queries

type AddFavoriteParams struct {
	UserID string `json:"user_id"`
	DagID  string `json:"dag_id"`
	Tenant string `json:"tenant"`
}

type AssignUserRoleParams struct {
	UserID pgtype.UUID `json:"user_id"`
	RoleID pgtype.UUID `json:"role_id"`
}

type AuditLog struct {
	ID           int64              `json:"id"`
	TenantID     pgtype.UUID        `json:"tenant_id"`
	UserID       pgtype.UUID        `json:"user_id"`
	Action       string             `json:"action"`
	ResourceType *string            `json:"resource_type"`
	ResourceID   *string            `json:"resource_id"`
	Metadata     []byte             `json:"metadata"`
	IpAddress    *netip.Addr        `json:"ip_address"`
	UserAgent    *string            `json:"user_agent"`
	OccurredAt   pgtype.Timestamptz `json:"occurred_at"`
}

type BindWarmAttemptParams struct {
	DagRunID     pgtype.UUID `json:"dag_run_id"`
	TaskID       string      `json:"task_id"`
	TryNumber    int32       `json:"try_number"`
	WarmWorkerID *string     `json:"warm_worker_id"`
	AttemptEpoch *int32      `json:"attempt_epoch"`
}

type ClaimAlertAttemptParams struct {
	ID          pgtype.UUID     `json:"id"`
	Backoff     pgtype.Interval `json:"backoff"`
	MaxAttempts int32           `json:"max_attempts"`
}

type ClaimAlertAttemptRow struct {
	ID            pgtype.UUID `json:"id"`
	AlertAttempts int32       `json:"alert_attempts"`
}

type ClaimAttemptEpochParams struct {
	DagRunID pgtype.UUID `json:"dag_run_id"`
	TaskID   string      `json:"task_id"`
}

type ClaimAttemptEpochRow struct {
	ID           pgtype.UUID `json:"id"`
	TenantID     pgtype.UUID `json:"tenant_id"`
	TryNumber    int32       `json:"try_number"`
	AttemptEpoch int32       `json:"attempt_epoch"`
}

type ConfirmInfraFailureParams struct {
	ID           pgtype.UUID `json:"id"`
	TryNumber    int32       `json:"try_number"`
	AttemptEpoch int32       `json:"attempt_epoch"`
}

type Connection struct {
	ID          pgtype.UUID        `json:"id"`
	TenantID    pgtype.UUID        `json:"tenant_id"`
	ConnID      string             `json:"conn_id"`
	ConnType    string             `json:"conn_type"`
	Host        *string            `json:"host"`
	ConnSchema  *string            `json:"conn_schema"`
	Login       *string            `json:"login"`
	Password    *string            `json:"password"`
	Port        *int32             `json:"port"`
	Extra       *string            `json:"extra"`
	Description *string            `json:"description"`
	CreatedAt   pgtype.Timestamptz `json:"created_at"`
	UpdatedAt   pgtype.Timestamptz `json:"updated_at"`
}

type CountAuditLogsParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	DagID    *string     `json:"dag_id"`
}

type CountDagRunStatesInWindowParams struct {
	TenantID      pgtype.UUID        `json:"tenant_id"`
	LogicalDate   pgtype.Timestamptz `json:"logical_date"`
	LogicalDate_2 pgtype.Timestamptz `json:"logical_date_2"`
}

type CountDagRunStatesInWindowRow struct {
	State DagRunState `json:"state"`
	N     int64       `json:"n"`
}

type CountDagRunsByDagStatesParams struct {
	DagID  pgtype.UUID `json:"dag_id"`
	States []string    `json:"states"`
}

type CountDagsByLatestRunStateRow struct {
	State DagRunState `json:"state"`
	N     int64       `json:"n"`
}

type CountDagsFilteredParams struct {
	TenantID pgtype.UUID  `json:"tenant_id"`
	Paused   *bool        `json:"paused"`
	RunState *DagRunState `json:"run_state"`
}

type CountLocalPasswordUserParams struct {
	Name  string `json:"name"`
	Lower string `json:"lower"`
}

type CountTaskInstanceStatesInWindowParams struct {
	TenantID      pgtype.UUID        `json:"tenant_id"`
	LogicalDate   pgtype.Timestamptz `json:"logical_date"`
	LogicalDate_2 pgtype.Timestamptz `json:"logical_date_2"`
}

type CountTaskInstanceStatesInWindowRow struct {
	State TaskState `json:"state"`
	N     int64     `json:"n"`
}

type CreateAuditLogParams struct {
	TenantID     pgtype.UUID `json:"tenant_id"`
	UserID       pgtype.UUID `json:"user_id"`
	Action       string      `json:"action"`
	ResourceType *string     `json:"resource_type"`
	ResourceID   *string     `json:"resource_id"`
	Metadata     []byte      `json:"metadata"`
}

type CreateDagRunParams struct {
	TenantID     pgtype.UUID        `json:"tenant_id"`
	DagID        pgtype.UUID        `json:"dag_id"`
	DagVersionID pgtype.UUID        `json:"dag_version_id"`
	RunID        string             `json:"run_id"`
	LogicalDate  pgtype.Timestamptz `json:"logical_date"`
	State        DagRunState        `json:"state"`
	Trigger      DagRunTrigger      `json:"trigger"`
	Note         *string            `json:"note"`
	Conf         []byte             `json:"conf"`
}

type CreateScheduledRunByDagIDParams struct {
	RunID       string             `json:"run_id"`
	LogicalDate pgtype.Timestamptz `json:"logical_date"`
	TenantID    pgtype.UUID        `json:"tenant_id"`
	DagID       string             `json:"dag_id"`
}

type CreateTaskInstanceParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	DagRunID pgtype.UUID `json:"dag_run_id"`
	TaskID   string      `json:"task_id"`
	Operator string      `json:"operator"`
	MaxTries int32       `json:"max_tries"`
	State    TaskState   `json:"state"`
	Pool     *string     `json:"pool"`
}

type CreateTaskInstancesParams struct {
	TenantID  pgtype.UUID `json:"tenant_id"`
	DagRunID  pgtype.UUID `json:"dag_run_id"`
	TaskID    string      `json:"task_id"`
	Operator  string      `json:"operator"`
	MaxTries  int32       `json:"max_tries"`
	State     TaskState   `json:"state"`
	Pool      *string     `json:"pool"`
	TryNumber int32       `json:"try_number"`
}

type CreateUserParams struct {
	TenantID     pgtype.UUID `json:"tenant_id"`
	Email        string      `json:"email"`
	PasswordHash *string     `json:"password_hash"`
}

type DBTX interface {
	Exec(context.Context, string, ...interface{}) (pgconn.CommandTag, error)
	Query(context.Context, string, ...interface{}) (pgx.Rows, error)
	QueryRow(context.Context, string, ...interface{}) pgx.Row
	CopyFrom(ctx context.Context, tableName pgx.Identifier, columnNames []string, rowSrc pgx.CopyFromSource) (int64, error)
}

type Dag struct {
	ID               pgtype.UUID        `json:"id"`
	TenantID         pgtype.UUID        `json:"tenant_id"`
	DagID            string             `json:"dag_id"`
	Description      *string            `json:"description"`
	IsPaused         bool               `json:"is_paused"`
	IsActive         bool               `json:"is_active"`
	Owner            *string            `json:"owner"`
	Tags             []string           `json:"tags"`
	Schedule         *string            `json:"schedule"`
	ScheduleTimezone *string            `json:"schedule_timezone"`
	StartDate        pgtype.Timestamptz `json:"start_date"`
	EndDate          pgtype.Timestamptz `json:"end_date"`
	MaxActiveRuns    int32              `json:"max_active_runs"`
	Catchup          bool               `json:"catchup"`
	CurrentVersionID pgtype.UUID        `json:"current_version_id"`
	CreatedAt        pgtype.Timestamptz `json:"created_at"`
	UpdatedAt        pgtype.Timestamptz `json:"updated_at"`
}

type DagFavorite struct {
	ID        pgtype.UUID        `json:"id"`
	TenantID  pgtype.UUID        `json:"tenant_id"`
	UserID    string             `json:"user_id"`
	DagID     string             `json:"dag_id"`
	CreatedAt pgtype.Timestamptz `json:"created_at"`
}

type DagRun struct {
	ID                 pgtype.UUID        `json:"id"`
	TenantID           pgtype.UUID        `json:"tenant_id"`
	DagID              pgtype.UUID        `json:"dag_id"`
	DagVersionID       pgtype.UUID        `json:"dag_version_id"`
	RunID              string             `json:"run_id"`
	LogicalDate        pgtype.Timestamptz `json:"logical_date"`
	DataIntervalStart  pgtype.Timestamptz `json:"data_interval_start"`
	DataIntervalEnd    pgtype.Timestamptz `json:"data_interval_end"`
	State              DagRunState        `json:"state"`
	Trigger            DagRunTrigger      `json:"trigger"`
	Conf               []byte             `json:"conf"`
	TriggeredBy        pgtype.UUID        `json:"triggered_by"`
	QueuedAt           pgtype.Timestamptz `json:"queued_at"`
	StartedAt          pgtype.Timestamptz `json:"started_at"`
	EndedAt            pgtype.Timestamptz `json:"ended_at"`
	Note               *string            `json:"note"`
	AlertedAt          pgtype.Timestamptz `json:"alerted_at"`
	AlertAttempts      int32              `json:"alert_attempts"`
	NextAlertAttemptAt pgtype.Timestamptz `json:"next_alert_attempt_at"`
}

type DagRunExistsByDagIDParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	DagID    string      `json:"dag_id"`
	RunID    string      `json:"run_id"`
}

type DagRunState string

type DagRunTrigger string

type DagVersion struct {
	ID             pgtype.UUID        `json:"id"`
	DagID          pgtype.UUID        `json:"dag_id"`
	Version        string             `json:"version"`
	ImageReference string             `json:"image_reference"`
	Spec           []byte             `json:"spec"`
	SpecHash       string             `json:"spec_hash"`
	CreatedBy      pgtype.UUID        `json:"created_by"`
	CreatedAt      pgtype.Timestamptz `json:"created_at"`
}

type DeleteConnectionParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	ConnID   string      `json:"conn_id"`
}

type DeleteDagParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	DagID    string      `json:"dag_id"`
}

type DeleteDagRunParams struct {
	DagID pgtype.UUID `json:"dag_id"`
	RunID string      `json:"run_id"`
}

type DeleteImportErrorParams struct {
	Tenant   string `json:"tenant"`
	Filename string `json:"filename"`
}

type DeletePoolParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	Name     string      `json:"name"`
}

type DeleteVariableParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	Key      string      `json:"key"`
}

type DeleteXComIndexForTasksParams struct {
	DagRunID pgtype.UUID `json:"dag_run_id"`
	TaskIds  []string    `json:"task_ids"`
}

type DispatchAttemptsForActiveParams struct {
	DagRunID pgtype.UUID `json:"dag_run_id"`
	TaskID   string      `json:"task_id"`
}

type ExistingConnectionIDsParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	ConnIds  []string    `json:"conn_ids"`
}

type ExistingVariableKeysParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	Keys     []string    `json:"keys"`
}

type FailDispatchExhaustedParams struct {
	DagRunID     pgtype.UUID `json:"dag_run_id"`
	TaskID       string      `json:"task_id"`
	ErrorMessage *string     `json:"error_message"`
}

type FailDispatchRefusedParams struct {
	DagRunID     pgtype.UUID `json:"dag_run_id"`
	TaskID       string      `json:"task_id"`
	ErrorMessage *string     `json:"error_message"`
}

type FailTaskInstanceIfActiveParams struct {
	ErrorMessage *string     `json:"error_message"`
	ID           pgtype.UUID `json:"id"`
	TryNumber    int32       `json:"try_number"`
	AttemptEpoch int32       `json:"attempt_epoch"`
}

type GetConnectionParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	ConnID   string      `json:"conn_id"`
}

type GetConnectionRow struct {
	ConnID      string  `json:"conn_id"`
	ConnType    string  `json:"conn_type"`
	Host        *string `json:"host"`
	ConnSchema  *string `json:"conn_schema"`
	Login       *string `json:"login"`
	Password    *string `json:"password"`
	Port        *int32  `json:"port"`
	Extra       *string `json:"extra"`
	Description *string `json:"description"`
}

type GetCurrentDagSpecParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	DagID    string      `json:"dag_id"`
}

type GetDagByDagIDParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	DagID    string      `json:"dag_id"`
}

type GetDagRunParams struct {
	DagID pgtype.UUID `json:"dag_id"`
	RunID string      `json:"run_id"`
}

type GetDagRunWithVersionParams struct {
	DagID pgtype.UUID `json:"dag_id"`
	RunID string      `json:"run_id"`
}

