queries

type AddFavoriteParams struct {
	UserID string `json:"user_id"`
	DagID  string `json:"dag_id"`
	Tenant string `json:"tenant"`
}

type ApiToken struct {
	ID         pgtype.UUID        `json:"id"`
	TenantID   pgtype.UUID        `json:"tenant_id"`
	UserID     pgtype.UUID        `json:"user_id"`
	Name       string             `json:"name"`
	TokenHash  string             `json:"token_hash"`
	Scopes     []string           `json:"scopes"`
	CreatedAt  pgtype.Timestamptz `json:"created_at"`
	ExpiresAt  pgtype.Timestamptz `json:"expires_at"`
	LastUsedAt pgtype.Timestamptz `json:"last_used_at"`
	RevokedAt  pgtype.Timestamptz `json:"revoked_at"`
}

type ApproveCLIDeviceParams struct {
	Email  *string     `json:"email"`
	Roles  []string    `json:"roles"`
	ID     pgtype.UUID `json:"id"`
	UserID pgtype.UUID `json:"user_id"`
	Tenant string      `json:"tenant"`
}

type AssignUserRoleParams struct {
	UserID pgtype.UUID `json:"user_id"`
	RoleID pgtype.UUID `json:"role_id"`
}

type AuditLog struct {
	ID           int64              `json:"id"`
	TenantID     pgtype.UUID        `json:"tenant_id"`
	UserID       pgtype.UUID        `json:"user_id"`
	Action       string             `json:"action"`
	ResourceType *string            `json:"resource_type"`
	ResourceID   *string            `json:"resource_id"`
	Metadata     []byte             `json:"metadata"`
	IpAddress    *netip.Addr        `json:"ip_address"`
	UserAgent    *string            `json:"user_agent"`
	OccurredAt   pgtype.Timestamptz `json:"occurred_at"`
}

type BindWarmAttemptParams struct {
	DagRunID     pgtype.UUID `json:"dag_run_id"`
	TaskID       string      `json:"task_id"`
	TryNumber    int32       `json:"try_number"`
	WarmWorkerID *string     `json:"warm_worker_id"`
	AttemptEpoch *int32      `json:"attempt_epoch"`
}

type ClaimAlertAttemptParams struct {
	ID          pgtype.UUID     `json:"id"`
	Backoff     pgtype.Interval `json:"backoff"`
	MaxAttempts int32           `json:"max_attempts"`
}

type ClaimAlertAttemptRow struct {
	ID            pgtype.UUID `json:"id"`
	AlertAttempts int32       `json:"alert_attempts"`
}

type ClaimAttemptEpochParams struct {
	DagRunID pgtype.UUID `json:"dag_run_id"`
	TaskID   string      `json:"task_id"`
}

type ClaimAttemptEpochRow struct {
	ID           pgtype.UUID `json:"id"`
	TenantID     pgtype.UUID `json:"tenant_id"`
	TryNumber    int32       `json:"try_number"`
	AttemptEpoch int32       `json:"attempt_epoch"`
}

type ClearDagRunsParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	DagID    pgtype.UUID `json:"dag_id"`
}

type CliDeviceAuthorization struct {
	ID                  pgtype.UUID        `json:"id"`
	DeviceCodeHash      string             `json:"device_code_hash"`
	UserCodeHash        string             `json:"user_code_hash"`
	Status              string             `json:"status"`
	CreatedAt           pgtype.Timestamptz `json:"created_at"`
	ExpiresAt           pgtype.Timestamptz `json:"expires_at"`
	PollIntervalSeconds int32              `json:"poll_interval_seconds"`
	RequesterHash       string             `json:"requester_hash"`
	RequesterAddr       string             `json:"requester_addr"`
	LastPolledAt        pgtype.Timestamptz `json:"last_polled_at"`
	DecidedAt           pgtype.Timestamptz `json:"decided_at"`
	TenantID            pgtype.UUID        `json:"tenant_id"`
	UserID              pgtype.UUID        `json:"user_id"`
	Email               *string            `json:"email"`
	Roles               []string           `json:"roles"`
}

type ConfirmInfraFailureParams struct {
	ID           pgtype.UUID `json:"id"`
	TryNumber    int32       `json:"try_number"`
	AttemptEpoch int32       `json:"attempt_epoch"`
}

type Connection struct {
	ID          pgtype.UUID        `json:"id"`
	TenantID    pgtype.UUID        `json:"tenant_id"`
	ConnID      string             `json:"conn_id"`
	ConnType    string             `json:"conn_type"`
	Host        *string            `json:"host"`
	ConnSchema  *string            `json:"conn_schema"`
	Login       *string            `json:"login"`
	Password    *string            `json:"password"`
	Port        *int32             `json:"port"`
	Extra       *string            `json:"extra"`
	Description *string            `json:"description"`
	CreatedAt   pgtype.Timestamptz `json:"created_at"`
	UpdatedAt   pgtype.Timestamptz `json:"updated_at"`
}

type CountAPITokensParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	OwnerID  pgtype.UUID `json:"owner_id"`
}

type CountActiveDagRunsByDagIDParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	DagID    pgtype.UUID `json:"dag_id"`
}

type CountAuditLogsParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	DagID    *string     `json:"dag_id"`
}

type CountConnectionsFilteredParams struct {
	TenantID                  pgtype.UUID `json:"tenant_id"`
	ConnectionIDPattern       *string     `json:"connection_id_pattern"`
	ConnectionIDPrefixPattern *string     `json:"connection_id_prefix_pattern"`
}

type CountDagRunStatesInWindowParams struct {
	TenantID      pgtype.UUID        `json:"tenant_id"`
	LogicalDate   pgtype.Timestamptz `json:"logical_date"`
	LogicalDate_2 pgtype.Timestamptz `json:"logical_date_2"`
}

type CountDagRunStatesInWindowRow struct {
	State DagRunState `json:"state"`
	N     int64       `json:"n"`
}

type CountDagRunsByDagParams struct {
	DagID    pgtype.UUID `json:"dag_id"`
	TenantID pgtype.UUID `json:"tenant_id"`
}

type CountDagRunsByDagStatesParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	DagID    pgtype.UUID `json:"dag_id"`
	States   []string    `json:"states"`
}

type CountDagRunsFilteredParams struct {
	TenantID           pgtype.UUID        `json:"tenant_id"`
	DagID              pgtype.UUID        `json:"dag_id"`
	States             []string           `json:"states"`
	RunIDPattern       *string            `json:"run_id_pattern"`
	RunIDPrefixPattern *string            `json:"run_id_prefix_pattern"`
	RunType            *string            `json:"run_type"`
	StartDateGte       pgtype.Timestamptz `json:"start_date_gte"`
	StartDateLte       pgtype.Timestamptz `json:"start_date_lte"`
	EndDateGte         pgtype.Timestamptz `json:"end_date_gte"`
	EndDateLte         pgtype.Timestamptz `json:"end_date_lte"`
}

type CountDagsByLatestRunStateRow struct {
	State DagRunState `json:"state"`
	N     int64       `json:"n"`
}

type CountDagsFilteredParams struct {
	TenantID pgtype.UUID  `json:"tenant_id"`
	Paused   *bool        `json:"paused"`
	RunState *DagRunState `json:"run_state"`
}

type CountDagsWithFilterParams struct {
	TenantID                    pgtype.UUID  `json:"tenant_id"`
	Paused                      *bool        `json:"paused"`
	RunState                    *DagRunState `json:"run_state"`
	DagIDPattern                *string      `json:"dag_id_pattern"`
	DagIDPrefixPattern          *string      `json:"dag_id_prefix_pattern"`
	DagDisplayNamePattern       *string      `json:"dag_display_name_pattern"`
	DagDisplayNamePrefixPattern *string      `json:"dag_display_name_prefix_pattern"`
	Owners                      []string     `json:"owners"`
	Tags                        []string     `json:"tags"`
	TagsMatchMode               *string      `json:"tags_match_mode"`
	IsFavorite                  *bool        `json:"is_favorite"`
	UserID                      *string      `json:"user_id"`
}

type CountExpiredSettledRunsOfTenantParams struct {
	TenantID pgtype.UUID        `json:"tenant_id"`
	Cutoff   pgtype.Timestamptz `json:"cutoff"`
	MaxRuns  int32              `json:"max_runs"`
}

type CountExpiredSettledRunsOfTenantRow struct {
	Runs          int64 `json:"runs"`
	TaskInstances int64 `json:"task_instances"`
}

type CountExpiredSystemAuditLogParams struct {
	Cutoff  pgtype.Timestamptz `json:"cutoff"`
	MaxRows int32              `json:"max_rows"`
}

type CountExpiredTenantAuditLogParams struct {
	TenantID pgtype.UUID        `json:"tenant_id"`
	Cutoff   pgtype.Timestamptz `json:"cutoff"`
	MaxRows  int32              `json:"max_rows"`
}

type CountExpiredUsageEventsParams struct {
	Cutoff  pgtype.Timestamptz `json:"cutoff"`
	MaxRows int32              `json:"max_rows"`
}

type CountImportErrorsFilteredParams struct {
	Tenant     string  `json:"tenant"`
	Filename   *string `json:"filename"`
	BundleName *string `json:"bundle_name"`
}

type CountLiveAPITokensParams struct {
	UserID   pgtype.UUID `json:"user_id"`
	TenantID pgtype.UUID `json:"tenant_id"`
}

type CountLiveCLIDevicesRow struct {
	Live          int64 `json:"live"`
	FromRequester int64 `json:"from_requester"`
}

type CountLocalPasswordUserParams struct {
	Name  string `json:"name"`
	Lower string `json:"lower"`
}

