@wardby/cli 0.2.1 → 0.4.0

package/dist/core/tool-names.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Tool-name rules shared by every path that creates or attaches a Tool
+ * (MCP create_tool/attach_tool, `wardby tool create|attach`, the importer)
+ * and by the runner that dispatches them.
+ *
+ * Tool names are unique per owner, not globally (schema.prisma), so one
+ * agent could otherwise end up holding two same-named tools -- say its own
+ * `foo` plus a public `foo`. The runtime dispatches by name (runner.ts), so
+ * the model would see a duplicate tool name and one tool would silently
+ * shadow the other; every attach path refuses that instead
+ * (findSameNamedAttachedTool), and the runner asserts it at load time.
+ */
+import type { Prisma, PrismaClient, Tool } from "#prisma";
+/** The runner's synthesized sub-agent tools are `delegate_to_<boundName>`. */
+export declare const DELEGATE_TOOL_PREFIX = "delegate_to_";
+/**
+ * Why `name` can't be a user tool's name, or undefined if it can. Each
+ * reserved name is checked by the runner before user tools, so a user tool
+ * with one of these names could be created but never reached.
+ */
+export declare function reservedToolNameReason(name: string): string | undefined;
+/** Names appearing more than once, each reported once, in first-seen order. */
+export declare function duplicateToolNames(names: readonly string[]): string[];
+export type ToolLookupDb = Pick<PrismaClient | Prisma.TransactionClient, "tool" | "agentTool">;
+/**
+ * A tool other than `tool` that is already attached to `agentId` under the
+ * same name, or null. Run it inside the attaching transaction (attach_tool's
+ * is Serializable) so a concurrent attach can't slip in between.
+ */
+export declare function findSameNamedAttachedTool(db: Pick<ToolLookupDb, "agentTool">, agentId: string, tool: Pick<Tool, "id" | "name">): Promise<Pick<Tool, "id" | "name" | "ownerId"> | null>;
+/**
+ * Resolves a CLI tool reference: an id, else a name. A name is no longer
+ * unique across owners, so more than one match is refused -- with the
+ * candidate ids, so the operator can pass one -- rather than guessed at.
+ */
+export declare function resolveToolRef(db: Pick<ToolLookupDb, "tool">, ref: string): Promise<{
+    ok: true;
+    tool: Tool;
+} | {
+    ok: false;
+    error: string;
+}>;

package/dist/core/tool-names.js

@@ -0,0 +1,67 @@
+import { MEMORY_TOOL_NAMES } from "./memory-tools.js";
+import { SUBAGENT_MEMORY_TOOL_NAMES } from "./subagent-memory-tools.js";
+import { ISSUE_TRACKER_TOOL_NAMES } from "./issue-tracker-tools.js";
+/** The runner's synthesized sub-agent tools are `delegate_to_<boundName>`. */
+export const DELEGATE_TOOL_PREFIX = "delegate_to_";
+/**
+ * Why `name` can't be a user tool's name, or undefined if it can. Each
+ * reserved name is checked by the runner before user tools, so a user tool
+ * with one of these names could be created but never reached.
+ */
+export function reservedToolNameReason(name) {
+    if (MEMORY_TOOL_NAMES.has(name))
+        return `Tool name "${name}" is reserved for the built-in agent-memory tools.`;
+    if (SUBAGENT_MEMORY_TOOL_NAMES.has(name)) {
+        return `Tool name "${name}" is reserved for the built-in sub-agent memory tools.`;
+    }
+    if (ISSUE_TRACKER_TOOL_NAMES.has(name))
+        return `Tool name "${name}" is reserved for the built-in Jira tools.`;
+    if (name.startsWith(DELEGATE_TOOL_PREFIX)) {
+        return `Tool names starting with "${DELEGATE_TOOL_PREFIX}" are reserved for sub-agent delegation tools.`;
+    }
+    return undefined;
+}
+/** Names appearing more than once, each reported once, in first-seen order. */
+export function duplicateToolNames(names) {
+    const seen = new Set();
+    const duplicates = new Set();
+    for (const name of names) {
+        if (seen.has(name))
+            duplicates.add(name);
+        seen.add(name);
+    }
+    return [...duplicates];
+}
+/**
+ * A tool other than `tool` that is already attached to `agentId` under the
+ * same name, or null. Run it inside the attaching transaction (attach_tool's
+ * is Serializable) so a concurrent attach can't slip in between.
