@wardby/cli 0.2.0 → 0.2.1

package/dist/coding-worker/main.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { readCodingInput, writeCodingOutputAtomic } from "./artifact.js";
 import { runCodingWorker } from "./driver.js";
-import { safeWorkerErrorCode } from "./errors.js";
+import { safeOutputIssues, safeWorkerErrorCode } from "./errors.js";
 import { createCodexSdkClient } from "./sdk.js";
 const INPUT_PATH = "/run/wardby/input/input.json";
 const OUTPUT_PATH = "/run/wardby/output/result.json";
@@ -38,6 +38,7 @@ catch (error) {
         : safeCode === "worker_failed"
             ? `worker_${stage}_failed`
             : safeCode;
-    process.stderr.write(`${JSON.stringify({ error: code })}\n`);
+    const issues = code === "coding_output_invalid" ? safeOutputIssues(error) : undefined;
+    process.stderr.write(`${JSON.stringify({ error: code, ...(issues ? { issues } : {}) })}\n`);
     process.exitCode = controller.signal.aborted ? 143 : 1;
 }

package/dist/core/budget-groups.d.ts

@@ -12,7 +12,7 @@
  * budget of 0, which the engine's turn-1 gate already refuses exactly
  * like any other zero/negative budget.
  */
-import type { Agent, BudgetGroup, PrismaClient } from "@prisma/client";
+import type { Agent, BudgetGroup, PrismaClient } from "#prisma";
 export type Period = "day" | "week" | "month";
 export type BudgetGroupsDb = Pick<PrismaClient, "budgetGroup" | "run" | "agent">;
 /**

package/dist/core/coding-queue.d.ts

@@ -14,7 +14,7 @@
  * Called on the scheduler leader's tick and immediately in any process
  * whose coding run just finished (ContainerExecutor onSlotReleased).
  */
-import type { PrismaClient } from "@prisma/client";
+import type { PrismaClient } from "#prisma";
 import type { Executor } from "../providers/executor/types.js";
 export declare const CODING_QUEUE_TIMEOUT_ERROR = "coding_queue_timeout";
 export type CodingQueueDb = Pick<PrismaClient, "run" | "codingRun" | "$transaction">;

package/dist/core/datastores.d.ts

@@ -4,7 +4,7 @@
  * by a per-attachment `boundName` (sharedDatastore.get(boundName, key)) —
  * same boundName convention as AgentSecret.
  */
-import type { PrismaClient, Datastore as DatastoreRow } from "@prisma/client";
+import type { PrismaClient, Datastore as DatastoreRow } from "#prisma";
 import type { Datastore, DatastoreSetOptions, DatastoreValue } from "../providers/datastore/types.js";
 export type DatastoreMetadata = Pick<DatastoreRow, "id" | "name" | "ownerId" | "createdAt" | "updatedAt">;
 export interface SharedDatastoreAccessor {

package/dist/core/db.d.ts

@@ -1,2 +1,36 @@
-import { PrismaClient } from "@prisma/client";
-export declare const prisma: PrismaClient<import("@prisma/client").Prisma.PrismaClientOptions, never, import("@prisma/client/runtime/library").DefaultArgs>;
+import { PrismaClient } from "#prisma";
+/**
+ * Connection-pool sizing for the node-postgres pool behind @prisma/adapter-pg.
+ *
+ * Prisma 6's query engine owned the pool: `connection_limit` defaulted to
+ * cpus * 2 + 1 and a caller waited at most `pool_timeout` = 10 s for a free
+ * connection (then P2024). Prisma 7 hands the pool to `pg`, whose defaults are
+ * max = 10 and connectionTimeoutMillis = 0 — wait for a connection *forever*,
+ * so a saturated pool would hang requests instead of failing them. Both values
+ * are therefore set explicitly, to Prisma 6's defaults:
+ *
+ * - max: availableParallelism() * 2 + 1 (Prisma 6 counted physical cores; the
+ *   logical count is the closest portable Node equivalent).
+ * - connectionTimeoutMillis: 10 000 (Prisma 6's pool_timeout). A timeout now
+ *   surfaces as a pg "timeout exceeded when trying to connect" error, not P2024.
+ *
+ * `pg` ignores Prisma's own URL parameters, so the two that tuned these same
+ * knobs (`connection_limit`, `pool_timeout` in seconds) are still honoured here
+ * for URLs that set them. idleTimeoutMillis stays at pg's 10 s default.
+ *
+ * TLS is whatever the URL asks for (`sslmode`, `sslrootcert`, ...); certificate
+ * validation is never disabled here.
+ */
+export declare const DEFAULT_POOL_TIMEOUT_MS = 10000;
+export declare function defaultPoolMax(): number;
+export interface PoolSettings {
+    max: number;
+    connectionTimeoutMillis: number;
+}
+export declare function poolSettings(connectionString: string): PoolSettings;
+/**
+ * The one way wardby builds a Prisma client. `url` defaults to DATABASE_URL
+ * as read at call time.
+ */
+export declare function createPrismaClient(url?: string | undefined): PrismaClient;
+export declare const prisma: PrismaClient;