type GetDagRunWithVersionRow struct {
	ID                 pgtype.UUID        `json:"id"`
	TenantID           pgtype.UUID        `json:"tenant_id"`
	DagID              pgtype.UUID        `json:"dag_id"`
	DagVersionID       pgtype.UUID        `json:"dag_version_id"`
	RunID              string             `json:"run_id"`
	LogicalDate        pgtype.Timestamptz `json:"logical_date"`
	DataIntervalStart  pgtype.Timestamptz `json:"data_interval_start"`
	DataIntervalEnd    pgtype.Timestamptz `json:"data_interval_end"`
	State              DagRunState        `json:"state"`
	Trigger            DagRunTrigger      `json:"trigger"`
	Conf               []byte             `json:"conf"`
	TriggeredBy        pgtype.UUID        `json:"triggered_by"`
	QueuedAt           pgtype.Timestamptz `json:"queued_at"`
	StartedAt          pgtype.Timestamptz `json:"started_at"`
	EndedAt            pgtype.Timestamptz `json:"ended_at"`
	Note               *string            `json:"note"`
	AlertedAt          pgtype.Timestamptz `json:"alerted_at"`
	AlertAttempts      int32              `json:"alert_attempts"`
	NextAlertAttemptAt pgtype.Timestamptz `json:"next_alert_attempt_at"`
	DagVersionLabel    *string            `json:"dag_version_label"`
}

type GetDagVersionByHashParams struct {
	DagID    pgtype.UUID `json:"dag_id"`
	SpecHash string      `json:"spec_hash"`
}

type GetDagWithVersionParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	DagID    string      `json:"dag_id"`
}

type GetDagWithVersionRow struct {
	ID                  pgtype.UUID        `json:"id"`
	TenantID            pgtype.UUID        `json:"tenant_id"`
	DagID               string             `json:"dag_id"`
	Description         *string            `json:"description"`
	IsPaused            bool               `json:"is_paused"`
	IsActive            bool               `json:"is_active"`
	Owner               *string            `json:"owner"`
	Tags                []string           `json:"tags"`
	Schedule            *string            `json:"schedule"`
	ScheduleTimezone    *string            `json:"schedule_timezone"`
	StartDate           pgtype.Timestamptz `json:"start_date"`
	EndDate             pgtype.Timestamptz `json:"end_date"`
	MaxActiveRuns       int32              `json:"max_active_runs"`
	Catchup             bool               `json:"catchup"`
	CurrentVersionID    pgtype.UUID        `json:"current_version_id"`
	CreatedAt           pgtype.Timestamptz `json:"created_at"`
	UpdatedAt           pgtype.Timestamptz `json:"updated_at"`
	CurrentVersionLabel *string            `json:"current_version_label"`
}

type GetDefaultTenantRow struct {
	ID   pgtype.UUID `json:"id"`
	Name string      `json:"name"`
}

type GetPoolParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	Name     string      `json:"name"`
}

type GetPoolRow struct {
	Name        string  `json:"name"`
	Slots       int32   `json:"slots"`
	Description *string `json:"description"`
	IsDefault   bool    `json:"is_default"`
}

type GetRoleByNameParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	Name     string      `json:"name"`
}

type GetRoleIDForUserTenantParams struct {
	ID   pgtype.UUID `json:"id"`
	Name string      `json:"name"`
}

type GetTenantByNameRow struct {
	ID   pgtype.UUID `json:"id"`
	Name string      `json:"name"`
}

type GetTenantLimitsRow struct {
	MaxDags                    int32 `json:"max_dags"`
	MaxRunsPerDay              int32 `json:"max_runs_per_day"`
	MinScheduleIntervalSeconds int32 `json:"min_schedule_interval_seconds"`
	MaxTaskPoolSlots           int32 `json:"max_task_pool_slots"`
}

type GetUserByEmailParams struct {
	Name  string `json:"name"`
	Email string `json:"email"`
}

type GetUserByEmailRow struct {
	ID           pgtype.UUID `json:"id"`
	TenantID     pgtype.UUID `json:"tenant_id"`
	Email        string      `json:"email"`
	PasswordHash *string     `json:"password_hash"`
	IsActive     bool        `json:"is_active"`
}

type GetUserByIDRow struct {
	ID       pgtype.UUID `json:"id"`
	Tenant   string      `json:"tenant"`
	Email    string      `json:"email"`
	IsActive bool        `json:"is_active"`
}

type GetUserByOIDCSubjectParams struct {
	OidcProvider *string `json:"oidc_provider"`
	OidcSubject  *string `json:"oidc_subject"`
}

type GetUserByOIDCSubjectRow struct {
	ID       pgtype.UUID `json:"id"`
	Tenant   string      `json:"tenant"`
	Email    string      `json:"email"`
	IsActive bool        `json:"is_active"`
}

type GetUserPermissionsRow struct {
	Action   string `json:"action"`
	Resource string `json:"resource"`
}

type GetUserPrincipalByIDRow struct {
	ID          pgtype.UUID `json:"id"`
	Tenant      string      `json:"tenant"`
	Email       string      `json:"email"`
	IsActive    bool        `json:"is_active"`
	Roles       []string    `json:"roles"`
	Permissions []byte      `json:"permissions"`
}

type GetVariableParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	Key      string      `json:"key"`
}

type GetVariableRow struct {
	Key         string  `json:"key"`
	Value       string  `json:"value"`
	Description *string `json:"description"`
}

type GetXComByNamesParams struct {
	Name   string `json:"name"`
	DagID  string `json:"dag_id"`
	RunID  string `json:"run_id"`
	TaskID string `json:"task_id"`
	Key    string `json:"key"`
}

type GetXComByNamesRow struct {
	RedisKey    string             `json:"redis_key"`
	ContentType string             `json:"content_type"`
	SizeBytes   int32              `json:"size_bytes"`
	CreatedAt   pgtype.Timestamptz `json:"created_at"`
}

type GetXComEntryParams struct {
	DagRunID pgtype.UUID `json:"dag_run_id"`
	TaskID   string      `json:"task_id"`
	Key      string      `json:"key"`
}

type GetXComEntryRow struct {
	RedisKey    string             `json:"redis_key"`
	ContentType string             `json:"content_type"`
	SizeBytes   int32              `json:"size_bytes"`
	CreatedAt   pgtype.Timestamptz `json:"created_at"`
}

type ImportError struct {
	ID         pgtype.UUID        `json:"id"`
	TenantID   pgtype.UUID        `json:"tenant_id"`
	Filename   string             `json:"filename"`
	Stacktrace string             `json:"stacktrace"`
	BundleName *string            `json:"bundle_name"`
	CreatedAt  pgtype.Timestamptz `json:"created_at"`
}

type InsertDagVersionParams struct {
	DagID          pgtype.UUID `json:"dag_id"`
	Version        string      `json:"version"`
	ImageReference string      `json:"image_reference"`
	Spec           []byte      `json:"spec"`
	SpecHash       string      `json:"spec_hash"`
	CreatedBy      pgtype.UUID `json:"created_by"`
}

type InsertOIDCUserParams struct {
	TenantID     pgtype.UUID `json:"tenant_id"`
	Email        string      `json:"email"`
	OidcProvider *string     `json:"oidc_provider"`
	OidcSubject  *string     `json:"oidc_subject"`
}

type InsertOIDCUserRow struct {
	ID        pgtype.UUID        `json:"id"`
	Email     string             `json:"email"`
	IsActive  bool               `json:"is_active"`
	CreatedAt pgtype.Timestamptz `json:"created_at"`
}

type InsertTenantIfMissingParams struct {
	Name        string  `json:"name"`
	DisplayName *string `json:"display_name"`
}

type InsertUserParams struct {
	TenantID     pgtype.UUID `json:"tenant_id"`
	Email        string      `json:"email"`
	PasswordHash *string     `json:"password_hash"`
}

type InsertUserRow struct {
	ID        pgtype.UUID        `json:"id"`
	Email     string             `json:"email"`
	IsActive  bool               `json:"is_active"`
	CreatedAt pgtype.Timestamptz `json:"created_at"`
}

type IsTaskInstanceLiveParams struct {
	DagRunID     pgtype.UUID `json:"dag_run_id"`
	TaskID       string      `json:"task_id"`
	TryNumber    int32       `json:"try_number"`
	AttemptEpoch *int32      `json:"attempt_epoch"`
}

type LatestRunsForDagsParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	Column2  []string    `json:"column_2"`
	Limit    int32       `json:"limit"`
}

type LatestRunsForDagsRow struct {
	DagIDText   string             `json:"dag_id_text"`
	RunID       string             `json:"run_id"`
	LogicalDate pgtype.Timestamptz `json:"logical_date"`
	State       DagRunState        `json:"state"`
	Trigger     DagRunTrigger      `json:"trigger"`
	QueuedAt    pgtype.Timestamptz `json:"queued_at"`
	StartedAt   pgtype.Timestamptz `json:"started_at"`
	EndedAt     pgtype.Timestamptz `json:"ended_at"`
}

type ListActiveStagingVolumesRow struct {
	PvcName    string             `json:"pvc_name"`
	CreatedAt  pgtype.Timestamptz `json:"created_at"`
	RunState   *DagRunState       `json:"run_state"`
	RunEndedAt pgtype.Timestamptz `json:"run_ended_at"`
}

type ListAgentLostCandidatesRow struct {
	TaskInstanceID  pgtype.UUID        `json:"task_instance_id"`
	TenantID        pgtype.UUID        `json:"tenant_id"`
	DagRunID        pgtype.UUID        `json:"dag_run_id"`
	DagIDText       string             `json:"dag_id_text"`
	TaskID          string             `json:"task_id"`
	TryNumber       int32              `json:"try_number"`
	AttemptEpoch    int32              `json:"attempt_epoch"`
	LastHeartbeatAt pgtype.Timestamptz `json:"last_heartbeat_at"`
	StartedAt       pgtype.Timestamptz `json:"started_at"`
}

type ListAuditLogsAfterParams struct {
	TenantID        pgtype.UUID        `json:"tenant_id"`
	DagID           *string            `json:"dag_id"`
	AfterOccurredAt pgtype.Timestamptz `json:"after_occurred_at"`
	AfterID         int64              `json:"after_id"`
	RowLimit        int32              `json:"row_limit"`
}

type ListAuditLogsAfterRow struct {
	ID           int64              `json:"id"`
	Action       string             `json:"action"`
	ResourceType *string            `json:"resource_type"`
	ResourceID   *string            `json:"resource_id"`
	Metadata     []byte             `json:"metadata"`
	OccurredAt   pgtype.Timestamptz `json:"occurred_at"`
	Owner        string             `json:"owner"`
}

type ListAuditLogsParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	Limit    int32       `json:"limit"`
	Offset   int32       `json:"offset"`
	DagID    *string     `json:"dag_id"`
}

type ListAuditLogsRow struct {
	ID           int64              `json:"id"`
	Action       string             `json:"action"`
	ResourceType *string            `json:"resource_type"`
	ResourceID   *string            `json:"resource_id"`
	Metadata     []byte             `json:"metadata"`
	OccurredAt   pgtype.Timestamptz `json:"occurred_at"`
	Owner        string             `json:"owner"`
}

type ListConnectionSecretsRow struct {
	ConnID     string  `json:"conn_id"`
	ConnType   string  `json:"conn_type"`
	Host       *string `json:"host"`
	ConnSchema *string `json:"conn_schema"`
	Login      *string `json:"login"`
	Password   *string `json:"password"`
	Port       *int32  `json:"port"`
	Extra      *string `json:"extra"`
}

type ListConnectionSecretsScopedParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	ConnIds  []string    `json:"conn_ids"`
}

type ListConnectionSecretsScopedRow struct {
	ConnID     string  `json:"conn_id"`
	ConnType   string  `json:"conn_type"`
	Host       *string `json:"host"`
	ConnSchema *string `json:"conn_schema"`
	Login      *string `json:"login"`
	Password   *string `json:"password"`
	Port       *int32  `json:"port"`
	Extra      *string `json:"extra"`
}

type ListConnectionsParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	Limit    int32       `json:"limit"`
	Offset   int32       `json:"offset"`
}

type ListConnectionsRow struct {
	ConnID      string  `json:"conn_id"`
	ConnType    string  `json:"conn_type"`
	Host        *string `json:"host"`
	ConnSchema  *string `json:"conn_schema"`
	Login       *string `json:"login"`
	Port        *int32  `json:"port"`
	Extra       *string `json:"extra"`
	Description *string `json:"description"`
}

type ListDagRunsByDagAfterParams struct {
	DagID            pgtype.UUID        `json:"dag_id"`
	States           []string           `json:"states"`
	AfterLogicalDate pgtype.Timestamptz `json:"after_logical_date"`
	AfterRunID       string             `json:"after_run_id"`
	RowLimit         int32              `json:"row_limit"`
}

type ListDagRunsByDagAfterRow struct {
	ID                 pgtype.UUID        `json:"id"`
	TenantID           pgtype.UUID        `json:"tenant_id"`
	DagID              pgtype.UUID        `json:"dag_id"`
	DagVersionID       pgtype.UUID        `json:"dag_version_id"`
	RunID              string             `json:"run_id"`
	LogicalDate        pgtype.Timestamptz `json:"logical_date"`
	DataIntervalStart  pgtype.Timestamptz `json:"data_interval_start"`
	DataIntervalEnd    pgtype.Timestamptz `json:"data_interval_end"`
	State              DagRunState        `json:"state"`
	Trigger            DagRunTrigger      `json:"trigger"`
	Conf               []byte             `json:"conf"`
	TriggeredBy        pgtype.UUID        `json:"triggered_by"`
	QueuedAt           pgtype.Timestamptz `json:"queued_at"`
	StartedAt          pgtype.Timestamptz `json:"started_at"`
	EndedAt            pgtype.Timestamptz `json:"ended_at"`
	Note               *string            `json:"note"`
	AlertedAt          pgtype.Timestamptz `json:"alerted_at"`
	AlertAttempts      int32              `json:"alert_attempts"`
	NextAlertAttemptAt pgtype.Timestamptz `json:"next_alert_attempt_at"`
	DagVersionLabel    *string            `json:"dag_version_label"`
}