+ */
+export async function findSameNamedAttachedTool(db, agentId, tool) {
+    const clash = await db.agentTool.findFirst({
+        where: { agentId, toolId: { not: tool.id }, tool: { name: tool.name } },
+        select: { tool: { select: { id: true, name: true, ownerId: true } } },
+    });
+    return clash?.tool ?? null;
+}
+/**
+ * Resolves a CLI tool reference: an id, else a name. A name is no longer
+ * unique across owners, so more than one match is refused -- with the
+ * candidate ids, so the operator can pass one -- rather than guessed at.
+ */
+export async function resolveToolRef(db, ref) {
+    const byId = await db.tool.findUnique({ where: { id: ref } });
+    if (byId)
+        return { ok: true, tool: byId };
+    const byName = await db.tool.findMany({ where: { name: ref } });
+    if (byName.length === 0)
+        return { ok: false, error: `unknown tool "${ref}".` };
+    if (byName.length > 1) {
+        const candidates = byName.map((t) => `${t.id} (owner: ${t.ownerId ?? "public"})`).join(", ");
+        return {
+            ok: false,
+            error: `ambiguous: ${byName.length} tools named "${ref}"; pass the tool id instead (${candidates}).`,
+        };
+    }
+    return { ok: true, tool: byName[0] };
+}

package/dist/core/untrusted-content.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The one place untrusted text is fenced for the model. Tool results
+ * (engine-native.ts) and a run's untrusted context (the parts of a trigger
+ * nobody vetted, e.g. a GitHub issue's title and description) are delivered
+ * inside wrapper tags; a run's task is fenced in the system prompt by
+ * run_task tags (runner.ts). Every one of those tags is only a boundary if
+ * the content inside cannot write it, so all wrapped text passes through
+ * neutraliseWrapperTags first (H5-6 / E-09).
+ */
+export declare const UNTRUSTED_TOOL_OUTPUT_TAG = "untrusted_tool_output";
+export declare const UNTRUSTED_CONTEXT_TAG = "untrusted_context";
+export declare const RUN_TASK_TAG = "run_task";
+/** Makes every fence-like tag in `content` inert. Idempotent. */
+export declare function neutraliseWrapperTags(content: string): string;
+/** `content` between `<tag>` and `</tag>`, unable to close or reopen either fence itself. */
+export declare function wrapUntrusted(tag: string, content: string): string;
+/**
+ * Stores a run's task and its untrusted context in the one Run.taskOverride
+ * column: the task, then a wrapped context block. Both parts are
+ * neutralised, so the stored text holds exactly one real context opener.
+ */
+export declare function composeTaskOverride(task: string, untrustedContext?: string): string;
+/**
+ * The inverse of composeTaskOverride, read by the runner. Everything from the
+ * first context opener on is context. A producer that wrote the opener
+ * without composeTaskOverride (a webhook caller, a delegating model) can only
+ * demote its own text into the untrusted context, never promote any.
+ */
+export declare function splitTaskOverride(taskOverride: string): {
+    task: string;
+    untrustedContext?: string;
+};

package/dist/core/untrusted-content.js

@@ -0,0 +1,72 @@
+/**
+ * The one place untrusted text is fenced for the model. Tool results
+ * (engine-native.ts) and a run's untrusted context (the parts of a trigger
+ * nobody vetted, e.g. a GitHub issue's title and description) are delivered
+ * inside wrapper tags; a run's task is fenced in the system prompt by
+ * run_task tags (runner.ts). Every one of those tags is only a boundary if
+ * the content inside cannot write it, so all wrapped text passes through
+ * neutraliseWrapperTags first (H5-6 / E-09).
