models

type Addon struct {
	ID            DBVarchar         `gorm:"primaryKey;not null;size:36"`
	CreatedAt     time.Time         `gorm:"not null;autoCreateTime"`
	Name          DBVarchar         `gorm:"size:256;not null"`
	WebhookID     DBVarchar         `gorm:"size:36;not null;index"`
	Description   NullableDBText    `gorm:""`
	Icon          NullableDBVarchar `gorm:"size:60"`
	Objects       StringArray       `gorm:""`
	ThreatModelID NullableDBVarchar `gorm:"size:36;index"`
	Parameters    JSONRaw           `gorm:""`

	// Relationships
	Webhook     WebhookSubscription `gorm:"foreignKey:WebhookID"`
	ThreatModel *ThreatModel        `gorm:"foreignKey:ThreatModelID"`
}

type AddonInvocationQuota struct {
	OwnerInternalUUID     DBVarchar `gorm:"primaryKey;not null;size:36"`
	MaxActiveInvocations  int       `gorm:"default:3"`
	MaxInvocationsPerHour int       `gorm:"default:10"`
	CreatedAt             time.Time `gorm:"not null;autoCreateTime"`
	ModifiedAt            time.Time `gorm:"not null;autoUpdateTime"`

	// Relationships
	Owner User `gorm:"foreignKey:OwnerInternalUUID;references:InternalUUID"`
}

type AliasCounter struct {
	ParentID   DBVarchar `gorm:"primaryKey;not null;size:36"`
	ObjectType DBVarchar `gorm:"primaryKey;not null;size:16"`
	NextAlias  int32     `gorm:"not null;default:1"`
}

type Asset struct {
	ID              DBVarchar         `gorm:"primaryKey;not null;size:36"`
	ThreatModelID   DBVarchar         `` /* 166-byte string literal not displayed */
	Name            DBVarchar         `gorm:"size:256;not null;index:idx_assets_name"`
	Description     NullableDBText    `gorm:""`
	Type            DBVarchar         `gorm:"size:64;not null;index:idx_assets_type"`
	Criticality     NullableDBVarchar `gorm:"size:128"`
	Classification  StringArray       `gorm:""`
	Sensitivity     NullableDBVarchar `gorm:"size:128"`
	IncludeInReport DBBool            `gorm:"default:1"`
	TimmyEnabled    DBBool            `gorm:"default:1"`
	Alias           int32             `gorm:"not null;default:0;<-:create;uniqueIndex:uniq_assets_tm_alias,priority:2"` // Server-assigned per-(threat_model_id, type) alias
	CreatedAt       time.Time         `gorm:"not null;autoCreateTime;index:idx_assets_created;index:idx_assets_tm_created,priority:2"`
	ModifiedAt      time.Time         `gorm:"not null;autoUpdateTime;index:idx_assets_modified;index:idx_assets_tm_modified,priority:2"`
	DeletedAt       *time.Time        `gorm:"index:idx_assets_deleted_at"`
	// Version is incremented on every successful update (T14 / #385).
	Version int `gorm:"not null;default:1"`

	// Relationships
	ThreatModel ThreatModel `gorm:"foreignKey:ThreatModelID"`
}

type AuditEntry struct {
	ID               DBVarchar      `gorm:"primaryKey;not null;size:36;index:idx_audit_created_id,priority:2"`
	ThreatModelID    DBVarchar      `gorm:"size:36;not null;index:idx_audit_tm;index:idx_audit_tm_created,priority:1"`
	ObjectType       DBVarchar      `gorm:"size:50;not null;index:idx_audit_object,priority:1;index:idx_audit_object_version,priority:1"`
	ObjectID         DBVarchar      `gorm:"size:36;not null;index:idx_audit_object,priority:2;index:idx_audit_object_version,priority:2"`
	Version          *int           `gorm:"index:idx_audit_object_version,priority:3"` // nullable: NULL means version snapshot has been pruned
	ChangeType       DBVarchar      `gorm:"size:20;not null;index:idx_audit_change_type"`
	ActorEmail       DBVarchar      `gorm:"size:320;not null;index:idx_audit_actor,priority:1"`
	ActorProvider    DBVarchar      `gorm:"size:100;not null"`
	ActorProviderID  DBVarchar      `gorm:"size:500;not null"`
	ActorDisplayName DBVarchar      `gorm:"size:256;not null"`
	ChangeSummary    NullableDBText `gorm:""`
	// Composite (created_at, id) index serves the unfiltered admin audit keyset
	// scans and full-table export in both directions (#473). idx_audit_tm_created
	// already covers the filtered-by-threat-model path.
	CreatedAt time.Time `` /* 139-byte string literal not displayed */
}

type CVSSArray []CVSSScore

type CVSSScore struct {
	Vector string  `json:"vector"`
	Score  float64 `json:"score"`
}

type ClientCredential struct {
	ID               DBVarchar      `gorm:"primaryKey;not null;size:36"`
	OwnerUUID        DBVarchar      `gorm:"size:36;not null;index"`
	ClientID         DBVarchar      `gorm:"size:1000;not null;uniqueIndex"`
	ClientSecretHash DBText         `gorm:"not null"`
	Name             DBVarchar      `gorm:"size:256;not null"`
	Description      NullableDBText `gorm:""`
	IsActive         DBBool         `gorm:"default:1"`
	// DirectWrite lets this credential's service-account token pass the T18
	// subject_authority=invoker gate and be authorized by the owner's normal
	// roles (#856). Opt-in; never set on administrator-owned credentials.
	DirectWrite DBBool `gorm:"default:0"`
	// AddonID links a direct_write credential to the addon whose automation
	// uses it, so events caused by its writes are not delivered back to that
	// addon's own subscription (#883). Not a FK: deleting the addon must not
	// invalidate the credential; a dangling link just stops suppressing.
	AddonID    NullableDBVarchar `gorm:"size:36"`
	LastUsedAt *time.Time
	CreatedAt  time.Time `gorm:"not null;autoCreateTime"`
	ModifiedAt time.Time `gorm:"not null;autoUpdateTime"`
	ExpiresAt  *time.Time

	// Relationships
	Owner User `gorm:"foreignKey:OwnerUUID;references:InternalUUID"`
}

type CollaborationSession struct {
	ID            DBVarchar `gorm:"primaryKey;not null;size:36"`
	ThreatModelID DBVarchar `gorm:"size:36;not null;index"`
	DiagramID     DBVarchar `gorm:"size:36;not null;index"`
	WebsocketURL  DBText    `gorm:"not null"`
	CreatedAt     time.Time `gorm:"not null;autoCreateTime"`
	ExpiresAt     *time.Time

	// Relationships
	ThreatModel  ThreatModel          `gorm:"foreignKey:ThreatModelID"`
	Diagram      Diagram              `gorm:"foreignKey:DiagramID"`
	Participants []SessionParticipant `gorm:"foreignKey:SessionID"`
}

type ContentFeedback struct {
	ID                     DBVarchar         `gorm:"primaryKey;not null;size:36"`
	ThreatModelID          DBVarchar         `gorm:"size:36;not null;index:idx_content_feedback_target,priority:1"`
	TargetType             DBVarchar         `gorm:"size:24;not null;index:idx_content_feedback_target,priority:2"`
	TargetID               DBVarchar         `gorm:"size:36;not null;index:idx_content_feedback_target,priority:3"`
	TargetField            NullableDBVarchar `gorm:"size:64"`
	Sentiment              DBVarchar         `gorm:"size:8;not null;index:idx_content_feedback_sentiment"`
	Verbatim               NullableDBText    `gorm:""`
	FalsePositiveReason    NullableDBVarchar `gorm:"size:32;index:idx_content_feedback_fp_reason"`
	FalsePositiveSubreason NullableDBVarchar `gorm:"size:40"`
	ClientID               DBVarchar         `gorm:"size:32;not null"`
	ClientVersion          NullableDBVarchar `gorm:"size:32"`
	Screenshot             NullableDBText    `gorm:""`
	// CreatedBy is the internal UUID of the authenticated user who submitted
	// this feedback (#710: see the identical comment on
	// UsabilityFeedback.CreatedBy above -- renamed from CreatedByUUID, and the
	// explicit column:created_by tag dropped, so the NamingStrategy-derived
	// DBName equals the real column on both dialects).
	CreatedBy DBVarchar `gorm:"size:36;not null"`
	// Note: autoCreateTime tag removed for Oracle compatibility (#380). The
	// repository sets CreatedAt explicitly in Create / CreateWithTargetCheck
	// before INSERT, matching the Threat model pattern.
	CreatedAt time.Time `gorm:"not null;index:idx_content_feedback_created_at"`