type ListDagRunsByDagParams struct {
	DagID  pgtype.UUID `json:"dag_id"`
	Limit  int32       `json:"limit"`
	Offset int32       `json:"offset"`
}

type ListDagRunsByDagWithVersionParams struct {
	DagID  pgtype.UUID `json:"dag_id"`
	Limit  int32       `json:"limit"`
	Offset int32       `json:"offset"`
}

type ListDagRunsByDagWithVersionRow struct {
	ID                 pgtype.UUID        `json:"id"`
	TenantID           pgtype.UUID        `json:"tenant_id"`
	DagID              pgtype.UUID        `json:"dag_id"`
	DagVersionID       pgtype.UUID        `json:"dag_version_id"`
	RunID              string             `json:"run_id"`
	LogicalDate        pgtype.Timestamptz `json:"logical_date"`
	DataIntervalStart  pgtype.Timestamptz `json:"data_interval_start"`
	DataIntervalEnd    pgtype.Timestamptz `json:"data_interval_end"`
	State              DagRunState        `json:"state"`
	Trigger            DagRunTrigger      `json:"trigger"`
	Conf               []byte             `json:"conf"`
	TriggeredBy        pgtype.UUID        `json:"triggered_by"`
	QueuedAt           pgtype.Timestamptz `json:"queued_at"`
	StartedAt          pgtype.Timestamptz `json:"started_at"`
	EndedAt            pgtype.Timestamptz `json:"ended_at"`
	Note               *string            `json:"note"`
	AlertedAt          pgtype.Timestamptz `json:"alerted_at"`
	AlertAttempts      int32              `json:"alert_attempts"`
	NextAlertAttemptAt pgtype.Timestamptz `json:"next_alert_attempt_at"`
	DagVersionLabel    *string            `json:"dag_version_label"`
}

type ListDagVersionsParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	DagID    string      `json:"dag_id"`
}

type ListDagVersionsRow struct {
	ID            pgtype.UUID        `json:"id"`
	Version       string             `json:"version"`
	CreatedAt     pgtype.Timestamptz `json:"created_at"`
	VersionNumber int64              `json:"version_number"`
}

type ListDagsFilteredParams struct {
	TenantID pgtype.UUID  `json:"tenant_id"`
	Limit    int32        `json:"limit"`
	Offset   int32        `json:"offset"`
	Paused   *bool        `json:"paused"`
	RunState *DagRunState `json:"run_state"`
}

type ListDagsParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	Limit    int32       `json:"limit"`
	Offset   int32       `json:"offset"`
}

type ListDagsWithVersionParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	Limit    int32       `json:"limit"`
	Offset   int32       `json:"offset"`
}

type ListDagsWithVersionRow struct {
	ID                  pgtype.UUID        `json:"id"`
	TenantID            pgtype.UUID        `json:"tenant_id"`
	DagID               string             `json:"dag_id"`
	Description         *string            `json:"description"`
	IsPaused            bool               `json:"is_paused"`
	IsActive            bool               `json:"is_active"`
	Owner               *string            `json:"owner"`
	Tags                []string           `json:"tags"`
	Schedule            *string            `json:"schedule"`
	ScheduleTimezone    *string            `json:"schedule_timezone"`
	StartDate           pgtype.Timestamptz `json:"start_date"`
	EndDate             pgtype.Timestamptz `json:"end_date"`
	MaxActiveRuns       int32              `json:"max_active_runs"`
	Catchup             bool               `json:"catchup"`
	CurrentVersionID    pgtype.UUID        `json:"current_version_id"`
	CreatedAt           pgtype.Timestamptz `json:"created_at"`
	UpdatedAt           pgtype.Timestamptz `json:"updated_at"`
	CurrentVersionLabel *string            `json:"current_version_label"`
}

type ListEncryptedConnectionSecretsRow struct {
	ID       pgtype.UUID `json:"id"`
	TenantID pgtype.UUID `json:"tenant_id"`
	ConnID   string      `json:"conn_id"`
	Password *string     `json:"password"`
	Extra    *string     `json:"extra"`
}

type ListFavoriteDagIDsParams struct {
	Tenant string `json:"tenant"`
	UserID string `json:"user_id"`
}

type ListImportErrorsRow struct {
	ID         pgtype.UUID        `json:"id"`
	Filename   string             `json:"filename"`
	Stacktrace string             `json:"stacktrace"`
	BundleName *string            `json:"bundle_name"`
	CreatedAt  pgtype.Timestamptz `json:"created_at"`
}

type ListOrphanCandidatesRow struct {
	ID           pgtype.UUID        `json:"id"`
	DagIDText    string             `json:"dag_id_text"`
	LastActivity pgtype.Timestamptz `json:"last_activity"`
}

type ListPoolsParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	Limit    int32       `json:"limit"`
	Offset   int32       `json:"offset"`
}

type ListPoolsRow struct {
	Name        string  `json:"name"`
	Slots       int32   `json:"slots"`
	Description *string `json:"description"`
	IsDefault   bool    `json:"is_default"`
}

type ListProvisionalInfraFailuresRow struct {
	TaskInstanceID pgtype.UUID `json:"task_instance_id"`
	DagRunID       pgtype.UUID `json:"dag_run_id"`
	TaskID         string      `json:"task_id"`
	TryNumber      int32       `json:"try_number"`
	AttemptEpoch   int32       `json:"attempt_epoch"`
}

type ListRunningTasksRow struct {
	TaskInstanceID pgtype.UUID        `json:"task_instance_id"`
	TenantID       pgtype.UUID        `json:"tenant_id"`
	DagRunID       pgtype.UUID        `json:"dag_run_id"`
	DagIDText      string             `json:"dag_id_text"`
	TaskID         string             `json:"task_id"`
	TryNumber      int32              `json:"try_number"`
	AttemptEpoch   int32              `json:"attempt_epoch"`
	StartedAt      pgtype.Timestamptz `json:"started_at"`
	Heartbeated    bool               `json:"heartbeated"`
}

type ListScheduledDagsRow struct {
	TenantID      pgtype.UUID        `json:"tenant_id"`
	DagID         string             `json:"dag_id"`
	Schedule      *string            `json:"schedule"`
	Catchup       bool               `json:"catchup"`
	StartDate     pgtype.Timestamptz `json:"start_date"`
	MaxActiveRuns int32              `json:"max_active_runs"`
	LastLogical   interface{}        `json:"last_logical"`
}

type ListSettledRunIDsParams struct {
	TenantIds []pgtype.UUID `json:"tenant_ids"`
	RunIds    []pgtype.UUID `json:"run_ids"`
}

type ListSettledRunIDsRow struct {
	ID       pgtype.UUID `json:"id"`
	TenantID pgtype.UUID `json:"tenant_id"`
}

type ListStaleQueuedTaskInstancesRow struct {
	TaskInstanceID pgtype.UUID        `json:"task_instance_id"`
	DagRunID       pgtype.UUID        `json:"dag_run_id"`
	DagIDText      string             `json:"dag_id_text"`
	TaskID         string             `json:"task_id"`
	TryNumber      int32              `json:"try_number"`
	AttemptEpoch   int32              `json:"attempt_epoch"`
	QueuedAt       pgtype.Timestamptz `json:"queued_at"`
	WarmWorkerID   *string            `json:"warm_worker_id"`
}

type ListTaskInstanceAttemptsParams struct {
	DagRunID pgtype.UUID `json:"dag_run_id"`
	TaskID   string      `json:"task_id"`
}

type ListTaskInstanceAttemptsRow struct {
	TaskInstanceID  pgtype.UUID        `json:"task_instance_id"`
	MapIndex        int32              `json:"map_index"`
	Operator        string             `json:"operator"`
	MaxTries        int32              `json:"max_tries"`
	TryNumber       int32              `json:"try_number"`
	State           TaskState          `json:"state"`
	QueuedAt        pgtype.Timestamptz `json:"queued_at"`
	ScheduledAt     pgtype.Timestamptz `json:"scheduled_at"`
	StartedAt       pgtype.Timestamptz `json:"started_at"`
	EndedAt         pgtype.Timestamptz `json:"ended_at"`
	DurationSeconds *float64           `json:"duration_seconds"`
	ExitCode        *int32             `json:"exit_code"`
	ErrorMessage    *string            `json:"error_message"`
	Hostname        *string            `json:"hostname"`
	PodName         *string            `json:"pod_name"`
	NodeName        *string            `json:"node_name"`
	Note            *string            `json:"note"`
}

type ListUsersParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	Limit    int32       `json:"limit"`
	Offset   int32       `json:"offset"`
}

type ListUsersRow struct {
	ID        pgtype.UUID        `json:"id"`
	Email     string             `json:"email"`
	IsActive  bool               `json:"is_active"`
	CreatedAt pgtype.Timestamptz `json:"created_at"`
	Roles     []string           `json:"roles"`
}

type ListVariablesParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	Limit    int32       `json:"limit"`
	Offset   int32       `json:"offset"`
}

type ListVariablesRow struct {
	Key         string  `json:"key"`
	Value       string  `json:"value"`
	Description *string `json:"description"`
}

type ListVariablesScopedParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	Keys     []string    `json:"keys"`
}

type ListVariablesScopedRow struct {
	Key         string  `json:"key"`
	Value       string  `json:"value"`
	Description *string `json:"description"`
}

type ListWarmBoundRunningTIsRow struct {
	TaskInstanceID pgtype.UUID `json:"task_instance_id"`
	DagRunID       pgtype.UUID `json:"dag_run_id"`
	TaskID         string      `json:"task_id"`
	TryNumber      int32       `json:"try_number"`
	AttemptEpoch   int32       `json:"attempt_epoch"`
	WarmWorkerID   *string     `json:"warm_worker_id"`
}

type ListXComEntriesParams struct {
	Name   string `json:"name"`
	DagID  string `json:"dag_id"`
	RunID  string `json:"run_id"`
	TaskID string `json:"task_id"`
}

type ListXComEntriesRow struct {
	Key       string             `json:"key"`
	CreatedAt pgtype.Timestamptz `json:"created_at"`
}

type MarkRunAlertDeliveredParams struct {
	ID      pgtype.UUID `json:"id"`
	Attempt int32       `json:"attempt"`
}

type MarkRunOrphanedRunParams struct {
	ID          pgtype.UUID        `json:"id"`
	QuietBefore pgtype.Timestamptz `json:"quiet_before"`
}

type MarkStagingDeletedParams struct {
	Reason  *string `json:"reason"`
	PvcName string  `json:"pvc_name"`
}

type MarkTaskAgentLostParams struct {
	Provisional  bool        `json:"provisional"`
	ID           pgtype.UUID `json:"id"`
	TryNumber    int32       `json:"try_number"`
	AttemptEpoch int32       `json:"attempt_epoch"`
}

type MarkTaskCredentialCeilingParams struct {
	ID           pgtype.UUID `json:"id"`
	TryNumber    int32       `json:"try_number"`
	AttemptEpoch int32       `json:"attempt_epoch"`
}

type MarkTaskDispatchFailedParams struct {
	DagRunID     pgtype.UUID `json:"dag_run_id"`
	TaskID       string      `json:"task_id"`
	ErrorMessage *string     `json:"error_message"`
}

type MarkTaskDispatchLostParams struct {
	Provisional  bool        `json:"provisional"`
	ID           pgtype.UUID `json:"id"`
	TryNumber    int32       `json:"try_number"`
	AttemptEpoch int32       `json:"attempt_epoch"`
}

type MarkTaskInstanceQueuedParams struct {
	DagRunID             pgtype.UUID        `json:"dag_run_id"`
	TaskID               string             `json:"task_id"`
	ExpectNextDispatchAt pgtype.Timestamptz `json:"expect_next_dispatch_at"`
}

type MarkTaskPodLostParams struct {
	Provisional  bool        `json:"provisional"`
	ID           pgtype.UUID `json:"id"`
	TryNumber    int32       `json:"try_number"`
	AttemptEpoch int32       `json:"attempt_epoch"`
}

type NullDagRunState struct {
	DagRunState DagRunState `json:"dag_run_state"`
	Valid       bool        `json:"valid"` // Valid is true if DagRunState is not NULL
}

type NullDagRunTrigger struct {
	DagRunTrigger DagRunTrigger `json:"dag_run_trigger"`
	Valid         bool          `json:"valid"` // Valid is true if DagRunTrigger is not NULL
}

type NullTaskState struct {
	TaskState TaskState `json:"task_state"`
	Valid     bool      `json:"valid"` // Valid is true if TaskState is not NULL
}

type Permission struct {
	ID          pgtype.UUID `json:"id"`
	Action      string      `json:"action"`
	Resource    string      `json:"resource"`
	Description *string     `json:"description"`
}

