entity

type AgentBoard struct {
	ID          string `gorm:"primaryKey;type:varchar(64)" json:"id"`
	Key         string `gorm:"type:varchar(128);uniqueIndex;not null" json:"key"`
	Name        string `gorm:"type:varchar(256);not null;default:''" json:"name"`
	Description string `gorm:"type:text;not null;default:''" json:"description"`
	// Columns is a JSON array of {id,title,stage,order}. Presentation
	// only — the state machine reads Stage, never the column id.
	Columns string `gorm:"type:text;not null;default:'[]'" json:"columns"`
	// SquadKey scopes which agents claim from this board.
	SquadKey string `gorm:"type:varchar(128);not null;default:''" json:"squad_key"`
	// GateMode controls evidence-gated completion: off | warning | blocking.
	GateMode string `gorm:"type:varchar(16);not null;default:'off'" json:"gate_mode"`
	// AutoDelegate makes entering the `ready` stage enqueue work
	// automatically — the column-as-automation-trigger model.
	AutoDelegate bool   `gorm:"not null;default:false" json:"auto_delegate"`
	Disabled     bool   `gorm:"not null;default:false" json:"disabled"`
	CreatedBy    string `gorm:"type:varchar(128);not null;default:''" json:"created_by"`
	CreatedAt    time.Time
	UpdatedAt    time.Time
}

type AgentChannel struct {
	ID        string  `gorm:"primaryKey;type:varchar(64)"`
	Type      string  `gorm:"type:varchar(32);not null;index"`
	Name      string  `gorm:"type:varchar(128);not null;default:'default'"`
	UserID    *string `gorm:"type:varchar(36);index"`
	Enabled   bool    `gorm:"not null;default:true"`
	Config    string  `gorm:"type:text;not null;default:'{}'"`
	CreatedAt time.Time
	UpdatedAt time.Time
}

type AgentDelegation struct {
	ID string `gorm:"primaryKey;type:varchar(64)" json:"id"`
	// RootID is the id of the top-most delegation in this tree; equal to
	// ID when Depth == 0. Turn budget is pooled across the whole root.
	RootID string `gorm:"type:varchar(64);not null;index" json:"root_id"`
	// ParentSessionID is the leader session that called wick_delegate.
	ParentSessionID string `gorm:"type:varchar(128);not null;index" json:"parent_session_id"`
	ParentAgent     string `gorm:"type:varchar(128);not null;default:''" json:"parent_agent"`
	ProfileKey      string `gorm:"type:varchar(128);not null" json:"profile_key"`
	// ChildSessionID is the isolated execution context spawned for this
	// delegation. A real session (own transcript + store), just hidden
	// from the conversation list.
	ChildSessionID string `gorm:"type:varchar(128);not null;index" json:"child_session_id"`
	ChildAgent     string `gorm:"type:varchar(128);not null;default:''" json:"child_agent"`

	Task  string `gorm:"type:text;not null;default:''" json:"task"`
	Depth int    `gorm:"not null;default:0" json:"depth"`
	Mode  string `gorm:"type:varchar(16);not null;default:'sync'" json:"mode"`
	// AncestorKeys is the JSON-encoded profile-key chain from root to
	// parent. The cycle guard rejects a delegation whose profile already
	// appears here, which is what stops A→B→A from looping forever.
	AncestorKeys string `gorm:"type:text;not null;default:'[]'" json:"ancestor_keys"`

	// DeliverySink routes an async result: "channel" posts back to the
	// originating thread, "session" re-prompts the leader (collect),
	// "none" leaves it for the monitor only.
	DeliverySink string `gorm:"type:varchar(32);not null;default:''" json:"delivery_sink"`
	// Detached marks an async delegation that must outlive its leader.
	// A detached sub-agent is NOT torn down when the leader goes idle or
	// is killed — it was fired deliberately to run on its own.
	Detached bool `gorm:"not null;default:false" json:"detached"`
	// Collected marks an async result the leader has already picked up
	// via wick_delegate_collect, so a second call does not re-deliver it.
	Collected bool `gorm:"not null;default:false" json:"collected"`

	// ProjectID is the scope the delegation ran in, copied from the parent
	// session. Roles are scoped, so resolving ProfileKey later without it
	// would find the GLOBAL role of the same name — a different prompt and
	// a different tool list, with nothing to signal the mismatch.
	ProjectID string `gorm:"type:varchar(64);not null;default:'';index" json:"project_id"`

	Workspace     string `gorm:"type:varchar(16);not null;default:'shared'" json:"workspace"`
	WorkspacePath string `gorm:"type:text;not null;default:''" json:"workspace_path"`
	// WorkspaceNote records why a requested workspace mode was not honoured
	// (e.g. worktree asked for on a non-git project, fell back to shared).
	// Surfaced to the leader so a silent downgrade never looks like success.
	WorkspaceNote string `gorm:"type:text;not null;default:''" json:"workspace_note"`
	// SquadKey links this delegation to the named squad that produced it.
	SquadKey string `gorm:"type:varchar(128);not null;default:'';index" json:"squad_key"`
	// UserSteered marks a delegation a human sent a message into
	// mid-flight. The result is no longer purely the sub-agent's own work,
	// and the leader is told so rather than being handed a steered answer
	// as though the role produced it unaided.
	UserSteered bool `gorm:"not null;default:false" json:"user_steered"`

	Status    string `gorm:"type:varchar(32);not null;index" json:"status"`
	TurnsUsed int    `gorm:"not null;default:0" json:"turns_used"`
	MaxTurns  int    `gorm:"not null;default:0" json:"max_turns"`

	// Token accounting. Populated when the provider reports usage in its
	// stream; 0 means "this provider did not tell us", never "free".
	//
	// Usage is recorded BEFORE any cancellation check, deliberately: a
	// turn that gets cancelled still consumed tokens, and skipping the
	// write there silently under-reports spend.
	InputTokens  int `gorm:"not null;default:0" json:"input_tokens"`
	OutputTokens int `gorm:"not null;default:0" json:"output_tokens"`
	TokensUsed   int `gorm:"not null;default:0" json:"tokens_used"`
	// MaxTokens is the per-delegation token cap, 0 = uncapped by the
	// delegation itself (the per-tree budget still applies).
	MaxTokens int `gorm:"not null;default:0" json:"max_tokens"`
	// Result carries the final answer on success and the PARTIAL text on
	// interrupt / turn-exhaustion. Never empty-on-stop by design: the
	// leader receives partial work as a normal tool result rather than an
	// error, because an error tends to trigger a blind retry right after
	// the user asked for a stop.
	Result   string `gorm:"type:text;not null;default:''" json:"result"`
	ErrorMsg string `gorm:"type:text;not null;default:''" json:"error_msg"`
	// ResultJSON is the structured envelope a sub-agent reported through
	// report_result, or one reconstructed from Result when it never
	// called. Result stays authoritative for humans; this column exists
	// so a supervisor can act on an answer without re-reading prose.
	ResultJSON string `gorm:"type:text;not null;default:''" json:"result_json,omitempty"`