package/dist/core/db.js

@@ -1,2 +1,69 @@
-import { PrismaClient } from "@prisma/client";
-export const prisma = new PrismaClient();
+import { availableParallelism } from "node:os";
+import { PrismaPg } from "@prisma/adapter-pg";
+import { PrismaClient } from "#prisma";
+/**
+ * Connection-pool sizing for the node-postgres pool behind @prisma/adapter-pg.
+ *
+ * Prisma 6's query engine owned the pool: `connection_limit` defaulted to
+ * cpus * 2 + 1 and a caller waited at most `pool_timeout` = 10 s for a free
+ * connection (then P2024). Prisma 7 hands the pool to `pg`, whose defaults are
+ * max = 10 and connectionTimeoutMillis = 0 — wait for a connection *forever*,
+ * so a saturated pool would hang requests instead of failing them. Both values
+ * are therefore set explicitly, to Prisma 6's defaults:
+ *
+ * - max: availableParallelism() * 2 + 1 (Prisma 6 counted physical cores; the
+ *   logical count is the closest portable Node equivalent).
+ * - connectionTimeoutMillis: 10 000 (Prisma 6's pool_timeout). A timeout now
+ *   surfaces as a pg "timeout exceeded when trying to connect" error, not P2024.
+ *
+ * `pg` ignores Prisma's own URL parameters, so the two that tuned these same
+ * knobs (`connection_limit`, `pool_timeout` in seconds) are still honoured here
+ * for URLs that set them. idleTimeoutMillis stays at pg's 10 s default.
+ *
+ * TLS is whatever the URL asks for (`sslmode`, `sslrootcert`, ...); certificate
+ * validation is never disabled here.
+ */
+export const DEFAULT_POOL_TIMEOUT_MS = 10_000;
+export function defaultPoolMax() {
+    return availableParallelism() * 2 + 1;
+}
+export function poolSettings(connectionString) {
+    const settings = { max: defaultPoolMax(), connectionTimeoutMillis: DEFAULT_POOL_TIMEOUT_MS };
+    let params;
+    try {
+        params = new URL(connectionString).searchParams;
+    }
+    catch {
+        return settings;
+    }
+    const limit = Number(params.get("connection_limit"));
+    if (Number.isInteger(limit) && limit > 0)
+        settings.max = limit;
+    const timeout = params.get("pool_timeout");
+    if (timeout !== null && timeout !== "" && Number.isFinite(Number(timeout)) && Number(timeout) >= 0) {
+        // Prisma's pool_timeout=0 meant "no timeout"; pg's 0 means the same.
+        settings.connectionTimeoutMillis = Number(timeout) * 1000;
+    }
+    return settings;
+}
+/**
+ * Without a URL, pg would silently fall back to PGHOST/localhost:5432 as the
+ * OS user. Prisma 6 failed the first query instead ("Environment variable not
+ * found: DATABASE_URL"); keep that: construction succeeds, connecting fails.
+ */
+class MissingUrlAdapter extends PrismaPg {
+    async connect() {
+        throw new Error("DATABASE_URL is not set: cannot connect to the database.");
+    }
+}
+/**
+ * The one way wardby builds a Prisma client. `url` defaults to DATABASE_URL
+ * as read at call time.
+ */
+export function createPrismaClient(url = process.env.DATABASE_URL) {
+    const adapter = url
+        ? new PrismaPg({ connectionString: url, ...poolSettings(url) })
+        : new MissingUrlAdapter({ connectionString: "" });
+    return new PrismaClient({ adapter });
+}
+export const prisma = createPrismaClient();