	// Relationships. ContentFeedback rows are cleaned up explicitly by
	// deleteThreatModelChildren (issue #378), matching every other TM child.
	// The CreatedByUser FK is suppressed (constraint:-) so a user with
	// outstanding feedback can still be deleted; application-layer integrity
	// is sufficient. Named CreatedByUser (not CreatedBy) to avoid colliding
	// with the scalar CreatedBy field above.
	ThreatModel   ThreatModel `gorm:"foreignKey:ThreatModelID"`
	CreatedByUser User        `gorm:"foreignKey:CreatedBy;references:InternalUUID;constraint:-"`
}

type DBBool bool

type DBBytes []byte

type DBText string

type DBVarchar string

type Diagram struct {
	ID                DBVarchar         `gorm:"primaryKey;not null;size:36"`
	ThreatModelID     DBVarchar         `` /* 129-byte string literal not displayed */
	Name              DBVarchar         `gorm:"size:256;not null"`
	Description       NullableDBText    `gorm:""`
	Type              NullableDBVarchar `gorm:"size:64;index:idx_diagrams_type;index:idx_diagrams_tm_type,priority:2"`
	Content           NullableDBText    `gorm:""`
	Cells             JSONRaw           `gorm:""`
	ColorPalette      JSONRaw           `gorm:""`
	SVGImage          NullableDBText    `gorm:""`
	ImageUpdateVector *int64
	UpdateVector      int64      `gorm:"default:0"`
	IncludeInReport   DBBool     `gorm:"default:1"`
	TimmyEnabled      DBBool     `gorm:"default:1"`
	AutoGenerated     DBBool     `gorm:"default:0;<-:create" json:"auto_generated"`
	Alias             int32      `gorm:"not null;default:0;<-:create;uniqueIndex:uniq_diagrams_tm_alias,priority:2"` // Server-assigned per-(threat_model_id, type) alias
	CreatedAt         time.Time  `gorm:"not null;autoCreateTime"`
	ModifiedAt        time.Time  `gorm:"not null;autoUpdateTime"`
	DeletedAt         *time.Time `gorm:"index:idx_diagrams_deleted_at"`
	// Version is incremented on every successful update (T14 / #385).
	Version int `gorm:"not null;default:1"`

	// Relationships
	ThreatModel ThreatModel `gorm:"foreignKey:ThreatModelID"`
}

type Document struct {
	ID              DBVarchar         `gorm:"primaryKey;not null;size:36"`
	ThreatModelID   DBVarchar         `` /* 163-byte string literal not displayed */
	Name            DBVarchar         `gorm:"size:256;not null;index:idx_docs_name"`
	URI             DBText            `gorm:"not null"`
	Description     NullableDBText    `gorm:""`
	IncludeInReport DBBool            `gorm:"default:1"`
	TimmyEnabled    DBBool            `gorm:"default:1"`
	AccessStatus    NullableDBVarchar `gorm:"size:32;default:unknown"`
	ContentSource   NullableDBVarchar `gorm:"size:64"`

	// Picker registration (all three set together or all null — enforced by application code).
	PickerProviderID NullableDBVarchar `gorm:"size:64;index:idx_docs_picker,priority:1"`
	PickerFileID     NullableDBVarchar `gorm:"size:255;index:idx_docs_picker,priority:2"`
	PickerMimeType   NullableDBVarchar `gorm:"size:128"`

	// Access diagnostics (populated when access_status != accessible/unknown).
	AccessReasonCode      NullableDBVarchar `gorm:"size:64"`
	AccessReasonDetail    NullableDBText
	AccessStatusUpdatedAt *time.Time

	Alias      int32      `gorm:"not null;default:0;<-:create;uniqueIndex:uniq_documents_tm_alias,priority:2"` // Server-assigned per-(threat_model_id, type) alias
	CreatedAt  time.Time  `gorm:"not null;autoCreateTime;index:idx_docs_created;index:idx_docs_tm_created,priority:2"`
	ModifiedAt time.Time  `gorm:"not null;autoUpdateTime;index:idx_docs_modified;index:idx_docs_tm_modified,priority:2"`
	DeletedAt  *time.Time `gorm:"index:idx_docs_deleted_at"`
	// Version is incremented on every successful update (T14 / #385).
	Version int `gorm:"not null;default:1"`

	// Relationships
	ThreatModel ThreatModel `gorm:"foreignKey:ThreatModelID"`
}

type ExtractionJob struct {
	JobID DBVarchar `gorm:"primaryKey;not null;size:36"`
	// DocumentRef is the document being extracted. NOT NULL with no DB-level FK.
	// On the bare-upsert-insert path (a terminal result arriving with no prior
	// queued row) the real ref is unknown and the non-empty sentinel
	// "__unknown__" (unknownDocumentRef in api/extraction_job_store.go) is
	// written instead — an empty string is indistinguishable from NULL on
	// Oracle and would violate NOT NULL (ORA-01400). Any query that filters on
	// document_ref must exclude the sentinel.
	DocumentRef DBVarchar         `gorm:"size:36;not null;index:idx_extraction_jobs_doc"`
	Status      DBVarchar         `gorm:"size:32;not null;default:queued"`
	ReasonCode  NullableDBVarchar `gorm:"size:64"`
	Stage       NullableDBVarchar `gorm:"size:32"`
	Attempts    int32             `gorm:"not null;default:0"`
	CreatedAt   time.Time         `gorm:"not null;autoCreateTime"`
	UpdatedAt   time.Time         `gorm:"not null;autoUpdateTime"`
	CompletedAt *time.Time        `gorm:""`
}

type Group struct {
	InternalUUID DBVarchar         `gorm:"primaryKey;not null;size:36"`
	Provider     DBVarchar         `gorm:"size:100;not null;index:idx_groups_provider;uniqueIndex:uniq_groups_provider_group_name,priority:1"`
	GroupName    DBVarchar         `gorm:"size:500;not null;index:idx_groups_group_name;uniqueIndex:uniq_groups_provider_group_name,priority:2"`
	Name         NullableDBVarchar `gorm:"size:256"`
	Description  NullableDBText    `gorm:""`
	FirstUsed    time.Time         `gorm:"not null;autoCreateTime"`
	LastUsed     time.Time         `gorm:"not null;autoUpdateTime;index:idx_groups_last_used"`
	UsageCount   int               `gorm:"default:1"`
}

type GroupMember struct {
	ID                      DBVarchar         `gorm:"primaryKey;not null;size:36"`
	GroupInternalUUID       DBVarchar         `gorm:"size:36;not null;index;uniqueIndex:idx_gm_group_user_type,priority:1"`
	UserInternalUUID        NullableDBVarchar `gorm:"size:36;index;uniqueIndex:idx_gm_group_user_type,priority:2"`
	MemberGroupInternalUUID NullableDBVarchar `gorm:"size:36;index"`
	SubjectType             DBVarchar         `gorm:"size:10;not null;default:user;uniqueIndex:idx_gm_group_user_type,priority:3"`
	AddedByInternalUUID     NullableDBVarchar `gorm:"size:36"`
	AddedAt                 time.Time         `gorm:"not null;autoCreateTime"`
	Notes                   NullableDBText    `gorm:""`