	// TriggeredBy is the human user id at the root of this tree. Drives
	// both tag inheritance and interrupt authorization; it is NOT the
	// leader agent's identity.
	TriggeredBy string     `gorm:"type:varchar(128);not null;default:'';index" json:"triggered_by"`
	StartedAt   time.Time  `json:"started_at"`
	EndedAt     *time.Time `json:"ended_at,omitempty"`

	// Handle is this instance's address inside its tree ("reviewer-2").
	// Unique per RootID and never reused, because a handle that could be
	// recycled would let a message land on a different agent than the one
	// the sender was talking to.
	Handle string `gorm:"type:varchar(64);not null;default:''" json:"handle"`
	// HopCount is the number of consecutive agent-to-agent messages in
	// this tree since a human last spoke. Stored on the ROOT row only, and
	// reset only by a human turn — a leader that could reset its own limit
	// would not be limited.
	HopCount int `gorm:"not null;default:0" json:"hop_count"`

	// Blocked marks a RUNNING delegation whose agent is waiting on a
	// synchronous child rather than working. A blocked row does not hold a
	// parallel slot — without this, a serial room deadlocks the moment a
	// sub-agent delegates: the parent owns the only slot while its child
	// queues behind it, and neither can ever proceed.
	Blocked bool `gorm:"not null;default:false" json:"blocked"`
	// ContextText preserves the caller's `context` argument so a delegation
	// that waits in the queue can be started later exactly as it was
	// requested. Without it a queued row would lose the background its
	// caller supplied, and the sub-agent would start on a thinner task than
	// the one that was asked for.
	ContextText string `gorm:"type:text;not null;default:''" json:"-"`
	// MemoryMode is the resolved choice of what this sub-agent was told
	// about the rest of the conversation. Stored so a delegation that
	// waits in the queue is started with the memory its caller asked for,
	// not with whatever the default happens to be by then.
	MemoryMode string `gorm:"type:varchar(32);not null;default:''" json:"memory_mode,omitempty"`
	// IncidentID links this delegation to its tree's incident record, once
	// one exists. This column is the whole of what a separate agent_tasks
	// table would have been: status, timestamps, error and once-only
	// collection already live on this row, under test.
	IncidentID string `gorm:"type:varchar(64);not null;default:'';index" json:"incident_id,omitempty"`
	// Iteration is the checker round this delegation belongs to, stamped
	// from the incident when it was created. Round completion is a query
	// over it rather than a judgement.
	Iteration int `gorm:"not null;default:0" json:"iteration"`
	// IntakeReasked records that the mechanical gate already sent this
	// sub-agent one follow-up about malformed evidence. Bounded at one:
	// unbounded re-asking turns a turn budget into an argument about
	// formatting.
	IntakeReasked bool `gorm:"not null;default:false" json:"intake_reasked,omitempty"`
	// CollectNudged records that the leader has already been woken once
	// about this uncollected async result. Without it a sweep every
	// fifteen seconds becomes a wake every fifteen seconds.
	CollectNudged bool `gorm:"not null;default:false" json:"collect_nudged,omitempty"`
}

type AgentEvidence struct {
	ID string `gorm:"primaryKey;type:varchar(64)" json:"id"`
	// IncidentID + Fingerprint is the dedup key. The same log line found
	// by two agents is one piece of evidence, and the second finder is
	// not an error.
	IncidentID  string `gorm:"type:varchar(64);not null;index:idx_evidence_dedup,unique" json:"incident_id"`
	Fingerprint string `gorm:"type:varchar(64);not null;index:idx_evidence_dedup,unique" json:"fingerprint"`
	// DelegationID and Role record WHO found it, so a contradiction can be
	// traced back to the agent that reported each side of it.
	DelegationID string    `gorm:"type:varchar(64);not null;index" json:"delegation_id"`
	Role         string    `gorm:"type:varchar(128);not null;default:''" json:"role"`
	Kind         string    `gorm:"type:varchar(32);not null" json:"kind"`
	Source       string    `gorm:"type:text;not null;default:''" json:"source"`
	Excerpt      string    `gorm:"type:text;not null;default:''" json:"excerpt"`
	CreatedAt    time.Time `json:"created_at"`
}

type AgentIncident struct {
	ID string `gorm:"primaryKey;type:varchar(64)" json:"id"`
	// RootID ties the incident to a delegation tree. Unique: one
	// investigation per conversation, and the index is what makes
	// concurrent lazy creation safe.
	RootID      string `gorm:"type:varchar(64);not null;uniqueIndex" json:"root_id"`
	ProjectID   string `gorm:"type:varchar(64);not null;default:'';index" json:"project_id"`
	TriggeredBy string `gorm:"type:varchar(128);not null;default:'';index" json:"triggered_by"`

	Status string `gorm:"type:varchar(32);not null;index" json:"status"`
	// Iteration counts completed checker rounds.
	Iteration int    `gorm:"not null;default:0" json:"iteration"`
	Title     string `gorm:"type:text;not null;default:''" json:"title"`
	UserIssue string `gorm:"type:text;not null;default:''" json:"user_issue"`
	Summary   string `gorm:"type:text;not null;default:''" json:"summary"`
	// StopReason records WHY an investigation stopped. A loop that ends
	// without saying why is indistinguishable from one still running.
	StopReason string `gorm:"type:text;not null;default:''" json:"stop_reason"`

	// Embedded JSON collections: small, always read whole, never queried
	// by element. Evidence is NOT one of these — it is appended
	// concurrently by many delegations and deduplicated across them,
	// which is exactly what makes it a table instead.
	Hypotheses      string `gorm:"type:text;not null;default:'[]'" json:"hypotheses"`
	MissingEvidence string `gorm:"type:text;not null;default:'[]'" json:"missing_evidence"`
	NextActions     string `gorm:"type:text;not null;default:'[]'" json:"next_actions"`
	ClientContext   string `gorm:"type:text;not null;default:'{}'" json:"client_context"`