+ */
+export const UNTRUSTED_TOOL_OUTPUT_TAG = "untrusted_tool_output";
+export const UNTRUSTED_CONTEXT_TAG = "untrusted_context";
+export const RUN_TASK_TAG = "run_task";
+/** Invisible characters (zero-width, bidi controls, soft hyphen, variation selectors, tag characters, ...). */
+const IGNORABLE = "\\p{Default_Ignorable_Code_Point}";
+/** "<" and its common lookalikes: fullwidth, small, angle brackets, single guillemet. */
+const BRACKET = "[<\\uFF1C\\uFE64\\u2329\\u3008\\u27E8\\u2039]";
+/** Between the bracket and the name: whitespace, invisibles, and any number of slashes, backslashes or slash lookalikes. */
+const LEAD = `[\\s${IGNORABLE}/\\\\\\uFF0F\\u2215\\u2044\\u29F8]*`;
+/** Between "run" and "task": whitespace, invisibles, "_", "-" and their dash/fullwidth lookalikes. */
+const JOIN = `[\\s${IGNORABLE}_\\-\\u2010-\\u2015\\uFF3F\\uFF0D]*`;
+/** One ASCII letter or its fullwidth form (the `i` flag covers either case). */
+const letter = (ch) => `[${ch}${String.fromCharCode(0xff41 + ch.charCodeAt(0) - 0x61)}]`;
+/** A word whose letters may be separated by invisible characters. */
+const word = (w) => [...w].map(letter).join(`[${IGNORABLE}]*`);
+/**
+ * A bracket that could be read as opening or closing one of the fences: a
+ * "<" or lookalike, then LEAD, then the start of a fence name ("untrusted…"
+ * or "run_task" / "run-task" / "run task"), in any case, with invisible
+ * characters or fullwidth letters allowed inside the name. Only the bracket
+ * is replaced, with "&lt;", so the rest of the text is unchanged.
+ *
+ * Linear time (I-1): every starred class is followed by a letter it cannot
+ * contain, so it has exactly one way to match, and a failed attempt at one
+ * bracket gives back each character at most once. Homoglyphs from other
+ * scripts inside the name (a Cyrillic "е") are not caught.
+ */
+const FENCE_TAG_LIKE = new RegExp(`${BRACKET}(?=${LEAD}(?:${word("untrusted")}|${word("run")}${JOIN}${word("task")}))`, "giu");
+/** Makes every fence-like tag in `content` inert. Idempotent. */
+export function neutraliseWrapperTags(content) {
+    return content.replace(FENCE_TAG_LIKE, "&lt;");
+}
+/** `content` between `<tag>` and `</tag>`, unable to close or reopen either fence itself. */
+export function wrapUntrusted(tag, content) {
+    return `<${tag}>\n${neutraliseWrapperTags(content)}\n</${tag}>`;
+}
+const CONTEXT_OPEN = `<${UNTRUSTED_CONTEXT_TAG}>\n`;
+const CONTEXT_CLOSE = `\n</${UNTRUSTED_CONTEXT_TAG}>`;
+/**
+ * Stores a run's task and its untrusted context in the one Run.taskOverride
+ * column: the task, then a wrapped context block. Both parts are
+ * neutralised, so the stored text holds exactly one real context opener.
+ */
+export function composeTaskOverride(task, untrustedContext) {
+    const safeTask = neutraliseWrapperTags(task);
+    return untrustedContext ? `${safeTask}\n\n${wrapUntrusted(UNTRUSTED_CONTEXT_TAG, untrustedContext)}` : safeTask;
+}
+/**
+ * The inverse of composeTaskOverride, read by the runner. Everything from the
+ * first context opener on is context. A producer that wrote the opener
+ * without composeTaskOverride (a webhook caller, a delegating model) can only
+ * demote its own text into the untrusted context, never promote any.
