent       Agent         @relation(fields: [agentId], references: [id])
+  secretHash  String
+  status      WebhookStatus @default(enabled)
+  ownerId     String?
+  owner       Principal?    @relation(fields: [ownerId], references: [id])
+  createdAt   DateTime      @default(now())
+  lastFiredAt DateTime?
+
+  @@index([agentId])
+}
+
+/// Phase 4 (self-hosted AS only): a registered OAuth client. Created and
+/// used only under AUTH_PROVIDER=self-hosted; the delegating adapter never
+/// writes these tables even though the migration creates them unconditionally.
+model OAuthClient {
+  clientId  String                      @id
+  metadata  Json
+  createdAt DateTime                    @default(now())
+  requests  OAuthAuthorizationRequest[]
+  codes     OAuthAuthorizationCode[]
+  families  OAuthFamily[]
+}
+
+/// Phase 4 (self-hosted AS only): an issued authorization grant / refresh token.
+model OAuthGrant {
+  id               String      @id
+  familyId         String
+  family           OAuthFamily @relation(fields: [familyId], references: [id], onDelete: Cascade)
+  refreshTokenHash String
+  expiresAt        DateTime
+  createdAt        DateTime    @default(now())
+  consumedAt       DateTime?
+  revokedAt        DateTime?
+  replacedById     String?
+
+  @@index([familyId])
+  @@index([expiresAt])
+}
+
+model AuthUser {
+  id          String                   @id @default(cuid())
+  principalId String                   @unique
+  principal   Principal                @relation(fields: [principalId], references: [id])
+  displayName String?
+  status      String                   @default("enabled")
+  createdAt   DateTime                 @default(now())
+  updatedAt   DateTime                 @updatedAt
+  loginKeys   AuthLoginKey[]
+  sessions    AuthSession[]
+  codes       OAuthAuthorizationCode[]
+  families    OAuthFamily[]
+}
+
+model AuthLoginKey {
+  keyId      String    @id
+  userId     String
+  user       AuthUser  @relation(fields: [userId], references: [id], onDelete: Cascade)
+  secretHash String
+  createdAt  DateTime  @default(now())
+  lastUsedAt DateTime?
+  expiresAt  DateTime
+  revokedAt  DateTime?
+
+  @@index([userId])
+  @@index([expiresAt])
+}
+
+model AuthSession {
+  sessionId  String              @id
+  userId     String
+  user       AuthUser            @relation(fields: [userId], references: [id], onDelete: Cascade)
+  secretHash String
+  createdAt  DateTime            @default(now())
+  lastSeenAt DateTime            @default(now())
+  expiresAt  DateTime
+  revokedAt  DateTime?
+  challenges AuthFormChallenge[]
+
+  @@index([userId])
+  @@index([expiresAt])
+}
+
+model AuthFormChallenge {
+  challengeId String       @id
+  sessionId   String?
+  session     AuthSession? @relation(fields: [sessionId], references: [sessionId], onDelete: Cascade)
+  purpose     String
+  binding     String
+  secretHash  String
+  createdAt   DateTime     @default(now())
+  expiresAt   DateTime
+  consumedAt  DateTime?
+
+  @@index([expiresAt])
+}
+
+model OAuthAuthorizationRequest {
+  id             String      @id @default(cuid())
+  clientId       String
+  client         OAuthClient @relation(fields: [clientId], references: [clientId], onDelete: Cascade)
+  redirectUri    String
+  resource       String
+  requestedScope String
+  codeChallenge  String
+  state          String?
+  createdAt      DateTime    @default(now())
+  expiresAt      DateTime
+  consumedAt     DateTime?
+
+  @@index([expiresAt])
+}
+
+model OAuthAuthorizationCode {
+  codeId        String      @id
+  secretHash    String
+  clientId      String
+  client        OAuthClient @relation(fields: [clientId], references: [clientId], onDelete: Cascade)
+  userId        String
+  user          AuthUser    @relation(fields: [userId], references: [id], onDelete: Cascade)
+  redirectUri   String
+  resource      String
+  scope         String
+  codeChallenge String
+  createdAt     DateTime    @default(now())
+  expiresAt     DateTime
+  consumedAt    DateTime?
+
+  @@index([expiresAt])
+}
+
+// The family row serializes refresh/revocation, including creation of replacements.
+model OAuthFamily {
+  id        String       @id
+  clientId  String
+  client    OAuthClient  @relation(fields: [clientId], references: [clientId], onDelete: Cascade)
+  userId    String
+  user      AuthUser     @relation(fields: [userId], references: [id], onDelete: Cascade)
+  scope     String
+  resource  String
+  expiresAt DateTime
+  revokedAt DateTime?
+  createdAt DateTime     @default(now())
+  grants    OAuthGrant[]
+
+  @@index([userId])
+  @@index([expiresAt])
+}
+
+model AuthRateLimit {
+  key       String   @id
+  hits      Int
+  expiresAt DateTime
+
+  @@index([expiresAt])
+}