type CountTaskInstanceStatesInWindowParams struct {
	TenantID      pgtype.UUID        `json:"tenant_id"`
	LogicalDate   pgtype.Timestamptz `json:"logical_date"`
	LogicalDate_2 pgtype.Timestamptz `json:"logical_date_2"`
}

type CountTaskInstanceStatesInWindowRow struct {
	State TaskState `json:"state"`
	N     int64     `json:"n"`
}

type CountTaskInstancesFilteredParams struct {
	TenantID            pgtype.UUID `json:"tenant_id"`
	DagRunID            pgtype.UUID `json:"dag_run_id"`
	States              []string    `json:"states"`
	TaskIDPattern       *string     `json:"task_id_pattern"`
	TaskIDPrefixPattern *string     `json:"task_id_prefix_pattern"`
	Pool                *string     `json:"pool"`
}

type CountTenantDagTagsParams struct {
	TenantID             pgtype.UUID `json:"tenant_id"`
	TagNamePattern       *string     `json:"tag_name_pattern"`
	TagNamePrefixPattern *string     `json:"tag_name_prefix_pattern"`
}

type CountVariablesFilteredParams struct {
	TenantID         pgtype.UUID `json:"tenant_id"`
	KeyPattern       *string     `json:"key_pattern"`
	KeyPrefixPattern *string     `json:"key_prefix_pattern"`
}

type CreateAuditLogParams struct {
	TenantID     pgtype.UUID `json:"tenant_id"`
	UserID       pgtype.UUID `json:"user_id"`
	Action       string      `json:"action"`
	ResourceType *string     `json:"resource_type"`
	ResourceID   *string     `json:"resource_id"`
	Metadata     []byte      `json:"metadata"`
}

type CreateDagRunParams struct {
	TenantID     pgtype.UUID        `json:"tenant_id"`
	DagID        pgtype.UUID        `json:"dag_id"`
	DagVersionID pgtype.UUID        `json:"dag_version_id"`
	RunID        string             `json:"run_id"`
	LogicalDate  pgtype.Timestamptz `json:"logical_date"`
	State        DagRunState        `json:"state"`
	Trigger      DagRunTrigger      `json:"trigger"`
	Note         *string            `json:"note"`
	Conf         []byte             `json:"conf"`
}

type CreateScheduledRunByDagIDParams struct {
	RunID       string             `json:"run_id"`
	LogicalDate pgtype.Timestamptz `json:"logical_date"`
	TenantID    pgtype.UUID        `json:"tenant_id"`
	DagID       string             `json:"dag_id"`
}

type CreateTaskInstanceParams struct {
	TenantID  pgtype.UUID `json:"tenant_id"`
	DagRunID  pgtype.UUID `json:"dag_run_id"`
	TaskID    string      `json:"task_id"`
	Operator  string      `json:"operator"`
	MaxTries  int32       `json:"max_tries"`
	State     TaskState   `json:"state"`
	Pool      *string     `json:"pool"`
	PoolSlots int32       `json:"pool_slots"`
}

type CreateTaskInstancesParams struct {
	TenantID  pgtype.UUID `json:"tenant_id"`
	DagRunID  pgtype.UUID `json:"dag_run_id"`
	TaskID    string      `json:"task_id"`
	Operator  string      `json:"operator"`
	MaxTries  int32       `json:"max_tries"`
	State     TaskState   `json:"state"`
	Pool      *string     `json:"pool"`
	TryNumber int32       `json:"try_number"`
	PoolSlots int32       `json:"pool_slots"`
}

type CreateUserParams struct {
	TenantID     pgtype.UUID `json:"tenant_id"`
	Email        string      `json:"email"`
	PasswordHash *string     `json:"password_hash"`
}

type DBTX interface {
	Exec(context.Context, string, ...interface{}) (pgconn.CommandTag, error)
	Query(context.Context, string, ...interface{}) (pgx.Rows, error)
	QueryRow(context.Context, string, ...interface{}) pgx.Row
	CopyFrom(ctx context.Context, tableName pgx.Identifier, columnNames []string, rowSrc pgx.CopyFromSource) (int64, error)
}

type Dag struct {
	ID               pgtype.UUID        `json:"id"`
	TenantID         pgtype.UUID        `json:"tenant_id"`
	DagID            string             `json:"dag_id"`
	Description      *string            `json:"description"`
	IsPaused         bool               `json:"is_paused"`
	IsActive         bool               `json:"is_active"`
	Owner            *string            `json:"owner"`
	Tags             []string           `json:"tags"`
	Schedule         *string            `json:"schedule"`
	ScheduleTimezone *string            `json:"schedule_timezone"`
	StartDate        pgtype.Timestamptz `json:"start_date"`
	EndDate          pgtype.Timestamptz `json:"end_date"`
	MaxActiveRuns    int32              `json:"max_active_runs"`
	Catchup          bool               `json:"catchup"`
	CurrentVersionID pgtype.UUID        `json:"current_version_id"`
	CreatedAt        pgtype.Timestamptz `json:"created_at"`
	UpdatedAt        pgtype.Timestamptz `json:"updated_at"`
	NextRunAt        pgtype.Timestamptz `json:"next_run_at"`
	ScheduleEpoch    int64              `json:"schedule_epoch"`
}

type DagFavorite struct {
	ID        pgtype.UUID        `json:"id"`
	TenantID  pgtype.UUID        `json:"tenant_id"`
	UserID    string             `json:"user_id"`
	DagID     string             `json:"dag_id"`
	CreatedAt pgtype.Timestamptz `json:"created_at"`
}

type DagRun struct {
	ID                 pgtype.UUID        `json:"id"`
	TenantID           pgtype.UUID        `json:"tenant_id"`
	DagID              pgtype.UUID        `json:"dag_id"`
	DagVersionID       pgtype.UUID        `json:"dag_version_id"`
	RunID              string             `json:"run_id"`
	LogicalDate        pgtype.Timestamptz `json:"logical_date"`
	DataIntervalStart  pgtype.Timestamptz `json:"data_interval_start"`
	DataIntervalEnd    pgtype.Timestamptz `json:"data_interval_end"`
	State              DagRunState        `json:"state"`
	Trigger            DagRunTrigger      `json:"trigger"`
	Conf               []byte             `json:"conf"`
	TriggeredBy        pgtype.UUID        `json:"triggered_by"`
	QueuedAt           pgtype.Timestamptz `json:"queued_at"`
	StartedAt          pgtype.Timestamptz `json:"started_at"`
	EndedAt            pgtype.Timestamptz `json:"ended_at"`
	Note               *string            `json:"note"`
	AlertedAt          pgtype.Timestamptz `json:"alerted_at"`
	AlertAttempts      int32              `json:"alert_attempts"`
	NextAlertAttemptAt pgtype.Timestamptz `json:"next_alert_attempt_at"`
}

type DagRunExistsByDagIDParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	DagID    string      `json:"dag_id"`
	RunID    string      `json:"run_id"`
}

type DagRunState string

type DagRunTrigger string

type DagVersion struct {
	ID             pgtype.UUID        `json:"id"`
	DagID          pgtype.UUID        `json:"dag_id"`
	Version        string             `json:"version"`
	ImageReference string             `json:"image_reference"`
	Spec           []byte             `json:"spec"`
	SpecHash       string             `json:"spec_hash"`
	CreatedBy      pgtype.UUID        `json:"created_by"`
	CreatedAt      pgtype.Timestamptz `json:"created_at"`
	BuildInfo      []byte             `json:"build_info"`
}

type DeleteConnectionParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	ConnID   string      `json:"conn_id"`
}

type DeleteDagParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	DagID    string      `json:"dag_id"`
}

type DeleteDagRunParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	DagID    pgtype.UUID `json:"dag_id"`
	RunID    string      `json:"run_id"`
}

type DeleteDagRunsByIDParams struct {
	TenantID pgtype.UUID   `json:"tenant_id"`
	RunIds   []pgtype.UUID `json:"run_ids"`
	RowLimit int32         `json:"row_limit"`
}

type DeleteExpiredUsageEventsParams struct {
	Cutoff   pgtype.Timestamptz `json:"cutoff"`
	RowLimit int32              `json:"row_limit"`
}

type DeleteImportErrorParams struct {
	Tenant   string `json:"tenant"`
	Filename string `json:"filename"`
}

type DeletePoolParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	Name     string      `json:"name"`
}

type DeleteSystemAuditLogParams struct {
	Cutoff   pgtype.Timestamptz `json:"cutoff"`
	RowLimit int32              `json:"row_limit"`
}

type DeleteTaskInstanceHistoryOfRunsParams struct {
	TenantID pgtype.UUID   `json:"tenant_id"`
	RunIds   []pgtype.UUID `json:"run_ids"`
	RowLimit int32         `json:"row_limit"`
}

type DeleteTaskInstancesOfRunsParams struct {
	TenantID       pgtype.UUID   `json:"tenant_id"`
	RunIds         []pgtype.UUID `json:"run_ids"`
	RowLimit       int64         `json:"row_limit"`
	FirstRunAlways bool          `json:"first_run_always"`
}

type DeleteTenantAuditLogParams struct {
	TenantID pgtype.UUID        `json:"tenant_id"`
	Cutoff   pgtype.Timestamptz `json:"cutoff"`
	RowLimit int32              `json:"row_limit"`
}

type DeleteVariableParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	Key      string      `json:"key"`
}

type DeleteXComIndexForTasksParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	DagRunID pgtype.UUID `json:"dag_run_id"`
	TaskIds  []string    `json:"task_ids"`
}

type DeleteXComIndexOfRunsParams struct {
	TenantID pgtype.UUID   `json:"tenant_id"`
	RunIds   []pgtype.UUID `json:"run_ids"`
	RowLimit int32         `json:"row_limit"`
}

