@wardby/cli 0.5.3 → 0.7.0

package/dist/core/workflow-run-events.js

@@ -0,0 +1,75 @@
+import { packageAuditDigest } from "../coding/registry/audit-mode.js";
+import { blockingRefusals, collectPackageAudit, collectRunOutcome, isBlockedByRefusals } from "./host-status.js";
+import { logger } from "./logger.js";
+import { dedupeKeys, emitWorkflowEvent, shortReason } from "./workflow-events.js";
+const log = logger.child({ module: "workflow-run-events" });
+const FAILED = new Set(["failed", "budget_exhausted", "cancelled", "lost", "refused"]);
+const VERDICTS = new Set(["APPROVE", "CHANGES_REQUESTED", "COMMENT"]);
+/** Emits top-level run outcomes and published review verdicts. Never throws. */
+export async function emitRunFinishedEvents(db, run) {
+    try {
+        const agentName = (await db.agent.findUnique({ where: { id: run.agentId }, select: { name: true } }))?.name ?? run.agentId;
+        if (!run.parentRunId) {
+            try {
+                // Only a succeeded run can be blocked (isBlockedByRefusals), so only it needs its children read.
+                const succeeded = { id: run.id, status: "succeeded", finalText: null };
+                const outcome = run.status === "succeeded" ? await collectRunOutcome(db, succeeded) : null;
+                if (outcome && isBlockedByRefusals(succeeded, outcome)) {
+                    await emitWorkflowEvent({
+                        dedupeKey: dedupeKeys.runBlocked(run.id),
+                        runId: run.id,
+                        agentId: run.agentId,
+                        payload: { kind: "run_blocked", agentName, packageRefusals: blockingRefusals(outcome) },
+                    });
+                }
+                // Any terminal status: what audit mode let in is worth knowing whether or not the run succeeded.
+                const audit = outcome ? outcome.packageAudit : await collectPackageAudit(db, run.id);
+                if (audit && audit.summary.entries.length > 0) {
+                    await emitWorkflowEvent({
+                        dedupeKey: dedupeKeys.packagesAudited(run.id),
+                        runId: run.id,
+                        agentId: run.agentId,
+                        payload: {
+                            kind: "packages_audited",
+                            agentName,
+                            mode: audit.mode,
+                            ...packageAuditDigest(audit.mode, audit.summary),
+                        },
+                    });
+                }
+            }
+            catch {
+                // A reporting read failure must not prevent other workflow events.
+            }
+            if (FAILED.has(run.status)) {
+                await emitWorkflowEvent({
+                    dedupeKey: dedupeKeys.runFailed(run.id),
+                    runId: run.id,
+                    agentId: run.agentId,
+                    payload: { kind: "run_failed", agentName, status: run.status, reason: shortReason(run.error) },
+                });
+            }
+        }
+        const check = await db.runHostCheck.findUnique({ where: { runId: run.id } });
+        if (check?.verdict && VERDICTS.has(check.verdict) && check.prNumber !== null) {
+            const prLabel = `${check.repository}#${check.prNumber}`;
+            await emitWorkflowEvent({
+                dedupeKey: dedupeKeys.reviewPosted(run.id),
+                runId: run.id,
+                agentId: run.agentId,
+                pullRequest: { codeProvider: check.provider, repository: check.repository, number: check.prNumber },
+                payload: {
+                    kind: "review_posted",
+                    agentName,
+                    verdict: check.verdict,
+                    prLabel,
+                    prUrl: check.provider === "github" ? `https://github.com/${check.repository}/pull/${check.prNumber}` : null,
+                    ciPending: check.ciPendingAtReview === true,
+                },
+            });
+        }
+    }
+    catch (err) {
+        log.warn({ err, runId: run.id }, "could not emit run workflow events");
+    }
+}

package/dist/core/zod-json-schema.d.ts

@@ -0,0 +1,4 @@
+export interface LegacyJsonSchemaOptions {
+    closeObjects?: boolean;
+}
+export declare function legacyJsonSchema(node: unknown, options?: LegacyJsonSchemaOptions): unknown;