	// Relationships
	Group       Group  `gorm:"foreignKey:GroupInternalUUID;references:InternalUUID"`
	User        *User  `gorm:"foreignKey:UserInternalUUID;references:InternalUUID"`
	MemberGroup *Group `gorm:"foreignKey:MemberGroupInternalUUID;references:InternalUUID"`
	AddedBy     *User  `gorm:"foreignKey:AddedByInternalUUID;references:InternalUUID;constraint:-"`
}

type JSONMap map[string]any

type JSONRaw json.RawMessage

type LinkedIdentity struct {
	ID               DBVarchar `gorm:"primaryKey;not null;size:36"`
	UserInternalUUID DBVarchar `gorm:"size:36;not null;index:idx_linked_user"`
	Provider         DBVarchar `gorm:"size:100;not null;uniqueIndex:uniq_linked_provider_sub,priority:1"`
	ProviderUserID   DBVarchar `gorm:"size:500;not null;uniqueIndex:uniq_linked_provider_sub,priority:2"`
	Email            DBVarchar `gorm:"size:320"`
	Name             DBVarchar `gorm:"size:256"`
	LinkedAt         time.Time `gorm:"not null;autoCreateTime"`
	LastUsedAt       *time.Time
}

type Metadata struct {
	ID         DBVarchar `gorm:"primaryKey;not null;size:36"`
	EntityType DBVarchar `gorm:"size:50;not null;index:idx_metadata_entity_type_id,priority:1;index:idx_metadata_unique,priority:1,unique"`
	EntityID   DBVarchar `` /* 174-byte string literal not displayed */
	Key        DBVarchar `gorm:"size:256;not null;index:idx_metadata_key;index:idx_metadata_unique,priority:3;index:idx_metadata_key_value,priority:2"`
	Value      DBVarchar `gorm:"size:1024;not null;index:idx_metadata_key_value,priority:3"`
	CreatedAt  time.Time `gorm:"not null;autoCreateTime"`
	ModifiedAt time.Time `gorm:"not null;autoUpdateTime"`
}

type Note struct {
	ID              DBVarchar      `gorm:"primaryKey;not null;size:36"`
	ThreatModelID   DBVarchar      `` /* 162-byte string literal not displayed */
	Name            DBVarchar      `gorm:"size:256;not null;index:idx_notes_name"`
	Content         DBText         `gorm:"not null"`
	Description     NullableDBText `gorm:""`
	IncludeInReport DBBool         `gorm:"default:1"`
	TimmyEnabled    DBBool         `gorm:"default:1"`
	AutoGenerated   DBBool         `gorm:"default:0;<-:create" json:"auto_generated"`
	Alias           int32          `gorm:"not null;default:0;<-:create;uniqueIndex:uniq_notes_tm_alias,priority:2"` // Server-assigned per-(threat_model_id, type) alias
	CreatedAt       time.Time      `gorm:"not null;autoCreateTime;index:idx_notes_created;index:idx_notes_tm_created,priority:2"`
	ModifiedAt      time.Time      `gorm:"not null;autoUpdateTime;index:idx_notes_modified;index:idx_notes_tm_modified,priority:2"`
	DeletedAt       *time.Time     `gorm:"index:idx_notes_deleted_at"`

	// Relationships
	ThreatModel ThreatModel `gorm:"foreignKey:ThreatModelID"`
}

type NullableDBText struct {
	String string
	Valid  bool
}

type NullableDBVarchar struct {
	String string
	Valid  bool
}

type NullableSSVC struct {
	SSVCScore
	Valid bool `json:"-"` // false means NULL in the database
}

type ProjectNoteRecord struct {
	ID           DBVarchar      `gorm:"primaryKey;not null;size:36"`
	ProjectID    DBVarchar      `gorm:"size:36;not null;index:idx_pnote_project;index:idx_pnote_project_name,priority:1"`
	Name         DBVarchar      `gorm:"size:256;not null;index:idx_pnote_name;index:idx_pnote_project_name,priority:2"`
	Content      DBText         `gorm:"not null"`
	Description  NullableDBText `gorm:""`
	TimmyEnabled DBBool         `gorm:"default:1"`
	Sharable     DBBool         `gorm:"not null"`
	CreatedAt    time.Time      `gorm:"not null;autoCreateTime;index:idx_pnote_created"`
	ModifiedAt   time.Time      `gorm:"not null;autoUpdateTime"`

	// Relationships
	Project ProjectRecord `gorm:"foreignKey:ProjectID;constraint:OnDelete:CASCADE"`
}

type ProjectRecord struct {
	ID                     DBVarchar         `gorm:"primaryKey;not null;size:36"`
	Name                   DBVarchar         `gorm:"size:256;not null;index:idx_proj_name"`
	Description            NullableDBText    `gorm:""`
	TeamID                 DBVarchar         `gorm:"size:36;not null;index:idx_proj_team"`
	URI                    NullableDBText    `gorm:""`
	Status                 NullableDBVarchar `gorm:"size:128;index:idx_proj_status"`
	CreatedByInternalUUID  DBVarchar         `gorm:"size:36;not null"`
	ModifiedByInternalUUID NullableDBVarchar `gorm:"size:36"`
	ReviewedByInternalUUID NullableDBVarchar `gorm:"size:36"`
	ReviewedAt             *time.Time        `gorm:"index:idx_proj_reviewed_at"`
	CreatedAt              time.Time         `gorm:"not null;autoCreateTime;index:idx_proj_created_at"`
	ModifiedAt             time.Time         `gorm:"not null;autoUpdateTime"`
	// Version is incremented on every successful update (T14 / #385).
	Version int `gorm:"not null;default:1"`

	// Relationships
	Team       TeamRecord `gorm:"foreignKey:TeamID"`
	CreatedBy  User       `gorm:"foreignKey:CreatedByInternalUUID;references:InternalUUID;constraint:-"`
	ModifiedBy *User      `gorm:"foreignKey:ModifiedByInternalUUID;references:InternalUUID;constraint:-"`
	ReviewedBy *User      `gorm:"foreignKey:ReviewedByInternalUUID;references:InternalUUID;constraint:-"`
}

type ProjectRelationshipRecord struct {
	ID                 DBVarchar         `gorm:"primaryKey;not null;size:36"`
	ProjectID          DBVarchar         `gorm:"size:36;not null;index:idx_prel_project;uniqueIndex:idx_prel_project_related,priority:1"`
	RelatedProjectID   DBVarchar         `gorm:"size:36;not null;index:idx_prel_related;uniqueIndex:idx_prel_project_related,priority:2"`
	Relationship       DBVarchar         `gorm:"size:64;not null"`
	CustomRelationship NullableDBVarchar `gorm:"size:128"`
	CreatedAt          time.Time         `gorm:"not null;autoCreateTime"`

	// Relationships
	Project        ProjectRecord `gorm:"foreignKey:ProjectID"`
	RelatedProject ProjectRecord `gorm:"foreignKey:RelatedProjectID"`
}

type ProjectResponsiblePartyRecord struct {
	ID               DBVarchar         `gorm:"primaryKey;not null;size:36"`
	ProjectID        DBVarchar         `gorm:"size:36;not null;index:idx_prp_project;uniqueIndex:idx_prp_project_user,priority:1"`
	UserInternalUUID DBVarchar         `gorm:"size:36;not null;index:idx_prp_user;uniqueIndex:idx_prp_project_user,priority:2"`
	Role             DBVarchar         `gorm:"size:64;not null"`
	CustomRole       NullableDBVarchar `gorm:"size:128"`
	CreatedAt        time.Time         `gorm:"not null;autoCreateTime"`

	// Relationships
	Project ProjectRecord `gorm:"foreignKey:ProjectID"`
	User    User          `gorm:"foreignKey:UserInternalUUID;references:InternalUUID"`
}

type RefreshTokenRecord struct {
	ID               DBVarchar `gorm:"primaryKey;not null;size:36"`
	UserInternalUUID DBVarchar `gorm:"size:36;not null;index"`
	Token            DBVarchar `gorm:"size:4000;not null;uniqueIndex"` // DBVarchar size:4000 for Oracle compatibility (CLOB cannot have unique index)
	ExpiresAt        time.Time `gorm:"not null"`
	CreatedAt        time.Time `gorm:"not null;autoCreateTime"`