type DispatchAttemptsForActiveParams struct {
	DagRunID pgtype.UUID `json:"dag_run_id"`
	TaskID   string      `json:"task_id"`
}

type EnsureDagParams struct {
	TenantID         pgtype.UUID        `json:"tenant_id"`
	DagID            string             `json:"dag_id"`
	Description      *string            `json:"description"`
	Owner            *string            `json:"owner"`
	Tags             []string           `json:"tags"`
	Schedule         *string            `json:"schedule"`
	ScheduleTimezone *string            `json:"schedule_timezone"`
	StartDate        pgtype.Timestamptz `json:"start_date"`
	MaxActiveRuns    int32              `json:"max_active_runs"`
	Catchup          bool               `json:"catchup"`
	IsPaused         bool               `json:"is_paused"`
}

type ExistingConnectionIDsParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	ConnIds  []string    `json:"conn_ids"`
}

type ExistingVariableKeysParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	Keys     []string    `json:"keys"`
}

type FailDispatchExhaustedParams struct {
	DagRunID     pgtype.UUID `json:"dag_run_id"`
	TaskID       string      `json:"task_id"`
	ErrorMessage *string     `json:"error_message"`
}

type FailDispatchRefusedParams struct {
	DagRunID     pgtype.UUID `json:"dag_run_id"`
	TaskID       string      `json:"task_id"`
	ErrorMessage *string     `json:"error_message"`
}

type FailTaskInstanceIfActiveParams struct {
	ErrorMessage *string     `json:"error_message"`
	ID           pgtype.UUID `json:"id"`
	TryNumber    int32       `json:"try_number"`
	AttemptEpoch int32       `json:"attempt_epoch"`
}

type FailTaskInstanceInfraIfActiveParams struct {
	ErrorMessage *string     `json:"error_message"`
	ID           pgtype.UUID `json:"id"`
	TryNumber    int32       `json:"try_number"`
	AttemptEpoch int32       `json:"attempt_epoch"`
}

type FindPendingCLIDeviceByUserCodeRow struct {
	ID            pgtype.UUID        `json:"id"`
	CreatedAt     pgtype.Timestamptz `json:"created_at"`
	ExpiresAt     pgtype.Timestamptz `json:"expires_at"`
	RequesterAddr string             `json:"requester_addr"`
}

type GetAPITokenByHashRow struct {
	ID         pgtype.UUID        `json:"id"`
	Tenant     string             `json:"tenant"`
	UserID     pgtype.UUID        `json:"user_id"`
	Name       string             `json:"name"`
	Scopes     []string           `json:"scopes"`
	CreatedAt  pgtype.Timestamptz `json:"created_at"`
	ExpiresAt  pgtype.Timestamptz `json:"expires_at"`
	LastUsedAt pgtype.Timestamptz `json:"last_used_at"`
	RevokedAt  pgtype.Timestamptz `json:"revoked_at"`
}

type GetConnectionParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	ConnID   string      `json:"conn_id"`
}

type GetConnectionRow struct {
	ConnID      string  `json:"conn_id"`
	ConnType    string  `json:"conn_type"`
	Host        *string `json:"host"`
	ConnSchema  *string `json:"conn_schema"`
	Login       *string `json:"login"`
	Password    *string `json:"password"`
	Port        *int32  `json:"port"`
	Extra       *string `json:"extra"`
	Description *string `json:"description"`
}

type GetCurrentDagSpecParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	DagID    string      `json:"dag_id"`
}

type GetDagByDagIDParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	DagID    string      `json:"dag_id"`
}

type GetDagRunForUpdateParams struct {
	ID       pgtype.UUID `json:"id"`
	TenantID pgtype.UUID `json:"tenant_id"`
}

type GetDagRunInTenantParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	ID       pgtype.UUID `json:"id"`
}

type GetDagRunParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	DagID    pgtype.UUID `json:"dag_id"`
	RunID    string      `json:"run_id"`
}

type GetDagRunWithVersionParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	DagID    pgtype.UUID `json:"dag_id"`
	RunID    string      `json:"run_id"`
}

type GetDagRunWithVersionRow struct {
	ID                 pgtype.UUID        `json:"id"`
	TenantID           pgtype.UUID        `json:"tenant_id"`
	DagID              pgtype.UUID        `json:"dag_id"`
	DagVersionID       pgtype.UUID        `json:"dag_version_id"`
	RunID              string             `json:"run_id"`
	LogicalDate        pgtype.Timestamptz `json:"logical_date"`
	DataIntervalStart  pgtype.Timestamptz `json:"data_interval_start"`
	DataIntervalEnd    pgtype.Timestamptz `json:"data_interval_end"`
	State              DagRunState        `json:"state"`
	Trigger            DagRunTrigger      `json:"trigger"`
	Conf               []byte             `json:"conf"`
	TriggeredBy        pgtype.UUID        `json:"triggered_by"`
	QueuedAt           pgtype.Timestamptz `json:"queued_at"`
	StartedAt          pgtype.Timestamptz `json:"started_at"`
	EndedAt            pgtype.Timestamptz `json:"ended_at"`
	Note               *string            `json:"note"`
	AlertedAt          pgtype.Timestamptz `json:"alerted_at"`
	AlertAttempts      int32              `json:"alert_attempts"`
	NextAlertAttemptAt pgtype.Timestamptz `json:"next_alert_attempt_at"`
	DagVersionLabel    *string            `json:"dag_version_label"`
}

type GetDagVersionByHashParams struct {
	DagID    pgtype.UUID `json:"dag_id"`
	SpecHash string      `json:"spec_hash"`
	TenantID pgtype.UUID `json:"tenant_id"`
}

type GetDagVersionInTenantParams struct {
	ID       pgtype.UUID `json:"id"`
	TenantID pgtype.UUID `json:"tenant_id"`
}

type GetDagWithVersionParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	DagID    string      `json:"dag_id"`
}

type GetDagWithVersionRow struct {
	ID                  pgtype.UUID        `json:"id"`
	TenantID            pgtype.UUID        `json:"tenant_id"`
	DagID               string             `json:"dag_id"`
	Description         *string            `json:"description"`
	IsPaused            bool               `json:"is_paused"`
	IsActive            bool               `json:"is_active"`
	Owner               *string            `json:"owner"`
	Tags                []string           `json:"tags"`
	Schedule            *string            `json:"schedule"`
	ScheduleTimezone    *string            `json:"schedule_timezone"`
	StartDate           pgtype.Timestamptz `json:"start_date"`
	EndDate             pgtype.Timestamptz `json:"end_date"`
	MaxActiveRuns       int32              `json:"max_active_runs"`
	Catchup             bool               `json:"catchup"`
	CurrentVersionID    pgtype.UUID        `json:"current_version_id"`
	CreatedAt           pgtype.Timestamptz `json:"created_at"`
	UpdatedAt           pgtype.Timestamptz `json:"updated_at"`
	NextRunAt           pgtype.Timestamptz `json:"next_run_at"`
	ScheduleEpoch       int64              `json:"schedule_epoch"`
	CurrentVersionLabel *string            `json:"current_version_label"`
}

type GetDefaultTenantRow struct {
	ID   pgtype.UUID `json:"id"`
	Name string      `json:"name"`
}

type GetPoolParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	Name     string      `json:"name"`
}

type GetPoolRow struct {
	Name        string  `json:"name"`
	Slots       int32   `json:"slots"`
	Description *string `json:"description"`
	IsDefault   bool    `json:"is_default"`
}

type GetRoleByNameParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	Name     string      `json:"name"`
}

type GetRoleIDForUserTenantParams struct {
	ID   pgtype.UUID `json:"id"`
	Name string      `json:"name"`
}

type GetRolePermissionsByIDRow struct {
	Action   string `json:"action"`
	Resource string `json:"resource"`
}

type GetTenantByNameRow struct {
	ID   pgtype.UUID `json:"id"`
	Name string      `json:"name"`
}

type GetTenantLimitsRow struct {
	MaxDags                    int32              `json:"max_dags"`
	MaxRunsPerDay              int32              `json:"max_runs_per_day"`
	MinScheduleIntervalSeconds int32              `json:"min_schedule_interval_seconds"`
	MaxTaskPoolSlots           int32              `json:"max_task_pool_slots"`
	SuspendedAt                pgtype.Timestamptz `json:"suspended_at"`
	SuspensionMode             *string            `json:"suspension_mode"`
	SuspensionReason           string             `json:"suspension_reason"`
}

type GetTenantUserIDParams struct {
	ID       pgtype.UUID `json:"id"`
	TenantID pgtype.UUID `json:"tenant_id"`
}

type GetUsageEventsStateRow struct {
	Enabled   bool          `json:"enabled"`
	PrunedXid pgtype.Uint64 `json:"pruned_xid"`
	PrunedID  *int64        `json:"pruned_id"`
}

type GetUserByEmailParams struct {
	Name  string `json:"name"`
	Email string `json:"email"`
}

type GetUserByEmailRow struct {
	ID           pgtype.UUID `json:"id"`
	TenantID     pgtype.UUID `json:"tenant_id"`
	Email        string      `json:"email"`
	PasswordHash *string     `json:"password_hash"`
	IsActive     bool        `json:"is_active"`
}

type GetUserByIDRow struct {
	ID       pgtype.UUID `json:"id"`
	Tenant   string      `json:"tenant"`
	Email    string      `json:"email"`
	IsActive bool        `json:"is_active"`
}

type GetUserByOIDCSubjectParams struct {
	OidcProvider *string `json:"oidc_provider"`
	OidcSubject  *string `json:"oidc_subject"`
}

type GetUserByOIDCSubjectRow struct {
	ID       pgtype.UUID `json:"id"`
	Tenant   string      `json:"tenant"`
	Email    string      `json:"email"`
	IsActive bool        `json:"is_active"`
}