package/dist/core/zod-json-schema.js

@@ -0,0 +1,39 @@
+function isStringKeySchema(value) {
+    return (!!value &&
+        typeof value === "object" &&
+        !Array.isArray(value) &&
+        Object.keys(value).length === 1 &&
+        value.type === "string");
+}
+export function legacyJsonSchema(node, options = {}) {
+    if (Array.isArray(node))
+        return node.map((item) => legacyJsonSchema(item, options));
+    if (!node || typeof node !== "object")
+        return node;
+    const source = node;
+    const out = {};
+    for (const [key, value] of Object.entries(source)) {
+        if (source.type === "integer" && key === "minimum" && value === Number.MIN_SAFE_INTEGER)
+            continue;
+        if (source.type === "integer" && key === "maximum" && value === Number.MAX_SAFE_INTEGER)
+            continue;
+        if (key === "propertyNames" && isStringKeySchema(value))
+            continue;
+        if (options.closeObjects &&
+            key === "additionalProperties" &&
+            value &&
+            typeof value === "object" &&
+            Object.keys(value).length === 0) {
+            out[key] = true;
+            continue;
+        }
+        // A `properties` map's keys are names, not keywords: only its values are schemas.
+        out[key === "oneOf" ? "anyOf" : key] =
+            key === "properties" && value && typeof value === "object"
+                ? Object.fromEntries(Object.entries(value).map(([name, sub]) => [name, legacyJsonSchema(sub, options)]))
+                : legacyJsonSchema(value, options);
+    }
+    if (options.closeObjects && source.type === "object" && "properties" in source && !("additionalProperties" in source))
+        out.additionalProperties = false;
+    return out;
+}

package/dist/core/zod3-window.d.ts

@@ -0,0 +1,35 @@
+import type { PrismaClient } from "#prisma";
+import { type Zod4Compatibility } from "../sandbox/zod-params.js";
+import type { SandboxResult } from "../sandbox/eval-core.js";
+export declare const ZOD3_WINDOW_ENDS = "Zod 3 schemas stop working in the next release";
+/** The warning for one paramsZod, or undefined when Zod 4 compiles it (or there is nothing to say). */
+export declare function zod3WindowWarning(subject: string, compatibility: Zod4Compatibility): string | undefined;
+/** How a warning names a tool. */
+export declare function toolSubject(name: string): string;
+export declare function cachedZod4Compatibility(paramsZod: string): Promise<Zod4Compatibility>;
+/** Test hook: empties the compatibility cache. */
+export declare function clearZod4CompatibilityCache(): void;
+/** The warnings for one tool's paramsZod (empty or one entry), ready for a result's `warnings`. */
+export declare function zod3ToolWarnings(subject: string, paramsZod: string): Promise<string[]>;
+/**
+ * A tool row with its Zod 3 window warnings, for a caller who owns it (and so
+ * already sees its paramsZod). Rows projected for anyone else, which carry no
+ * paramsZod, pass through unchanged: a warning would reveal part of the schema.
+ */
+export declare function withZod3ToolWarnings<T extends object>(projected: T): Promise<T | (T & {
+    warnings: string[];
+})>;
+/**
+ * dry_run_tool's check of a schema Zod 4 does compile: whether Zod 4 treats
+ * the sample arguments as the current release does. Names no values.
+ */
+export declare function zod3SampleArgsWarning(subject: string, current: SandboxResult, zod4: SandboxResult): string | undefined;
+interface WarnLog {
+    warn(fields: object, message: string): void;
+}
+/**
+ * Logs one warning per stored tool whose paramsZod Zod 4 can't compile. Runs
+ * in the background at startup; never throws.
+ */
+export declare function logZod3ToolWarnings(db: Pick<PrismaClient, "tool">, log: WarnLog): Promise<number>;
+export {};