type Pool struct {
	ID          pgtype.UUID        `json:"id"`
	TenantID    pgtype.UUID        `json:"tenant_id"`
	Name        string             `json:"name"`
	Slots       int32              `json:"slots"`
	Description *string            `json:"description"`
	IsDefault   bool               `json:"is_default"`
	CreatedAt   pgtype.Timestamptz `json:"created_at"`
	UpdatedAt   pgtype.Timestamptz `json:"updated_at"`
}

type PoolBudgetsRow struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	Name     string      `json:"name"`
	Slots    int32       `json:"slots"`
}

type PoolSlotUsageRow struct {
	Pool  string    `json:"pool"`
	State TaskState `json:"state"`
	N     int64     `json:"n"`
}

type Querier interface {
	AddFavorite(ctx context.Context, arg AddFavoriteParams) error
	AssignUserRole(ctx context.Context, arg AssignUserRoleParams) error
	// Records the durable warm-attempt binding (ADR 0058 N1d-a1): the warm worker
	// pod ($4, its own downward-API pod name) that acked THIS attempt (dag_run_id,
	// task_id, try_number) as started. A later failover reaper matches warm_worker_id
	// against the live warm-pod set to find attempts a dead warm pod held.
	//
	// Guarded on state IN ('queued', 'running') — the same active predicate the
	// heartbeat and liveness queries use — so a settled attempt is never bound: an
	// ack that races a reaper settling the row must not stamp a worker onto a
	// terminal TI. Bounded by (dag_run_id, task_id, try_number, attempt_epoch) to
	// match exactly the attempt the assignment named. Returns the affected row count; zero means the
	// attempt already moved on (terminal or superseded), and the caller treats that
	// as a benign no-op, never an error.
	BindWarmAttempt(ctx context.Context, arg BindWarmAttemptParams) (int64, error)
	// Atomically claim one on-failure ATTEMPT for a run, returning the row iff this
	// call won it. Replaces the old claim-then-send (#431), which set alerted_at
	// before the send and so lost the page whenever the send failed.
	//
	// Three predicates, one per way an attempt should be refused:
	//   * alerted_at IS NULL  — already delivered; never page twice for one episode.
	//   * alert_attempts < $2 — the budget is spent; a dead endpoint stops being
	//     retried instead of being hit once per tick for the life of the run.
	//   * next_alert_attempt_at — backoff has not elapsed yet.
	//
	// The attempt is consumed up front, before the send, so a crash mid-send costs one
	// attempt rather than looping. A clear resets all three (ResetDagRunToVersion),
	// making the next genuine failure a fresh episode with a fresh budget.
	ClaimAlertAttempt(ctx context.Context, arg ClaimAlertAttemptParams) (ClaimAlertAttemptRow, error)
	// The dispatcher's claim of a new execution attempt (ADR 0051 amendment, A1).
	// launchQueued creates the pod BEFORE it records `queued`, so a dispatch whose
	// queued write failed is dispatched again on a later tick with no reset rail in
	// between; without a claim here both pods would share (try_number,
	// attempt_epoch). Bumping at dispatch gives every execution its own epoch
	// whatever path led to it. The token (A2) and the pod label (A4) are minted
	// from the value returned.
	//
	// Guarded to the pre-dispatch states. 'queued' is included because the
	// buffered dispatcher records queued before its worker resolves the row. A row
	// that is running or settled is never claimed (zero rows), so a late or
	// duplicate dispatch cannot move the epoch of the live attempt. The row is the
	// task's latest try, matching how the dispatcher has always resolved it.
	ClaimAttemptEpoch(ctx context.Context, arg ClaimAttemptEpochParams) (ClaimAttemptEpochRow, error)
	ClearDagRuns(ctx context.Context, dagID pgtype.UUID) (int64, error)
	// The reconciler confirms a provisional infra mark (ADR 0052 amendment, part
	// 2): the attempt's pods show no SUCCESS record and no task container still
	// running, so the guess stands and the planner may re-place. Guarded on the
	// exact attempt and the provisional mark, so a confirmation computed for a
	// superseded attempt, or a second one, is a no-op.
	ConfirmInfraFailure(ctx context.Context, arg ConfirmInfraFailureParams) (int64, error)
	// Grant each copied built-in role the same permissions as its "default" twin.
	CopyDefaultRolePermissions(ctx context.Context, tenantID pgtype.UUID) error
	// Give a tenant the built-in roles the migrations seed for "default". Copying
	// keeps every tenant's ladder equal to default's as later migrations change it.
	CopyDefaultSystemRoles(ctx context.Context, tenantID pgtype.UUID) error
	// Counts queued+running runs for a single DAG; used by the manual-trigger
	// path to enforce max_active_runs (#200) before insert.
	CountActiveDagRunsByDagID(ctx context.Context, dagID pgtype.UUID) (int64, error)
	CountAuditLogs(ctx context.Context, arg CountAuditLogsParams) (int64, error)
	CountConnections(ctx context.Context, tenantID pgtype.UUID) (int64, error)
	CountDagRunStatesInWindow(ctx context.Context, arg CountDagRunStatesInWindowParams) ([]CountDagRunStatesInWindowRow, error)
	CountDagRunsByDag(ctx context.Context, dagID pgtype.UUID) (int64, error)
	CountDagRunsByDagStates(ctx context.Context, arg CountDagRunsByDagStatesParams) (int64, error)
	CountDags(ctx context.Context, tenantID pgtype.UUID) (int64, error)
	// One index probe per DAG of the tenant for its newest run. DAGs without runs
	// drop out of the CROSS JOIN, so they are not counted.
	CountDagsByLatestRunState(ctx context.Context, tenantID pgtype.UUID) ([]CountDagsByLatestRunStateRow, error)
	// Same newest-run lookup as ListDagsFiltered.
	CountDagsFiltered(ctx context.Context, arg CountDagsFilteredParams) (int64, error)
	// Does this address have a usable LOCAL password login in the tenant? The boot
	// check on auth.oidc.break_glass_emails asks it: an address on that allowlist
	// with no password row is an escape hatch that does not open, which is worse
	// than an empty allowlist because the operator believes they have one.
	//
	// password_hash IS NOT NULL is the point, not merely that the row exists. A user
	// created by OIDC just-in-time provisioning has a NULL password (the table's
	// users_has_auth check permits it because the OIDC subject is the other half),
	// so the row can exist while no password can ever be verified against it.
	CountLocalPasswordUser(ctx context.Context, arg CountLocalPasswordUserParams) (int64, error)
	CountPools(ctx context.Context, tenantID pgtype.UUID) (int64, error)
	CountTaskInstanceStatesInWindow(ctx context.Context, arg CountTaskInstanceStatesInWindowParams) ([]CountTaskInstanceStatesInWindowRow, error)
	CountTenantDags(ctx context.Context, tenantID pgtype.UUID) (int64, error)
	CountUsers(ctx context.Context, tenantID pgtype.UUID) (int64, error)
	CountVariables(ctx context.Context, tenantID pgtype.UUID) (int64, error)
	CreateAuditLog(ctx context.Context, arg CreateAuditLogParams) error
	CreateDagRun(ctx context.Context, arg CreateDagRunParams) (DagRun, error)
	// Zero rows means the slot's run already exists (or the DAG has no current
	// version): the caller then rolls back the charge it took from the tenant's
	// daily run cap.
	CreateScheduledRunByDagID(ctx context.Context, arg CreateScheduledRunByDagIDParams) (int64, error)
	// try_number starts at 1 to match Airflow (1-based attempts): the first run's
	// logs live at .../1.log, which is where the UI's log view looks. Retries bump
	// it via ResetForRetry.
	CreateTaskInstance(ctx context.Context, arg CreateTaskInstanceParams) (TaskInstance, error)
	// Batched form of CreateTaskInstance: materializes every task of one run in a
	// single COPY instead of T INSERT round-trips. The caller supplies one param row
	// per task with try_number pinned to 1 (matching CreateTaskInstance's literal)
	// and pool carried through so cross-DAG pool occupancy is attributed correctly;
	// columns omitted from the list take their table defaults, so the rows are
	// byte-identical to the loop — only the statement count changes (T INSERTs → 1 COPY).
	CreateTaskInstances(ctx context.Context, arg []CreateTaskInstancesParams) (int64, error)
	CreateUser(ctx context.Context, arg CreateUserParams) (pgtype.UUID, error)
	// Whether run_id of the DAG dag_id in tenant tenant_id exists: the read behind
	// a refused daily run cap charge, so a run that already exists keeps its usual
	// answer (a no-op for a scheduled slot, a conflict for a manual run id) instead
	// of a refusal, and nothing is written (createRunWithinDailyLimit).
	DagRunExistsByDagID(ctx context.Context, arg DagRunExistsByDagIDParams) (bool, error)
	DeleteConnection(ctx context.Context, arg DeleteConnectionParams) (int64, error)
	DeleteDag(ctx context.Context, arg DeleteDagParams) (int64, error)
	// Removes one run; its task_instances and XCom rows cascade (ON DELETE CASCADE).
	DeleteDagRun(ctx context.Context, arg DeleteDagRunParams) (int64, error)
	DeleteExpiredXComIndex(ctx context.Context) error
	DeleteImportError(ctx context.Context, arg DeleteImportErrorParams) error
	// The implicit default pool is never deletable (Airflow parity): the guard is in
	// the query so a direct call cannot orphan the fallback pool the gate resolves to.
	DeletePool(ctx context.Context, arg DeletePoolParams) (int64, error)
	// Remove every role grant for a user: the delete half of the IdP-authoritative
	// reconcile that sets the grants to exactly the group-mapped set on each login.
	DeleteUserRoles(ctx context.Context, userID pgtype.UUID) error
	DeleteVariable(ctx context.Context, arg DeleteVariableParams) (int64, error)
	// Removes the XCom index rows of task instances a clear is resetting (#1131) and
	// returns their backend keys, so the stored values can be deleted too. XCom
	// carries no try number, so rows left behind would serve the cleared attempt's
	// values to the next attempt's downstream.
	DeleteXComIndexForTasks(ctx context.Context, arg DeleteXComIndexForTasksParams) ([]string, error)
	// The consecutive dispatch-failure count of a task still waiting to run
	// (scheduled or queued); no row means it has moved on.
	DispatchAttemptsForActive(ctx context.Context, arg DispatchAttemptsForActiveParams) (int32, error)
	// The subset of the given conn_ids that exist for the tenant. Used to reject a
	// DAG that declares an unknown connection at registration (ADR 0055 D6); a name
	// absent from the result does not exist.
	ExistingConnectionIDs(ctx context.Context, arg ExistingConnectionIDsParams) ([]string, error)
	// The subset of the given keys that exist for the tenant. Used to reject a DAG
	// that declares an unknown Variable at registration (ADR 0055 D6); a name absent
	// from the result does not exist.
	ExistingVariableKeys(ctx context.Context, arg ExistingVariableKeysParams) ([]string, error)
	// The dispatch-attempt budget is spent (ADR 0031 Amendment A): fail the task with
	// a dispatch_failed reason so the run can finalize instead of looping forever.
	// error_message carries the underlying cause. Guarded to 'scheduled' for the same
	// reason as RecordDispatchFailure. This is distinct from dispatch_lost (a TI that
	// reached 'queued' then vanished) and from a task's own 'failed' (the code ran).
	FailDispatchExhausted(ctx context.Context, arg FailDispatchExhaustedParams) error
	// A dispatch the executor refused (ADR 0066 section 3: the task is larger than
	// its size, or above executor.unit.max_size) fails the task for good. The
	// verdict is permanent, so no retry can change it: the retry budget is spent by
	// lowering max_tries to the current try, which makes the planner's
	// try_number < max_tries check false without counting a try that never ran. A
	// clear restores the budget from the task as usual (#1131), so an operator who
	// fixes the DAG or the unit can run it again. Guarded to the dispatch states:
	// the sync path refuses a scheduled task, the buffered path a scheduled or
	// queued one, and a row that moved on is left alone.
	FailDispatchRefused(ctx context.Context, arg FailDispatchRefusedParams) error
	// Settle a task instance failed from the pod reconciler, guarded by id,
	// try_number and attempt_epoch (ADR 0052, ADR 0051 amendment): try_number bumps
	// IN PLACE on retry (same row id), and an infra re-place or reschedule keeps the
	// try but bumps the epoch, so a stale reconciler acting on a previous attempt's
	// lingering pod must not match the new attempt and clobber it. The pod's epoch
	// comes from its leoflow.io/attempt-epoch label, absent meaning 0. The
	// active-state guard prevents clobbering a terminal row.
	FailTaskInstanceIfActive(ctx context.Context, arg FailTaskInstanceIfActiveParams) error
	GetConnection(ctx context.Context, arg GetConnectionParams) (GetConnectionRow, error)
	GetCurrentDagSpec(ctx context.Context, arg GetCurrentDagSpecParams) ([]byte, error)
	GetDagByDagID(ctx context.Context, arg GetDagByDagIDParams) (Dag, error)
	GetDagRun(ctx context.Context, arg GetDagRunParams) (DagRun, error)
	GetDagRunByID(ctx context.Context, id pgtype.UUID) (DagRun, error)
	// The run plus the LABEL of the version it is pinned to. The API needs the label
	// to populate bundle_version, which is what makes the UI's clear dialog render
	// its "Run with latest bundle version" control: the SPA shows that control only
	// when the run's bundle_version differs from the DAG's, and hides it when either
	// is null. A null there means the operator has no way to ask for the current
	// version, whatever the API supports.