	// EvidenceAtRoundStart snapshots the evidence count when the current
	// round began, so "did this round establish anything new?" is a
	// subtraction rather than a judgement call.
	EvidenceAtRoundStart int `gorm:"not null;default:0" json:"evidence_at_round_start"`
	// DryRounds counts consecutive completed rounds that added no
	// evidence. Two in a row stops the loop.
	DryRounds int `gorm:"not null;default:0" json:"dry_rounds"`

	FinalSummary string    `gorm:"type:text;not null;default:''" json:"final_summary"`
	CreatedAt    time.Time `json:"created_at"`
	UpdatedAt    time.Time `json:"updated_at"`
}

type AgentMessage struct {
	ID         string `gorm:"primaryKey;type:varchar(64)" json:"id"`
	RootID     string `gorm:"type:varchar(64);not null;index:idx_agent_messages_inbox,priority:1" json:"root_id"`
	FromHandle string `gorm:"type:varchar(64);not null" json:"from_handle"`
	ToHandle   string `gorm:"type:varchar(64);not null;index:idx_agent_messages_inbox,priority:2" json:"to_handle"`
	Body       string `gorm:"type:text;not null" json:"body"`
	Kind       string `gorm:"type:varchar(16);not null" json:"kind"`
	// ReplyTo points a reply at the ask it answers.
	ReplyTo string `gorm:"type:varchar(64);index" json:"reply_to,omitempty"`
	// AutoReply marks a reply wick synthesised from the recipient's final
	// turn because it never called reply explicitly. Surfaced so a reader
	// can tell a deliberate answer from a salvaged one — the salvaged kind
	// often does not actually answer the question.
	AutoReply bool   `gorm:"not null;default:false" json:"auto_reply,omitempty"`
	Status    string `gorm:"type:varchar(16);not null;index:idx_agent_messages_inbox,priority:3" json:"status"`
	// Hop records the tree's hop counter when this message was sent. Kept
	// for audit; the live counter lives on the root delegation row.
	Hop         int        `gorm:"not null;default:0" json:"hop"`
	CreatedAt   time.Time  `json:"created_at"`
	DeliveredAt *time.Time `json:"delivered_at,omitempty"`
}

type AgentProfile struct {
	ID string `gorm:"primaryKey;type:varchar(64)" json:"id"`
	// ProjectID scopes this role. Empty = global: reachable from every
	// project. Non-empty = owned by that project and invisible elsewhere.
	// A project row whose Key matches a global row SHADOWS it for sessions
	// in that project; the global row is untouched for everyone else.
	// See delegation.ResolveScoped.
	ProjectID string `gorm:"type:varchar(64);not null;default:'';index:idx_profile_scope,unique,priority:1" json:"project_id"`
	// Key is the stable handle the LLM passes to wick_delegate. Unique
	// within a scope, lowercase-kebab by convention ("code-reviewer").
	Key         string `gorm:"type:varchar(128);not null;index:idx_profile_scope,unique,priority:2" json:"key"`
	Name        string `gorm:"type:varchar(256);not null;default:''" json:"name"`
	Description string `gorm:"type:text;not null;default:''" json:"description"`
	Icon        string `gorm:"type:varchar(32);not null;default:''" json:"icon"`

	// Provider is the agent runtime ("claude" | "codex" | "gemini").
	// Resolved through the existing pool factory — a sub-agent is a
	// normal provider spawn, not a new runtime.
	Provider string `gorm:"type:varchar(64);not null" json:"provider"`
	// Model is a provider-specific model id. Empty = provider default.
	Model string `gorm:"type:varchar(128);not null;default:''" json:"model"`
	// SystemPrompt is injected into the child spawn via
	// provider.SpawnOptions.Preset (--append-system-prompt or the
	// per-provider equivalent).
	SystemPrompt string `gorm:"type:text;not null;default:''" json:"system_prompt"`

	// AllowedTagIDs is an OPTIONAL narrowing filter, stored as a JSON
	// array of tag ids. Empty = inherit the triggering user's tags in
	// full. Non-empty = intersect with them. See delegation.EffectiveTags.
	AllowedTagIDs string `gorm:"type:text;not null;default:'[]'" json:"allowed_tag_ids"`
	// AllowedNativeTools is a JSON array of provider-native tool names.
	//
	// NOT WIRED. The value is stored and returned by the API, but nothing
	// forwards it to the spawn as --allowedTools, so setting it has no
	// effect on what a sub-agent can call. Do not present it as a control
	// until a spawn path reads it.
	AllowedNativeTools string `gorm:"type:text;not null;default:'[]'" json:"allowed_native_tools"`
	// StrictMCP is intended to drop the host's own MCP servers
	// (~/.claude.json) from the child spawn.
	//
	// NOT WIRED, and it is NOT a security boundary today. Whether a spawn
	// passes --strict-mcp-config is decided globally by the
	// WICK_STRICT_MCP environment variable (see
	// internal/agents/provider/claude/spawn.go), identically for leaders
	// and sub-agents. This field is read by nobody, so a sub-agent
	// inherits whatever MCP servers the host CLI has configured
	// regardless of what a profile says.
	StrictMCP bool `gorm:"not null;default:true" json:"strict_mcp"`

	DefaultMaxTurns int `gorm:"not null;default:12" json:"default_max_turns"`
	// DefaultMode is "async" unless a role opts into "sync". Empty is
	// read as async too (see delegation.NormalizeMode): only an explicit
	// "sync" makes a caller block, so a role created without an opinion
	// runs in the background.
	DefaultMode string `gorm:"type:varchar(16);not null;default:'async'" json:"default_mode"`
	// DefaultWorkspace is "shared" today. "worktree" lands in Phase 3.
	DefaultWorkspace string `gorm:"type:varchar(16);not null;default:'shared'" json:"default_workspace"`
	// DefaultMemoryMode decides what this role is told about the rest of
	// the conversation beyond its own task: no_history, state_summary
	// (the default), relevant_chunks, or full_history. Empty means the
	// system default rather than "nothing".
	DefaultMemoryMode string `gorm:"type:varchar(32);not null;default:''" json:"default_memory_mode"`
	// CanDelegate marks a profile as eligible to be a leader, i.e. to
	// call wick_delegate itself (nested delegation). Forced false for
	// providers without MCP tool-use.
	CanDelegate bool `gorm:"not null;default:false" json:"can_delegate"`
	// AllowTakeOver lets a human send messages straight into a running
	// sub-agent of this role. Off by default: steering a sub-agent means
	// the result is no longer purely that role's own work, so it is opted
	// into per role rather than granted everywhere. Delegations that were
	// steered are flagged UserSteered and the leader is told.
	AllowTakeOver bool `gorm:"not null;default:false" json:"allow_take_over"`
	// DefaultMaxTokens caps token spend for one delegation of this role.
	// 0 = uncapped by the profile; the per-tree budget still applies.
	DefaultMaxTokens int `gorm:"not null;default:0" json:"default_max_tokens"`