package/dist/core/zod3-window.js

@@ -0,0 +1,124 @@
+/**
+ * The Zod 3 compatibility window's warnings (one release; see
+ * sandbox/zod-params.ts). A custom tool whose paramsZod Zod 4 can't compile
+ * still works this release, compiled with Zod 3, and stops working in the
+ * next. The operator hears about it in create_tool, update_tool,
+ * dry_run_tool, list_tools and get_agent results (on tools the caller owns),
+ * in import results, from `wardby tool create`, and once per tool in the
+ * server log at startup.
+ *
+ * A warning names only the tool and the removed Zod 3 API it uses (fixed
+ * labels from zod-params.ts): never the schema's text or anything else from
+ * the tool.
+ */
+import { createHash } from "node:crypto";
+import { zod4Compatibility } from "../sandbox/zod-params.js";
+export const ZOD3_WINDOW_ENDS = "Zod 3 schemas stop working in the next release";
+/** The warning for one paramsZod, or undefined when Zod 4 compiles it (or there is nothing to say). */
+export function zod3WindowWarning(subject, compatibility) {
+    if (compatibility.compatible !== false)
+        return undefined;
+    const what = compatibility.removed.length
+        ? `uses Zod 3 API that Zod 4 removed: ${compatibility.removed.join(", ")}`
+        : "does not compile with Zod 4";
+    return (`${subject} ${what}. Wardby still compiles it with Zod 3 in this release, but ${ZOD3_WINDOW_ENDS}: ` +
+        "rewrite it with the Zod 4 API and check it with dry_run_tool.");
+}
+/** How a warning names a tool. */
+export function toolSubject(name) {
+    return `Tool ${JSON.stringify(name)}'s paramsZod`;
+}
+/**
+ * Compatibility depends on the paramsZod text alone, so results are cached in
+ * memory keyed by a SHA-256 of that text: a changed paramsZod is a different
+ * key and is always probed afresh, so the cache can never hide a warning for
+ * it. The tool's name is not part of the result (the warning text is built
+ * from the current name each time). The startup scan fills the cache, so
+ * list_tools usually probes nothing. Bounded; the oldest entry goes first.
+ * An "unknown" result (a probe that hit a sandbox limit) is not cached.
+ */
+const COMPATIBILITY_CACHE_LIMIT = 2000;
+const compatibilityCache = new Map();
+export function cachedZod4Compatibility(paramsZod) {
+    const key = createHash("sha256").update(paramsZod).digest("hex");
+    const hit = compatibilityCache.get(key);
+    if (hit)
+        return hit;
+    const pending = zod4Compatibility(paramsZod).then((result) => {
+        if (result.compatible === "unknown")
+            compatibilityCache.delete(key);
+        return result;
+    }, (err) => {
+        compatibilityCache.delete(key);
+        throw err;
+    });
+    compatibilityCache.set(key, pending);
+    while (compatibilityCache.size > COMPATIBILITY_CACHE_LIMIT) {
+        compatibilityCache.delete(compatibilityCache.keys().next().value);
+    }
+    return pending;
+}
+/** Test hook: empties the compatibility cache. */
+export function clearZod4CompatibilityCache() {
+    compatibilityCache.clear();
+}
+/** The warnings for one tool's paramsZod (empty or one entry), ready for a result's `warnings`. */
+export async function zod3ToolWarnings(subject, paramsZod) {
+    const warning = zod3WindowWarning(subject, await cachedZod4Compatibility(paramsZod));
+    return warning ? [warning] : [];
+}
+/**
+ * A tool row with its Zod 3 window warnings, for a caller who owns it (and so
+ * already sees its paramsZod). Rows projected for anyone else, which carry no
+ * paramsZod, pass through unchanged: a warning would reveal part of the schema.
+ */
+export async function withZod3ToolWarnings(projected) {
+    const row = projected;
+    if (typeof row.paramsZod !== "string" || typeof row.name !== "string")
+        return projected;
+    const warnings = await zod3ToolWarnings(toolSubject(row.name), row.paramsZod);
+    return warnings.length ? { ...projected, warnings } : projected;
+}
+/**
+ * dry_run_tool's check of a schema Zod 4 does compile: whether Zod 4 treats
+ * the sample arguments as the current release does. Names no values.
+ */
+export function zod3SampleArgsWarning(subject, current, zod4) {
+    let how;
+    if (current.ok && zod4.ok) {
+        if (JSON.stringify(current.value) === JSON.stringify(zod4.value))
+            return undefined;
+        how = "parses the sample arguments to a different value with Zod 4";
+    }
+    else if (current.ok !== zod4.ok) {
+        how = current.ok ? "rejects the sample arguments with Zod 4" : "accepts the sample arguments with Zod 4";
+    }
+    else {
+        return undefined;
+    }
+    return (`${subject} ${how}. Wardby still compiles it with Zod 3 in this release, but ${ZOD3_WINDOW_ENDS}: ` +
+        "check the schema against the Zod 4 API.");
+}
+/**
+ * Logs one warning per stored tool whose paramsZod Zod 4 can't compile. Runs
+ * in the background at startup; never throws.
+ */
+export async function logZod3ToolWarnings(db, log) {
+    let warned = 0;
+    try {
+        const tools = await db.tool.findMany({ select: { id: true, name: true, paramsZod: true }, orderBy: { id: "asc" } });
+        for (const tool of tools) {
+            const compatibility = await cachedZod4Compatibility(tool.paramsZod);
+            const warning = zod3WindowWarning(toolSubject(tool.name), compatibility);
+            if (!warning)
+                continue;
+            const removed = compatibility.compatible === false ? compatibility.removed : [];
+            log.warn({ toolId: tool.id, toolName: tool.name, removed }, warning);
+            warned += 1;
+        }
+    }
+    catch (err) {
+        log.warn({ errorName: err instanceof Error ? err.name : typeof err }, "zod3_window_check_failed");
+    }
+    return warned;
+}