	//
	// LEFT JOIN is defensive, not load-bearing today: dag_runs.dag_version_id is NOT
	// NULL with a plain FK, so the version row cannot disappear under a live run. It
	// is written this way so that a future ON DELETE SET NULL degrades to a null
	// label instead of dropping the run from the UI.
	GetDagRunWithVersion(ctx context.Context, arg GetDagRunWithVersionParams) (GetDagRunWithVersionRow, error)
	GetDagVersionByHash(ctx context.Context, arg GetDagVersionByHashParams) (DagVersion, error)
	GetDagVersionByID(ctx context.Context, id pgtype.UUID) (DagVersion, error)
	// See ListDagsWithVersion.
	GetDagWithVersion(ctx context.Context, arg GetDagWithVersionParams) (GetDagWithVersionRow, error)
	GetDefaultTenant(ctx context.Context) (GetDefaultTenantRow, error)
	GetPool(ctx context.Context, arg GetPoolParams) (GetPoolRow, error)
	GetRoleByName(ctx context.Context, arg GetRoleByNameParams) (pgtype.UUID, error)
	// Resolve a role name to its id within the user's OWN tenant, so an OIDC login
	// can reconcile the user's grants to the group-mapped set without the caller
	// passing the tenant separately. A name that is not a role in that tenant yields
	// no row, which the reconcile turns into a fail-closed error.
	GetRoleIDForUserTenant(ctx context.Context, arg GetRoleIDForUserTenantParams) (pgtype.UUID, error)
	GetTenantByName(ctx context.Context, name string) (GetTenantByNameRow, error)
	GetTenantLimits(ctx context.Context, id pgtype.UUID) (GetTenantLimitsRow, error)
	GetUserByEmail(ctx context.Context, arg GetUserByEmailParams) (GetUserByEmailRow, error)
	// The by-id lookup backing the per-request authz reload. Returns the tenant
	// name (not the uuid) so the reconstructed principal matches the login path's
	// User.TenantID, plus the active flag the authenticator gates on.
	GetUserByID(ctx context.Context, id pgtype.UUID) (GetUserByIDRow, error)
	// Resolve an OIDC identity to a Dexaflow user by its immutable (provider,
	// subject) pair (the trusted link key). Returns the tenant name (not the uuid)
	// so the reconstructed principal matches the login path's User.TenantID, plus
	// the active flag the login gates on. Never selects password_hash.
	GetUserByOIDCSubject(ctx context.Context, arg GetUserByOIDCSubjectParams) (GetUserByOIDCSubjectRow, error)
	GetUserPermissions(ctx context.Context, userID pgtype.UUID) ([]GetUserPermissionsRow, error)
	// The per-request authz reload in ONE round trip: what GetUserByID,
	// GetUserRoles and GetUserPermissions return, folded into a single statement.
	// Permissions are a JSON array of distinct [action, resource] pairs.
	GetUserPrincipalByID(ctx context.Context, id pgtype.UUID) (GetUserPrincipalByIDRow, error)
	GetUserRoles(ctx context.Context, userID pgtype.UUID) ([]string, error)
	GetVariable(ctx context.Context, arg GetVariableParams) (GetVariableRow, error)
	GetXComByNames(ctx context.Context, arg GetXComByNamesParams) (GetXComByNamesRow, error)
	GetXComEntry(ctx context.Context, arg GetXComEntryParams) (GetXComEntryRow, error)
	InsertDagVersion(ctx context.Context, arg InsertDagVersionParams) (DagVersion, error)
	// The implicit default pool every tenant needs (migration 023 seeds it for
	// "default"), copied from default's so the slot count stays in step.
	InsertDefaultPool(ctx context.Context, tenantID pgtype.UUID) error
	// Just-in-time provisioning insert for a first OIDC login: an OIDC-only user
	// (NULL password) linked by (oidc_provider, oidc_subject). The unique
	// (oidc_provider, oidc_subject) constraint makes a concurrent double-provision
	// surface as a conflict rather than a duplicate identity.
	InsertOIDCUser(ctx context.Context, arg InsertOIDCUserParams) (InsertOIDCUserRow, error)
	// Service API (#1283): create a tenant by name, or do nothing when it exists.
	// Zero rows affected means it already existed.
	InsertTenantIfMissing(ctx context.Context, arg InsertTenantIfMissingParams) (int64, error)
	// Mirrors the bootstrap CreateUser insert (tenant_id, email, password_hash) but
	// returns the columns the admin create-user API echoes back to the caller.
	InsertUser(ctx context.Context, arg InsertUserParams) (InsertUserRow, error)
	// Reports whether the attempt (dag_run_id, task_id, try_number) is still live:
	// present and in an active (non-terminal) state. This is exactly the predicate
	// RecordTaskHeartbeat stamps on — the same (dag_run_id, task_id, try_number)
	// tuple and the same state IN ('queued', 'running') guard — but as a pure READ
	// with no write. It is the read-only revocation signal the secret path consults
	// (ADR 0055): a terminal or superseded attempt (try_number moved on) is not
	// live, so a token that carries it stops resolving secrets, even while its
	// signature is still valid.
	//
	// It MUST derive ONLY from (run, task, try) + active state. It must NEVER gain a
	// "run is not current / archived / logical_date in the past" clause: a recency
	// term would deny a legitimate clear-and-rerun of an old run — credential
	// lifetime binds to the attempt, never to the run's age or logical date.
	//
	// The epoch term is the heartbeat's: exact for a token carrying attempt_epoch,
	// absent for a claim-less one (ADR 0051 amendment).
	IsTaskInstanceLive(ctx context.Context, arg IsTaskInstanceLiveParams) (bool, error)
	LatestRunsForDags(ctx context.Context, arg LatestRunsForDagsParams) ([]LatestRunsForDagsRow, error)
	ListActiveDagRuns(ctx context.Context) ([]DagRun, error)
	// run_id is the dag_run's UUID (StagingClaimName uses it), so join on dag_runs.id,
	// which is globally unique. run_state is NULL only when the run row is truly gone.
	// The join compares uuids so it probes dag_runs_pkey; casting dag_runs.id to text
	// instead read every run. run_id is TEXT and older rows may hold something else,
	// so the CASE casts only the canonical lower case form, the one id::text produces,
	// and leaves anything else unmatched rather than failing the cast.
	ListActiveStagingVolumes(ctx context.Context) ([]ListActiveStagingVolumesRow, error)
	// Lists running TIs that have heartbeated at least once and whose latest
	// heartbeat is non-null, alongside enough identity to log + observe.
	// The "non-null" filter is the safety guarantee: a TI that never heartbeated
	// is either inline (no agent ever exists) or fresh — out of scope for this
	// reaper. The LIMIT bounds a single tick's reap work even after a large
	// outage; the rest are picked up on the next tick.
	ListAgentLostCandidates(ctx context.Context) ([]ListAgentLostCandidatesRow, error)
	ListAuditLogs(ctx context.Context, arg ListAuditLogsParams) ([]ListAuditLogsRow, error)
	// Keyset form of ListAuditLogs: the entries strictly before the cursor
	// (occurred_at, id) in the same order, so a deep page costs the same as the
	// first.
	ListAuditLogsAfter(ctx context.Context, arg ListAuditLogsAfterParams) ([]ListAuditLogsAfterRow, error)
	// Lists the DISTINCT warm-worker pod names currently serving an active attempt
	// (ADR 0058 N1d-b): a warm worker is BUSY iff some task_instance in an active
	// state (`queued` or `running`) is durably bound to it (warm_worker_id = the
	// pod's own name — the binding landed in N1d-a1/a2). The busy-aware warm-pool
	// reconciler reads this once per tick to classify each live warm pod as busy
	// (serving an attempt) or idle, so scale-down and drain delete only IDLE workers
	// and never kill an in-flight attempt (review findings M1/M2).
	//
	// The `queued` state MUST be in the busy set, not just `running`: BindWarmAttempt
	// stamps warm_worker_id the instant a warm worker ACKs an assignment as started,
	// while the TI is still `queued`, and the child only reports RUNNING
	// (queued->running) a moment later. Between the ack and that report the worker is
	// actively STARTING the attempt; counting only `running` would classify it IDLE
	// in that window and let the excess-idle-tail delete remove a worker that is
	// starting an attempt — an M1 violation that kills a just-started attempt. The
	// BindWarmAttempt guard binds exactly the queued/running window, and every
	// re-dispatch/reset that moves a bound row back out of that window clears
	// warm_worker_id, so a queued+bound row here is always a live starting attempt,
	// never a stale binding.
	//
	// With warm pools off no TI is ever bound, so this is always empty and every
	// worker classifies as idle — byte-for-byte today's dedicated pod-per-task
	// behavior.
	ListBusyWarmWorkerPods(ctx context.Context) ([]*string, error)
	// All of a tenant's connections WITH the encrypted password, for delivering
	// credentials to task pods (ADR 0021). Never use this for UI/API responses,
	// which must mask the password.
	ListConnectionSecrets(ctx context.Context, tenantID pgtype.UUID) ([]ListConnectionSecretsRow, error)
	// The tenant's connections WITH the encrypted password, restricted to the given
	// conn_ids and filtered in the query (ADR 0055 D1: scope in the SQL, never
	// post-filter the decrypted whole vault). Never use this for UI/API responses,
	// which must mask the password. Used under secret_scoping: enforce so a task
	// receives only the connections it declared. An empty conn_id set never reaches
	// here — the handler returns nothing without a query.
	ListConnectionSecretsScoped(ctx context.Context, arg ListConnectionSecretsScopedParams) ([]ListConnectionSecretsScopedRow, error)
	ListConnections(ctx context.Context, arg ListConnectionsParams) ([]ListConnectionsRow, error)
	ListDagRunsByDag(ctx context.Context, arg ListDagRunsByDagParams) ([]DagRun, error)
	// Keyset form of ListDagRunsByDagWithVersion: the runs strictly before the
	// cursor (logical_date, run_id) in the same order, so a deep page costs the
	// same as the first. run_id is unique per DAG, so it makes the order total. An
	// empty states array keeps every state.
	ListDagRunsByDagAfter(ctx context.Context, arg ListDagRunsByDagAfterParams) ([]ListDagRunsByDagAfterRow, error)
	// See GetDagRunWithVersion. One join rather than a lookup per row.
	ListDagRunsByDagWithVersion(ctx context.Context, arg ListDagRunsByDagWithVersionParams) ([]ListDagRunsByDagWithVersionRow, error)
	ListDagVersions(ctx context.Context, arg ListDagVersionsParams) ([]ListDagVersionsRow, error)
	ListDags(ctx context.Context, arg ListDagsParams) ([]Dag, error)
	// The newest run is looked up per listed DAG through idx_dag_runs_dag_logical,
	// one index probe each, instead of a DISTINCT ON over every run in the table.
	// LEFT JOIN keeps DAGs without runs; they match no run_state filter.
	ListDagsFiltered(ctx context.Context, arg ListDagsFilteredParams) ([]Dag, error)
	// The DAG plus the LABEL of its current version. The UI's clear dialog compares
	// this against the RUN's bundle_version and offers "Run with latest bundle
	// version" only when they differ, so leaving it null either hides the control or
	// shows it unconditionally — neither of which tells the operator the truth.
	ListDagsWithVersion(ctx context.Context, arg ListDagsWithVersionParams) ([]ListDagsWithVersionRow, error)
	// Every connection's ciphertext, across every tenant, for the key-rotation
	// pass. The id is returned because the rewrite targets a row, not a
	// (tenant, conn_id) pair, and nothing here decrypts: the caller holds the keys.
	ListEncryptedConnectionSecrets(ctx context.Context) ([]ListEncryptedConnectionSecretsRow, error)
	ListFavoriteDagIDs(ctx context.Context, arg ListFavoriteDagIDsParams) ([]string, error)
	ListImportErrors(ctx context.Context, tenant string) ([]ListImportErrorsRow, error)
	// Lists dag_runs currently in 'running' whose task instances are ALL terminal
	// or never-started (every TI in none/success/failed/skipped/upstream_failed),
	// alongside the timestamp of their most recent observable activity. The "no
	// live TI" filter is the critical safety guarantee: a run that is still
	// progressing stays out of the candidate set, so the reaper can never kill a
	// live execution. Live means any state outside that settled set, which covers
	// a legitimately-active task (scheduled/queued/running: slow image pull,
	// long-running job) AND a task parked for the scheduler to bring back
	// (up_for_retry during its retry_delay, up_for_reschedule between sensor pokes,
	// the reserved deferred state). Parked states stamp no fresh timestamp on entry,
	// so last_activity cannot protect them: a retry_delay or poke_interval longer
	// than the reaper threshold would otherwise fail a healthy run. Listing the
	// settled states (rather than the live ones) keeps any future non-terminal
	// state on the safe side by default. `none` stays reapable: a never-started TI
	// whose upstreams are all settled is decided on the next scheduler tick, and one
	// whose upstream is still pending already has a live sibling keeping the run
	// out. A TI released back to `none` for another attempt (the retry release,
	// the reschedule re-dispatch, the infra re-place, an operator clear) has its
	// per-attempt timestamps cleared and only becomes `scheduled` on the next
	// tick, so each release stamps released_at and last_activity counts it: the
	// release itself is activity, and a run is never reaped in the tick between a
	// release and none -> scheduled. An infra-failed TI parked in its re-place backoff is `failed` and is covered by
	// the threshold itself, which sits above that backoff. The shape this catches
	// is the post-crash one: TIs settled (success/failed/skipped/upstream_failed)