	// Locked freezes this role's behaviour. While true, no edit and no
	// delete is accepted from ANY surface — web UI or MCP. Unlocking is a
	// UI-only action, so an agent can never widen its own definition.
	// Distinct from Disabled: a disabled role is switched off, a locked
	// role is switched in stone.
	Locked bool `gorm:"not null;default:false" json:"locked"`

	Disabled  bool      `gorm:"not null;default:false" json:"disabled"`
	CreatedBy string    `gorm:"type:varchar(128);not null;default:''" json:"created_by"`
	CreatedAt time.Time `json:"created_at"`
	UpdatedAt time.Time `json:"updated_at"`
}

type AgentSquad struct {
	ID          string `gorm:"primaryKey;type:varchar(64)" json:"id"`
	Key         string `gorm:"type:varchar(128);uniqueIndex;not null" json:"key"`
	Name        string `gorm:"type:varchar(256);not null;default:''" json:"name"`
	Description string `gorm:"type:text;not null;default:''" json:"description"`
	// LeaderProfileKey is the role that orchestrates. Empty = any profile
	// with can_delegate may lead this squad.
	LeaderProfileKey string `gorm:"type:varchar(128);not null;default:''" json:"leader_profile_key"`
	// MemberProfileKeys is a JSON array of profile keys the leader may
	// delegate to while this squad is active.
	MemberProfileKeys string `gorm:"type:text;not null;default:'[]'" json:"member_profile_keys"`
	Disabled          bool   `gorm:"not null;default:false" json:"disabled"`
	CreatedBy         string `gorm:"type:varchar(128);not null;default:''" json:"created_by"`
	CreatedAt         time.Time
	UpdatedAt         time.Time
}

type AgentTask struct {
	ID      string `gorm:"primaryKey;type:varchar(64)" json:"id"`
	BoardID string `gorm:"type:varchar(64);not null;index" json:"board_id"`
	Title   string `gorm:"type:varchar(512);not null;default:''" json:"title"`
	Body    string `gorm:"type:text;not null;default:''" json:"body"`
	// Stage drives the state machine; ColumnID is only where it renders.
	Stage    string `gorm:"type:varchar(32);not null;index" json:"stage"`
	ColumnID string `gorm:"type:varchar(64);not null;default:''" json:"column_id"`
	Position int    `gorm:"not null;default:0" json:"position"`
	// ProfileKey is the role that should execute this task.
	ProfileKey string `gorm:"type:varchar(128);not null;default:''" json:"profile_key"`
	Priority   int    `gorm:"not null;default:0" json:"priority"`

	ClaimState string     `gorm:"type:varchar(32);not null;default:'unclaimed';index" json:"claim_state"`
	ClaimedBy  string     `gorm:"type:varchar(128);not null;default:''" json:"claimed_by"`
	ClaimedAt  *time.Time `json:"claimed_at,omitempty"`
	// DelegationID links a started task to the delegation executing it.
	DelegationID string `gorm:"type:varchar(64);not null;default:''" json:"delegation_id"`

	Result string `gorm:"type:text;not null;default:''" json:"result"`
	// Evidence is the proof of completion a gated board demands (test
	// output, a report, a link). Checked against GateMode on the move
	// into a terminal stage.
	Evidence string `gorm:"type:text;not null;default:''" json:"evidence"`
	ErrorMsg string `gorm:"type:text;not null;default:''" json:"error_msg"`

	CreatedBy string `gorm:"type:varchar(128);not null;default:''" json:"created_by"`
	CreatedAt time.Time
	UpdatedAt time.Time
	EndedAt   *time.Time `json:"ended_at,omitempty"`
}

type Bookmark struct {
	UserID    string `gorm:"primaryKey;type:varchar(36)"`
	ToolPath  string `gorm:"primaryKey;type:varchar(255)"`
	CreatedAt time.Time
}

type Config = pkgentity.Config

type Connector struct {
	ID    string `gorm:"type:varchar(36);primaryKey"`
	Key   string `gorm:"type:varchar(100);index;not null"`
	Label string `gorm:"type:varchar(255);not null"`
	// Description is per-instance free text an admin writes to guide the AI:
	// when to use this specific instance, team notes, constraints. It is
	// appended to the module's built-in Meta.Description in the MCP surface
	// (connector_list / connector_get) so the agent reads both. Empty by
	// default; purely additive.
	Description string `gorm:"type:text"`
	Disabled    bool   `gorm:"default:false"`
	// RateLimitRPM caps how many times this connector instance may be
	// called per minute across all users. 0 means unlimited. Enforced
	// in-process via a sliding-window counter — not distributed.
	RateLimitRPM int    `gorm:"default:0"`
	CreatedBy    string `gorm:"type:varchar(36)"`
	// AllowOthersConfigure controls whether non-admin users who have tag
	// access to this instance can edit its credentials and settings.
	// Default false — only admins can configure. When true, any user
	// whose tags grant access to this row can also edit it.
	AllowOthersConfigure bool `gorm:"default:false"`
	// AllowOthersConnectSSO controls whether non-admin users who have tag
	// access to this instance can connect their own OAuth account.
	// Only meaningful when the connector's OAuthMeta is non-nil.
	// Default false — only admins can initiate the OAuth flow.
	AllowOthersConnectSSO bool `gorm:"default:false"`
	// EnableSSO controls whether this instance participates in the OAuth
	// flow at all. When false (default) the instance uses manually-entered
	// credentials (bot token, API key, service account). When true the
	// "Connect Account" button is shown and the OAuth flow is active.
	// Only meaningful when the connector's OAuthMeta is non-nil.
	EnableSSO bool `gorm:"default:false"`
	// MultiAccount controls whether each OAuth connect creates a new
	// instance row (true) or replaces the token on this row (false).
	// Only meaningful when EnableSSO=true.
	// false (default) — one row, one identity; reconnect replaces token.
	// true — each user that connects gets their own auto-created row
	// labelled "{Connector} – @{displayName}".
	MultiAccount bool `gorm:"default:false"`
	// AllowSessionConfig opts THIS instance into per-session cloning (the
	// Config tab + wick_session_workspace). Default false — admins flip it
	// per instance. Only meaningful when the connector's module declares
	// AllowSessionConfig=true (the capability); the UI only shows the
	// toggle for capable connectors. Effective gate: module-capable AND
	// this instance flag on.
	AllowSessionConfig bool `gorm:"default:false"`
	CreatedAt          time.Time
	UpdatedAt          time.Time
}