package/dist/core/dispatch.d.ts

@@ -1,4 +1,4 @@
-import type { Prisma, PrismaClient, Run, RunTrigger, Task } from "@prisma/client";
+import type { Prisma, PrismaClient, Run, RunTrigger, Task } from "#prisma";
 import type { Executor } from "../providers/executor/types.js";
 export type DispatchDb = Pick<PrismaClient, "agent" | "run" | "codingRun" | "task" | "webhook" | "$transaction" | "$queryRaw">;
 type DispatchTx = Pick<Prisma.TransactionClient, "agent" | "run" | "codingRun" | "task" | "webhook" | "$queryRaw">;
@@ -63,6 +63,21 @@ export interface DispatchRunResult {
     run: Run;
     task?: Task;
 }
+/**
+ * A transient transaction conflict in the Serializable persist transaction:
+ * a serialization failure (40001) or a deadlock (40P01). It arrives in one of
+ * three shapes:
+ * - on a model statement: P2034;
+ * - on a raw statement ($queryRaw, e.g. the FOR UPDATE SKIP LOCKED below, or
+ *   anything a beforePersist callback runs): P2010, with the SQLSTATE at
+ *   meta.driverAdapterError.cause.originalCode under the pg driver adapter
+ *   (Prisma 7) -- Prisma 6's engine put 40001 at meta.code, still accepted;
+ * - at COMMIT (e.g. SSI write skew): an unwrapped DriverAdapterError, no
+ *   code or meta, with the SQLSTATE at cause.originalCode.
+ *
+ * @internal Exported only for the real-PostgreSQL tests.
+ */
+export declare function isSerializationConflict(err: unknown): boolean;
 /**
  * Record an executor-level failure on a run that never reached a terminal
  * state itself. Deliberately idempotent: the same failure can arrive twice —