	// but FinalizeRun did not transition the dag_run, e.g. the server died between
	// the last TI report and the next scheduler tick. The LIMIT bounds a single
	// tick's reap work even after a multi-hour outage; the rest are picked up on
	// the next tick (the reaper is a backstop, not a sprint). The list is only a
	// snapshot: MarkRunOrphanedRun re-checks the same predicate atomically, so keep
	// the two in step.
	ListOrphanCandidates(ctx context.Context) ([]ListOrphanCandidatesRow, error)
	ListPools(ctx context.Context, arg ListPoolsParams) ([]ListPoolsRow, error)
	// Provisional infra marks for the reconciler's confirmation pass (ADR 0052
	// amendment, part 2), oldest first. The LIMIT bounds one sweep's work; the
	// rest are picked up next sweep. Only queued or running runs: the planner reads
	// no other run, and the valve is shorter than the orphan threshold, so a mark
	// of a finished run gates nothing. The join keeps this per-sweep query on
	// idx_dag_runs_state and idx_ti_run instead of a scan of every failed task
	// instance, and keeps old unconfirmed marks (a rollback window, marks written
	// by a previous release) from filling the LIMIT ahead of live ones.
	ListProvisionalInfraFailures(ctx context.Context) ([]ListProvisionalInfraFailuresRow, error)
	// Lists every TI currently in `running` alongside the timestamp it entered
	// running, for the pod-lost reaper (#527). A running TI whose backing pod
	// vanished before its first heartbeat is invisible to the agent-lost reaper
	// (its null-heartbeat zero-guard) and to the reconciler (which only sees pods
	// that still exist), so it would sit `running` until the 5-minute orphan reaper.
	// Warm-pool attempts (warm_worker_id set) are excluded: they run in a shared
	// warm pod with no per-task labels, so the reaper's presence check would always
	// read them as lost; the warm-worker-lost reaper owns them. The grace period is
	// applied here, before the LIMIT, so attempts still inside it never take the
	// slots of those past it; a NULL started_at is never listed (too poorly observed
	// to reap). The reaper re-checks grace and pod liveness per candidate in Go.
	// heartbeated lets Lite (no pods) judge a TI whose agent died before its first
	// heartbeat, which the agent-lost query never lists (#916). The
	// LIMIT bounds a single tick's reap work even after a large outage; the rest
	// are picked up next tick.
	ListRunningTasks(ctx context.Context, graceSeconds float64) ([]ListRunningTasksRow, error)
	// Returns each cron-scheduled DAG with the bits the scheduler needs to decide
	// both "is there a slot due?" (schedule + last_logical), "how many slots
	// should I backfill on this tick?" (catchup + start_date, see #129), and
	// "may this DAG take another active run?" (max_active_runs, see #200). The
	// owning tenant is returned because a dag_id is unique only within its tenant
	// (#209).
	ListScheduledDags(ctx context.Context) ([]ListScheduledDagsRow, error)
	// Of the given (tenant, run) pairs, the settled runs: run in success or failed
	// and no task instance outside success, failed, skipped and upstream_failed.
	// This is the same "settled" the retention janitor's LockExpiredSettledRuns
	// uses (duplicated there on purpose, keep the two identical). A run marked
	// failed while a task still runs is not settled, so the reconciler never
	// collects a pod whose outcome it may not have recorded yet. The pairs come
	// from the pods' tenant and run labels; a pair whose tenant does not own the
	// run matches nothing.
	ListSettledRunIDs(ctx context.Context, arg ListSettledRunIDsParams) ([]ListSettledRunIDsRow, error)
	// Lists every TI currently in `queued` alongside its queued_at timestamp for
	// the dispatch-lost reaper (#202). The reaper applies the threshold per
	// candidate so the SQL stays simple and the decision is purely in Go. The
	// LIMIT bounds a tick's reap work after a long outage; the rest are picked
	// up next tick (backstop, not sprint).
	// warm_worker_id rides along (ADR 0058 N1d-a2, review finding H3): a queued warm
	// attempt whose serving warm worker is still alive is just slow to transition
	// queued->running, so the dispatch-lost reaper must DEFER it rather than fail it
	// (the double-run bug). It is NULL for a dedicated attempt and for a warm attempt
	// not yet acked, in which case the reaper falls back to its existing pod-liveness
	// gate unchanged.
	// attempt_epoch rides along (ADR 0051 amendment) so the mark and the pod
	// teardown name exactly the attempt that was listed.
	ListStaleQueuedTaskInstances(ctx context.Context) ([]ListStaleQueuedTaskInstancesRow, error)
	// Returns every attempt for (run, task), oldest first. UNIONs the current
	// task_instances row with all archived task_instance_history rows so the UI's
	// /tries endpoint can render one navigable tab per attempt (Lima bug #241).
	// One entry per try (ADR 0051 amendment, #863): an infra re-place archives the
	// try and keeps it on the current row, so a history row for the current try is
	// left out and the current row, the try's latest execution, stands for it.
	// Each row carries the per-attempt fields PLUS the run-constant fields
	// (operator, max_tries, map_index) copied from the current TI; archived rows
	// get them via the JOIN.
	ListTaskInstanceAttempts(ctx context.Context, arg ListTaskInstanceAttemptsParams) ([]ListTaskInstanceAttemptsRow, error)
	ListTaskInstancesByRun(ctx context.Context, dagRunID pgtype.UUID) ([]TaskInstance, error)
	// The batched form of ListTaskInstancesByRun for the scheduler tick: every
	// active run's task instances in one round trip instead of one per run. Rows
	// come grouped by run and, within a run, in the same task_id order the per-run
	// query returns, so the caller can split them without re-sorting.
	ListTaskInstancesByRuns(ctx context.Context, dagRunIds []pgtype.UUID) ([]TaskInstance, error)
	// "role:action:resource" for every grant of a tenant's built-in roles.
	ListTenantRolePermissions(ctx context.Context, name string) ([]string, error)
	// One row per user in the tenant, newest first, with every granted role name
	// aggregated into a text array (empty when the user holds none). Paged by the
	// caller. Never selects password_hash — the list must not expose secrets.
	ListUsers(ctx context.Context, arg ListUsersParams) ([]ListUsersRow, error)
	ListVariables(ctx context.Context, arg ListVariablesParams) ([]ListVariablesRow, error)
	// The tenant's variables restricted to the given keys, filtered in the query
	// (ADR 0055 D1: scope in the SQL, never post-filter the decrypted whole vault in
	// the handler). Used under secret_scoping: enforce so a task receives only the
	// Variables it declared. An empty key set never reaches here — the handler
	// returns nothing without a query.
	ListVariablesScoped(ctx context.Context, arg ListVariablesScopedParams) ([]ListVariablesScopedRow, error)
	// Lists every `running` TI that is durably bound to a warm worker (ADR 0058
	// N1d-a2): warm_worker_id names the warm pod that acked and is serving this
	// attempt. The failover reaper matches that name against the live warm-pod set;
	// a bound TI whose worker is no longer live has lost its serving pod and is
	// routed to infra via MarkTaskPodLost (fan-out: every attempt a dead worker
	// held is marked). Only `running` rows carry a live attempt, and the
	// IS NOT NULL filter keeps dedicated (non-warm) tasks out of this reaper
	// entirely — with warm pools off no TI is ever bound, so this returns empty and
	// the reaper is inert. The LIMIT bounds a single tick's work after a large
	// outage; the rest are picked up next tick.
	ListWarmBoundRunningTIs(ctx context.Context) ([]ListWarmBoundRunningTIsRow, error)
	ListXComEntries(ctx context.Context, arg ListXComEntriesParams) ([]ListXComEntriesRow, error)
	// Share-locks every task instance of a run inside the reap transaction, before
	// MarkRunOrphanedRun re-checks the orphan predicate, so the re-check (a fresh
	// snapshot under READ COMMITTED) sees committed state and no TI of the run can
	// change until the reap commits or rolls back. NOWAIT: a TI another transaction
	// is writing right now is activity, so the reap gives up (lock_not_available,
	// treated as a no-op by ReapRun) instead of waiting. Waiting would let these
	// share locks, taken in scan order, form a cycle with a writer that locks
	// several TIs of the run in another order (a multi-task clear, a batched
	// scheduler transition); a reap that never waits on a TI cannot be in one.
	LockRunTaskInstancesForReap(ctx context.Context, dagRunID pgtype.UUID) error
	// Stamp a run's on-failure alert as DELIVERED. Called only after a successful
	// send, which is the whole point of the split: alerted_at now answers "did the
	// page get through", not "did we try".
	//
	// Guarded on the attempt it is reporting for. The send runs in a goroutine
	// detached from the tick, so an operator clear can land between the claim and the
	// stamp: the clear resets alert_attempts to 0 and starts a NEW failure episode,
	// and an unguarded stamp from the old in-flight send would mark that new episode
	// delivered without ever paging it. Requiring the attempt to still match means a
	// stamp from a superseded episode simply matches no row. Same shape as the guard
	// on ReportTaskResult: a late writer must never clobber newer state.
	MarkRunAlertDelivered(ctx context.Context, arg MarkRunAlertDeliveredParams) error
	// Fails an orphaned dag run, but only if it is STILL orphaned: the same
	// predicate ListOrphanCandidates applies (running, no live TI, last activity at
	// or before the reaper's cutoff) is re-checked in this statement, because the
	// list is a snapshot and a TI may have moved (failed -> up_for_retry, none ->
	// scheduled) or fresh activity may have landed since. Keep the two in step. The
	// `state = 'running'` guard also makes the reap a safety net, never a takeover:
	// a competing finalizer (the normal scheduler path) cannot be overwritten.
	// Zero rows means the run is no longer an orphan and nothing may be touched.
	// Idempotent: a second call on a run already failed updates zero rows.
	MarkRunOrphanedRun(ctx context.Context, arg MarkRunOrphanedRunParams) (int64, error)
	// Fails any still-active task instance under an orphaned run. Called together
	// with MarkRunOrphanedRun inside a single transaction (the repository owns the
	// atomicity); split because sqlc cannot generate a CTE+UPDATE that reuses one
	// parameter across an UPDATE-inside-WITH and the outer UPDATE.
	MarkRunOrphanedTaskInstances(ctx context.Context, dagRunID pgtype.UUID) error
	MarkStagingDeleted(ctx context.Context, arg MarkStagingDeletedParams) error
	// Fails a TI whose agent went silent. The WHERE state='running' guard
	// prevents overwriting a TI the agent's last terminal report finally
	// delivered between our list and our write (defense in depth — a late
	// report wins over the reaper). Idempotent on a second call. Pinned to the
	// listed attempt, (try_number, attempt_epoch) (ADR 0051 amendment), so a mark
	// computed for a superseded attempt never fails its replacement.
	MarkTaskAgentLost(ctx context.Context, arg MarkTaskAgentLostParams) (int64, error)
	// Fails a TI whose agent went silent after the attempt outlived
	// auth.max_attempt_credential_lifetime (#1461). Renewal stops at the ceiling,
	// so the silence is the credential lapsing, not a lost agent: this is a TASK
	// failure (last_failure_kind NULL, the retry policy applies), never an infra
	// mark the planner would re-place with a fresh credential. Same guards as
	// MarkTaskAgentLost: state='running' (a late report wins) and the listed
	// attempt, (try_number, attempt_epoch) (ADR 0051 amendment).
	MarkTaskCredentialCeiling(ctx context.Context, arg MarkTaskCredentialCeilingParams) (int64, error)
	// Fails a TI whose asynchronous dispatch (BufferedDispatcher worker) errored
	// inside the inner dispatcher. Targets the active row by (dag_run_id,
	// task_id) and the active states (scheduled/queued) — a TI that already
	// moved to running/terminal between the worker accepting the request and
	// the dispatch failing is left alone (defense in depth).
	MarkTaskDispatchFailed(ctx context.Context, arg MarkTaskDispatchFailedParams) error
	// Fails one queued TI with a dispatch_lost error. The WHERE state='queued'
	// guard makes the operation idempotent: a second call on a TI that has
	// since transitioned (real dispatch landed, or already failed) is a no-op,
	// never overwriting a more meaningful state. It is also pinned to the listed
	// attempt, (try_number, attempt_epoch) (ADR 0051 amendment): a row that was
	// re-placed and re-dispatched between the list and this write is a different
	// attempt, and a mark computed for the old one must not fail it.
	MarkTaskDispatchLost(ctx context.Context, arg MarkTaskDispatchLostParams) (int64, error)
	// The scheduler's scheduled -> queued write after a dispatch was accepted.
	// Guarded to the exact slot the tick planned: still 'scheduled', with the
	// next_dispatch_at the tick read. Under buffered dispatch the worker can finish
	// before this write lands: it may have failed the task (MarkTaskDispatchFailed),
	// re-offered it with a new backoff (RequeueDispatch), or the agent may already
	// have reported running. Each of those moves the row off the planned slot, so
	// this write touches zero rows instead of overwriting the newer outcome.