type GetUserPermissionsRow struct {
	Action   string `json:"action"`
	Resource string `json:"resource"`
}

type GetUserPrincipalByIDRow struct {
	ID          pgtype.UUID `json:"id"`
	Tenant      string      `json:"tenant"`
	Email       string      `json:"email"`
	IsActive    bool        `json:"is_active"`
	Roles       []string    `json:"roles"`
	Permissions []byte      `json:"permissions"`
}

type GetVariableParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	Key      string      `json:"key"`
}

type GetVariableRow struct {
	Key         string  `json:"key"`
	Value       string  `json:"value"`
	Description *string `json:"description"`
}

type GetXComByNamesParams struct {
	Name   string `json:"name"`
	DagID  string `json:"dag_id"`
	RunID  string `json:"run_id"`
	TaskID string `json:"task_id"`
	Key    string `json:"key"`
}

type GetXComByNamesRow struct {
	RedisKey    string             `json:"redis_key"`
	ContentType string             `json:"content_type"`
	SizeBytes   int32              `json:"size_bytes"`
	CreatedAt   pgtype.Timestamptz `json:"created_at"`
}

type GetXComEntryParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	DagRunID pgtype.UUID `json:"dag_run_id"`
	TaskID   string      `json:"task_id"`
	Key      string      `json:"key"`
}

type GetXComEntryRow struct {
	RedisKey    string             `json:"redis_key"`
	ContentType string             `json:"content_type"`
	SizeBytes   int32              `json:"size_bytes"`
	CreatedAt   pgtype.Timestamptz `json:"created_at"`
}

type ImportError struct {
	ID         pgtype.UUID        `json:"id"`
	TenantID   pgtype.UUID        `json:"tenant_id"`
	Filename   string             `json:"filename"`
	Stacktrace string             `json:"stacktrace"`
	BundleName *string            `json:"bundle_name"`
	CreatedAt  pgtype.Timestamptz `json:"created_at"`
}

type InsertAPITokenParams struct {
	TenantID  pgtype.UUID        `json:"tenant_id"`
	UserID    pgtype.UUID        `json:"user_id"`
	Name      string             `json:"name"`
	TokenHash string             `json:"token_hash"`
	Scopes    []string           `json:"scopes"`
	ExpiresAt pgtype.Timestamptz `json:"expires_at"`
}

type InsertAPITokenRow struct {
	ID        pgtype.UUID        `json:"id"`
	CreatedAt pgtype.Timestamptz `json:"created_at"`
}

type InsertCLIDeviceParams struct {
	DeviceCodeHash      string  `json:"device_code_hash"`
	UserCodeHash        string  `json:"user_code_hash"`
	TtlSeconds          float64 `json:"ttl_seconds"`
	PollIntervalSeconds int32   `json:"poll_interval_seconds"`
	RequesterHash       string  `json:"requester_hash"`
	RequesterAddr       string  `json:"requester_addr"`
}

type InsertCLIDeviceRow struct {
	ID        pgtype.UUID        `json:"id"`
	CreatedAt pgtype.Timestamptz `json:"created_at"`
	ExpiresAt pgtype.Timestamptz `json:"expires_at"`
}

type InsertDagVersionParams struct {
	Version        string      `json:"version"`
	ImageReference string      `json:"image_reference"`
	Spec           []byte      `json:"spec"`
	SpecHash       string      `json:"spec_hash"`
	CreatedBy      pgtype.UUID `json:"created_by"`
	BuildInfo      []byte      `json:"build_info"`
	DagID          pgtype.UUID `json:"dag_id"`
	TenantID       pgtype.UUID `json:"tenant_id"`
}

type InsertOIDCUserParams struct {
	TenantID     pgtype.UUID `json:"tenant_id"`
	Email        string      `json:"email"`
	OidcProvider *string     `json:"oidc_provider"`
	OidcSubject  *string     `json:"oidc_subject"`
}

type InsertOIDCUserRow struct {
	ID        pgtype.UUID        `json:"id"`
	Email     string             `json:"email"`
	IsActive  bool               `json:"is_active"`
	CreatedAt pgtype.Timestamptz `json:"created_at"`
}

type InsertTenantIfMissingParams struct {
	Name        string  `json:"name"`
	DisplayName *string `json:"display_name"`
}

type InsertUserParams struct {
	TenantID     pgtype.UUID `json:"tenant_id"`
	Email        string      `json:"email"`
	PasswordHash *string     `json:"password_hash"`
}

type InsertUserRow struct {
	ID        pgtype.UUID        `json:"id"`
	Email     string             `json:"email"`
	IsActive  bool               `json:"is_active"`
	CreatedAt pgtype.Timestamptz `json:"created_at"`
}

type Installation struct {
	Singleton  bool               `json:"singleton"`
	ID         string             `json:"id"`
	RecordedAt pgtype.Timestamptz `json:"recorded_at"`
}

type IsTaskInstanceLiveParams struct {
	DagRunID     pgtype.UUID `json:"dag_run_id"`
	TaskID       string      `json:"task_id"`
	TryNumber    int32       `json:"try_number"`
	TenantID     pgtype.UUID `json:"tenant_id"`
	AttemptEpoch *int32      `json:"attempt_epoch"`
}

type LatestRunsForDagsParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	Column2  []string    `json:"column_2"`
	Limit    int32       `json:"limit"`
}

type LatestRunsForDagsRow struct {
	DagIDText   string             `json:"dag_id_text"`
	RunID       string             `json:"run_id"`
	LogicalDate pgtype.Timestamptz `json:"logical_date"`
	State       DagRunState        `json:"state"`
	Trigger     DagRunTrigger      `json:"trigger"`
	QueuedAt    pgtype.Timestamptz `json:"queued_at"`
	StartedAt   pgtype.Timestamptz `json:"started_at"`
	EndedAt     pgtype.Timestamptz `json:"ended_at"`
}

type ListAPITokensParams struct {
	TenantID  pgtype.UUID `json:"tenant_id"`
	OwnerID   pgtype.UUID `json:"owner_id"`
	RowOffset int32       `json:"row_offset"`
	RowLimit  int32       `json:"row_limit"`
}

type ListAPITokensRow struct {
	ID         pgtype.UUID        `json:"id"`
	UserID     pgtype.UUID        `json:"user_id"`
	UserEmail  string             `json:"user_email"`
	Name       string             `json:"name"`
	Scopes     []string           `json:"scopes"`
	CreatedAt  pgtype.Timestamptz `json:"created_at"`
	ExpiresAt  pgtype.Timestamptz `json:"expires_at"`
	LastUsedAt pgtype.Timestamptz `json:"last_used_at"`
}

type ListActiveDagRunsRow struct {
	DagRun               DagRun `json:"dag_run"`
	DagPaused            bool   `json:"dag_paused"`
	DagMaxActiveRuns     int32  `json:"dag_max_active_runs"`
	TenantSuspensionMode string `json:"tenant_suspension_mode"`
}

type ListActiveStagingVolumesRow struct {
	PvcName    string             `json:"pvc_name"`
	CreatedAt  pgtype.Timestamptz `json:"created_at"`
	RunState   *DagRunState       `json:"run_state"`
	RunEndedAt pgtype.Timestamptz `json:"run_ended_at"`
}

type ListAgentLostCandidatesRow struct {
	TaskInstanceID  pgtype.UUID        `json:"task_instance_id"`
	TenantID        pgtype.UUID        `json:"tenant_id"`
	DagRunID        pgtype.UUID        `json:"dag_run_id"`
	DagIDText       string             `json:"dag_id_text"`
	TaskID          string             `json:"task_id"`
	TryNumber       int32              `json:"try_number"`
	AttemptEpoch    int32              `json:"attempt_epoch"`
	LastHeartbeatAt pgtype.Timestamptz `json:"last_heartbeat_at"`
	StartedAt       pgtype.Timestamptz `json:"started_at"`
}

type ListAuditLogsAfterParams struct {
	TenantID        pgtype.UUID        `json:"tenant_id"`
	DagID           *string            `json:"dag_id"`
	AfterOccurredAt pgtype.Timestamptz `json:"after_occurred_at"`
	AfterID         int64              `json:"after_id"`
	RowLimit        int32              `json:"row_limit"`
}

type ListAuditLogsAfterRow struct {
	ID           int64              `json:"id"`
	Action       string             `json:"action"`
	ResourceType *string            `json:"resource_type"`
	ResourceID   *string            `json:"resource_id"`
	Metadata     []byte             `json:"metadata"`
	OccurredAt   pgtype.Timestamptz `json:"occurred_at"`
	Owner        string             `json:"owner"`
}

type ListAuditLogsParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	Limit    int32       `json:"limit"`
	Offset   int32       `json:"offset"`
	DagID    *string     `json:"dag_id"`
}

type ListAuditLogsRow struct {
	ID           int64              `json:"id"`
	Action       string             `json:"action"`
	ResourceType *string            `json:"resource_type"`
	ResourceID   *string            `json:"resource_id"`
	Metadata     []byte             `json:"metadata"`
	OccurredAt   pgtype.Timestamptz `json:"occurred_at"`
	Owner        string             `json:"owner"`
}

type ListConnectionSecretsRow struct {
	ConnID     string  `json:"conn_id"`
	ConnType   string  `json:"conn_type"`
	Host       *string `json:"host"`
	ConnSchema *string `json:"conn_schema"`
	Login      *string `json:"login"`
	Password   *string `json:"password"`
	Port       *int32  `json:"port"`
	Extra      *string `json:"extra"`
}

type ListConnectionSecretsScopedParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	ConnIds  []string    `json:"conn_ids"`
}