type ConnectorAccount struct {
	ID             string `gorm:"type:varchar(36);primaryKey"`
	ConnectorID    string `gorm:"type:varchar(36);not null;index"`
	WickUserID     string `gorm:"type:varchar(36);index"`
	ExternalUserID string `gorm:"type:varchar(255);index"`
	DisplayName    string `gorm:"type:varchar(255);not null"`
	AccessToken    string `gorm:"type:text;not null"`
	// DisabledOps is a JSON array of operation keys disabled for this
	// account. Empty = all ops allowed. Example: ["send_message","delete_message"]
	DisabledOps string `gorm:"type:text;default:''"`
	CreatedAt   time.Time
	UpdatedAt   time.Time
}

type ConnectorOperation struct {
	ConnectorID  string `gorm:"primaryKey;type:varchar(36)"`
	OperationKey string `gorm:"primaryKey;type:varchar(100)"`
	Enabled      bool   `gorm:"default:true"`
	// AdminOnly restricts this operation to admin users only. Non-admin
	// MCP callers receive a 403-equivalent error before Execute runs.
	// Default: false (all authenticated users may call the operation).
	AdminOnly bool `gorm:"default:false"`
	// SystemDisabled is set by the health-check mechanism when the
	// configured credential lacks the upstream permissions an operation
	// needs (e.g. missing OAuth scope). It is orthogonal to Enabled —
	// effective availability is `Enabled AND NOT SystemDisabled`. The
	// admin UI locks the manual Enable/Disable toggle while this is
	// true; the only way to clear it is to fix the upstream permission
	// and re-run the health check. Default: false.
	SystemDisabled bool `gorm:"default:false"`
	// SystemDisabledReason is the human-readable explanation surfaced
	// alongside the lock — e.g. "needs scope: chat:write". Empty when
	// SystemDisabled is false.
	SystemDisabledReason string `gorm:"type:text"`
	UpdatedAt            time.Time
}

type ConnectorRun struct {
	// String columns are text, not varchar(n): in Postgres text and varchar
	// share storage/perf, so a length cap is pure constraint — and the caps
	// here kept biting (e.g. ConnectorID held "sw_"+uuid = 39 > varchar(36)).
	ID           string `gorm:"type:text;primaryKey"`
	ConnectorID  string `gorm:"type:text;not null;index:idx_run_connector_started,priority:1"`
	OperationKey string `gorm:"type:text;not null"`
	UserID       string `gorm:"type:text;index:idx_run_user_started,priority:1"`
	// SessionID is the agent/live-session this op ran under (empty for direct
	// PAT calls with no session). Persisted so a session_close can find and abort
	// every in-flight run bound to the session, and so a stale-run reaper /
	// audit can attribute a run to its session. Indexed for the by-session lookup.
	SessionID    string             `gorm:"type:text;index:idx_run_session"`
	Source       ConnectorRunSource `gorm:"type:text;not null"`
	RequestJSON  string             `gorm:"type:text"`
	ResponseJSON string             `gorm:"type:text"`
	Status       ConnectorRunStatus `gorm:"type:text;not null;index:idx_run_status_started,priority:1"`
	ErrorMsg     string             `gorm:"type:text"`
	LatencyMs    int
	HTTPStatus   int
	IPAddress    string    `gorm:"type:text;index:idx_run_ip_started,priority:1"`
	UserAgent    string    `gorm:"type:text"`
	ParentRunID  *string   `gorm:"type:text;index"`
	StartedAt    time.Time `` /* 218-byte string literal not displayed */
	EndedAt      *time.Time
	CreatedAt    time.Time
}

type ConnectorRunSource string

type ConnectorRunStatus string

type ConnectorState struct {
	Key       string `gorm:"primaryKey"`
	Enabled   bool   `gorm:"default:true"`
	UpdatedAt time.Time
}

type CustomConnector struct {
	ID          string `gorm:"type:varchar(36);primaryKey"`
	Key         string `gorm:"type:varchar(100);uniqueIndex;not null"`
	Name        string `gorm:"type:varchar(255);not null"`
	Description string `gorm:"type:text"`
	// Icon is an emoji, an inline <svg>, or a data:image/...;base64
	// payload (validated to 32KB) — rendered as text or <img> by the UI.
	Icon       string                `gorm:"type:text"`
	Source     CustomConnectorSource `gorm:"type:varchar(16);not null"`
	SourceMeta string                `gorm:"type:text"`
	Configs    string                `gorm:"type:text;not null;default:'[]'"`
	Ops        string                `gorm:"type:text;not null;default:'[]'"`
	CreatedBy  string                `gorm:"type:varchar(36)"`
	// SingleInstance locks the def to one row (Meta.Fixed). Default off:
	// custom connectors behave like built-ins — admins add/duplicate
	// instance rows, each with its own credentials.
	SingleInstance bool `gorm:"default:false"`
	// AllowSessionConfig is the capability flag mirrored onto
	// Module.AllowSessionConfig: when true this def's configs (base_url,
	// keys, …) may be overridden per agent session. Default off; an admin
	// still has to enable the per-instance toggle before any override is
	// accepted. Only meaningful for curl/manual API defs — leave off for
	// oauth/sso-backed MCP defs whose config is a user token.
	AllowSessionConfig bool `gorm:"default:false"`
	Disabled           bool `gorm:"default:false"`
	CreatedAt          time.Time
	UpdatedAt          time.Time
}

type CustomConnectorMCPServer struct {
	ID          string `gorm:"type:varchar(36);primaryKey"`
	Label       string `gorm:"type:varchar(255);not null"`
	Transport   string `gorm:"type:varchar(16);not null;default:'http'"`
	URL         string `gorm:"type:text;not null"`
	AuthScheme  string `gorm:"type:varchar(20);not null;default:'none'"`
	AuthSecret  string `gorm:"type:text"`
	AuthHeaders string `gorm:"type:text"`
	AuthExtra   string `gorm:"type:text"`
	Headers     string `gorm:"type:text"`
	// ExcludedTools is a JSON array of tool names the connector must NOT
	// expose. The exclusion model is opt-out: everything the server
	// lists is an operation unless its name is in here.
	ExcludedTools string `gorm:"type:text;not null;default:'[]'"`
	// ServerInfo is the JSON {name, version} the server reported on the
	// last successful initialize — admin-facing only (edit form,
	// def_get); deliberately never exposed to the LLM via wick_list.
	ServerInfo string `gorm:"type:text"`
	LastTestAt *time.Time
	LastTestOK bool `gorm:"default:false"`
	CreatedAt  time.Time
	UpdatedAt  time.Time
}