+ */
+export function splitTaskOverride(taskOverride) {
+    const at = taskOverride.startsWith(CONTEXT_OPEN) ? 0 : taskOverride.indexOf(`\n${CONTEXT_OPEN}`);
+    if (at < 0)
+        return { task: taskOverride };
+    const task = taskOverride.slice(0, at).trimEnd();
+    let rest = taskOverride.slice(at === 0 ? CONTEXT_OPEN.length : at + 1 + CONTEXT_OPEN.length);
+    if (rest.endsWith(CONTEXT_CLOSE))
+        rest = rest.slice(0, -CONTEXT_CLOSE.length);
+    return { task, untrustedContext: rest };
+}

package/dist/core/webhooks.d.ts

@@ -1,12 +1,20 @@
 import type { PrismaClient, Webhook } from "#prisma";
 import type { Executor } from "../providers/executor/types.js";
+import type { IssueTrackerRegistry } from "../providers/issue-tracker/types.js";
 export type WebhookMetadata = Pick<Webhook, "id" | "agentId" | "status" | "ownerId" | "createdAt" | "lastFiredAt">;
 /** Creates a webhook and returns the raw secret ONCE — only its hash is ever stored. */
 export declare function createWebhook(agentId: string, ownerId: string, db: PrismaClient): Promise<{
     id: string;
     secret: string;
 }>;
-export declare function listWebhooks(ownerId: string, db: PrismaClient): Promise<WebhookMetadata[]>;
+/**
+ * Webhooks the principal created, plus every webhook on an agent it owns
+ * (the agent owner must be able to see standing triggers others hold on
+ * its agent). `all` (the stdio operator) lists every webhook.
+ */
+export declare function listWebhooks(principalId: string, db: PrismaClient, opts?: {
+    all?: boolean;
+}): Promise<WebhookMetadata[]>;
 export declare function deleteWebhook(id: string, db: PrismaClient): Promise<void>;
 export type ResolveWebhookRunResult = {
     ok: true;
@@ -14,10 +22,17 @@ export type ResolveWebhookRunResult = {
 } | {
     ok: false;
     reason: "not_found" | "invalid_secret" | "disabled";
+} | {
+    ok: false;
+    reason: "invalid_issue";
+    message: string;
 };
 /**
  * Validates the presented secret and, if valid + enabled, enqueues a run via
  * the exact same `createRun` path `trigger_agent`/the scheduler use — the
  * budget guardrail applies identically regardless of what triggered the run.
  */
-export declare function resolveWebhookRun(id: string, presentedSecret: string, db: PrismaClient, executor: Executor, codingTask?: string): Promise<ResolveWebhookRunResult>;
+export declare function resolveWebhookRun(id: string, presentedSecret: string, db: PrismaClient, executor: Executor, codingTask?: string, opts?: {
+    issue?: unknown;
+    issueTrackers?: IssueTrackerRegistry;
+}): Promise<ResolveWebhookRunResult>;

package/dist/core/webhooks.js

@@ -9,7 +9,9 @@
  * is always 32 bytes, so there's no length-mismatch case to special-case).
  */
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { AttributionError, explicitAttribution, RESPONSE_PATH_SNAPSHOT_BUDGET, } from "./attribution.js";
 import { dispatchRun } from "./dispatch.js";
+import { atLeast, effectiveAccess } from "./grants.js";
 function hashSecret(secret) {
     return createHash("sha256").update(secret).digest("hex");
 }
@@ -39,8 +41,15 @@ export async function createWebhook(agentId, ownerId, db) {
     const webhook = await db.webhook.create({ data: { agentId, ownerId, secretHash: hashSecret(secret) } });
     return { id: webhook.id, secret };
 }
-export async function listWebhooks(ownerId, db) {
-    const webhooks = await db.webhook.findMany({ where: { ownerId } });
+/**
+ * Webhooks the principal created, plus every webhook on an agent it owns
+ * (the agent owner must be able to see standing triggers others hold on
+ * its agent). `all` (the stdio operator) lists every webhook.
+ */
+export async function listWebhooks(principalId, db, opts = {}) {
+    const webhooks = await db.webhook.findMany({
+        where: opts.all ? {} : { OR: [{ ownerId: principalId }, { agent: { ownerId: principalId } }] },
+    });
     return webhooks.map(({ id, agentId, status, ownerId: owner, createdAt, lastFiredAt }) => ({
         id,
         agentId,
@@ -58,7 +67,7 @@ export async function deleteWebhook(id, db) {
  * the exact same `createRun` path `trigger_agent`/the scheduler use — the
  * budget guardrail applies identically regardless of what triggered the run.