package/dist/core/dispatch.js

@@ -1,12 +1,38 @@
-import { CODING_PROTOCOL_VERSION, CodingTaskInputSchema, normalizeGitHubRepository, publicCodingRunResult, } from "../coding/protocol.js";
+import { CODING_PROTOCOL_VERSION, CodingTaskInputSchema, normalizeGitHubRepository, publicCodingRunResult, composeCodingTask, } from "../coding/protocol.js";
 import { assertCodingProviderModel } from "../coding/provider.js";
 import { logger } from "./logger.js";
 const dispatchLog = logger.child({ module: "dispatch" });
-function isSerializationConflict(err) {
+/** SQLSTATEs worth retrying the persist transaction for: serialization failure, deadlock. */
+const RETRYABLE_SQLSTATES = new Set(["40001", "40P01"]);
+/**
+ * A transient transaction conflict in the Serializable persist transaction:
+ * a serialization failure (40001) or a deadlock (40P01). It arrives in one of
+ * three shapes:
+ * - on a model statement: P2034;
+ * - on a raw statement ($queryRaw, e.g. the FOR UPDATE SKIP LOCKED below, or
+ *   anything a beforePersist callback runs): P2010, with the SQLSTATE at
+ *   meta.driverAdapterError.cause.originalCode under the pg driver adapter
+ *   (Prisma 7) -- Prisma 6's engine put 40001 at meta.code, still accepted;
+ * - at COMMIT (e.g. SSI write skew): an unwrapped DriverAdapterError, no
+ *   code or meta, with the SQLSTATE at cause.originalCode.
+ *
+ * @internal Exported only for the real-PostgreSQL tests.
+ */
+export function isSerializationConflict(err) {
     if (!err || typeof err !== "object")
         return false;
     const candidate = err;
-    return candidate.code === "P2034" || (candidate.code === "P2010" && candidate.meta?.code === "40001");
+    if (candidate.code === "P2034")
+        return true;
+    if (candidate.code === "P2010") {
+        const sqlState = candidate.meta?.driverAdapterError?.cause?.originalCode;
+        return (typeof sqlState === "string" && RETRYABLE_SQLSTATES.has(sqlState)) || candidate.meta?.code === "40001";
+    }
+    if (candidate.name === "DriverAdapterError") {
+        const sqlState = candidate.cause?.originalCode;
+        return typeof sqlState === "string" && RETRYABLE_SQLSTATES.has(sqlState);
+    }
+    return false;
 }
 /**
  * Record an executor-level failure on a run that never reached a terminal
@@ -66,9 +92,11 @@ export async function dispatchRun(options) {
             if (!agent.codingProfile)
                 throw new Error(`Coding agent "${agent.id}" has no coding profile.`);
             assertCodingProviderModel(agent.codingProfile.provider, agent.model);
-            const task = options.codingTask ?? agent.codingProfile.defaultTask;
-            if (!task)
+            const request = options.codingTask ?? agent.codingProfile.defaultTask;
+            if (!request)
                 throw new Error(`Coding agent "${agent.id}" requires a task.`);
+            // The worker sees only the task text, so the agent's own instructions ride in it.
+            const task = composeCodingTask(agent.systemPrompt, request);
             const budgetUsd = options.budgetUsdOverride ?? Number(agent.budgetUsd);
             let baseRef = options.codingBaseRef ?? agent.codingProfile.baseRef;
             let headRef = `wardby/run-${run.id}`;

package/dist/core/http-runtime.js

@@ -57,11 +57,10 @@
  * later in the process, would replace this Agent with an h2-enabled one and
  * silently restore the corruption — the price of fixing this with a dispatcher
  * instead of owning the fetch stack. Nothing in the runtime image does that
- * today: the only other `setGlobalDispatcher` calls in the tree are undici
- * copies bundled inside `@prisma/client/runtime/binary.*` (guarded by the same
- * `=== undefined` check, and the binary engine is not the default) and
+ * today: the only other `setGlobalDispatcher` call in the tree is
  * `node-fetch-native` under the `prisma` CLI, which `deploy/Dockerfile:25`
- * asserts is absent from the runtime image.
+ * asserts is absent from the runtime image. (Prisma 7's client runtime and
+ * `@prisma/adapter-pg` contain none; Prisma 6's `runtime/binary.*` did.)
  *
  * Restoring Node's OWN dispatcher instead is not possible, though not for the
  * reason one might guess: undici defines the legacy symbol `configurable: false`

package/dist/core/lease.d.ts

@@ -7,7 +7,7 @@
  * expired, or already ours, and `RETURNING` tells the caller which case it
  * was — zero rows means someone else holds an unexpired lease.
  */
-import type { PrismaClient } from "@prisma/client";
+import type { PrismaClient } from "#prisma";
 export type LeaseDb = Pick<PrismaClient, "$queryRaw">;
 /** Attempts to acquire (or renew) the lease for `scope`. Returns whether `holder` now holds it. */
 export declare function tryAcquireLease(db: LeaseDb, scope: string, holder: string, ttlMs: number): Promise<boolean>;

package/dist/core/private-directory.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Creates `path` as a private directory, or verifies an existing one is safe to
+ * trust.
+ *
+ * `mkdir(..., { mode: 0o700 })` does nothing to a directory that already
+ * exists. The coding state roots default to fixed names under the OS temp
+ * directory, so on a shared host another user could create one first -- or
+ * point it somewhere else with a symlink -- and then read or plant the job
+ * records, workspaces and artifacts wardby keeps there. This refuses:
+ *
+ * - a symlink, or anything that is not a directory;
+ * - a directory owned by a different user (root excepted: an operator-mounted
+ *   volume is commonly root-owned);
+ * - a directory any other user can write to.
+ *
+ * Group write is allowed, since a Kubernetes `fsGroup` volume is group-writable
+ * by design and its group is chosen by the operator. Ownership and mode are not
+ * checked on platforms without POSIX uids.
+ */
+export declare function ensurePrivateDirectory(path: string): Promise<void>;