package/dist/generated/prisma/browser.d.ts

@@ -111,6 +111,12 @@ export type CodingAgentProfile = Prisma.CodingAgentProfileModel;
  * one coding run. Policy is copied from the profile before work starts.
  */
 export type CodingRun = Prisma.CodingRunModel;
+/**
+ * Model RunTranscript
+ * A coding run's session transcript for local resume: metadata only. The redacted content lives in
+ * the blob store under blobKey; the unredacted transcript is never stored.
+ */
+export type RunTranscript = Prisma.RunTranscriptModel;
 /**
  * Model CodingService
  * Coding-run services (docs/coding-services.md): the catalog a repository's
@@ -134,6 +140,42 @@ export type CodingService = Prisma.CodingServiceModel;
  * never probe output.
  */
 export type CodingRunServiceStatus = Prisma.CodingRunServiceStatusModel;
+/**
+ * Model RunBudgetEvent
+ * One budget decision about a run: a refusal by the coding proxy or at
+ * dispatch, or an overrun top-up with no room, with the numbers behind it.
+ * `limit` names what refused it: run, run-tree, day, week or month. `details`
+ * holds amounts, the model and the turn; never secrets or message text.
+ */
+export type RunBudgetEvent = Prisma.RunBudgetEventModel;
+/**
+ * Model NativeGatewaySession
+ * The trusted gateway's record of one sandbox-mode native run (native
+ * sandbox phase 3): the worker authenticates with a capability whose hash is
+ * stored here (the raw token is never persisted), and any control-plane
+ * replica can serve it from this row. `snapshot` is what the run loaded --
+ * the worker's input plus trusted-only capabilities and links -- and never
+ * holds a secret value.
+ */
+export type NativeGatewaySession = Prisma.NativeGatewaySessionModel;
+/**
+ * Model NativeWarmWorker
+ * One worker of the native sandbox warm pool (native sandbox phase 6): an
+ * isolated worker started before any run exists, holding no run data or
+ * capability. A run claims an idle one with a compare-and-swap on this row
+ * (`runId` is set at the claim), its input is delivered only after, and the
+ * worker is destroyed after that one run. The row is inserted before the
+ * worker is created, so a worker with no row is an orphan.
+ */
+export type NativeWarmWorker = Prisma.NativeWarmWorkerModel;
+/**
+ * Model NativeGatewayCall
+ * One worker call through the gateway, keyed by its callId: model calls are
+ * reserved before the provider is called and settled after; side-effecting
+ * built-in and bridge calls keep their result so a retried callId replays it;
+ * a delegation records the child run it started.
+ */
+export type NativeGatewayCall = Prisma.NativeGatewayCallModel;
 /**
  * Model CodingProxySession
  * Trusted-boundary state for one coding run. Only a capability digest and an
@@ -142,10 +184,17 @@ export type CodingRunServiceStatus = Prisma.CodingRunServiceStatusModel;
 export type CodingProxySession = Prisma.CodingProxySessionModel;
 /**
  * Model CodingProxyRequest
- * Monotonic per-upstream-call ledger. Uncertain reservations remain held so a
- * crash or truncated provider stream can never create new spendable budget.
+ * Monotonic per-upstream-call ledger. An uncertain request without an
+ * estimate stays held in full; one the proxy estimated (costEstimated) counts
+ * at that estimate.
  */
 export type CodingProxyRequest = Prisma.CodingProxyRequestModel;
+/**
+ * Model RegistryAuditRecord
+ * One package version a run's registry served only because of package audit mode (or, in full mode,