type CustomConnectorSource string

type DataTable struct {
	Slug        string `gorm:"type:varchar(80);primaryKey"`
	Name        string `gorm:"type:varchar(255);not null"`
	Description string `gorm:"type:text"`
	Mode        string `gorm:"type:varchar(20);not null;default:'strict'"` // strict | lax
	SchemaJSON  string `gorm:"type:jsonb;not null;default:'{}'"`
	AccessJSON  string `gorm:"type:jsonb;default:'{}'"`
	NextRowID   int64  `gorm:"not null;default:0"`     // per-slug monotonic row id allocator
	CreatedBy   string `gorm:"type:varchar(36);index"` // owner user id (Schema.UserID); access via owner:<slug> tag
	CreatedAt   time.Time
	UpdatedAt   time.Time
}

type DataTableRow struct {
	TableSlug string    `gorm:"type:varchar(80);primaryKey;not null;index:idx_dtr_slug_created,priority:1"`
	ID        int64     `gorm:"primaryKey;not null;autoIncrement:false"`
	Data      string    `gorm:"type:jsonb;not null;default:'{}'"`
	CreatedAt time.Time `gorm:"not null;index:idx_dtr_slug_created,priority:2,sort:desc"`
	UpdatedAt time.Time `gorm:"not null"`
}

type HealthComponent struct {
	Database HealthState `json:"database"`
}

type HealthState string

type Job struct {
	ID            string    `gorm:"type:varchar(36);primaryKey"`
	Key           string    `gorm:"type:varchar(100);uniqueIndex;not null"`
	Name          string    `gorm:"type:varchar(255);not null"`
	Description   string    `gorm:"type:text"`
	Icon          string    `gorm:"type:varchar(10)"`
	Schedule      string    `gorm:"type:varchar(100)"` // cron expression
	Enabled       bool      `gorm:"default:false"`
	MaxRuns       int       `gorm:"default:0"`  // 0 = unlimited, admin-managed
	MaxTimeoutMin int       `gorm:"default:30"` // auto-cancel after N minutes; 0 = no timeout
	TotalRuns     int       `gorm:"default:0"`
	LastStatus    JobStatus `gorm:"type:varchar(20);default:'idle'"`
	LastRunAt     *time.Time
	CreatedBy     string `gorm:"type:varchar(36)"`
	CreatedAt     time.Time
	UpdatedAt     time.Time
}

type JobRun struct {
	ID          string     `gorm:"type:varchar(36);primaryKey"`
	JobID       string     `gorm:"type:varchar(36);index;not null"`
	Status      RunStatus  `gorm:"type:varchar(20);not null"`
	Result      string     `gorm:"type:text"`
	TriggeredBy RunTrigger `gorm:"type:varchar(20);not null"`
	UserID      string     `gorm:"type:varchar(36)"`
	StartedAt   time.Time
	EndedAt     *time.Time
	CreatedAt   time.Time
}

type JobStatus string

type OAuthAuthorizationCode struct {
	ID                  string `gorm:"type:varchar(36);primaryKey"`
	Code                string `gorm:"type:varchar(64);uniqueIndex;not null"`
	ClientID            string `gorm:"type:varchar(64);index;not null"`
	UserID              string `gorm:"type:varchar(36);not null"`
	RedirectURI         string `gorm:"type:varchar(512);not null"`
	Scope               string `gorm:"type:varchar(255)"`
	CodeChallenge       string `gorm:"type:varchar(128);not null"`
	CodeChallengeMethod string `gorm:"type:varchar(10);not null"`
	Used                bool   `gorm:"default:false"`
	ExpiresAt           time.Time
	CreatedAt           time.Time
}

type OAuthClient struct {
	ID           string `gorm:"type:varchar(36);primaryKey"`
	ClientID     string `gorm:"type:varchar(64);uniqueIndex;not null"`
	Name         string `gorm:"type:varchar(255)"`
	RedirectURIs string `gorm:"type:text;not null"` // JSON array
	CreatedBy    string `gorm:"type:varchar(36)"`
	CreatedAt    time.Time
}

type OAuthToken struct {
	ID            string  `gorm:"type:varchar(36);primaryKey"`
	TokenHash     string  `gorm:"type:varchar(64);uniqueIndex;not null"`
	Kind          string  `gorm:"type:varchar(10);not null"` // access | refresh
	ClientID      string  `gorm:"type:varchar(64);index;not null"`
	UserID        string  `gorm:"type:varchar(36);index;not null"`
	Scope         string  `gorm:"type:varchar(255)"`
	ParentTokenID *string `gorm:"type:varchar(36);index"` // refresh chain ancestor
	ExpiresAt     time.Time
	RevokedAt     *time.Time `gorm:"index"`
	LastUsedAt    *time.Time
	CreatedAt     time.Time
}

type PersonalAccessToken struct {
	ID         string `gorm:"type:varchar(36);primaryKey"`
	UserID     string `gorm:"type:varchar(36);not null;index"`
	Name       string `gorm:"type:varchar(120);not null"`
	TokenHash  string `gorm:"type:varchar(64);not null;uniqueIndex"`
	Last4      string `gorm:"type:varchar(8);not null"`
	CreatedAt  time.Time
	LastUsedAt *time.Time
	RevokedAt  *time.Time `gorm:"index"`
}

type PluginState struct {
	Key       string `gorm:"primaryKey"`
	Enabled   bool   `gorm:"default:true"`
	UpdatedAt time.Time
}

type ProviderStorage struct {
	ID            uint   `gorm:"primaryKey;autoIncrement"`
	ProviderType  string `gorm:"type:varchar(32);not null;uniqueIndex:idx_provider_path"`
	InstanceName  string `gorm:"type:varchar(128);not null;uniqueIndex:idx_provider_path"`
	RelPath       string `gorm:"type:varchar(1024);not null;uniqueIndex:idx_provider_path"` // absolute filesystem path
	ParentID      uint   `gorm:"default:0;index"`                                           // 0 = root (RootParentID)
	Name          string `gorm:"type:varchar(512)"`                                         // basename only
	IsDir         bool   `gorm:"default:false"`
	Content       []byte
	Size          int       `gorm:"default:0"`                 // byte length of Content; lets listings skip loading the blob
	ContentHash   string    `gorm:"type:varchar(64);not null"` // SHA-256 hex; "" for dirs
	SyncedAt      time.Time `gorm:"not null"`
	RetentionDays int       `gorm:"not null;default:0"` // 0 = never purge
}