package/dist/core/private-directory.js

@@ -0,0 +1,36 @@
+import { lstat, mkdir } from "node:fs/promises";
+/**
+ * Creates `path` as a private directory, or verifies an existing one is safe to
+ * trust.
+ *
+ * `mkdir(..., { mode: 0o700 })` does nothing to a directory that already
+ * exists. The coding state roots default to fixed names under the OS temp
+ * directory, so on a shared host another user could create one first -- or
+ * point it somewhere else with a symlink -- and then read or plant the job
+ * records, workspaces and artifacts wardby keeps there. This refuses:
+ *
+ * - a symlink, or anything that is not a directory;
+ * - a directory owned by a different user (root excepted: an operator-mounted
+ *   volume is commonly root-owned);
+ * - a directory any other user can write to.
+ *
+ * Group write is allowed, since a Kubernetes `fsGroup` volume is group-writable
+ * by design and its group is chosen by the operator. Ownership and mode are not
+ * checked on platforms without POSIX uids.
+ */
+export async function ensurePrivateDirectory(path) {
+    await mkdir(path, { recursive: true, mode: 0o700 });
+    const metadata = await lstat(path);
+    if (metadata.isSymbolicLink() || !metadata.isDirectory()) {
+        throw new Error(`${path} must be a real directory, not a symlink.`);
+    }
+    const uid = process.getuid?.();
+    if (uid === undefined)
+        return;
+    if (metadata.uid !== uid && metadata.uid !== 0) {
+        throw new Error(`${path} is owned by uid ${metadata.uid}, not this process (uid ${uid}). Remove it or choose another path.`);
+    }
+    if ((metadata.mode & 0o002) !== 0) {
+        throw new Error(`${path} is writable by other users. Run chmod o-w on it or choose another path.`);
+    }
+}

package/dist/core/reconciler.d.ts

@@ -28,7 +28,7 @@
  * second one's WHERE simply matches zero rows — double-reconcile is a
  * no-op, not a race.
  */
-import type { PrismaClient } from "@prisma/client";
+import type { PrismaClient } from "#prisma";
 import type { Executor } from "../providers/executor/types.js";
 export type ReconcilerDb = Pick<PrismaClient, "run">;
 /** Runs one reconciliation pass. Returns the number of runs marked `lost`. */

package/dist/core/runner.d.ts

@@ -16,7 +16,7 @@
  * down) lives inside the engine now — there is exactly one place that
  * reasons about cost, not one here plus one in the engine.
  */
-import type { PrismaClient, Run, RunTrigger } from "@prisma/client";
+import type { PrismaClient, Run, RunTrigger } from "#prisma";
 import type { ProviderRegistry } from "../providers/index.js";
 import { type StepRunner } from "../providers/engine/types.js";
 import type { Executor } from "../providers/executor/types.js";

package/dist/core/scheduler.d.ts

@@ -6,7 +6,7 @@
  * create — never by the lease alone (the lease only prevents concurrent
  * *ticking*, not a race within a single tick against a future one).
  */
-import type { Agent } from "@prisma/client";
+import type { Agent } from "#prisma";
 import type { Executor } from "../providers/executor/types.js";
 import { type DispatchDb } from "./dispatch.js";
 export type SchedulerDb = DispatchDb;

package/dist/core/secrets.d.ts

@@ -6,7 +6,7 @@
  * always resolve a name within one owner's (or, at get-time, one agent's)
  * scope, never globally.
  */
-import type { PrismaClient, Secret } from "@prisma/client";
+import type { PrismaClient, Secret } from "#prisma";
 import type { SecretCipher } from "../providers/secrets/types.js";
 export type SecretMetadata = Pick<Secret, "id" | "name" | "keyId" | "ownerId" | "createdAt" | "updatedAt">;
 export interface SecretsAccessor {