+ * served despite blocking advisories). Insert-only for the proxy.
+ */
+export type RegistryAuditRecord = Prisma.RegistryAuditRecordModel;
 /**
  * Model RegistryAllowance
  * One package a run's profile has approved from a given ecosystem, resolved
@@ -183,6 +232,15 @@ export type RegistryApprovedVersion = Prisma.RegistryApprovedVersionModel;
  * from here with the same code and reason, without a graph walk.
  */
 export type RegistryPlanRefusal = Prisma.RegistryPlanRefusalModel;
+/**
+ * Model DependencySnapshot
+ * A cached node_modules snapshot for one npm project of a repository, keyed
+ * server-side by the coding proxy. The archive lives in the blob store under
+ * blobKey; only trusted wardby code writes it, before a run's agent starts.
+ * Outlives the run that created it (createdByRunId is cleared when that run is
+ * deleted); evicted least-recently-used.
+ */
+export type DependencySnapshot = Prisma.DependencySnapshotModel;
 /**
  * Model SchedulerLease
  * Phase 2: single-row-per-scope lease so exactly one scheduler process
@@ -218,6 +276,12 @@ export type Task = Prisma.TaskModel;
  * produces plaintext, and only at point-of-use inside the sandbox.
  */
 export type Secret = Prisma.SecretModel;
+/**
+ * Model SecretBrokerChange
+ * Audit trail of every change to a secret's broker config. No FK to Secret,
+ * so the history survives deleting the secret. Never holds a value.
+ */
+export type SecretBrokerChange = Prisma.SecretBrokerChangeModel;
 /**
  * Model AgentSecret
  * Phase 4: attaches a secret to an agent, addressed at sandbox point-of-use
@@ -364,7 +428,8 @@ export type AgentIssueProject = Prisma.AgentIssueProjectModel;
 export type IssueFingerprint = Prisma.IssueFingerprintModel;
 /**
  * Model IssuePullRequest
- * A pull request wardby opened for a tracker issue (the Jira -> code bridge). Provider-neutral on both sides.
+ * A pull request wardby opened for an issue (a Jira issue, a GitHub issue): one shape for every issue
+ * provider. Provider-neutral on both sides.
  * Deliberately no foreign keys to Agent or Run: audit-style rows that survive agent/run deletion.
  */
 export type IssuePullRequest = Prisma.IssuePullRequestModel;
@@ -415,3 +480,27 @@ export type LocalPullRequest = Prisma.LocalPullRequestModel;
  * A review (or a plain comment, verdict COMMENT) published on a LocalPullRequest.
  */
 export type LocalReview = Prisma.LocalReviewModel;
+/**
+ * Model NotificationChannel
+ * A Slack (chat) channel that receives workflow notifications for a Jira
+ * project or for one agent. Exactly one subject: (issueProvider, projectKey)
+ * or agentId (enforced in code and by a CHECK constraint). Admin-approved.
+ * See docs/slack-notifications.md.
+ */
+export type NotificationChannel = Prisma.NotificationChannelModel;
+/**
+ * Model WorkflowEvent
+ * One workflow fact (a card picked up, a PR opened, ...). Written only when
+ * at least one channel matches. No FKs to Run/Agent: audit-style rows.
+ */
+export type WorkflowEvent = Prisma.WorkflowEventModel;
+/**
+ * Model NotificationDelivery
+ * One event's delivery to one channel (the outbox row the dispatcher works).
+ */
+export type NotificationDelivery = Prisma.NotificationDeliveryModel;
+/**
+ * Model NotificationThread
+ * The parent message of a work item's (or PR's) thread in one channel.
+ */
+export type NotificationThread = Prisma.NotificationThreadModel;