type ListConnectionSecretsScopedRow struct {
	ConnID     string  `json:"conn_id"`
	ConnType   string  `json:"conn_type"`
	Host       *string `json:"host"`
	ConnSchema *string `json:"conn_schema"`
	Login      *string `json:"login"`
	Password   *string `json:"password"`
	Port       *int32  `json:"port"`
	Extra      *string `json:"extra"`
}

type ListConnectionsFilteredParams struct {
	TenantID                  pgtype.UUID `json:"tenant_id"`
	Limit                     int32       `json:"limit"`
	Offset                    int32       `json:"offset"`
	ConnectionIDPattern       *string     `json:"connection_id_pattern"`
	ConnectionIDPrefixPattern *string     `json:"connection_id_prefix_pattern"`
}

type ListConnectionsFilteredRow struct {
	ConnID      string  `json:"conn_id"`
	ConnType    string  `json:"conn_type"`
	Host        *string `json:"host"`
	ConnSchema  *string `json:"conn_schema"`
	Login       *string `json:"login"`
	Port        *int32  `json:"port"`
	Extra       *string `json:"extra"`
	Description *string `json:"description"`
}

type ListConnectionsParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	Limit    int32       `json:"limit"`
	Offset   int32       `json:"offset"`
}

type ListConnectionsRow struct {
	ConnID      string  `json:"conn_id"`
	ConnType    string  `json:"conn_type"`
	Host        *string `json:"host"`
	ConnSchema  *string `json:"conn_schema"`
	Login       *string `json:"login"`
	Port        *int32  `json:"port"`
	Extra       *string `json:"extra"`
	Description *string `json:"description"`
}

type ListDagRunsByDagAfterParams struct {
	TenantID         pgtype.UUID        `json:"tenant_id"`
	DagID            pgtype.UUID        `json:"dag_id"`
	States           []string           `json:"states"`
	AfterLogicalDate pgtype.Timestamptz `json:"after_logical_date"`
	AfterRunID       string             `json:"after_run_id"`
	RowLimit         int32              `json:"row_limit"`
}

type ListDagRunsByDagAfterRow struct {
	ID                 pgtype.UUID        `json:"id"`
	TenantID           pgtype.UUID        `json:"tenant_id"`
	DagID              pgtype.UUID        `json:"dag_id"`
	DagVersionID       pgtype.UUID        `json:"dag_version_id"`
	RunID              string             `json:"run_id"`
	LogicalDate        pgtype.Timestamptz `json:"logical_date"`
	DataIntervalStart  pgtype.Timestamptz `json:"data_interval_start"`
	DataIntervalEnd    pgtype.Timestamptz `json:"data_interval_end"`
	State              DagRunState        `json:"state"`
	Trigger            DagRunTrigger      `json:"trigger"`
	Conf               []byte             `json:"conf"`
	TriggeredBy        pgtype.UUID        `json:"triggered_by"`
	QueuedAt           pgtype.Timestamptz `json:"queued_at"`
	StartedAt          pgtype.Timestamptz `json:"started_at"`
	EndedAt            pgtype.Timestamptz `json:"ended_at"`
	Note               *string            `json:"note"`
	AlertedAt          pgtype.Timestamptz `json:"alerted_at"`
	AlertAttempts      int32              `json:"alert_attempts"`
	NextAlertAttemptAt pgtype.Timestamptz `json:"next_alert_attempt_at"`
	DagVersionLabel    *string            `json:"dag_version_label"`
}

type ListDagRunsByDagParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	DagID    pgtype.UUID `json:"dag_id"`
	Limit    int32       `json:"limit"`
	Offset   int32       `json:"offset"`
}

type ListDagRunsByDagWithVersionParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	DagID    pgtype.UUID `json:"dag_id"`
	Limit    int32       `json:"limit"`
	Offset   int32       `json:"offset"`
}

type ListDagRunsByDagWithVersionRow struct {
	ID                 pgtype.UUID        `json:"id"`
	TenantID           pgtype.UUID        `json:"tenant_id"`
	DagID              pgtype.UUID        `json:"dag_id"`
	DagVersionID       pgtype.UUID        `json:"dag_version_id"`
	RunID              string             `json:"run_id"`
	LogicalDate        pgtype.Timestamptz `json:"logical_date"`
	DataIntervalStart  pgtype.Timestamptz `json:"data_interval_start"`
	DataIntervalEnd    pgtype.Timestamptz `json:"data_interval_end"`
	State              DagRunState        `json:"state"`
	Trigger            DagRunTrigger      `json:"trigger"`
	Conf               []byte             `json:"conf"`
	TriggeredBy        pgtype.UUID        `json:"triggered_by"`
	QueuedAt           pgtype.Timestamptz `json:"queued_at"`
	StartedAt          pgtype.Timestamptz `json:"started_at"`
	EndedAt            pgtype.Timestamptz `json:"ended_at"`
	Note               *string            `json:"note"`
	AlertedAt          pgtype.Timestamptz `json:"alerted_at"`
	AlertAttempts      int32              `json:"alert_attempts"`
	NextAlertAttemptAt pgtype.Timestamptz `json:"next_alert_attempt_at"`
	DagVersionLabel    *string            `json:"dag_version_label"`
}

type ListDagRunsFilteredParams struct {
	TenantID           pgtype.UUID        `json:"tenant_id"`
	DagID              pgtype.UUID        `json:"dag_id"`
	States             []string           `json:"states"`
	RunIDPattern       *string            `json:"run_id_pattern"`
	RunIDPrefixPattern *string            `json:"run_id_prefix_pattern"`
	RunType            *string            `json:"run_type"`
	StartDateGte       pgtype.Timestamptz `json:"start_date_gte"`
	StartDateLte       pgtype.Timestamptz `json:"start_date_lte"`
	EndDateGte         pgtype.Timestamptz `json:"end_date_gte"`
	EndDateLte         pgtype.Timestamptz `json:"end_date_lte"`
	RowOffset          int32              `json:"row_offset"`
	RowLimit           int32              `json:"row_limit"`
}

type ListDagRunsFilteredRow struct {
	ID                 pgtype.UUID        `json:"id"`
	TenantID           pgtype.UUID        `json:"tenant_id"`
	DagID              pgtype.UUID        `json:"dag_id"`
	DagVersionID       pgtype.UUID        `json:"dag_version_id"`
	RunID              string             `json:"run_id"`
	LogicalDate        pgtype.Timestamptz `json:"logical_date"`
	DataIntervalStart  pgtype.Timestamptz `json:"data_interval_start"`
	DataIntervalEnd    pgtype.Timestamptz `json:"data_interval_end"`
	State              DagRunState        `json:"state"`
	Trigger            DagRunTrigger      `json:"trigger"`
	Conf               []byte             `json:"conf"`
	TriggeredBy        pgtype.UUID        `json:"triggered_by"`
	QueuedAt           pgtype.Timestamptz `json:"queued_at"`
	StartedAt          pgtype.Timestamptz `json:"started_at"`
	EndedAt            pgtype.Timestamptz `json:"ended_at"`
	Note               *string            `json:"note"`
	AlertedAt          pgtype.Timestamptz `json:"alerted_at"`
	AlertAttempts      int32              `json:"alert_attempts"`
	NextAlertAttemptAt pgtype.Timestamptz `json:"next_alert_attempt_at"`
	DagVersionLabel    *string            `json:"dag_version_label"`
}

type ListDagVersionsParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	DagID    string      `json:"dag_id"`
}

type ListDagVersionsRow struct {
	ID             pgtype.UUID        `json:"id"`
	Version        string             `json:"version"`
	CreatedAt      pgtype.Timestamptz `json:"created_at"`
	ImageReference string             `json:"image_reference"`
	SpecHash       string             `json:"spec_hash"`
	BuildInfo      []byte             `json:"build_info"`
	IsCurrent      bool               `json:"is_current"`
	CreatedBy      string             `json:"created_by"`
	VersionNumber  int64              `json:"version_number"`
}

type ListDagsFilteredParams struct {
	TenantID pgtype.UUID  `json:"tenant_id"`
	Limit    int32        `json:"limit"`
	Offset   int32        `json:"offset"`
	Paused   *bool        `json:"paused"`
	RunState *DagRunState `json:"run_state"`
}

type ListDagsParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	Limit    int32       `json:"limit"`
	Offset   int32       `json:"offset"`
}

type ListDagsWithFilterParams struct {
	TenantID                    pgtype.UUID  `json:"tenant_id"`
	Limit                       int32        `json:"limit"`
	Offset                      int32        `json:"offset"`
	Paused                      *bool        `json:"paused"`
	RunState                    *DagRunState `json:"run_state"`
	DagIDPattern                *string      `json:"dag_id_pattern"`
	DagIDPrefixPattern          *string      `json:"dag_id_prefix_pattern"`
	DagDisplayNamePattern       *string      `json:"dag_display_name_pattern"`
	DagDisplayNamePrefixPattern *string      `json:"dag_display_name_prefix_pattern"`
	Owners                      []string     `json:"owners"`
	Tags                        []string     `json:"tags"`
	TagsMatchMode               *string      `json:"tags_match_mode"`
	IsFavorite                  *bool        `json:"is_favorite"`
	UserID                      *string      `json:"user_id"`
	OrderBy                     *string      `json:"order_by"`
}