type ProviderStorageSource struct {
	ID           uint   `gorm:"primaryKey;autoIncrement"`
	ProviderType string `gorm:"type:varchar(32);not null;index:idx_source_provider"`
	InstanceName string `gorm:"type:varchar(128);not null;index:idx_source_provider"`
	Label        string `gorm:"type:varchar(128);not null"` // e.g. "claude workspace", "credentials"
	SyncPath     string `gorm:"type:varchar(1024);not null"`
	// Mode is one of:
	//   "folder"  — include the folder tree at SyncPath
	//   "single"  — include the single file at SyncPath
	//   "exclude" — skip paths matching SyncPath (literal abs path or
	//               glob with * / ** / ?). Stops walks for any include
	//               source on the same instance and purges DB rows.
	Mode          string    `gorm:"type:varchar(16);not null;default:'folder'"`
	RetentionDays int       `gorm:"not null;default:0"` // 0 = never purge (include only)
	Enabled       bool      `gorm:"not null;default:true"`
	CreatedAt     time.Time `gorm:"not null"`
	UpdatedAt     time.Time `gorm:"not null"`
}

type PushSubscription struct {
	ID          string `gorm:"type:varchar(36);primaryKey"`
	UserID      string `gorm:"type:varchar(36);not null;index"`
	User        User   `gorm:"foreignKey:UserID"`
	Endpoint    string `gorm:"not null;uniqueIndex;type:text"`
	P256dh      string `gorm:"not null;type:text"`
	Auth        string `gorm:"not null;type:text"`
	UserAgent   string `gorm:"type:text"`
	DeviceLabel string `gorm:"type:varchar(160)"`
	CreatedAt   time.Time
	UpdatedAt   time.Time
	LastSeenAt  *time.Time
	DisabledAt  *time.Time `gorm:"index"`
}

type RunStatus string

type RunTrigger string

type SSOProvider struct {
	ID           uint   `gorm:"primaryKey"`
	Provider     string `gorm:"uniqueIndex;type:varchar(32);not null"` // "google"
	ClientID     string `gorm:"type:varchar(255)"`
	ClientSecret string `gorm:"type:varchar(255)"`
	Enabled      bool   `gorm:"default:false"`
	// AllowedDomains is a comma-separated list of email domains allowed
	// to sign in through this provider (e.g. "abc.com,abc.net").
	// Empty string means no restriction — any email from the provider is
	// accepted. Matching is case-insensitive.
	AllowedDomains string `gorm:"type:text"`
	CreatedAt      time.Time
	UpdatedAt      time.Time
}

type ScheduledMessage struct {
	ID string `gorm:"type:varchar(40);primaryKey"`
	// SessionID is the session the message is delivered into.
	SessionID string `gorm:"type:varchar(128);index;not null"`
	// OwnerUserID is who the schedule belongs to — copied from the target
	// session's Meta.UserID at create time (empty for legacy/unowned
	// sessions). Access control and the dashboard scope on this.
	OwnerUserID string `gorm:"type:varchar(36);index"`
	// CreatedBy records how the schedule was made: "ai" (agent scheduled
	// itself), "user" (dashboard), or "api" (external caller).
	CreatedBy string `gorm:"type:varchar(16)"`
	// SourceSessionID is the session the schedule was requested from. Usually
	// equals SessionID, but kept explicit so provenance is preserved when a
	// schedule targets a different session.
	SourceSessionID string `gorm:"type:varchar(128)"`
	// AgentName is the pool agent to route the delivered message to; default
	// "main".
	AgentName string `gorm:"type:varchar(64);not null;default:'main'"`
	// Message is the prompt injected as a role=user turn when the schedule
	// fires.
	Message string `gorm:"type:text;not null"`

	// Kind is "once" (fire a single time) or "recurring" (fire repeatedly on
	// Interval/Cron until cancelled or a stop condition is met).
	Kind string `gorm:"type:varchar(16);not null;default:'once'"`
	// RunAt is the NEXT concrete fire time (UTC) the runner claims on. For a
	// one-shot it is the single fire time; for a recurring schedule it is
	// advanced after each fire. Named RunAt (not NextRunAt) so the runner's
	// claim query — run_at <= now — is uniform across both kinds.
	RunAt time.Time `gorm:"index;not null"`
	// IntervalMs, when > 0 on a recurring schedule, is the fixed gap between
	// fires in milliseconds ("every 5m"). Mutually exclusive with Cron.
	IntervalMs int64 `gorm:"default:0"`
	// Cron, when set on a recurring schedule, is a 5-field cron expression
	// (min hour dom mon dow) picking fire minutes ("0 9 * * 1"). Mutually
	// exclusive with IntervalMs.
	Cron string `gorm:"type:varchar(128)"`

	// Paused, when true on a recurring schedule, suspends firing without
	// deleting the row. Resume clears it and recomputes RunAt.
	Paused bool `gorm:"default:false"`
	// MaxRuns > 0 caps the number of fires for a recurring schedule; after
	// the RunCount reaches it the schedule finishes (status=done). 0 = no cap.
	MaxRuns int `gorm:"default:0"`
	// EndsAt, when non-nil, stops a recurring schedule once RunAt passes it.
	EndsAt *time.Time
	// RunCount is how many times this schedule has fired.
	RunCount int `gorm:"default:0"`
	// LastRunAt is when it last fired (nil until the first fire).
	LastRunAt *time.Time