	// Relationships
	User User `gorm:"foreignKey:UserInternalUUID;references:InternalUUID"`
}

type Repository struct {
	ID              DBVarchar         `gorm:"primaryKey;not null;size:36"`
	ThreatModelID   DBVarchar         `` /* 169-byte string literal not displayed */
	Name            NullableDBVarchar `gorm:"size:256;index:idx_repos_name"`
	URI             DBText            `gorm:"not null"`
	Description     NullableDBText    `gorm:""`
	Type            NullableDBVarchar `gorm:"size:64;index:idx_repos_type"`
	Parameters      JSONMap           `gorm:""`
	IncludeInReport DBBool            `gorm:"default:1"`
	TimmyEnabled    DBBool            `gorm:"default:1"`
	Alias           int32             `gorm:"not null;default:0;<-:create;uniqueIndex:uniq_repositories_tm_alias,priority:2"` // Server-assigned per-(threat_model_id, type) alias
	CreatedAt       time.Time         `gorm:"not null;autoCreateTime;index:idx_repos_created;index:idx_repos_tm_created,priority:2"`
	ModifiedAt      time.Time         `gorm:"not null;autoUpdateTime;index:idx_repos_modified;index:idx_repos_tm_modified,priority:2"`
	DeletedAt       *time.Time        `gorm:"index:idx_repos_deleted_at"`

	// Relationships
	ThreatModel ThreatModel `gorm:"foreignKey:ThreatModelID"`
}

type SSVCScore struct {
	Vector      string `json:"vector"`
	Decision    string `json:"decision"`
	Methodology string `json:"methodology"`
}

type SessionParticipant struct {
	ID               DBVarchar `gorm:"primaryKey;not null;size:36"`
	SessionID        DBVarchar `gorm:"size:36;not null;index"`
	UserInternalUUID DBVarchar `gorm:"size:36;not null;index"`
	JoinedAt         time.Time `gorm:"not null;autoCreateTime"`
	LeftAt           *time.Time

	// Relationships
	Session CollaborationSession `gorm:"foreignKey:SessionID"`
	User    User                 `gorm:"foreignKey:UserInternalUUID;references:InternalUUID"`
}

type StringArray []string

type SurveyAnswer struct {
	ID             DBVarchar         `gorm:"primaryKey;not null;size:36"`
	ResponseID     DBVarchar         `gorm:"size:36;not null;index:idx_sa_response_id;index:idx_sa_response_mapping"`
	QuestionName   DBVarchar         `gorm:"size:256;not null"`
	QuestionType   DBVarchar         `gorm:"size:64;not null"`
	QuestionTitle  NullableDBText    `gorm:""`
	MapsToTmField  NullableDBVarchar `gorm:"size:128;index:idx_sa_response_mapping"`
	AnswerValue    JSONRaw           `gorm:""`
	ResponseStatus DBVarchar         `gorm:"size:30;not null"`
	CreatedAt      time.Time         `gorm:"not null;autoCreateTime"`

	// Relationships
	SurveyResponse SurveyResponse `gorm:"foreignKey:ResponseID"`
}

type SurveyResponse struct {
	ID                     DBVarchar         `gorm:"primaryKey;not null;size:36"`
	TemplateID             DBVarchar         `gorm:"size:36;not null;index:idx_sr_template;index:idx_sr_template_status,priority:1"`
	TemplateVersion        DBVarchar         `gorm:"size:64;not null"` // Captured at creation, immutable
	Status                 DBVarchar         `gorm:"size:30;not null;default:draft;index:idx_sr_status;index:idx_sr_template_status,priority:2"`
	IsConfidential         DBBool            `gorm:"default:0"` // If true, Security Reviewers group not auto-added
	Answers                JSONRaw           `gorm:""`          // Question answers keyed by question name
	UIState                JSONRaw           `gorm:""`          // Client-managed UI state for draft resumption
	SurveyJSON             JSONRaw           `gorm:""`          // Snapshot of template survey_json at creation
	LinkedThreatModelID    NullableDBVarchar `gorm:"size:36;index:idx_sr_linked_tm"`
	CreatedThreatModelID   NullableDBVarchar `gorm:"size:36;index:idx_sr_created_tm"`
	RevisionNotes          NullableDBText    `gorm:""`
	OwnerInternalUUID      NullableDBVarchar `gorm:"size:36;index:idx_sr_owner"`
	CreatedAt              time.Time         `gorm:"not null;autoCreateTime;index:idx_sr_created_at"`
	ModifiedAt             time.Time         `gorm:"not null;autoUpdateTime"`
	SubmittedAt            *time.Time        `gorm:"index:idx_sr_submitted_at"`
	ReviewedAt             *time.Time
	ReviewedByInternalUUID NullableDBVarchar `gorm:"size:36"`
	ProjectID              NullableDBVarchar `gorm:"size:36;index:idx_sr_project"`
	// Version is incremented on every successful update (T14 / #385).
	Version int `gorm:"not null;default:1"`

	// Relationships
	Template           SurveyTemplate `gorm:"foreignKey:TemplateID"`
	Owner              *User          `gorm:"foreignKey:OwnerInternalUUID;references:InternalUUID"`
	ReviewedBy         *User          `gorm:"foreignKey:ReviewedByInternalUUID;references:InternalUUID;constraint:-"`
	LinkedThreatModel  *ThreatModel   `gorm:"foreignKey:LinkedThreatModelID"`
	CreatedThreatModel *ThreatModel   `gorm:"foreignKey:CreatedThreatModelID"`
	Project            *ProjectRecord `gorm:"foreignKey:ProjectID"`
}

type SurveyResponseAccess struct {
	ID                    DBVarchar         `gorm:"primaryKey;not null;size:36"`
	SurveyResponseID      DBVarchar         `gorm:"size:36;not null;index:idx_sra_sr;index:idx_sra_perf,priority:1"`
	UserInternalUUID      NullableDBVarchar `gorm:"size:36;index:idx_sra_user;index:idx_sra_perf,priority:3"`
	GroupInternalUUID     NullableDBVarchar `gorm:"size:36;index:idx_sra_group;index:idx_sra_perf,priority:4"`
	SubjectType           DBVarchar         `gorm:"size:10;not null;index:idx_sra_subject_type;index:idx_sra_perf,priority:2"`
	Role                  DBVarchar         `gorm:"size:6;not null;index:idx_sra_role"`
	GrantedByInternalUUID NullableDBVarchar `gorm:"size:36"`
	CreatedAt             time.Time         `gorm:"not null;autoCreateTime"`
	ModifiedAt            time.Time         `gorm:"not null;autoUpdateTime"`

	// Relationships
	SurveyResponse SurveyResponse `gorm:"foreignKey:SurveyResponseID"`
	User           *User          `gorm:"foreignKey:UserInternalUUID;references:InternalUUID"`
	Group          *Group         `gorm:"foreignKey:GroupInternalUUID;references:InternalUUID"`
	GrantedBy      *User          `gorm:"foreignKey:GrantedByInternalUUID;references:InternalUUID"`
}

type SurveyTemplate struct {
	ID                    DBVarchar      `gorm:"primaryKey;not null;size:36"`
	Name                  DBVarchar      `gorm:"size:256;not null;index:idx_st_name;uniqueIndex:idx_st_name_version,priority:1"`
	Description           NullableDBText `gorm:""`
	Version               DBVarchar      `gorm:"size:64;not null;index:idx_st_version;uniqueIndex:idx_st_name_version,priority:2"`
	Status                DBVarchar      `gorm:"size:20;not null;default:inactive;index:idx_st_status"`
	SurveyJSON            JSONRaw        `gorm:""` // Complete SurveyJS JSON definition (opaque blob)
	Settings              JSONRaw        `gorm:""` // Template settings (allow_threat_model_linking, etc.)
	CreatedByInternalUUID DBVarchar      `gorm:"size:36;not null;index:idx_st_created_by"`
	CreatedAt             time.Time      `gorm:"not null;autoCreateTime;index:idx_st_created_at"`
	ModifiedAt            time.Time      `gorm:"not null;autoUpdateTime"`
}

type SurveyTemplateVersion struct {
	ID                    DBVarchar `gorm:"primaryKey;not null;size:36"`
	TemplateID            DBVarchar `gorm:"size:36;not null;index:idx_stv_template;uniqueIndex:idx_stv_template_version,priority:1"`
	Version               DBVarchar `gorm:"size:64;not null;uniqueIndex:idx_stv_template_version,priority:2"`
	SurveyJSON            JSONRaw   `gorm:""`
	CreatedByInternalUUID DBVarchar `gorm:"size:36;not null"`
	CreatedAt             time.Time `gorm:"not null;autoCreateTime"`