package/dist/generated/prisma/client.d.ts

@@ -130,6 +130,12 @@ export type CodingAgentProfile = Prisma.CodingAgentProfileModel;
  * one coding run. Policy is copied from the profile before work starts.
  */
 export type CodingRun = Prisma.CodingRunModel;
+/**
+ * Model RunTranscript
+ * A coding run's session transcript for local resume: metadata only. The redacted content lives in
+ * the blob store under blobKey; the unredacted transcript is never stored.
+ */
+export type RunTranscript = Prisma.RunTranscriptModel;
 /**
  * Model CodingService
  * Coding-run services (docs/coding-services.md): the catalog a repository's
@@ -153,6 +159,42 @@ export type CodingService = Prisma.CodingServiceModel;
  * never probe output.
  */
 export type CodingRunServiceStatus = Prisma.CodingRunServiceStatusModel;
+/**
+ * Model RunBudgetEvent
+ * One budget decision about a run: a refusal by the coding proxy or at
+ * dispatch, or an overrun top-up with no room, with the numbers behind it.
+ * `limit` names what refused it: run, run-tree, day, week or month. `details`
+ * holds amounts, the model and the turn; never secrets or message text.
+ */
+export type RunBudgetEvent = Prisma.RunBudgetEventModel;
+/**
+ * Model NativeGatewaySession
+ * The trusted gateway's record of one sandbox-mode native run (native
+ * sandbox phase 3): the worker authenticates with a capability whose hash is
+ * stored here (the raw token is never persisted), and any control-plane
+ * replica can serve it from this row. `snapshot` is what the run loaded --
+ * the worker's input plus trusted-only capabilities and links -- and never
+ * holds a secret value.
+ */
+export type NativeGatewaySession = Prisma.NativeGatewaySessionModel;
+/**
+ * Model NativeWarmWorker
+ * One worker of the native sandbox warm pool (native sandbox phase 6): an
+ * isolated worker started before any run exists, holding no run data or
+ * capability. A run claims an idle one with a compare-and-swap on this row
+ * (`runId` is set at the claim), its input is delivered only after, and the
+ * worker is destroyed after that one run. The row is inserted before the
+ * worker is created, so a worker with no row is an orphan.
+ */
+export type NativeWarmWorker = Prisma.NativeWarmWorkerModel;
+/**
+ * Model NativeGatewayCall
+ * One worker call through the gateway, keyed by its callId: model calls are
+ * reserved before the provider is called and settled after; side-effecting
+ * built-in and bridge calls keep their result so a retried callId replays it;
+ * a delegation records the child run it started.
+ */
+export type NativeGatewayCall = Prisma.NativeGatewayCallModel;
 /**
  * Model CodingProxySession
  * Trusted-boundary state for one coding run. Only a capability digest and an
@@ -161,10 +203,17 @@ export type CodingRunServiceStatus = Prisma.CodingRunServiceStatusModel;
 export type CodingProxySession = Prisma.CodingProxySessionModel;
 /**
  * Model CodingProxyRequest
- * Monotonic per-upstream-call ledger. Uncertain reservations remain held so a
- * crash or truncated provider stream can never create new spendable budget.
+ * Monotonic per-upstream-call ledger. An uncertain request without an
+ * estimate stays held in full; one the proxy estimated (costEstimated) counts
+ * at that estimate.
  */
 export type CodingProxyRequest = Prisma.CodingProxyRequestModel;
+/**
+ * Model RegistryAuditRecord
+ * One package version a run's registry served only because of package audit mode (or, in full mode,