	// Status: pending | active | done | cancelled | failed.
	//   once:      pending → done   (or failed / cancelled)
	//   recurring: active  → active … → done  (max_runs/ends_at) / cancelled / failed
	Status string `gorm:"type:varchar(16);index;not null;default:'pending'"`
	// Attempts counts delivery attempts on the CURRENT fire (reset each fire).
	Attempts int `gorm:"default:0"`
	// LastError holds the most recent delivery failure reason.
	LastError string `gorm:"type:text"`
	CreatedAt time.Time
	UpdatedAt time.Time
}

type Session struct {
	Token     string    `gorm:"primaryKey;type:varchar(64)"`
	UserID    string    `gorm:"type:uuid;not null;index"`
	User      User      `gorm:"foreignKey:UserID"`
	ExpiresAt time.Time `gorm:"not null"`
	CreatedAt time.Time
}

type Skill struct {
	ID        string  `gorm:"type:varchar(36);primaryKey"`
	Name      string  `gorm:"uniqueIndex;not null"`
	IsSystem  bool    `gorm:"not null;default:false"`
	CreatedBy *string `gorm:"column:created_by;type:varchar(36)"`
	FilePath  string  `gorm:"column:file_path"`
	CreatedAt time.Time
	UpdatedAt time.Time
}

type Tag struct {
	ID          string `gorm:"type:varchar(36);primaryKey"`
	Name        string `gorm:"uniqueIndex;type:varchar(100);not null"`
	Description string `gorm:"type:varchar(500)"`
	IsGroup     bool   `gorm:"default:false"`
	IsFilter    bool   `gorm:"default:false"`
	IsSystem    bool   `gorm:"default:false"`
	SortOrder   int    `gorm:"default:0"`
	CreatedAt   time.Time
	DisplayName string `gorm:"-"`
}

type ToolPermission struct {
	ToolPath   string         `gorm:"primaryKey;type:varchar(255)"`
	Visibility ToolVisibility `gorm:"type:varchar(50);default:'private'"`
	// Disabled hides the tool from every user (including admins) and makes
	// direct hits to /tools/{slug}/* return 404. Admins re-enable from
	// /admin/tools.
	Disabled  bool `gorm:"default:false"`
	UpdatedAt time.Time
}

type ToolTag struct {
	ToolPath string `gorm:"primaryKey;type:varchar(255)"`
	TagID    string `gorm:"primaryKey;type:varchar(36);index"`
}

type ToolVisibility = pkgentity.ToolVisibility

type User struct {
	ID           string `gorm:"type:varchar(36);primaryKey"`
	Email        string `gorm:"uniqueIndex;not null"`
	Name         string `gorm:"not null"`
	Avatar       string
	Role         UserRole     `gorm:"type:varchar(50);default:'user'"`
	IsOwner      bool         `gorm:"column:is_owner;not null;default:false"`
	Approved     bool         `gorm:"default:false"`
	PasswordHash string       `gorm:"type:varchar(255)"`
	Metadata     UserMetadata `gorm:"type:jsonb"`
	CreatedAt    time.Time
	UpdatedAt    time.Time
}

type UserMetadata struct {
	// HomeView picks the tool grid density: "compact" (icon+name) or
	// "detailed" (wider cards with description). Empty means compact.
	HomeView string `json:"home_view,omitempty"`

	// Theme picks the UI color palette. Values are Theme.ID from
	// internal/pkg/ui/theme.go ("light", "dark", "dracula", …).
	// Empty means "no preference" — guests follow the device
	// `prefers-color-scheme`, logged-in users can pick in the navbar.
	Theme string `json:"theme,omitempty"`

	// LightTheme / DarkTheme remember the last light- and dark-mode
	// theme the user picked from the dropdown, so the navbar toggle
	// can switch straight back to that variant instead of the generic
	// "light"/"dark" defaults. Values are Theme.ID.
	LightTheme string `json:"light_theme,omitempty"`
	DarkTheme  string `json:"dark_theme,omitempty"`

	// PinnedAgentProjectID is the agents Project this user pinned as
	// their personal default. One per user. When set, opening the agents
	// tool lands scoped to this project. Empty = unpinned. See
	// internal/planning/archive/project/design.md.
	PinnedAgentProjectID string `json:"pinned_agent_project_id,omitempty"`

	// PushPermission stores the last browser notification permission
	// state reported by the browser prompt ("granted" or "denied").
	PushPermission   string     `json:"push_permission,omitempty"`
	PushPermissionAt *time.Time `json:"push_permission_at,omitempty"`
}

type UserRole string

type UserTag struct {
	UserID string `gorm:"primaryKey;type:uuid"`
	TagID  string `gorm:"primaryKey;type:varchar(36);index"`
}

type Workflow struct {
	// ID is the stable UUID minted by the canvas / MCP create flow.
	// Matches Workflow.ID on the in-memory side.
	ID      string `gorm:"primaryKey;type:varchar(64)"`
	Name    string `gorm:"type:varchar(256);not null;default:''"`
	Enabled bool   `gorm:"not null;default:false"`
	Version int    `gorm:"not null;default:0"`
	// BodyPublished is the last-published JSON body. Mutated only by
	// the publish path. Empty until first publish.
	BodyPublished string `gorm:"type:text;not null;default:''"`
	// BodyDraft is the in-progress edit. Mutated on every save. Empty
	// when there is no draft (cleared on publish + discard).
	BodyDraft string `gorm:"type:text;not null;default:''"`
	HasDraft  bool   `gorm:"not null;default:false"`
	// EnvValues is the runtime config blob: a JSON object of
	// {key: value} where secrets are stored as wick_enc_ ciphertext and
	// kvlist/picker values as JSON strings — same shape as configs.value.
	// Current-only: NOT snapshotted into workflow_versions, so changing a
	// channel target or rotating a secret never bloats the history. The
	// env SCHEMA (which fields exist, their widgets) lives in the body;
	// only the VALUES live here. See internal/docs/workflow/11-env-secrets.md.
	EnvValues string `gorm:"type:text;not null;default:''"`
	CreatedBy string `gorm:"type:varchar(128);default:''"`
	CreatedAt time.Time
	UpdatedAt time.Time
}

type WorkflowTestCase struct {
	ID         uint   `gorm:"primaryKey;autoIncrement"`
	WorkflowID string `gorm:"type:varchar(64);not null;index:idx_wtc_workflow_name,unique,priority:1"`
	Name       string `gorm:"type:varchar(256);not null;index:idx_wtc_workflow_name,unique,priority:2"`
	Body       string `gorm:"type:text;not null"`
	UpdatedAt  time.Time
}

type WorkflowVersion struct {
	ID         uint      `gorm:"primaryKey;autoIncrement" json:"id"`
	WorkflowID string    `gorm:"type:varchar(64);not null;index" json:"workflow_id"`
	Kind       string    `gorm:"type:varchar(16);not null;index" json:"kind"` // "draft" | "published"
	Body       string    `gorm:"type:text;not null" json:"body"`
	Message    string    `gorm:"type:varchar(512);default:''" json:"message"`
	CreatedBy  string    `gorm:"type:varchar(128);default:''" json:"created_by"`
	CreatedAt  time.Time `json:"created_at"`
}