	// Relationships
	Template SurveyTemplate `gorm:"foreignKey:TemplateID"`
}

type SystemAuditEntry struct {
	ID DBVarchar `gorm:"primaryKey;not null;size:36;index:idx_sysaudit_created_id,priority:2"`

	// Actor identity (denormalized)
	ActorEmail       DBVarchar `gorm:"size:320;not null;index:idx_sysaudit_actor,priority:1"`
	ActorProvider    DBVarchar `gorm:"size:100;not null"`
	ActorProviderID  DBVarchar `gorm:"size:500;not null"`
	ActorDisplayName DBVarchar `gorm:"size:256;not null"`

	// Request shape
	HTTPMethod DBVarchar `gorm:"size:10;not null"`
	HTTPPath   DBText    `gorm:"not null"`

	// Change description
	FieldPath        DBVarchar      `gorm:"size:1024;not null;index:idx_sysaudit_field"`
	OldValueRedacted NullableDBText `gorm:""`
	NewValueRedacted NullableDBText `gorm:""`
	ChangeSummary    NullableDBText `gorm:""`

	// Composite (created_at, id) index serves the bidirectional keyset scans and
	// the unfiltered full-table export in both ASC and DESC directions (#473). It
	// also covers single-column created_at lookups by prefix, so the former
	// single-column idx_sysaudit_created has been dropped from fresh schemas.
	CreatedAt time.Time `gorm:"not null;autoCreateTime;index:idx_sysaudit_actor,priority:2;index:idx_sysaudit_created_id,priority:1"`
}

type SystemSetting struct {
	// SettingKey is the unique identifier for this setting (e.g., "websocket.max_participants")
	// Named SettingKey instead of Key to avoid Oracle reserved word conflict
	SettingKey DBVarchar `gorm:"primaryKey;not null;size:256" json:"key"`
	Value      DBText    `gorm:"not null" json:"value"`
	// SettingType stores the value type: "string", "int", "bool", "json", "float"
	// Note: default tag removed for Oracle compatibility (unquoted string defaults cause syntax errors)
	SettingType DBVarchar         `gorm:"size:50;not null" json:"type"`
	Description NullableDBText    `gorm:"" json:"description,omitempty"`
	ModifiedAt  time.Time         `gorm:"not null;autoUpdateTime" json:"modified_at"`
	ModifiedBy  NullableDBVarchar `gorm:"size:36" json:"modified_by,omitempty"` // User InternalUUID
	// Origin records who wrote this row's current value: SystemSettingOriginSeeded
	// when SeedDefaults inserted the registry default at first boot, or
	// SystemSettingOriginExplicit when an operator deliberately set it (via the
	// admin API, SettingsService.Set, or dbtool --import-config).
	//
	// NULL means SEEDED — the fail-safe direction. Every way an origin value
	// can go missing (an empty string bound on Oracle, a future writer that
	// forgets the stamp, a stale pre-upgrade Redis entry whose cached JSON has
	// no origin key) therefore degrades to "seeded", which makes the config
	// layer win. Config is the layer an operator can see and control, so
	// losing this value must never hand authority to a database row nobody set
	// — that is precisely the 2026-08-20 outage (oracle-db-admin review, #794).
	//
	// Rows that predate this column are stamped explicit where they show
	// operator intent, by BackfillSystemSettingOrigin in internal/dbschema.
	// The column itself is added with no `ALTER TABLE ... DEFAULT` (Oracle
	// rejects unquoted string defaults — see the SettingType comment above).
	// Never write "" here: Oracle binds an
	// empty string as NULL, so an empty string and NULL would be
	// indistinguishable there. Only NULL, SystemSettingOriginSeeded, or
	// SystemSettingOriginExplicit are valid values.
	// Exposed read-only as SystemSetting.origin on the admin settings API by
	// modelToAPISystemSetting (api/config_handlers.go, #803), which maps NULL
	// to "seeded". The tag is a real json name (not "-") because the Redis
	// cache tier round-trips a
	// SystemSetting through json.Marshal/Unmarshal (setInRedisCache /
	// getFromRedisCache) — "-" would silently drop Origin on every Redis
	// cache hit and make every setting look explicit after a warm read
	// (oracle-db-admin review, #794).
	Origin NullableDBVarchar `gorm:"size:16" json:"origin,omitempty"`
	// Source indicates where the effective value comes from: "database", "config", "environment", "vault"
	// Computed at response time, not stored in the database.
	Source string `gorm:"-" json:"source"`
	// ReadOnly indicates whether this setting can be modified via the API.
	// True when source is not "database". Computed at response time.
	ReadOnly bool `gorm:"-" json:"read_only"`
}

type TeamMemberRecord struct {
	ID               DBVarchar         `gorm:"primaryKey;not null;size:36"`
	TeamID           DBVarchar         `gorm:"size:36;not null;index:idx_tmem_team;uniqueIndex:idx_tmem_team_user,priority:1"`
	UserInternalUUID DBVarchar         `gorm:"size:36;not null;index:idx_tmem_user;uniqueIndex:idx_tmem_team_user,priority:2"`
	Role             DBVarchar         `gorm:"size:64;not null;default:engineer"`
	CustomRole       NullableDBVarchar `gorm:"size:128"`
	CreatedAt        time.Time         `gorm:"not null;autoCreateTime"`

	// Relationships
	Team TeamRecord `gorm:"foreignKey:TeamID"`
	User User       `gorm:"foreignKey:UserInternalUUID;references:InternalUUID"`
}

type TeamNoteRecord struct {
	ID           DBVarchar      `gorm:"primaryKey;not null;size:36"`
	TeamID       DBVarchar      `gorm:"size:36;not null;index:idx_tnote_team;index:idx_tnote_team_name,priority:1"`
	Name         DBVarchar      `gorm:"size:256;not null;index:idx_tnote_name;index:idx_tnote_team_name,priority:2"`
	Content      DBText         `gorm:"not null"`
	Description  NullableDBText `gorm:""`
	TimmyEnabled DBBool         `gorm:"default:1"`
	Sharable     DBBool         `gorm:"not null"`
	CreatedAt    time.Time      `gorm:"not null;autoCreateTime;index:idx_tnote_created"`
	ModifiedAt   time.Time      `gorm:"not null;autoUpdateTime"`

	// Relationships
	Team TeamRecord `gorm:"foreignKey:TeamID;constraint:OnDelete:CASCADE"`
}

type TeamRecord struct {
	ID                     DBVarchar         `gorm:"primaryKey;not null;size:36"`
	Name                   DBVarchar         `gorm:"size:256;not null;index:idx_team_name"`
	Description            NullableDBText    `gorm:""`
	URI                    NullableDBText    `gorm:""`
	EmailAddress           NullableDBVarchar `gorm:"size:320"`
	Status                 NullableDBVarchar `gorm:"size:128;index:idx_team_status"`
	CreatedByInternalUUID  DBVarchar         `gorm:"size:36;not null"`
	ModifiedByInternalUUID NullableDBVarchar `gorm:"size:36"`
	ReviewedByInternalUUID NullableDBVarchar `gorm:"size:36"`
	ReviewedAt             *time.Time        `gorm:"index:idx_team_reviewed_at"`
	CreatedAt              time.Time         `gorm:"not null;autoCreateTime;index:idx_team_created_at"`
	ModifiedAt             time.Time         `gorm:"not null;autoUpdateTime"`
	// Version is incremented on every successful update (T14 / #385).
	Version int `gorm:"not null;default:1"`

	// Relationships
	CreatedBy  User  `gorm:"foreignKey:CreatedByInternalUUID;references:InternalUUID;constraint:-"`
	ModifiedBy *User `gorm:"foreignKey:ModifiedByInternalUUID;references:InternalUUID;constraint:-"`
	ReviewedBy *User `gorm:"foreignKey:ReviewedByInternalUUID;references:InternalUUID;constraint:-"`
}

type TeamRelationshipRecord struct {
	ID                 DBVarchar         `gorm:"primaryKey;not null;size:36"`
	TeamID             DBVarchar         `gorm:"size:36;not null;index:idx_trel_team;uniqueIndex:idx_trel_team_related,priority:1"`
	RelatedTeamID      DBVarchar         `gorm:"size:36;not null;index:idx_trel_related;uniqueIndex:idx_trel_team_related,priority:2"`
	Relationship       DBVarchar         `gorm:"size:64;not null"`
	CustomRelationship NullableDBVarchar `gorm:"size:128"`
	CreatedAt          time.Time         `gorm:"not null;autoCreateTime"`