  */
-export async function resolveWebhookRun(id, presentedSecret, db, executor, codingTask) {
+export async function resolveWebhookRun(id, presentedSecret, db, executor, codingTask, opts = {}) {
     const webhook = await db.webhook.findUnique({ where: { id } });
     if (!webhook)
         return { ok: false, reason: "not_found" };
@@ -72,12 +81,29 @@ export async function resolveWebhookRun(id, presentedSecret, db, executor, codin
     if (codingTask !== undefined && !taskAllowed(agent.kind, agent.codingProfile)) {
         return { ok: false, reason: "disabled" };
     }
+    // An invalid or unlinked issue refuses the call before any run exists.
+    let attribution;
+    if (opts.issue !== undefined) {
+        try {
+            attribution = await explicitAttribution(db, opts.issueTrackers, agent.id, opts.issue, {
+                ...RESPONSE_PATH_SNAPSHOT_BUDGET,
+                field: "wardbyIssue",
+            });
+        }
+        catch (err) {
+            if (err instanceof AttributionError)
+                return { ok: false, reason: "invalid_issue", message: err.message };
+            throw err;
+        }
+    }
     let rejected = "disabled";
     const dispatched = await dispatchRun({
         db,
         executor,
+        selfDefects: { db, issueTrackers: opts.issueTrackers },
         agentId: agent.id,
         trigger: "webhook",
+        attribution,
         // Coding agents keep the existing per-agent opt-in (allowWebhookTaskOverride);
         // a native agent's system prompt has no per-run input at all otherwise, so
         // accepting task text over an authenticated webhook call needs no separate
@@ -85,6 +111,9 @@ export async function resolveWebhookRun(id, presentedSecret, db, executor, codin
         // to modify a real repository.
         codingTask: agent.kind === "coding" ? codingTask : undefined,
         taskOverride: agent.kind === "native" ? codingTask : undefined,
+        // The webhook is its creator's standing trigger: its runs are visible to
+        // the creator (and the agent owner), like a trigger_agent call.
+        triggeredById: webhook.ownerId,
         beforePersist: async (tx, currentAgent) => {
             const current = await tx.webhook.findUnique({ where: { id } });
             if (!current) {
@@ -103,6 +132,16 @@ export async function resolveWebhookRun(id, presentedSecret, db, executor, codin
                 rejected = "disabled";
                 return false;
             }
+            // The creator must still be allowed to trigger the agent (resource-
+            // sharing grants spec §3.10): its owner, or a holder of execute. Read
+            // through tx, so a revoke or make_owner takes effect on the next fire.
+            // A webhook on a formerly public agent keeps firing through the
+            // migration's everyone-execute grant.
+            const creatorAccess = await effectiveAccess(tx, "agent", currentAgent, current.ownerId);
+            if (!atLeast("agent", creatorAccess, "execute")) {
+                rejected = "disabled";
+                return false;
+            }
             await tx.webhook.update({ where: { id }, data: { lastFiredAt: new Date() } });
             return true;
         },

package/dist/generated/prisma/browser.d.ts

@@ -111,6 +111,29 @@ export type CodingAgentProfile = Prisma.CodingAgentProfileModel;
  * one coding run. Policy is copied from the profile before work starts.
  */
 export type CodingRun = Prisma.CodingRunModel;
+/**
+ * Model CodingService
+ * Coding-run services (docs/coding-services.md): the catalog a repository's
+ * .wardby/services.yaml names entries from. Admin-managed over MCP
+ * (list/get_service: agents:read; create/update/delete_service:
+ * services:manage, audit-logged).
+ * Built-in rows ship with wardby, seeded by migration, and change only with a
+ * wardby release. `kind` is "sidecar" (a fresh instance in each run's pod);
+ * "external" is reserved.