package/dist/core/subagent-memory-tools.d.ts

@@ -1,4 +1,4 @@
-import type { PrismaClient } from "@prisma/client";
+import type { PrismaClient } from "#prisma";
 import type { LoadedTool } from "../providers/engine/types.js";
 import type { AgentMemoryStore } from "../providers/memory/types.js";
 export declare const SUBAGENT_MEMORY_TOOL_NAMES: ReadonlySet<string>;

package/dist/core/webhooks.d.ts

@@ -1,4 +1,4 @@
-import type { PrismaClient, Webhook } from "@prisma/client";
+import type { PrismaClient, Webhook } from "#prisma";
 import type { Executor } from "../providers/executor/types.js";
 export type WebhookMetadata = Pick<Webhook, "id" | "agentId" | "status" | "ownerId" | "createdAt" | "lastFiredAt">;
 /** Creates a webhook and returns the raw secret ONCE — only its hash is ever stored. */

package/dist/generated/prisma/browser.d.ts

@@ -0,0 +1,228 @@
+import * as Prisma from './internal/prismaNamespaceBrowser.js';
+export { Prisma };
+export * as $Enums from './enums.js';
+export * from './enums.js';
+/**
+ * Model Agent
+ *
+ */
+export type Agent = Prisma.AgentModel;
+/**
+ * Model AgentSubAgent
+ * Un-phased: agent-composition edge, referenced by agent name at the
+ * import boundary (capabilities/subagents.json) but id-based here to
+ * match that Tier-1 convention. Cycle-checked in the MCP tool handler at
+ * creation time, not enforced by the database (Postgres has no native
+ * "no cycles" constraint).
+ */
+export type AgentSubAgent = Prisma.AgentSubAgentModel;
+/**
+ * Model BudgetGroup
+ * Phase 7: an optional recurring spend cap across a group of agents,
+ * layered on top of each agent's own per-run budgetUsd (which stays
+ * required and unchanged). All three period caps are independently
+ * optional -- unset means "no cap for that period." warnThresholdRatio
+ * is per-group so different groups can choose their own early-warning
+ * point; enforcement itself never lives here -- see
+ * src/core/budget-groups.ts and runner.ts's executeRun, which turn a
+ * group's remaining period budget into a tightened *effective* per-run
+ * budget the existing engine budget machinery enforces unchanged.
+ */
+export type BudgetGroup = Prisma.BudgetGroupModel;
+/**
+ * Model Tool
+ * Phase 3: a WASM-sandboxed, Zod-validated tool a model can call.
+ */
+export type Tool = Prisma.ToolModel;
+/**
+ * Model AgentTool
+ * Phase 3: explicit many-to-many join between Agent and Tool.
+ * Phase 6: per-attachment capability scoping (OWASP LLM08 fix — Excessive
+ * Agency). Empty array = no access to that resource class; a tool must be
+ * explicitly granted secrets/datastore-prefixes/hosts at attach time. A
+ * literal "*" element in allowedHosts lifts the fetch allowlist entirely
+ * (existing SSRF protection against private/link-local addresses still
+ * applies) — the back-compat escape hatch for pre-existing attachments and
+ * deliberate full-web-access tools. See src/sandbox/tool-capabilities.ts.
+ */
+export type AgentTool = Prisma.AgentToolModel;
+/**
+ * Model Datastore
+ * Named, owned resource shared across agents via AgentDatastore (Un-phased
+ * roadmap item "Named / shared datastores"). Null ownerId = public/unowned,
+ * matching Tool's convention.
+ */
+export type Datastore = Prisma.DatastoreModel;
+/**
+ * Model AgentDatastore
+ * Attaches a Datastore to an agent, addressed at sandbox point-of-use by
+ * `boundName` (sharedDatastore.get(boundName, key)) — same boundName
+ * convention as AgentSecret. Defaults to the datastore's own name.
+ */
+export type AgentDatastore = Prisma.AgentDatastoreModel;