	// Relationships
	Team        TeamRecord `gorm:"foreignKey:TeamID"`
	RelatedTeam TeamRecord `gorm:"foreignKey:RelatedTeamID"`
}

type TeamResponsiblePartyRecord struct {
	ID               DBVarchar         `gorm:"primaryKey;not null;size:36"`
	TeamID           DBVarchar         `gorm:"size:36;not null;index:idx_trp_team;uniqueIndex:idx_trp_team_user,priority:1"`
	UserInternalUUID DBVarchar         `gorm:"size:36;not null;index:idx_trp_user;uniqueIndex:idx_trp_team_user,priority:2"`
	Role             DBVarchar         `gorm:"size:64;not null"`
	CustomRole       NullableDBVarchar `gorm:"size:128"`
	CreatedAt        time.Time         `gorm:"not null;autoCreateTime"`

	// Relationships
	Team TeamRecord `gorm:"foreignKey:TeamID"`
	User User       `gorm:"foreignKey:UserInternalUUID;references:InternalUUID"`
}

type Threat struct {
	ID              DBVarchar         `gorm:"primaryKey;not null;size:36"`
	ThreatModelID   DBVarchar         `` /* 170-byte string literal not displayed */
	DiagramID       NullableDBVarchar `gorm:"size:36;index:idx_threats_diagram"`
	CellID          NullableDBVarchar `gorm:"size:36;index:idx_threats_cell"`
	AssetID         NullableDBVarchar `gorm:"size:36;index:idx_threats_asset"`
	Name            DBVarchar         `gorm:"size:256;not null;index:idx_threats_name"`
	Description     NullableDBText    `gorm:""`
	Severity        NullableDBVarchar `gorm:"size:50;index:idx_threats_severity"`
	Likelihood      NullableDBVarchar `gorm:"size:50"`
	RiskLevel       NullableDBVarchar `gorm:"size:50;index:idx_threats_risk_level"`
	Score           *float64          `gorm:"type:decimal(3,1);index:idx_threats_score"`
	Priority        NullableDBVarchar `gorm:"size:256;index:idx_threats_priority"`
	Mitigated       DBBool            `gorm:"index:idx_threats_mitigated"`
	IncludeInReport DBBool            `gorm:"default:1"`
	TimmyEnabled    DBBool            `gorm:"default:1"`
	AutoGenerated   DBBool            `gorm:"default:0;<-:create" json:"auto_generated"`
	Status          NullableDBVarchar `gorm:"size:128;index:idx_threats_status"`
	ThreatType      StringArray       `gorm:"not null"`
	CweID           StringArray       `gorm:""` // CWE identifiers (e.g., CWE-89)
	Cvss            CVSSArray         `gorm:""` // CVSS vector and score pairs
	Ssvc            NullableSSVC      `gorm:""` // SSVC assessment result
	Mitigation      NullableDBText    `gorm:""`
	IssueURI        NullableDBText    `gorm:""`
	Alias           int32             `gorm:"not null;default:0;<-:create;uniqueIndex:uniq_threats_tm_alias,priority:2"` // Server-assigned per-(threat_model_id, type) alias
	// Note: autoCreateTime/autoUpdateTime tags removed for Oracle compatibility.
	// Timestamps are set explicitly in the store layer (toGormModelForCreate).
	CreatedAt  time.Time `gorm:"not null;index:idx_threats_tm_created,priority:2"`
	ModifiedAt time.Time `gorm:"not null;index:idx_threats_modified;index:idx_threats_tm_modified,priority:2"`
	// DeletedAt is deliberately *time.Time, NOT gorm.DeletedAt (true for every
	// tombstoned model in this file): GORM applies no automatic soft-delete
	// scoping, so EVERY query on these models must spell out its deleted_at
	// intent explicitly. On SELECTs use a plain `deleted_at IS NULL` string
	// predicate; on UPDATE/DELETE builds use a map condition
	// (Where(map[string]any{"deleted_at": nil})) because gorm-oracle discards
	// any clause.Expr containing both "deleted_at" and "null" there (#392).
	// See #669 for the audit that established this.
	DeletedAt *time.Time `gorm:"index:idx_threats_deleted_at"`
	// Version is incremented on every successful update (T14 / #385).
	Version int `gorm:"not null;default:1"`

	// Relationships
	ThreatModel ThreatModel `gorm:"foreignKey:ThreatModelID"`
	Diagram     *Diagram    `gorm:"foreignKey:DiagramID"`
	Asset       *Asset      `gorm:"foreignKey:AssetID"`
}

type ThreatModel struct {
	ID                           DBVarchar         `gorm:"primaryKey;not null;size:36"`
	OwnerInternalUUID            DBVarchar         `gorm:"size:36;not null;index:idx_tm_owner;index:idx_tm_owner_created,priority:1"`
	Name                         DBVarchar         `gorm:"size:256;not null"`
	Description                  NullableDBText    `gorm:""`
	CreatedByInternalUUID        DBVarchar         `gorm:"size:36;not null;index:idx_tm_created_by"`
	ThreatModelFramework         DBVarchar         `gorm:"size:30;default:STRIDE;index:idx_tm_framework"`
	IssueURI                     NullableDBText    `gorm:""`
	Status                       DBVarchar         `gorm:"size:128;not null;default:'not_started';index:idx_tm_status"`
	StatusUpdated                time.Time         `gorm:"not null;default:CURRENT_TIMESTAMP;index:idx_tm_status_updated"`
	Alias                        int32             `gorm:"not null;default:0;<-:create;uniqueIndex:uniq_threat_models_alias"` // Server-assigned globally-unique integer alias
	IsConfidential               DBBool            `gorm:"default:0"`                                                         // Immutable after creation
	SecurityReviewerInternalUUID NullableDBVarchar `gorm:"size:36;index:idx_tm_security_reviewer"`
	ProjectID                    NullableDBVarchar `gorm:"size:36;index:idx_tm_project"`
	// Timestamp columns map to precision-6 TIMESTAMP WITH TIME ZONE on both
	// PostgreSQL and Oracle (the gorm-oracle dialector emits bare TIMESTAMP WITH
	// TIME ZONE = microsecond). The application truncates created_at/modified_at
	// to microseconds at generation (see api/store.go UpdateTimestamps and the
	// threat-model handlers) so in-memory values match what the DB persists and
	// conform to the OpenAPI timestamp schema (max 6 fractional digits). If these
	// columns are ever pinned to a different precision, revisit that truncation.
	CreatedAt      time.Time  `gorm:"not null;autoCreateTime;index:idx_tm_owner_created,priority:2"`
	ModifiedAt     time.Time  `gorm:"not null;autoUpdateTime"`
	DeletedAt      *time.Time `gorm:"index:idx_tm_deleted_at"`
	LastAccessedAt *time.Time `gorm:"index:idx_tm_last_accessed_at"`
	// Version is incremented on every successful update (T14 / #385).
	// Clients pass the expected value via If-Match (or version body field) on
	// PUT/PATCH; mismatches return 409 Conflict.
	Version int `gorm:"not null;default:1"`