	MarkTaskInstanceQueued(ctx context.Context, arg MarkTaskInstanceQueuedParams) (int64, error)
	// Fails a running TI whose pod has vanished (deleted/evicted/node lost). The
	// WHERE state='running' guard makes it idempotent and prevents overwriting a
	// late terminal report that landed between our list and our write (a live
	// report wins over the reaper). Idempotent on a second call. Pinned to the
	// listed attempt, (try_number, attempt_epoch) (ADR 0051 amendment), so a mark
	// computed for a superseded attempt never fails its replacement.
	MarkTaskPodLost(ctx context.Context, arg MarkTaskPodLostParams) (int64, error)
	// Every named pool's slot cap across all tenants, for the scheduler's per-tick
	// cross-DAG admission budget (ADR 0053 Stage 3). Keyed by (tenant_id, name) so a
	// pool name is scoped to its tenant. Pro-only: Lite never calls this.
	PoolBudgets(ctx context.Context) ([]PoolBudgetsRow, error)
	// Per-pool occupancy for a tenant: how many of the tenant's task instances sit in
	// each non-terminal state, grouped by the instance's pool (a NULL pool is the
	// implicit default_pool). Feeds the Airflow PoolResponse occupancy fields; the
	// gate itself counts queued+running as the occupied slots.
	PoolSlotUsage(ctx context.Context, tenantID pgtype.UUID) ([]PoolSlotUsageRow, error)
	// A pod CREATE was refused by cluster backpressure — a ResourceQuota 403 or an
	// API Priority & Fairness 429 (ADR 0053). Back off the next attempt to $3 WITHOUT
	// touching dispatch_attempts: backpressure is a temporary "no room," retriable
	// forever, and must never accumulate toward the dispatch_failed budget the way a
	// permanent failure does (RecordDispatchFailure). The planner gates
	// scheduled->queued on next_dispatch_at alone, so setting it holds and re-offers
	// the task without a counter bump. Guarded to 'scheduled' for the same reason as
	// RecordDispatchFailure; try_number is untouched — this is infra, not a task
	// failure.
	RecordDispatchBackpressure(ctx context.Context, arg RecordDispatchBackpressureParams) error
	// A synchronous dispatch attempt failed (ADR 0031 Amendment A). Increment the
	// consecutive-failure counter and back off the next attempt to $3, so the planner
	// (which gates scheduled->queued on next_dispatch_at) does not re-attempt every
	// tick. Guarded to 'scheduled' so a report that raced the dispatch cannot clobber
	// a row that has since progressed. try_number is untouched: this is infra, not a
	// task failure.
	// last_heartbeat_at is cleared and attempt_epoch bumped for the reasons given on
	// ResetTaskInstanceToNone.
	RecordDispatchFailure(ctx context.Context, arg RecordDispatchFailureParams) error
	RecordStagingVolume(ctx context.Context, arg RecordStagingVolumeParams) error
	// Stamps last_heartbeat_at on the active TI of an attempt. Bounded by the
	// (dag_run_id, task_id, try_number) tuple to match the agent's identity. The
	// state IN guard avoids stamping a heartbeat on a TI the scheduler already
	// transitioned to terminal between the agent's last heartbeat and now — a
	// terminal TI must stay terminal even if a late heartbeat arrives.
	//
	// Returns the affected row count. Zero means the heartbeating agent's attempt
	// no longer matches the live row — its try_number is behind, or a reaper
	// already settled the row terminal — the same "moved on" predicate the state
	// report is guarded by (#467). The agent RPC turns a zero here into a
	// should_terminate signal so a reaped-but-alive pod stops itself (#474).
	//
	// A token carrying attempt_epoch must match it exactly (ADR 0051 amendment). A
	// claim-less token matches on try_number alone: it is either a pre-upgrade
	// token or one an old replica re-minted during a rolling upgrade, which drops
	// the claim it does not know. Fencing its heartbeat would kill a live attempt
	// for a missing claim; its reports are still fenced as epoch 0.
	RecordTaskHeartbeat(ctx context.Context, arg RecordTaskHeartbeatParams) (int64, error)
	RecordXCom(ctx context.Context, arg RecordXComParams) error
	// Re-dispatch a task parked in up_for_reschedule once its reschedule_at has passed:
	// back to 'none' with the per-attempt timestamps cleared (so the next dispatch
	// stamps fresh — queued_at MUST be NULL or the dispatch-lost reaper re-flags it)
	// and reschedule_at cleared. Unlike ResetTaskInstanceToNone (retry), try_number is
	// PRESERVED and no task_instance_history row is archived: reschedule is not a retry,
	// it consumes no attempt (#380). Guarded to the parked state so it is idempotent.
	// last_heartbeat_at is cleared and attempt_epoch bumped for the reasons given on
	// ResetTaskInstanceToNone.
	RedispatchRescheduledTaskInstance(ctx context.Context, arg RedispatchRescheduledTaskInstanceParams) error
	RemoveFavorite(ctx context.Context, arg RemoveFavoriteParams) error
	// The same re-open as ResetDagRunToVersion, WITHOUT touching dag_version_id: the
	// run stays pinned to the version it was created with, so the re-run executes the
	// image that produced the original attempt.
	//
	// Two separate decisions used to be one. Re-opening a run (state, timestamps,
	// alert bookkeeping) is what `reset_dag_runs` means; WHICH version the re-run
	// executes is what Airflow calls `run_on_latest_version`. Folding the second into
	// the first left no way to re-run last week's task as it was last week, and left
	// `reset_dag_runs=false` meaning "do not re-open either", which strands the
	// cleared task instance in a terminal run the scheduler never looks at again.
	//
	// Alert bookkeeping is cleared here for the same reason it is there: the clear
	// starts a new failure episode, so a genuine re-failure re-pages, and a spent
	// retry budget is not carried into an episode that has not been attempted.
	ReopenDagRunKeepingVersion(ctx context.Context, id pgtype.UUID) error
	// $3 is cast to task_state in every usage: without the cast Postgres deduces an
	// enum type from `state = $3` but text from the literal comparisons below and
	// rejects the parameter as having inconsistent types (SQLSTATE 42P08). The pod
	// agent path is the first to exercise this query end-to-end.
	//
	// Guarded on both the source state and the attempt, matching the other three
	// writes to this table (FailTaskInstanceIfActive, RescheduleTaskInstance,
	// RecordHeartbeat). Two writers touch task_instances — the scheduler tick and
	// this report — so an unguarded UPDATE lets a report that arrives late land
	// wherever the row happens to be:
	//   * after a reaper settled the row, it resurrects a terminal state (a run
	//     reports success on work the system already abandoned, and downstream
	//     tasks fire on it);
	//   * after a retry, it lands on the next attempt, because ResetTaskInstanceToNone
	//     bumps try_number in place rather than inserting a new row.
	// The agent token already carries the try_number it was dispatched with, so the
	// value that tells the attempts apart is present at the call site.
	//
	// try_number alone is not enough: an infra re-place, a reschedule poke and a
	// repeated dispatch reuse it. attempt_epoch (ADR 0051 amendment) is the
	// execution within the try. A token minted without the claim is read as epoch
	// 0: it matches its own pre-upgrade attempt (rows migrate at 0) and never an
	// attempt dispatched after the upgrade (the dispatch claim makes those >= 1).
	// That keeps a superseded agent's RUNNING report off its replacement (#911).
	// Returns the affected row count so the caller can tell a real write from a
	// rejected late report instead of dropping it silently.
	//
	// The state set is deliberately wider than the siblings' ('scheduled','queued',
	// 'running'): it also admits 'none'. Those writes are driven by the scheduler,
	// which only touches rows it has already advanced; this one is driven by the
	// agent, which starts reporting earlier. launchQueued dispatches the pod BEFORE
	// recording `queued`, so between those two statements a fast-starting task —
	// routine under the Lite subprocess executor — legitimately reports `running`
	// while the row is still `none`. Excluding it would reject a correct report,
	// trading a rare silent corruption for a frequent one. The settled states
	// (success/failed/skipped/upstream_failed) are what this guard is for.
	ReportTaskResult(ctx context.Context, arg ReportTaskResultParams) (int64, error)
	// A buffered dispatch failed inside the worker for a retriable reason: re-offer
	// the task the way a synchronous failure is re-offered (RecordDispatchFailure,
	// RecordDispatchBackpressure). Back to 'scheduled' with the next attempt held
	// until next_dispatch_at, adding one dispatch attempt only when counted
	// (backpressure is not). Guarded to scheduled/queued, so a task the agent has
	// since reported on is left alone. warm_worker_id is cleared as in
	// RequeueForRedispatch: the attempt never ran. last_heartbeat_at is cleared
	// as on every rail that starts a new execution of the row (ADR 0051
	// amendment, A0). The requeue is a rail, so attempt_epoch is bumped: a late
	// start or report from the abandoned dispatch is fenced (ADR 0051, A1).
	// queued_at is cleared too, so the next queued episode stamps a fresh one:
	// MarkTaskInstanceQueued only stamps a NULL queued_at, and a kept one would
	// make the dispatch-lost reaper fail the re-offered task as soon as it is
	// queued again.
	RequeueDispatch(ctx context.Context, arg RequeueDispatchParams) (int64, error)
	// Re-place a reclaimed warm assignment (ADR 0058 N1d-c, H2): a warm worker was
	// handed this attempt but demonstrably will NOT run it (its stream ended holding
	// an unacked lease, or it acked started=false), so the attempt sits `queued`
	// having never run. Move it back to `scheduled` so the planner re-admits it and
	// re-dispatches (the planner plans scheduled->queued; it never re-plans a TI
	// that is already `queued`, which is why a no-op reclaim left it stuck until the
	// 3-minute dispatch-lost reaper).
	//
	// Guarded to state='queued' and bounded by (dag_run_id, task_id, try_number,
	// attempt_epoch) to the exact attempt the assignment named, so it never disturbs a running or settled
	// TI: zero rows is the guard working, a benign no-op, never an error. It does NOT
	// bump try_number or infra_attempts: the attempt never ran, this is a re-offer of
	// the SAME attempt, and the existing dispatch_attempts/backoff on the re-dispatch
	// bounds a reclaim loop.
	//
	// warm_worker_id is CLEARED: the reclaimed worker demonstrably will not run this
	// attempt, so the SAME row must not carry its stale binding back into the next
	// queued/running window — with the busy set now spanning queued+running
	// (ListBusyWarmWorkerPods), a stale binding would falsely mark the OLD (gone)
	// worker busy. This is a same-row re-dispatch (the try_number is preserved), so
	// the clear must happen here; a fresh try lands on a new row that is already NULL.
	// last_heartbeat_at is cleared and attempt_epoch bumped for the reasons given on
	// ResetTaskInstanceToNone.
	RequeueForRedispatch(ctx context.Context, arg RequeueForRedispatchParams) (int64, error)
	// A reschedule-mode sensor (mode='reschedule') poked not-ready: park the active TI
	// in up_for_reschedule with its next-poke time ($3) so the scheduler re-dispatches
	// it once reschedule_at passes (#380), without consuming retry budget. Guarded to
	// the active states so a late report never clobbers a terminal row, and on the
	// attempt (try_number and attempt_epoch, the same rule as ReportTaskResult) so a
	// poke from a superseded attempt never parks its replacement. Returns the row
	// count; zero is a stale report. ended_at is left untouched (the task is not
	// finished); started_at is preserved.
	RescheduleTaskInstance(ctx context.Context, arg RescheduleTaskInstanceParams) (int64, error)
	// Settle a lost reschedule from the durable outcome record (ADR 0052): park the TI
	// in up_for_reschedule with the record's next-poke time, guarded by id,
	// try_number and attempt_epoch (never clobber a different attempt or a terminal
	// row), consuming no
	// retry budget. Mirrors RescheduleTaskInstance but keyed by id, for the reconciler.
	RescheduleTaskInstanceByIDIfActive(ctx context.Context, arg RescheduleTaskInstanceByIDIfActiveParams) error
	// Takes one of the tenant's runs for the current UTC day, resetting the count
	// when the day has turned. Zero rows means the tenant has no daily cap or has
	// reached it; the caller tells the two apart from the limit it read. It runs
	// before the run's INSERT in the same transaction, so a refusal writes nothing.
	// The UPDATE locks the tenant row until the transaction ends, and Postgres
	// re-checks the WHERE against the row a concurrent winner committed, so the
	// count can never pass the cap.
	ReserveTenantDailyRun(ctx context.Context, id pgtype.UUID) (int64, error)
	// Archives every failed attempt in the run into task_instance_history then
	// resets. See ResetTaskInstanceToNone for the per-attempt rationale. Returns the
	// task ids it reset, so the clear can delete exactly their XCom.
	ResetAllFailedTaskInstances(ctx context.Context, arg ResetAllFailedTaskInstancesParams) ([]string, error)
	// Clear with run_on_latest_version re-binds the run to the DAG's current
	// registered version (ADR 0020; opt-in since the 2026-09-15 amendment): a
	// re-run after a code/yaml fix picks up the newest image and config — in dev that