+/**
+ * Model DatastoreEntry
+ * Phase 3: the datastore seam's Postgres-backed default. Scoped by agentId
+ * (private, per-agent) or datastoreId (shared, see Datastore above) — a row
+ * carries exactly one, enforced by a hand-written CHECK in the migration
+ * (Prisma has no declarative "exactly one of two columns" constraint).
+ * Phase 6: optional per-entry PII encryption (see `pii`/`keyId` below).
+ *
+ * `id` is a surrogate key required by Prisma's schema validator: with
+ * agentId and datastoreId both optional, neither `@@unique` below has an
+ * all-required-fields criterion, and Prisma rejects a model with no such
+ * criterion (P1012, "Each model must have at least one unique criteria
+ * that has only required fields") — `prisma generate`/`validate` refuse to
+ * run at all without it. Point lookups still go through the
+ * agentId_key/datastoreId_key compound uniques; `id` is not otherwise used.
+ */
+export type DatastoreEntry = Prisma.DatastoreEntryModel;
+/**
+ * Model AgentMemory
+ * Un-phased: agent-controlled persistent memory (key/content per agent),
+ * gated by Agent.memoryEnabled. Deliberately a separate table rather than a
+ * Datastore convention — memory has its own access surface (built-in
+ * memory_get/memory_set/memory_list/memory_search tools, not user-authored
+ * sandbox code) and its own full-text search index, which would be an odd
+ * fit bolted onto Datastore's opaque-JSON-value shape. No FK to Agent,
+ * matching DatastoreEntry: deleting an agent leaves orphaned rows today,
+ * same pre-existing gap, not a new one.
+ *
+ * `contentTsv` is maintained by application code (see
+ * PostgresAgentMemory.set), never a Postgres GENERATED column — a generated
+ * column's expression has no representation in `Unsupported()`, which risks
+ * the migration-vs-schema drift check (CLAUDE.md) never landing clean.
+ */
+export type AgentMemory = Prisma.AgentMemoryModel;
+/**
+ * Model Run
+ *
+ */
+export type Run = Prisma.RunModel;
+/**
+ * Model CodingAgentProfile
+ * Phase 5: owner-configured coding behavior. Runtime credentials and opaque
+ * launcher handles never live on the reusable profile.
+ */
+export type CodingAgentProfile = Prisma.CodingAgentProfileModel;
+/**
+ * Model CodingRun
+ * Phase 5: immutable dispatch inputs plus opaque execution/result state for
+ * one coding run. Policy is copied from the profile before work starts.
+ */
+export type CodingRun = Prisma.CodingRunModel;
+/**
+ * Model CodingProxySession
+ * Trusted-boundary state for one coding run. Only a capability digest and an
+ * upstream credential reference are persisted; neither secret value enters the DB.
+ */
+export type CodingProxySession = Prisma.CodingProxySessionModel;
+/**
+ * Model CodingProxyRequest
+ * Monotonic per-upstream-call ledger. Uncertain reservations remain held so a
+ * crash or truncated provider stream can never create new spendable budget.
+ */
+export type CodingProxyRequest = Prisma.CodingProxyRequestModel;
+/**
+ * Model SchedulerLease
+ * Phase 2: single-row-per-scope lease so exactly one scheduler process
+ * ticks at a time. `holder` is a process instance id (crypto.randomUUID()).
+ */
+export type SchedulerLease = Prisma.SchedulerLeaseModel;
+/**
+ * Model Principal
+ * Phase 4: an authenticated caller. `subject` is the IdP subject claim
+ * (delegating mode) or the configured LOCAL_PRINCIPAL (stdio, no token).
+ * Created on first sight (find-or-create by subject).
+ */
+export type Principal = Prisma.PrincipalModel;
+/**
+ * Model Task
+ *