	// Relationships
	Project          *ProjectRecord `gorm:"foreignKey:ProjectID"`
	Owner            User           `gorm:"foreignKey:OwnerInternalUUID;references:InternalUUID"`
	CreatedBy        User           `gorm:"foreignKey:CreatedByInternalUUID;references:InternalUUID;constraint:-"`
	SecurityReviewer *User          `gorm:"foreignKey:SecurityReviewerInternalUUID;references:InternalUUID"`
	Diagrams         []Diagram      `gorm:"foreignKey:ThreatModelID"`
	Threats          []Threat       `gorm:"foreignKey:ThreatModelID"`
	Assets           []Asset        `gorm:"foreignKey:ThreatModelID"`
}

type ThreatModelAccess struct {
	ID                    DBVarchar         `gorm:"primaryKey;not null;size:36"`
	ThreatModelID         DBVarchar         `gorm:"size:36;not null;index:idx_tma_tm;index:idx_tma_perf,priority:1"`
	UserInternalUUID      NullableDBVarchar `gorm:"size:36;index:idx_tma_user;index:idx_tma_perf,priority:3"`
	GroupInternalUUID     NullableDBVarchar `gorm:"size:36;index:idx_tma_group;index:idx_tma_perf,priority:4"`
	SubjectType           DBVarchar         `gorm:"size:10;not null;index:idx_tma_subject_type;index:idx_tma_perf,priority:2"`
	Role                  DBVarchar         `gorm:"size:6;not null;index:idx_tma_role"`
	GrantedByInternalUUID NullableDBVarchar `gorm:"size:36"`
	CreatedAt             time.Time         `gorm:"not null;autoCreateTime"`
	ModifiedAt            time.Time         `gorm:"not null;autoUpdateTime"`

	// Relationships
	ThreatModel ThreatModel `gorm:"foreignKey:ThreatModelID"`
	User        *User       `gorm:"foreignKey:UserInternalUUID;references:InternalUUID"`
	Group       *Group      `gorm:"foreignKey:GroupInternalUUID;references:InternalUUID"`
	GrantedBy   *User       `gorm:"foreignKey:GrantedByInternalUUID;references:InternalUUID;constraint:-"`
}

type TimmyEmbedding struct {
	ID             DBVarchar `gorm:"primaryKey;not null;size:36"`
	ThreatModelID  DBVarchar `gorm:"size:36;not null;index:idx_timmy_embeddings_tm;index:idx_timmy_embeddings_entity,priority:1"`
	EntityType     DBVarchar `gorm:"size:30;not null;index:idx_timmy_embeddings_entity,priority:2"`
	EntityID       DBVarchar `gorm:"size:36;not null;index:idx_timmy_embeddings_entity,priority:3"`
	ChunkIndex     int       `gorm:"not null;index:idx_timmy_embeddings_entity,priority:4"`
	IndexType      DBVarchar `gorm:"size:10;not null;default:text;index:idx_timmy_embeddings_entity,priority:5"`
	ContentHash    DBVarchar `gorm:"size:64;not null"`
	EmbeddingModel DBVarchar `gorm:"size:100;not null"`
	EmbeddingDim   int       `gorm:"not null"`
	VectorData     DBBytes   `gorm:""`
	ChunkText      DBText    `gorm:"not null"`
	CreatedAt      time.Time `gorm:"not null;autoCreateTime"`

	// Relationships
	ThreatModel ThreatModel `gorm:"foreignKey:ThreatModelID"`
}

type TimmyMessage struct {
	ID         DBVarchar `gorm:"primaryKey;not null;size:36"`
	SessionID  DBVarchar `gorm:"size:36;not null;index:idx_timmy_messages_session;uniqueIndex:idx_timmy_messages_session_seq,priority:1"`
	Role       DBVarchar `gorm:"size:20;not null"`
	Content    DBText    `gorm:"not null"`
	TokenCount int       `gorm:"default:0"`
	Sequence   int       `gorm:"not null;uniqueIndex:idx_timmy_messages_session_seq,priority:2"`
	CreatedAt  time.Time `gorm:"not null;autoCreateTime"`

	// Relationships
	Session TimmySession `gorm:"foreignKey:SessionID"`
}

type TimmySession struct {
	ID               DBVarchar         `gorm:"primaryKey;not null;size:36"`
	ThreatModelID    DBVarchar         `gorm:"size:36;not null;index:idx_timmy_sessions_tm;index:idx_timmy_sessions_tm_user,priority:1"`
	UserID           DBVarchar         `gorm:"size:36;not null;index:idx_timmy_sessions_user;index:idx_timmy_sessions_tm_user,priority:2"`
	Title            DBVarchar         `gorm:"size:256"`
	SourceSnapshot   JSONRaw           `gorm:""`
	SystemPromptHash NullableDBVarchar `gorm:"size:64"`
	Status           DBVarchar         `gorm:"size:20;not null;default:active;index:idx_timmy_sessions_status"`
	CreatedAt        time.Time         `gorm:"not null;autoCreateTime"`
	ModifiedAt       time.Time         `gorm:"not null;autoUpdateTime"`
	DeletedAt        *time.Time        `gorm:"index:idx_timmy_sessions_deleted_at"`

	// Relationships
	ThreatModel ThreatModel `gorm:"foreignKey:ThreatModelID"`
	User        User        `gorm:"foreignKey:UserID;references:InternalUUID"`
}

type TimmyUsage struct {
	ID               DBVarchar `gorm:"primaryKey;not null;size:36"`
	UserID           DBVarchar `gorm:"size:36;not null;index:idx_timmy_usage_user"`
	SessionID        DBVarchar `gorm:"size:36;not null;index:idx_timmy_usage_session"`
	ThreatModelID    DBVarchar `gorm:"size:36;not null;index:idx_timmy_usage_tm"`
	MessageCount     int       `gorm:"default:0"`
	PromptTokens     int       `gorm:"default:0"`
	CompletionTokens int       `gorm:"default:0"`
	EmbeddingTokens  int       `gorm:"default:0"`
	PeriodStart      time.Time `gorm:"not null;index:idx_timmy_usage_period"`
	PeriodEnd        time.Time `gorm:"not null"`

	// Relationships
	ThreatModel ThreatModel  `gorm:"foreignKey:ThreatModelID"`
	User        User         `gorm:"foreignKey:UserID;references:InternalUUID"`
	Session     TimmySession `gorm:"foreignKey:SessionID"`
}

type TriageNote struct {
	SurveyResponseID       DBVarchar         `gorm:"primaryKey;not null;size:36;index:idx_tn_sr"`
	ID                     int               `gorm:"primaryKey;not null;autoIncrement:false"`
	Name                   DBVarchar         `gorm:"size:256;not null"`
	Content                DBText            `gorm:"not null"`
	CreatedByInternalUUID  NullableDBVarchar `gorm:"size:36"`
	ModifiedByInternalUUID NullableDBVarchar `gorm:"size:36"`
	CreatedAt              time.Time         `gorm:"not null;autoCreateTime;index:idx_tn_created"`
	ModifiedAt             time.Time         `gorm:"not null;autoUpdateTime"`

	// Relationships
	SurveyResponse SurveyResponse `gorm:"foreignKey:SurveyResponseID"`
	CreatedBy      *User          `gorm:"foreignKey:CreatedByInternalUUID;references:InternalUUID;constraint:-"`
	ModifiedBy     *User          `gorm:"foreignKey:ModifiedByInternalUUID;references:InternalUUID;constraint:-"`
}

type UsabilityFeedback struct {
	ID            DBVarchar         `gorm:"primaryKey;not null;size:36"`
	Sentiment     DBVarchar         `gorm:"size:8;not null;index:idx_usability_feedback_sentiment"`
	Verbatim      NullableDBText    `gorm:""`
	Surface       DBVarchar         `gorm:"size:32;not null;index:idx_usability_feedback_surface"`
	ClientID      DBVarchar         `gorm:"size:32;not null"`
	ClientVersion NullableDBVarchar `gorm:"size:32"`
	ClientBuild   NullableDBVarchar `gorm:"size:12"`
	UserAgent     NullableDBVarchar `gorm:"size:512"`
	UserAgentData JSONRaw           `gorm:""`
	Viewport      NullableDBVarchar `gorm:"size:11"`
	Screenshot    NullableDBText    `gorm:""`
	// CreatedBy is the internal UUID of the authenticated user who submitted
	// this feedback (#710: was named CreatedByUUID with an explicit
	// column:created_by tag; the UUID suffix made the NamingStrategy-derived
	// DBName "created_by_uuid" diverge from the actual column and, on Oracle,
	// silently zero this field on every read via LookUpField. Renamed instead
	// of tagged so the derived DBName is "created_by"/"CREATED_BY" on both
	// dialects, matching the real column with no tag needed).
	CreatedBy DBVarchar `gorm:"size:36;not null;index:idx_usability_feedback_created_by"`
	// Note: autoCreateTime tag removed for Oracle compatibility (#380). The
	// repository sets CreatedAt explicitly in Create before INSERT, matching
	// the Threat model pattern (see api/models/models.go Threat.CreatedAt).
	CreatedAt time.Time `gorm:"not null;index:idx_usability_feedback_created_at"`