type ListDagsWithFilterRow struct {
	ID                  pgtype.UUID        `json:"id"`
	TenantID            pgtype.UUID        `json:"tenant_id"`
	DagID               string             `json:"dag_id"`
	Description         *string            `json:"description"`
	IsPaused            bool               `json:"is_paused"`
	IsActive            bool               `json:"is_active"`
	Owner               *string            `json:"owner"`
	Tags                []string           `json:"tags"`
	Schedule            *string            `json:"schedule"`
	ScheduleTimezone    *string            `json:"schedule_timezone"`
	StartDate           pgtype.Timestamptz `json:"start_date"`
	EndDate             pgtype.Timestamptz `json:"end_date"`
	MaxActiveRuns       int32              `json:"max_active_runs"`
	Catchup             bool               `json:"catchup"`
	CurrentVersionID    pgtype.UUID        `json:"current_version_id"`
	CreatedAt           pgtype.Timestamptz `json:"created_at"`
	UpdatedAt           pgtype.Timestamptz `json:"updated_at"`
	NextRunAt           pgtype.Timestamptz `json:"next_run_at"`
	ScheduleEpoch       int64              `json:"schedule_epoch"`
	CurrentVersionLabel *string            `json:"current_version_label"`
}

type ListDagsWithVersionParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	Limit    int32       `json:"limit"`
	Offset   int32       `json:"offset"`
}

type ListDagsWithVersionRow struct {
	ID                  pgtype.UUID        `json:"id"`
	TenantID            pgtype.UUID        `json:"tenant_id"`
	DagID               string             `json:"dag_id"`
	Description         *string            `json:"description"`
	IsPaused            bool               `json:"is_paused"`
	IsActive            bool               `json:"is_active"`
	Owner               *string            `json:"owner"`
	Tags                []string           `json:"tags"`
	Schedule            *string            `json:"schedule"`
	ScheduleTimezone    *string            `json:"schedule_timezone"`
	StartDate           pgtype.Timestamptz `json:"start_date"`
	EndDate             pgtype.Timestamptz `json:"end_date"`
	MaxActiveRuns       int32              `json:"max_active_runs"`
	Catchup             bool               `json:"catchup"`
	CurrentVersionID    pgtype.UUID        `json:"current_version_id"`
	CreatedAt           pgtype.Timestamptz `json:"created_at"`
	UpdatedAt           pgtype.Timestamptz `json:"updated_at"`
	NextRunAt           pgtype.Timestamptz `json:"next_run_at"`
	ScheduleEpoch       int64              `json:"schedule_epoch"`
	CurrentVersionLabel *string            `json:"current_version_label"`
}

type ListEncryptedConnectionSecretsRow struct {
	ID       pgtype.UUID `json:"id"`
	TenantID pgtype.UUID `json:"tenant_id"`
	ConnID   string      `json:"conn_id"`
	Password *string     `json:"password"`
	Extra    *string     `json:"extra"`
}

type ListFavoriteDagIDsParams struct {
	Tenant string `json:"tenant"`
	UserID string `json:"user_id"`
}

type ListImportErrorsFilteredParams struct {
	Limit      int32   `json:"limit"`
	Offset     int32   `json:"offset"`
	Tenant     string  `json:"tenant"`
	Filename   *string `json:"filename"`
	BundleName *string `json:"bundle_name"`
}

type ListImportErrorsFilteredRow struct {
	ID         pgtype.UUID        `json:"id"`
	Filename   string             `json:"filename"`
	Stacktrace string             `json:"stacktrace"`
	BundleName *string            `json:"bundle_name"`
	CreatedAt  pgtype.Timestamptz `json:"created_at"`
}

type ListImportErrorsRow struct {
	ID         pgtype.UUID        `json:"id"`
	Filename   string             `json:"filename"`
	Stacktrace string             `json:"stacktrace"`
	BundleName *string            `json:"bundle_name"`
	CreatedAt  pgtype.Timestamptz `json:"created_at"`
}

type ListOrphanCandidatesRow struct {
	ID           pgtype.UUID        `json:"id"`
	DagIDText    string             `json:"dag_id_text"`
	LastActivity pgtype.Timestamptz `json:"last_activity"`
}

type ListPoolsParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	Limit    int32       `json:"limit"`
	Offset   int32       `json:"offset"`
}

type ListPoolsRow struct {
	Name        string  `json:"name"`
	Slots       int32   `json:"slots"`
	Description *string `json:"description"`
	IsDefault   bool    `json:"is_default"`
}

type ListProvisionalInfraFailuresRow struct {
	TaskInstanceID pgtype.UUID `json:"task_instance_id"`
	DagRunID       pgtype.UUID `json:"dag_run_id"`
	TaskID         string      `json:"task_id"`
	TryNumber      int32       `json:"try_number"`
	AttemptEpoch   int32       `json:"attempt_epoch"`
}

type ListRunningTasksParams struct {
	GraceSeconds float64            `json:"grace_seconds"`
	AfterAt      pgtype.Timestamptz `json:"after_at"`
	AfterID      pgtype.UUID        `json:"after_id"`
	PageSize     int32              `json:"page_size"`
}

type ListRunningTasksRow struct {
	TaskInstanceID pgtype.UUID        `json:"task_instance_id"`
	TenantID       pgtype.UUID        `json:"tenant_id"`
	DagRunID       pgtype.UUID        `json:"dag_run_id"`
	DagIDText      string             `json:"dag_id_text"`
	TaskID         string             `json:"task_id"`
	TryNumber      int32              `json:"try_number"`
	AttemptEpoch   int32              `json:"attempt_epoch"`
	StartedAt      pgtype.Timestamptz `json:"started_at"`
	Heartbeated    bool               `json:"heartbeated"`
}

type ListScheduledDagsRow struct {
	TenantID      pgtype.UUID        `json:"tenant_id"`
	DagID         string             `json:"dag_id"`
	Schedule      *string            `json:"schedule"`
	Catchup       bool               `json:"catchup"`
	StartDate     pgtype.Timestamptz `json:"start_date"`
	MaxActiveRuns int32              `json:"max_active_runs"`
	NextRunAt     pgtype.Timestamptz `json:"next_run_at"`
	ScheduleEpoch int64              `json:"schedule_epoch"`
	LastLogical   interface{}        `json:"last_logical"`
}

type ListSettledRunIDsParams struct {
	TenantIds []pgtype.UUID `json:"tenant_ids"`
	RunIds    []pgtype.UUID `json:"run_ids"`
}

type ListSettledRunIDsRow struct {
	ID       pgtype.UUID `json:"id"`
	TenantID pgtype.UUID `json:"tenant_id"`
}

type ListStaleQueuedTaskInstancesParams struct {
	ThresholdSeconds float64            `json:"threshold_seconds"`
	AfterAt          pgtype.Timestamptz `json:"after_at"`
	AfterID          pgtype.UUID        `json:"after_id"`
	PageSize         int32              `json:"page_size"`
}

type ListStaleQueuedTaskInstancesRow struct {
	TaskInstanceID pgtype.UUID        `json:"task_instance_id"`
	DagRunID       pgtype.UUID        `json:"dag_run_id"`
	TenantID       pgtype.UUID        `json:"tenant_id"`
	DagIDText      string             `json:"dag_id_text"`
	TaskID         string             `json:"task_id"`
	TryNumber      int32              `json:"try_number"`
	AttemptEpoch   int32              `json:"attempt_epoch"`
	QueuedAt       pgtype.Timestamptz `json:"queued_at"`
	WarmWorkerID   *string            `json:"warm_worker_id"`
}

type ListTaskInstanceAttemptsParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	DagRunID pgtype.UUID `json:"dag_run_id"`
	TaskID   string      `json:"task_id"`
}

type ListTaskInstanceAttemptsRow struct {
	TaskInstanceID  pgtype.UUID        `json:"task_instance_id"`
	MapIndex        int32              `json:"map_index"`
	Operator        string             `json:"operator"`
	MaxTries        int32              `json:"max_tries"`
	TryNumber       int32              `json:"try_number"`
	State           TaskState          `json:"state"`
	QueuedAt        pgtype.Timestamptz `json:"queued_at"`
	ScheduledAt     pgtype.Timestamptz `json:"scheduled_at"`
	StartedAt       pgtype.Timestamptz `json:"started_at"`
	EndedAt         pgtype.Timestamptz `json:"ended_at"`
	DurationSeconds *float64           `json:"duration_seconds"`
	ExitCode        *int32             `json:"exit_code"`
	ErrorMessage    *string            `json:"error_message"`
	Hostname        *string            `json:"hostname"`
	PodName         *string            `json:"pod_name"`
	NodeName        *string            `json:"node_name"`
	Note            *string            `json:"note"`
	Pool            *string            `json:"pool"`
	PoolSlots       int32              `json:"pool_slots"`
}

type ListTaskInstancesByRunParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	DagRunID pgtype.UUID `json:"dag_run_id"`
}

type ListTaskInstancesFilteredParams struct {
	TenantID            pgtype.UUID `json:"tenant_id"`
	DagRunID            pgtype.UUID `json:"dag_run_id"`
	States              []string    `json:"states"`
	TaskIDPattern       *string     `json:"task_id_pattern"`
	TaskIDPrefixPattern *string     `json:"task_id_prefix_pattern"`
	Pool                *string     `json:"pool"`
	RowOffset           int32       `json:"row_offset"`
	RowLimit            int32       `json:"row_limit"`
}

type ListTenantDagTagsParams struct {
	TenantID             pgtype.UUID `json:"tenant_id"`
	Limit                int32       `json:"limit"`
	Offset               int32       `json:"offset"`
	TagNamePattern       *string     `json:"tag_name_pattern"`
	TagNamePrefixPattern *string     `json:"tag_name_prefix_pattern"`
}

type ListUsageEventsParams struct {
	AfterXid pgtype.Uint64 `json:"after_xid"`
	AfterID  int64         `json:"after_id"`
	RowLimit int32         `json:"row_limit"`
}