+ */
+export type Task = Prisma.TaskModel;
+/**
+ * Model Secret
+ * Phase 4: a secret value, encrypted at rest via the SecretCipher seam.
+ * `ciphertext` is opaque to Prisma; only the cipher's decrypt() ever
+ * produces plaintext, and only at point-of-use inside the sandbox.
+ */
+export type Secret = Prisma.SecretModel;
+/**
+ * Model AgentSecret
+ * Phase 4: attaches a secret to an agent, addressed at sandbox point-of-use
+ * by `boundName` (secrets.get(boundName)). `boundName` defaults to the
+ * secret's canonical name; it differs only when the agent binds the secret
+ * under an alias, letting two agents resolve the same logical name to
+ * different underlying secrets.
+ */
+export type AgentSecret = Prisma.AgentSecretModel;
+/**
+ * Model SecretElicitationOutcome
+ * Cross-instance persistence for the out-of-band secret-entry flow
+ * (mcp/tools/secret-elicitation.ts) — was an in-process Map, which stranded
+ * a browser-form submission on the wrong instance under a multi-instance
+ * HTTP deployment. `outcome` holds the SecretElicitationOutcome JSON;
+ * `expiresAt` mirrors the old TTL sweep, now a `DELETE WHERE expiresAt <=
+ * now()` instead of a Map scan.
+ */
+export type SecretElicitationOutcome = Prisma.SecretElicitationOutcomeModel;
+/**
+ * Model Webhook
+ * Phase 4: inbound trigger for an agent. `secretHash` is an HMAC/hash of
+ * the validation secret shown to the caller once at creation; the raw
+ * secret itself is never stored.
+ */
+export type Webhook = Prisma.WebhookModel;
+/**
+ * Model OAuthClient
+ * Phase 4 (self-hosted AS only): a registered OAuth client. Created and
+ * used only under AUTH_PROVIDER=self-hosted; the delegating adapter never
+ * writes these tables even though the migration creates them unconditionally.
+ */
+export type OAuthClient = Prisma.OAuthClientModel;
+/**
+ * Model OAuthGrant
+ * Phase 4 (self-hosted AS only): an issued authorization grant / refresh token.
+ */
+export type OAuthGrant = Prisma.OAuthGrantModel;
+/**
+ * Model AuthUser
+ *
+ */
+export type AuthUser = Prisma.AuthUserModel;
+/**
+ * Model AuthLoginKey
+ *
+ */
+export type AuthLoginKey = Prisma.AuthLoginKeyModel;
+/**
+ * Model AuthSession
+ *
+ */
+export type AuthSession = Prisma.AuthSessionModel;
+/**
+ * Model AuthFormChallenge
+ *
+ */
+export type AuthFormChallenge = Prisma.AuthFormChallengeModel;
+/**
+ * Model OAuthAuthorizationRequest
+ *
+ */
+export type OAuthAuthorizationRequest = Prisma.OAuthAuthorizationRequestModel;
+/**
+ * Model OAuthAuthorizationCode
+ *
+ */
+export type OAuthAuthorizationCode = Prisma.OAuthAuthorizationCodeModel;
+/**
+ * Model OAuthFamily
+ *
+ */
+export type OAuthFamily = Prisma.OAuthFamilyModel;
+/**
+ * Model AuthRateLimit
+ *
+ */
+export type AuthRateLimit = Prisma.AuthRateLimitModel;

package/dist/generated/prisma/browser.js

@@ -0,0 +1,17 @@
+/* !!! This is code generated by Prisma. Do not edit directly. !!! */
+/* eslint-disable */
+// biome-ignore-all lint: generated file
+// @ts-nocheck 
+/*
+ * This file should be your main import to use Prisma-related types and utilities in a browser.
+ * Use it to get access to models, enums, and input types.
+ *
+ * This file does not contain a `PrismaClient` class, nor several other helpers that are intended as server-side only.
+ * See `client.ts` for the standard, server-side entry point.
+ *
+ * 🟢 You can import this file directly.
+ */
+import * as Prisma from './internal/prismaNamespaceBrowser.js';
+export { Prisma };
+export * as $Enums from './enums.js';
+export * from './enums.js';