	// Relationships. constraint:- suppresses the DB-level FK so a user with
	// outstanding feedback rows can still be deleted without an integrity-
	// constraint error. Application-layer integrity (CreatedBy is always
	// set from the authenticated user) is sufficient. Named CreatedByUser
	// (not CreatedBy) to avoid colliding with the scalar CreatedBy field above.
	CreatedByUser User `gorm:"foreignKey:CreatedBy;references:InternalUUID;constraint:-"`
}

type User struct {
	InternalUUID   DBVarchar         `gorm:"primaryKey;not null;size:36"`
	Provider       DBVarchar         `gorm:"size:100;not null;index:idx_users_provider;uniqueIndex:idx_users_provider_lookup,priority:1"`
	ProviderUserID NullableDBVarchar `gorm:"size:500;uniqueIndex:idx_users_provider_lookup,priority:2"`
	Email          DBVarchar         `gorm:"size:320;not null;index:idx_users_email"`
	Name           DBVarchar         `gorm:"size:256;not null"`
	EmailVerified  DBBool            `gorm:"default:0"`
	AccessToken    NullableDBText    `gorm:""`
	RefreshToken   NullableDBText    `gorm:""`
	TokenExpiry    *time.Time
	CreatedAt      time.Time  `gorm:"not null;autoCreateTime"`
	ModifiedAt     time.Time  `gorm:"not null;autoUpdateTime"`
	LastLogin      *time.Time `gorm:"index:idx_users_last_login"`
	Automation     *bool      `gorm:"default:null"`
	// ExtractionConcurrencyOverride lets a trusted machine account run more
	// concurrent OOXML extractions than the operator default. NULL = use
	// default. Hard-capped at maxPerUserConcurrency (16) regardless of value.
	ExtractionConcurrencyOverride *int `gorm:""`
}

type UserAPIQuota struct {
	UserInternalUUID     DBVarchar `gorm:"primaryKey;not null;size:36"`
	MaxRequestsPerMinute int       `gorm:"default:1000"`
	MaxRequestsPerHour   *int
	CreatedAt            time.Time `gorm:"not null;autoCreateTime"`
	ModifiedAt           time.Time `gorm:"not null;autoUpdateTime"`

	// Relationships
	User User `gorm:"foreignKey:UserInternalUUID;references:InternalUUID"`
}

type UserContentToken struct {
	ID                   DBVarchar `gorm:"primaryKey;not null;size:36"`
	UserID               DBVarchar `gorm:"size:36;not null;index:idx_uct_user;uniqueIndex:uq_uct_user_provider,priority:1"`
	ProviderID           DBVarchar `gorm:"size:64;not null;uniqueIndex:uq_uct_user_provider,priority:2"`
	AccessToken          DBBytes   `gorm:"not null"`
	RefreshToken         DBBytes
	Scopes               DBText
	ExpiresAt            *time.Time
	Status               NullableDBVarchar `gorm:"size:16;default:active;index:idx_uct_status_expires,priority:1"`
	LastRefreshAt        *time.Time        `gorm:"index:idx_uct_status_expires,priority:2"`
	LastError            NullableDBText
	ProviderAccountID    NullableDBVarchar `gorm:"size:255"`
	ProviderAccountLabel NullableDBVarchar `gorm:"size:255"`
	CreatedAt            time.Time         `gorm:"not null;autoCreateTime"`
	ModifiedAt           time.Time         `gorm:"not null;autoUpdateTime"`

	// Owner is the user who owns this token; ON DELETE CASCADE removes the token when the user is deleted.
	Owner User `gorm:"foreignKey:UserID;references:InternalUUID;constraint:OnDelete:CASCADE"`
}

type UserPreference struct {
	ID               DBVarchar `gorm:"primaryKey;not null;size:36"`
	UserInternalUUID DBVarchar `gorm:"size:36;not null;uniqueIndex"`
	Preferences      JSONRaw   `gorm:"not null"`
	CreatedAt        time.Time `gorm:"not null;autoCreateTime"`
	ModifiedAt       time.Time `gorm:"not null;autoUpdateTime"`

	// Relationships
	User User `gorm:"foreignKey:UserInternalUUID;references:InternalUUID"`
}

type VersionSnapshot struct {
	ID           DBVarchar      `gorm:"primaryKey;not null;size:36"`
	AuditEntryID DBVarchar      `gorm:"size:36;not null;index:idx_vs_audit_entry"`
	ObjectType   DBVarchar      `gorm:"size:50;not null;index:idx_vs_object,priority:1;index:idx_vs_object_snapshot,priority:1"`
	ObjectID     DBVarchar      `gorm:"size:36;not null;index:idx_vs_object,priority:2;index:idx_vs_object_snapshot,priority:2"`
	Version      int            `gorm:"not null;index:idx_vs_object,priority:3"`
	SnapshotType DBVarchar      `gorm:"size:20;not null;index:idx_vs_object_snapshot,priority:3"` // "checkpoint" or "diff"
	Data         NullableDBText `gorm:""`                                                         // full JSON snapshot or reverse JSON Patch
	CreatedAt    time.Time      `gorm:"not null;autoCreateTime"`
}

type WebhookQuota struct {
	OwnerID                          DBVarchar `gorm:"primaryKey;not null;size:36"`
	MaxSubscriptions                 int       `gorm:"default:10"`
	MaxEventsPerMinute               int       `gorm:"default:12"`
	MaxSubscriptionRequestsPerMinute int       `gorm:"default:10"`
	MaxSubscriptionRequestsPerDay    int       `gorm:"default:20"`
	CreatedAt                        time.Time `gorm:"not null;autoCreateTime"`
	ModifiedAt                       time.Time `gorm:"not null;autoUpdateTime"`

	// Relationships
	Owner User `gorm:"foreignKey:OwnerID;references:InternalUUID"`
}

type WebhookSubscription struct {
	ID                  DBVarchar         `gorm:"primaryKey;not null;size:36"`
	OwnerInternalUUID   DBVarchar         `gorm:"size:36;not null;index"`
	ThreatModelID       NullableDBVarchar `gorm:"size:36;index"`
	Name                DBVarchar         `gorm:"size:256;not null"`
	URL                 DBText            `gorm:"not null"`
	Events              StringArray       `gorm:"not null"`
	Secret              NullableDBVarchar `gorm:"size:128"`
	Status              DBVarchar         `gorm:"size:128;default:pending_verification"`
	Challenge           NullableDBVarchar `gorm:"size:1000"`
	ChallengesSent      int               `gorm:"default:0"`
	TimeoutCount        int               `gorm:"default:0"`
	CreatedAt           time.Time         `gorm:"not null;autoCreateTime"`
	ModifiedAt          time.Time         `gorm:"not null;autoUpdateTime"`
	LastSuccessfulUse   *time.Time
	PublicationFailures int `gorm:"default:0"`

	// OperatorPinned marks the subscription as materialized from operator
	// config (alerting block, #395). Pinned rows cannot be modified or
	// deleted through /admin/webhooks and their URL is redacted in reads.
	// DBBool is required for Oracle compatibility (NUMBER(1) column).
	OperatorPinned DBBool `gorm:"not null;default:false" json:"operator_pinned"`

	// Relationships
	Owner       User         `gorm:"foreignKey:OwnerInternalUUID;references:InternalUUID"`
	ThreatModel *ThreatModel `gorm:"foreignKey:ThreatModelID"`
}

type WebhookURLDenyList struct {
	ID          DBVarchar      `gorm:"primaryKey;not null;size:36"`
	Pattern     DBVarchar      `gorm:"size:256;not null;uniqueIndex:idx_webhook_deny_pattern"`
	PatternType DBVarchar      `gorm:"size:64;not null"`
	Description NullableDBText `gorm:""`
	CreatedAt   time.Time      `gorm:"not null;autoCreateTime"`
}