	// is the last hot-reload, in prod the last deploy — while everything within a
	// version stays reproducible. Clearing the alert bookkeeping (#431) makes the clear
	// a new failure episode, so a genuine re-failure re-pages while a re-tick of the
	// same failed state does not. All three columns reset together: leaving
	// alert_attempts behind would carry a spent retry budget into an episode that has
	// not been attempted, so a cleared run could exhaust its attempts without ever
	// having tried.
	ResetDagRunToVersion(ctx context.Context, arg ResetDagRunToVersionParams) error
	// Archives the current attempt into task_instance_history then resets the
	// live row. See ResetTaskInstanceToNone for the per-attempt rationale.
	ResetFailedTaskInstance(ctx context.Context, arg ResetFailedTaskInstanceParams) (int64, error)
	// The scheduler retry rail's reset: identical to ResetTaskInstanceToNone but
	// GUARDED to state='up_for_retry' on both the history snapshot and the update.
	// The planner emits up_for_retry → none, but by apply time the TI may have been
	// re-dispatched (a stale/concurrent decision); without this guard the reset
	// would yank a now-running TI back to none and bump try_number, orphaning its
	// live pod. Mirrors the source-state guard on RedispatchRescheduledTaskInstance.
	// The admin clear-task path deliberately uses the unguarded primitive above.
	ResetTaskInstanceForRetry(ctx context.Context, arg ResetTaskInstanceForRetryParams) (int64, error)
	// The scheduler infra-fault rail's reset (ADR 0051 Phase 1): re-place a task that
	// a reaper failed as infra (agent/pod/dispatch lost, last_failure_kind='infra')
	// back to 'none' WITHOUT consuming the retry budget — try_number is left
	// untouched and infra_attempts is bumped instead, mirroring how dispatch_attempts
	// counts synchronous-dispatch faults. GUARDED to state='failed' AND
	// last_failure_kind='infra' on both the history snapshot and the update: by apply
	// time a late terminal report may have moved the TI, and only a genuine infra
	// failure may re-place off-budget (an app failure at state='failed' must fall to
	// the normal retry rail). last_failure_kind is cleared so the next attempt's
	// outcome is classified fresh.
	// last_heartbeat_at is cleared and attempt_epoch bumped for the reasons given on
	// ResetTaskInstanceToNone.
	// A provisional mark (infra_confirmed_at NULL, ADR 0052 amendment) is not
	// re-placed until the reconciler confirms it or InfraConfirmMaxWait has passed
	// since ended_at (the liveness valve), so a durable SUCCESS record can still
	// settle the attempt it guessed lost. Both halves carry the guard, so a refused
	// re-place archives nothing.
	ResetTaskInstanceInfraReplace(ctx context.Context, arg ResetTaskInstanceInfraReplaceParams) (int64, error)
	// Resets a TI for retry: snapshot the current per-attempt state into
	// task_instance_history (so the UI's /tries endpoint can render one tab per
	// attempt, Lima bug #241), then state back to `none`, all per-attempt
	// timestamps cleared (including queued_at), and try_number bumped. queued_at
	// MUST be NULLed so the next TransitionTaskState(queued) stamps a fresh now()
	// — without that, the dispatch-lost reaper sees the stale pre-clear timestamp
	// and re-marks the TI dispatch_lost on every tick (Lima Bug 1).
	// This is the UNCONDITIONAL clear primitive: the admin "clear task" action
	// (ClearTaskInstances, onlyFailed=false) resets a TI to none from ANY state, so
	// it carries no source-state guard. The scheduler's retry rail uses the guarded
	// ResetTaskInstanceForRetry instead — do not add a guard here or clear-task
	// silently no-ops on non-up_for_retry tasks.
	// last_heartbeat_at is cleared on this and every other rail that starts a new
	// execution of the row (ADR 0051 amendment, A0): the next attempt reports
	// RUNNING one heartbeat interval before its first beat, and an inherited value
	// from the previous attempt would make the agent-lost reaper fail it in that
	// window.
	// The same rails bump attempt_epoch (ADR 0051 amendment, A1), so a reset alone
	// already fences the attempt it superseded before the next dispatch claims its
	// own epoch (ClaimAttemptEpoch). The archive row records the superseded
	// attempt's epoch. The archive key stays (task_instance_id, try_number) for
	// compatibility with the previous release until PR A6 widens it, so one try
	// keeps one history row: a later execution of the try (higher epoch) replaces
	// the row an earlier one archived, and the row always holds the try's latest
	// execution, which is what the tries endpoint shows (ADR 0051 amendment, A5).
	// An older binary archives with DO NOTHING against the same key, which still
	// plans and runs. Each execution's log is kept apart by its epoch-keyed object.
	ResetTaskInstanceToNone(ctx context.Context, arg ResetTaskInstanceToNoneParams) error
	ResolveRunRef(ctx context.Context, arg ResolveRunRefParams) (ResolveRunRefRow, error)
	SetCurrentDagVersion(ctx context.Context, arg SetCurrentDagVersionParams) error
	SetDagPaused(ctx context.Context, arg SetDagPausedParams) (Dag, error)
	SetTaskInstanceNote(ctx context.Context, arg SetTaskInstanceNoteParams) error
	// The mark-state endpoint's write (mark success / mark failed). Same stamping
	// as UpdateTaskInstanceStateByRunTask, and a user's state is a verdict, not a
	// guess: it clears last_failure_kind and confirms the row, so a reaped task a
	// user marks failed is neither re-placed nor overridden by a late SUCCESS
	// record (ADR 0052 amendment).
	SetTaskInstanceStateByUser(ctx context.Context, arg SetTaskInstanceStateByUserParams) error
	// Transitions a run's state and stamps the run's own timestamps so the UI can
	// show its duration: started_at on first entry into 'running', ended_at on a
	// terminal state. Other timestamps are preserved (the scheduler may re-run).
	StampDagRunState(ctx context.Context, arg StampDagRunStateParams) error
	// Settle a task instance succeeded from its durable outcome record (ADR 0052),
	// recovering a success whose report was lost. Guarded by id, try_number and
	// attempt_epoch so a stale reconciler never marks a LIVE retry or re-place
	// succeeded (#1130), which would fire downstream
	// tasks on incomplete work, strictly worse than the bug being fixed. The
	// active-state guard prevents clobbering a terminal row. It reports the rows
	// it changed, so the reconciler can tell a settle that found nothing active
	// (a reaper may have marked the attempt meanwhile) and try
	// SucceedTaskInstanceOverInfraMark (ADR 0052 amendment).
	SucceedTaskInstanceIfActive(ctx context.Context, arg SucceedTaskInstanceIfActiveParams) (int64, error)
	// A durable SUCCESS overrides a reaper's infra guess (ADR 0052 amendment,
	// part 1). Admits only a provisional infra mark (agent_lost, pod_lost,
	// dispatch_lost) of exactly the attempt the pod's labels name, while the
	// planner still treats it as active: not yet confirmed by the reconciler and
	// inside the confirmation valve. A run that already finalized is never
	// touched. An application failure, a user's verdict (SetTaskInstanceStateByUser
	// clears the infra kind) and every other state are left alone. Returns the
	// overridden mark (the reaper's reason prefix) and the attempt's log location;
	// no row means nothing was overridden.
	SucceedTaskInstanceOverInfraMark(ctx context.Context, arg SucceedTaskInstanceOverInfraMarkParams) (SucceedTaskInstanceOverInfraMarkRow, error)
	// The per-attempt fields the agent spec carries from the task instance row.
	// first_reschedule_at is the time a reschedule-mode sensor first entered
	// reschedule (NULL until it does), delivered to each re-dispatched pod so
	// get_first_reschedule_date returns the real value and the sensor honors its
	// cumulative timeout across pokes (#380). max_tries is the attempt budget the
	// scheduler enforces, which a clear moves past the spec's retries + 1 (#1131),
	// so the runtime's on_failure_callback gate must read it from here (#424).
	TaskInstanceAttemptFields(ctx context.Context, arg TaskInstanceAttemptFieldsParams) (TaskInstanceAttemptFieldsRow, error)
	TaskInstancesForDagRuns(ctx context.Context, arg TaskInstancesForDagRunsParams) ([]TaskInstancesForDagRunsRow, error)
	TenantHasDefaultPool(ctx context.Context, name string) (bool, error)
	// The range of attempt epochs one try's executions can have, for the log
	// reader (ADR 0051 amendment, #863). Epochs grow monotonically per row and the
	// try only grows, so every execution of try N has an epoch above the latest
	// epoch archived for an earlier try (low, exclusive) and at most the try's own
	// latest epoch (high, inclusive): the current row's when it is still on try N,
	// else the try's history row, which holds its latest archived execution. A row
	// the previous release archived carries epoch 0, so its try reads as epoch 0
	// alone. Epoch 0 is always read as well, since every pre-upgrade log has it.
	TryAttemptEpochBounds(ctx context.Context, arg TryAttemptEpochBoundsParams) (TryAttemptEpochBoundsRow, error)
	// Rewrite one row's ciphertext in place during a key rotation. It touches only
	// the two encrypted columns, so a re-encryption can never alter a connection's
	// identity, host, or any field a user set.
	//
	// The WHERE carries the ciphertext we read, so a row a user changed between our
	// read and our write is NOT overwritten. Without it the rotation re-seals stale
	// plaintext over a password the user just set, and bumps updated_at so the row
	// looks freshly written. Reachable whenever more than one replica serves, which
	// the chart calls the recommended production posture.
	UpdateConnectionCiphertext(ctx context.Context, arg UpdateConnectionCiphertextParams) (int64, error)
	UpdateDagRunState(ctx context.Context, arg UpdateDagRunStateParams) (DagRun, error)
	UpdateTaskInstanceState(ctx context.Context, arg UpdateTaskInstanceStateParams) (TaskInstance, error)
	// Stamps the per-state entry timestamps the UI shows (scheduled_when /
	// queued_when / start_date). Each is set on first entry only ("IS NULL"), so a
	// re-emitted transition does not move the recorded time. $3 is cast to
	// task_state (see ReportTaskResult for why the cast is required).
	UpdateTaskInstanceStateByRunTask(ctx context.Context, arg UpdateTaskInstanceStateByRunTaskParams) error
	// Batched form of UpdateTaskInstanceStateByRunTask: applies ONE target state to
	// every listed task of a run in a single statement. The per-row stamping is
	// identical (scheduled_at/queued_at/started_at set on first entry only), as is
	// the task_state cast, so a batch of R same-target transitions is byte-identical
	// to R single-row updates — only the statement count changes (R UPDATEs → 1 per
	// distinct target state). The scheduler groups a tick's plain state-set
	// transitions (scheduled/skipped/upstream_failed/up_for_retry) by target state
	// and flushes each group through this query. task_id = ANY keeps every row's CASE
	// self-referential, so an already-stamped row is never re-stamped.
	UpdateTaskInstanceStatesByRunTasks(ctx context.Context, arg UpdateTaskInstanceStatesByRunTasksParams) error
	// Sets the limits given and keeps the others: a NULL argument leaves that
	// column as it is, 0 makes the limit unlimited (migrations 040 and 041).
	UpdateTenantLimits(ctx context.Context, arg UpdateTenantLimitsParams) error
	UpdateUserPassword(ctx context.Context, arg UpdateUserPasswordParams) (int64, error)
	// Tri-state write (#887): COALESCE(EXCLUDED.col, connections.col) preserves the
	// stored value when the param is NULL, overwrites it when the param is a value,
	// and clears it when the param is a non-NULL empty string. A NULL param is how a
	// partial `set` stays safe — changing only --host must not wipe the (unreadable)
	// password — while an explicit empty string now clears a field, and a masked
	// secret ("***") is mapped to NULL by the caller so it preserves rather than
	// overwrites (#874). conn_type is required on every write, so it is a plain
	// overwrite.
	UpsertConnection(ctx context.Context, arg UpsertConnectionParams) error
	UpsertDag(ctx context.Context, arg UpsertDagParams) (Dag, error)
	// Sizes a tenant's default pool to an explicit slot count: inserts it under the
	// given name with the seed description, or re-sizes the row already there. A
	// row with that name left without is_default (a tenant created before the
	// default pool was seeded per tenant) is marked default, so the delete guard
	// and the pools view treat it as the pool the scheduler falls back to.
	UpsertDefaultPoolSlots(ctx context.Context, arg UpsertDefaultPoolSlotsParams) error
	UpsertImportError(ctx context.Context, arg UpsertImportErrorParams) error
	UpsertPool(ctx context.Context, arg UpsertPoolParams) error
	// value is always supplied (the variable IS its value, and the `value` column is
	// NOT NULL, so a NULL param cannot reach the COALESCE — Postgres rejects it on
	// the INSERT arm). The tri-state write (#887) therefore resolves value in the
	// handler: an omitted or masked ("***") value on update is replaced with the
	// stored value before it reaches here, so this always overwrites value.
	// description is nullable, so it keeps the COALESCE preserve semantics: a NULL
	// param keeps the stored description rather than wiping it.
	UpsertVariable(ctx context.Context, arg UpsertVariableParams) error
}

type Queries struct {
	// contains filtered or unexported fields
}