type ListUsageEventsRow struct {
	ID              int64              `json:"id"`
	Xid             pgtype.Uint64      `json:"xid"`
	Tenant          string             `json:"tenant"`
	DagID           string             `json:"dag_id"`
	RunID           string             `json:"run_id"`
	TaskInstanceID  pgtype.UUID        `json:"task_instance_id"`
	TaskID          string             `json:"task_id"`
	MapIndex        int32              `json:"map_index"`
	TryNumber       int32              `json:"try_number"`
	AttemptEpoch    int32              `json:"attempt_epoch"`
	Revision        int32              `json:"revision"`
	State           TaskState          `json:"state"`
	PreviousState   TaskState          `json:"previous_state"`
	PoolSlots       int32              `json:"pool_slots"`
	StartedAt       pgtype.Timestamptz `json:"started_at"`
	EndedAt         pgtype.Timestamptz `json:"ended_at"`
	LastFailureKind *string            `json:"last_failure_kind"`
	RecordedAt      pgtype.Timestamptz `json:"recorded_at"`
}

type ListUsersParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	Limit    int32       `json:"limit"`
	Offset   int32       `json:"offset"`
}

type ListUsersRow struct {
	ID        pgtype.UUID        `json:"id"`
	Email     string             `json:"email"`
	IsActive  bool               `json:"is_active"`
	CreatedAt pgtype.Timestamptz `json:"created_at"`
	Roles     []string           `json:"roles"`
}

type ListVariablesFilteredParams struct {
	TenantID         pgtype.UUID `json:"tenant_id"`
	Limit            int32       `json:"limit"`
	Offset           int32       `json:"offset"`
	KeyPattern       *string     `json:"key_pattern"`
	KeyPrefixPattern *string     `json:"key_prefix_pattern"`
}

type ListVariablesFilteredRow struct {
	Key         string  `json:"key"`
	Value       string  `json:"value"`
	Description *string `json:"description"`
}

type ListVariablesForEncryptionSweepParams struct {
	Prefix string `json:"prefix"`
	Sealed bool   `json:"sealed"`
}

type ListVariablesForEncryptionSweepRow struct {
	ID    pgtype.UUID `json:"id"`
	Key   string      `json:"key"`
	Value string      `json:"value"`
}

type ListVariablesParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	Limit    int32       `json:"limit"`
	Offset   int32       `json:"offset"`
}

type ListVariablesRow struct {
	Key         string  `json:"key"`
	Value       string  `json:"value"`
	Description *string `json:"description"`
}

type ListVariablesScopedParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	Keys     []string    `json:"keys"`
}

type ListVariablesScopedRow struct {
	Key         string  `json:"key"`
	Value       string  `json:"value"`
	Description *string `json:"description"`
}

type ListWarmBoundRunningTIsRow struct {
	TaskInstanceID pgtype.UUID `json:"task_instance_id"`
	TenantID       pgtype.UUID `json:"tenant_id"`
	DagRunID       pgtype.UUID `json:"dag_run_id"`
	DagIDText      string      `json:"dag_id_text"`
	TaskID         string      `json:"task_id"`
	TryNumber      int32       `json:"try_number"`
	AttemptEpoch   int32       `json:"attempt_epoch"`
	WarmWorkerID   *string     `json:"warm_worker_id"`
}

type ListWarmCurrentVersionsParams struct {
	Prewarm bool          `json:"prewarm"`
	DagIds  []pgtype.UUID `json:"dag_ids"`
}

type ListWarmCurrentVersionsRow struct {
	ID               pgtype.UUID `json:"id"`
	TenantID         pgtype.UUID `json:"tenant_id"`
	DagID            string      `json:"dag_id"`
	CurrentVersionID pgtype.UUID `json:"current_version_id"`
	Prewarm          bool        `json:"prewarm"`
}

type ListXComEntriesParams struct {
	Name   string `json:"name"`
	DagID  string `json:"dag_id"`
	RunID  string `json:"run_id"`
	TaskID string `json:"task_id"`
}

type ListXComEntriesRow struct {
	Key       string             `json:"key"`
	CreatedAt pgtype.Timestamptz `json:"created_at"`
}

type LockAPITokenOwnerParams struct {
	ID       pgtype.UUID `json:"id"`
	TenantID pgtype.UUID `json:"tenant_id"`
}

type LockAPITokenOwnerRow struct {
	ID    pgtype.UUID `json:"id"`
	Email string      `json:"email"`
}

type LockCLIDeviceForPollRow struct {
	ID                  pgtype.UUID `json:"id"`
	Status              string      `json:"status"`
	PollIntervalSeconds int32       `json:"poll_interval_seconds"`
	Expired             bool        `json:"expired"`
	TooFast             *bool       `json:"too_fast"`
	UserID              pgtype.UUID `json:"user_id"`
	Email               *string     `json:"email"`
	Roles               []string    `json:"roles"`
	Tenant              *string     `json:"tenant"`
}

type LockDagByDagIDParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	DagID    string      `json:"dag_id"`
}

type LockExpiredSettledRunsParams struct {
	TenantID pgtype.UUID        `json:"tenant_id"`
	Cutoff   pgtype.Timestamptz `json:"cutoff"`
	MaxRuns  int32              `json:"max_runs"`
}

type LockTaskInstancesOfRunsParams struct {
	TenantID pgtype.UUID   `json:"tenant_id"`
	RunIds   []pgtype.UUID `json:"run_ids"`
}

type LockTaskInstancesOfRunsRow struct {
	DagRunID pgtype.UUID `json:"dag_run_id"`
	Settled  bool        `json:"settled"`
}

type MarkCLIDevicePolledParams struct {
	PollIntervalSeconds int32       `json:"poll_interval_seconds"`
	ID                  pgtype.UUID `json:"id"`
}

type MarkRunAlertDeliveredParams struct {
	ID      pgtype.UUID `json:"id"`
	Attempt int32       `json:"attempt"`
}

type MarkRunOrphanedRunParams struct {
	ID          pgtype.UUID        `json:"id"`
	QuietBefore pgtype.Timestamptz `json:"quiet_before"`
}

type MarkStagingDeletedParams struct {
	Reason  *string `json:"reason"`
	PvcName string  `json:"pvc_name"`
}

type MarkTaskAgentLostParams struct {
	Provisional  bool        `json:"provisional"`
	ID           pgtype.UUID `json:"id"`
	TryNumber    int32       `json:"try_number"`
	AttemptEpoch int32       `json:"attempt_epoch"`
}

type MarkTaskCredentialCeilingParams struct {
	ID           pgtype.UUID `json:"id"`
	TryNumber    int32       `json:"try_number"`
	AttemptEpoch int32       `json:"attempt_epoch"`
}

type MarkTaskDispatchFailedParams struct {
	DagRunID     pgtype.UUID `json:"dag_run_id"`
	TaskID       string      `json:"task_id"`
	ErrorMessage *string     `json:"error_message"`
}

type MarkTaskDispatchLostParams struct {
	Provisional  bool        `json:"provisional"`
	ID           pgtype.UUID `json:"id"`
	TryNumber    int32       `json:"try_number"`
	AttemptEpoch int32       `json:"attempt_epoch"`
}

type MarkTaskInstanceQueuedParams struct {
	DagRunID             pgtype.UUID        `json:"dag_run_id"`
	TaskID               string             `json:"task_id"`
	ExpectNextDispatchAt pgtype.Timestamptz `json:"expect_next_dispatch_at"`
}

type MarkTaskInstancesRemovedParams struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	DagRunID pgtype.UUID `json:"dag_run_id"`
	TaskIds  []string    `json:"task_ids"`
}

type MarkTaskPodLostParams struct {
	Provisional  bool        `json:"provisional"`
	ErrorMessage *string     `json:"error_message"`
	ID           pgtype.UUID `json:"id"`
	TryNumber    int32       `json:"try_number"`
	AttemptEpoch int32       `json:"attempt_epoch"`
}

type MarkTaskStartExpiredParams struct {
	Provisional  bool        `json:"provisional"`
	ID           pgtype.UUID `json:"id"`
	TryNumber    int32       `json:"try_number"`
	AttemptEpoch int32       `json:"attempt_epoch"`
}

type NullDagRunState struct {
	DagRunState DagRunState `json:"dag_run_state"`
	Valid       bool        `json:"valid"` // Valid is true if DagRunState is not NULL
}

type NullDagRunTrigger struct {
	DagRunTrigger DagRunTrigger `json:"dag_run_trigger"`
	Valid         bool          `json:"valid"` // Valid is true if DagRunTrigger is not NULL
}

type NullTaskState struct {
	TaskState TaskState `json:"task_state"`
	Valid     bool      `json:"valid"` // Valid is true if TaskState is not NULL
}

type Permission struct {
	ID          pgtype.UUID `json:"id"`
	Action      string      `json:"action"`
	Resource    string      `json:"resource"`
	Description *string     `json:"description"`
}

type Pool struct {
	ID          pgtype.UUID        `json:"id"`
	TenantID    pgtype.UUID        `json:"tenant_id"`
	Name        string             `json:"name"`
	Slots       int32              `json:"slots"`
	Description *string            `json:"description"`
	IsDefault   bool               `json:"is_default"`
	CreatedAt   pgtype.Timestamptz `json:"created_at"`
	UpdatedAt   pgtype.Timestamptz `json:"updated_at"`
}

type PoolBudgetsRow struct {
	TenantID pgtype.UUID `json:"tenant_id"`
	Name     string      `json:"name"`
	Slots    int32       `json:"slots"`
}

type PoolSlotUsageRow struct {
	Pool  string    `json:"pool"`
	State TaskState `json:"state"`
	N     int64     `json:"n"`
}