+ */
+export type CodingService = Prisma.CodingServiceModel;
+/**
+ * Model CodingRunServiceStatus
+ * Live start-up state of one coding-run service (one row per run x
+ * service), written by the job launcher as it observes the service, for
+ * display only (the viewer). The run's CodingRun.services
+ * snapshot says what was started; this says how far each one got.
+ * `attempts` is the readiness probes made so far, known only where wardby
+ * runs the probe itself (Docker); `reason` is a fixed identifier
+ * (image_unavailable, start_failed, exited, probe_failed, timed_out),
+ * never probe output.
+ */
+export type CodingRunServiceStatus = Prisma.CodingRunServiceStatusModel;
 /**
  * Model CodingProxySession
  * Trusted-boundary state for one coding run. Only a capability digest and an
@@ -123,6 +146,43 @@ export type CodingProxySession = Prisma.CodingProxySessionModel;
  * crash or truncated provider stream can never create new spendable budget.
  */
 export type CodingProxyRequest = Prisma.CodingProxyRequestModel;
+/**
+ * Model RegistryAllowance
+ * One package a run's profile has approved from a given ecosystem, resolved
+ * once at dispatch (see CodingRun.packageAllowlist) and used to gate every
+ * proxy fetch for the run's lifetime.
+ */
+export type RegistryAllowance = Prisma.RegistryAllowanceModel;
+/**
+ * Model RegistryFetch
+ * Audit ledger of every package fetch the registry proxy served or refused
+ * for a run.
+ */
+export type RegistryFetch = Prisma.RegistryFetchModel;
+/**
+ * Model RegistryVersionFact
+ * Immutable facts about one published package version, read from the
+ * registry itself (never from a lockfile) by lockfile verification: its
+ * publish time, integrity, download URL and declared dependencies
+ * ([{ key, name, range }], aliases resolved). Stored once and reused
+ * forever; allow/deny decisions are never cached here.
+ */
+export type RegistryVersionFact = Prisma.RegistryVersionFactModel;
+/**
+ * Model RegistryApprovedVersion
+ * One exact package version a run's lockfile plan (POST
+ * /registry/<ecosystem>/-/plan) verified and approved: a download of it is
+ * served directly, integrity-checked against this value.
+ */
+export type RegistryApprovedVersion = Prisma.RegistryApprovedVersionModel;
+/**
+ * Model RegistryPlanRefusal
+ * One exact package version a run's lockfile plan refused for a reason
+ * intrinsic to the registry's name@version (too new, an advisory, not
+ * published, no integrity, hosted elsewhere): a download of it is answered
+ * from here with the same code and reason, without a graph walk.
+ */
+export type RegistryPlanRefusal = Prisma.RegistryPlanRefusalModel;
 /**
  * Model SchedulerLease
  * Phase 2: single-row-per-scope lease so exactly one scheduler process
@@ -136,6 +196,16 @@ export type SchedulerLease = Prisma.SchedulerLeaseModel;
  * Created on first sight (find-or-create by subject).
  */
 export type Principal = Prisma.PrincipalModel;
+/**
+ * Model ResourceGrant
+ * Explicit sharing of one resource with one grantee (docs/private/
+ * 2026-09-26-resource-sharing-grants-spec-and-plan.md). Polymorphic on
+ * (resourceType, resourceId) -- no FK to the resource, so every resource
+ * delete path removes its grants in the same transaction. Levels are
+ * ordered per type and validated in code (core/grants.ts), like
+ * AgentRepository.provider, so a new type or level needs no enum migration.
+ */
+export type ResourceGrant = Prisma.ResourceGrantModel;
 /**
  * Model Task
  *
@@ -226,3 +296,99 @@ export type OAuthFamily = Prisma.OAuthFamilyModel;
  *
  */
 export type AuthRateLimit = Prisma.AuthRateLimitModel;
+/**
+ * Model AgentRepository
+ * Which repositories on which code-review host a native agent may act on,
+ * and which host events trigger it. See
+ * docs/private/2026-09-25-code-review-host-design.md §4.1.