+ * served despite blocking advisories). Insert-only for the proxy.
+ */
+export type RegistryAuditRecord = Prisma.RegistryAuditRecordModel;
 /**
  * Model RegistryAllowance
  * One package a run's profile has approved from a given ecosystem, resolved
@@ -202,6 +251,15 @@ export type RegistryApprovedVersion = Prisma.RegistryApprovedVersionModel;
  * from here with the same code and reason, without a graph walk.
  */
 export type RegistryPlanRefusal = Prisma.RegistryPlanRefusalModel;
+/**
+ * Model DependencySnapshot
+ * A cached node_modules snapshot for one npm project of a repository, keyed
+ * server-side by the coding proxy. The archive lives in the blob store under
+ * blobKey; only trusted wardby code writes it, before a run's agent starts.
+ * Outlives the run that created it (createdByRunId is cleared when that run is
+ * deleted); evicted least-recently-used.
+ */
+export type DependencySnapshot = Prisma.DependencySnapshotModel;
 /**
  * Model SchedulerLease
  * Phase 2: single-row-per-scope lease so exactly one scheduler process
@@ -237,6 +295,12 @@ export type Task = Prisma.TaskModel;
  * produces plaintext, and only at point-of-use inside the sandbox.
  */
 export type Secret = Prisma.SecretModel;
+/**
+ * Model SecretBrokerChange
+ * Audit trail of every change to a secret's broker config. No FK to Secret,
+ * so the history survives deleting the secret. Never holds a value.
+ */
+export type SecretBrokerChange = Prisma.SecretBrokerChangeModel;
 /**
  * Model AgentSecret
  * Phase 4: attaches a secret to an agent, addressed at sandbox point-of-use
@@ -383,7 +447,8 @@ export type AgentIssueProject = Prisma.AgentIssueProjectModel;
 export type IssueFingerprint = Prisma.IssueFingerprintModel;
 /**
  * Model IssuePullRequest
- * A pull request wardby opened for a tracker issue (the Jira -> code bridge). Provider-neutral on both sides.
+ * A pull request wardby opened for an issue (a Jira issue, a GitHub issue): one shape for every issue
+ * provider. Provider-neutral on both sides.
  * Deliberately no foreign keys to Agent or Run: audit-style rows that survive agent/run deletion.
  */
 export type IssuePullRequest = Prisma.IssuePullRequestModel;
@@ -434,3 +499,27 @@ export type LocalPullRequest = Prisma.LocalPullRequestModel;
  * A review (or a plain comment, verdict COMMENT) published on a LocalPullRequest.
  */
 export type LocalReview = Prisma.LocalReviewModel;
+/**
+ * Model NotificationChannel
+ * A Slack (chat) channel that receives workflow notifications for a Jira
+ * project or for one agent. Exactly one subject: (issueProvider, projectKey)
+ * or agentId (enforced in code and by a CHECK constraint). Admin-approved.
+ * See docs/slack-notifications.md.
+ */
+export type NotificationChannel = Prisma.NotificationChannelModel;
+/**
+ * Model WorkflowEvent
+ * One workflow fact (a card picked up, a PR opened, ...). Written only when
+ * at least one channel matches. No FKs to Run/Agent: audit-style rows.
+ */
+export type WorkflowEvent = Prisma.WorkflowEventModel;
+/**
+ * Model NotificationDelivery
+ * One event's delivery to one channel (the outbox row the dispatcher works).
+ */
+export type NotificationDelivery = Prisma.NotificationDeliveryModel;
+/**
+ * Model NotificationThread
+ * The parent message of a work item's (or PR's) thread in one channel.
+ */
+export type NotificationThread = Prisma.NotificationThreadModel;