+ */
+export type AgentRepository = Prisma.AgentRepositoryModel;
+/**
+ * Model RunHostCheck
+ * The host check a run owns, so the review tool can complete it and the
+ * run finalizer can close it if the run ends without publishing.
+ */
+export type RunHostCheck = Prisma.RunHostCheckModel;
+/**
+ * Model RunHostStatus
+ * De-duplicates host webhook redeliveries; pruned after 7 days.
+ * The status comment wardby posts on the issue or pull request whose
+ * @-mention started this run ("working on it"), edited with the outcome
+ * when the run ends. One per mention run.
+ */
+export type RunHostStatus = Prisma.RunHostStatusModel;
+/**
+ * Model HostEventDelivery
+ *
+ */
+export type HostEventDelivery = Prisma.HostEventDeliveryModel;
+/**
+ * Model HostIdentity
+ * A principal's verified identity on a code-review host (GitHub today),
+ * linked through the host's user-authorization flow (link_host_account).
+ * Only the numeric user id and login are stored, never a user token. A host
+ * user belongs to at most one principal.
+ */
+export type HostIdentity = Prisma.HostIdentityModel;
+/**
+ * Model HostIdentityLinkRequest
+ * An in-flight host identity link (link_host_account): the OAuth state and
+ * PKCE verifier, then, after the host's callback, the verified user and the
+ * hash of the one-time confirmation code the same principal must submit.
+ * Lives 10 minutes.
+ */
+export type HostIdentityLinkRequest = Prisma.HostIdentityLinkRequestModel;
+/**
+ * Model AgentIssueProject
+ * Which issue-tracker projects (Jira today) a native agent may act on, and
+ * which issue events trigger it. Admin-approved in phase 1 (no way to verify
+ * an owner's Jira access). See
+ * docs/private/2026-09-30-jira-issue-tracker-design.md §3.
+ */
+export type AgentIssueProject = Prisma.AgentIssueProjectModel;
+/**
+ * Model IssueFingerprint
+ * Dedupe record: an issue wardby created for a fingerprint (several over time — regressions).
+ */
+export type IssueFingerprint = Prisma.IssueFingerprintModel;
+/**
+ * Model IssuePullRequest
+ * A pull request wardby opened for a tracker issue (the Jira -> code bridge). Provider-neutral on both sides.
+ * Deliberately no foreign keys to Agent or Run: audit-style rows that survive agent/run deletion.
+ */
+export type IssuePullRequest = Prisma.IssuePullRequestModel;
+/**
+ * Model RunIssueStatus
+ * The status comment wardby posts on the Jira issue whose event started this
+ * run ("working on it"), edited with the outcome when the run ends.
+ */
+export type RunIssueStatus = Prisma.RunIssueStatusModel;
+/**
+ * Model WorkItem
+ * Latest known state of an issue/epic in an external tracker (Jira, later
+ * Linear). Shared by every run attributed to it; titles are refreshed by the
+ * next snapshot, so reports always show current names.
+ */
+export type WorkItem = Prisma.WorkItemModel;
+/**
+ * Model RunAttribution
+ * Which work item a run's cost belongs to, with its parent frozen as of
+ * dispatch. Written in dispatchRun's persist transaction; child runs copy
+ * their parent's row (source "inherited"). Control-plane data only.
+ */
+export type RunAttribution = Prisma.RunAttributionModel;
+/**
+ * Model RunModelUsage
+ * Per-run, per-model usage by priced token kind. Sum of costUsd over a
+ * run's rows equals Run.costUsd (to Run.costUsd's 6 decimal places).
+ */
+export type RunModelUsage = Prisma.RunModelUsageModel;
+/**
+ * Model ModelCatalogEntry
+ * A deployment's override of the shipped model catalog
+ * (src/providers/llm/catalog-shipped.ts), written by set_model /
+ * disable_model (models:admin). A row fully replaces the shipped entry with
+ * the same key; enabled=false removes the model; a row with no shipped match
+ * adds one. Rates are the provider's exact published numbers (sourceUrl).
+ */
+export type ModelCatalogEntry = Prisma.ModelCatalogEntryModel;