type Querier interface {
	AddFavorite(ctx context.Context, arg AddFavoriteParams) error
	// Approves a pending, unexpired sign-in as a user of the named tenant. The
	// join is the tenant check: a user outside that tenant matches no row, and
	// neither does a sign-in already decided, so each is approved once across
	// every replica.
	ApproveCLIDevice(ctx context.Context, arg ApproveCLIDeviceParams) (int64, error)
	AssignUserRole(ctx context.Context, arg AssignUserRoleParams) error
	// Records the durable warm-attempt binding (ADR 0058 N1d-a1): the warm worker
	// pod ($4, its own downward-API pod name) that acked THIS attempt (dag_run_id,
	// task_id, try_number) as started. A later failover reaper matches warm_worker_id
	// against the live warm-pod set to find attempts a dead warm pod held.
	//
	// Guarded on state IN ('scheduled', 'queued', 'running'), so a settled attempt
	// is never bound: an ack that races a reaper settling the row must not stamp a
	// worker onto a terminal TI. 'scheduled' is admitted because with synchronous
	// dispatch the warm placer hands the assignment out inside Dispatch, before the
	// tick records queued, and the worker can ack (and report RUNNING) first. Missing
	// that bind left a running warm attempt unbound, and the pod-lost reaper failed it
	// while it ran (#1600). The epoch pin makes this safe: a scheduled row carries the
	// claimed epoch only for the attempt the dispatcher just handed out, and every
	// re-dispatch bumps it. Bounded by (dag_run_id, task_id, try_number,
	// attempt_epoch) to match exactly the attempt the assignment named. Returns the
	// affected row count; zero means the attempt already moved on (terminal or
	// superseded), and the caller treats that as a benign no-op, never an error.
	BindWarmAttempt(ctx context.Context, arg BindWarmAttemptParams) (int64, error)
	// Atomically claim one on-failure ATTEMPT for a run, returning the row iff this
	// call won it. Replaces the old claim-then-send (#431), which set alerted_at
	// before the send and so lost the page whenever the send failed.
	//
	// Three predicates, one per way an attempt should be refused:
	//   * alerted_at IS NULL  — already delivered; never page twice for one episode.
	//   * alert_attempts < $2 — the budget is spent; a dead endpoint stops being
	//     retried instead of being hit once per tick for the life of the run.
	//   * next_alert_attempt_at — backoff has not elapsed yet.
	//
	// The attempt is consumed up front, before the send, so a crash mid-send costs one
	// attempt rather than looping. A clear resets all three (ResetDagRunToVersion),
	// making the next genuine failure a fresh episode with a fresh budget.
	ClaimAlertAttempt(ctx context.Context, arg ClaimAlertAttemptParams) (ClaimAlertAttemptRow, error)
	// The dispatcher's claim of a new execution attempt (ADR 0051 amendment, A1).
	// launchQueued creates the pod BEFORE it records `queued`, so a dispatch whose
	// queued write failed is dispatched again on a later tick with no reset rail in
	// between; without a claim here both pods would share (try_number,
	// attempt_epoch). Bumping at dispatch gives every execution its own epoch
	// whatever path led to it. The token (A2) and the pod label (A4) are minted
	// from the value returned.
	//
	// Guarded to the pre-dispatch states. 'queued' is included because the
	// buffered dispatcher records queued before its worker resolves the row. A row
	// that is running or settled is never claimed (zero rows), so a late or
	// duplicate dispatch cannot move the epoch of the live attempt. The row is the
	// task's latest try, matching how the dispatcher has always resolved it.
	ClaimAttemptEpoch(ctx context.Context, arg ClaimAttemptEpochParams) (ClaimAttemptEpochRow, error)
	// The DAG's stored next due time goes with its runs (#2175).
	ClearDagRuns(ctx context.Context, arg ClearDagRunsParams) (int64, error)
	// The reconciler confirms a provisional infra mark (ADR 0052 amendment, part
	// 2): the attempt's pods show no SUCCESS record and no task container still
	// running, so the guess stands and the planner may re-place. Guarded on the
	// exact attempt and the provisional mark, so a confirmation computed for a
	// superseded attempt, or a second one, is a no-op.
	ConfirmInfraFailure(ctx context.Context, arg ConfirmInfraFailureParams) (int64, error)
	// Grant each copied built-in role the same permissions as its "default" twin.
	// Only the tenant's built-in roles: a custom role that shares a built-in's
	// name (one created before a migration added that built-in) keeps its grants.
	CopyDefaultRolePermissions(ctx context.Context, tenantID pgtype.UUID) error
	// Give a tenant the built-in roles the migrations seed for "default". Copying
	// keeps every tenant's ladder equal to default's as later migrations change it.
	CopyDefaultSystemRoles(ctx context.Context, tenantID pgtype.UUID) error
	CountAPITokens(ctx context.Context, arg CountAPITokensParams) (int64, error)
	// Counts queued+running runs for a single DAG; used by the manual-trigger
	// path to enforce max_active_runs (#200) before insert.
	CountActiveDagRunsByDagID(ctx context.Context, arg CountActiveDagRunsByDagIDParams) (int64, error)
	CountAuditLogs(ctx context.Context, arg CountAuditLogsParams) (int64, error)
	CountConnections(ctx context.Context, tenantID pgtype.UUID) (int64, error)
	CountConnectionsFiltered(ctx context.Context, arg CountConnectionsFilteredParams) (int64, error)
	CountDagRunStatesInWindow(ctx context.Context, arg CountDagRunStatesInWindowParams) ([]CountDagRunStatesInWindowRow, error)
	// The tenant is checked on the parent dag, once, rather than on every run row:
	// a per-row tenant_id filter would turn the index-only count over
	// idx_dag_runs_dag_logical into a heap visit per run. A dag_runs row always
	// carries its dag's tenant, so a dag id of another tenant counts zero either
	// way (#508).
	CountDagRunsByDag(ctx context.Context, arg CountDagRunsByDagParams) (int64, error)
	CountDagRunsByDagStates(ctx context.Context, arg CountDagRunsByDagStatesParams) (int64, error)
	CountDagRunsFiltered(ctx context.Context, arg CountDagRunsFilteredParams) (int64, error)
	CountDags(ctx context.Context, tenantID pgtype.UUID) (int64, error)
	// One index probe per DAG of the tenant for its newest run. DAGs without runs
	// drop out of the CROSS JOIN, so they are not counted.
	CountDagsByLatestRunState(ctx context.Context, tenantID pgtype.UUID) ([]CountDagsByLatestRunStateRow, error)
	// Same newest-run lookup as ListDagsFiltered.
	CountDagsFiltered(ctx context.Context, arg CountDagsFilteredParams) (int64, error)
	CountDagsWithFilter(ctx context.Context, arg CountDagsWithFilterParams) (int64, error)
	// The dry-run count for one tenant: the same predicate as
	// LockExpiredSettledRuns, with no lock, through the same partial index, and
	// stopped after max_runs runs so its cost stays bounded however long the
	// history is. The janitor reports a total that reached the cap as a lower bound.
	CountExpiredSettledRunsOfTenant(ctx context.Context, arg CountExpiredSettledRunsOfTenantParams) (CountExpiredSettledRunsOfTenantRow, error)
	// System audit rows (no tenant) older than the cutoff, at most max_rows.
	CountExpiredSystemAuditLog(ctx context.Context, arg CountExpiredSystemAuditLogParams) (int64, error)
	// Audit rows of one tenant older than the cutoff, at most max_rows.
	CountExpiredTenantAuditLog(ctx context.Context, arg CountExpiredTenantAuditLogParams) (int64, error)
	// Counts what DeleteExpiredUsageEvents would delete, looking at no more than
	// max_rows events.
	CountExpiredUsageEvents(ctx context.Context, arg CountExpiredUsageEventsParams) (int64, error)
	CountImportErrorsFiltered(ctx context.Context, arg CountImportErrorsFilteredParams) (int64, error)
	CountLiveAPITokens(ctx context.Context, arg CountLiveAPITokensParams) (int64, error)
	// The live sign-ins, in all and from one requester.
	CountLiveCLIDevices(ctx context.Context, requesterHash string) (CountLiveCLIDevicesRow, error)
	// Does this address have a usable LOCAL password login in the tenant? The boot
	// check on auth.oidc.break_glass_emails asks it: an address on that allowlist
	// with no password row is an escape hatch that does not open, which is worse
	// than an empty allowlist because the operator believes they have one.
	//
	// password_hash IS NOT NULL is the point, not merely that the row exists. A user
	// created by OIDC just-in-time provisioning has a NULL password (the table's
	// users_has_auth check permits it because the OIDC subject is the other half),
	// so the row can exist while no password can ever be verified against it.
	CountLocalPasswordUser(ctx context.Context, arg CountLocalPasswordUserParams) (int64, error)
	CountPools(ctx context.Context, tenantID pgtype.UUID) (int64, error)
	CountTaskInstanceStatesInWindow(ctx context.Context, arg CountTaskInstanceStatesInWindowParams) ([]CountTaskInstanceStatesInWindowRow, error)
	CountTaskInstancesFiltered(ctx context.Context, arg CountTaskInstancesFilteredParams) (int64, error)
	CountTenantDagTags(ctx context.Context, arg CountTenantDagTagsParams) (int64, error)
	CountTenantDags(ctx context.Context, tenantID pgtype.UUID) (int64, error)
	CountUsers(ctx context.Context, tenantID pgtype.UUID) (int64, error)
	CountVariables(ctx context.Context, tenantID pgtype.UUID) (int64, error)
	CountVariablesFiltered(ctx context.Context, arg CountVariablesFilteredParams) (int64, error)
	CreateAuditLog(ctx context.Context, arg CreateAuditLogParams) error
	CreateDagRun(ctx context.Context, arg CreateDagRunParams) (DagRun, error)
	// Zero rows means the slot's run already exists (or the DAG has no current
	// version): the caller then rolls back the charge it took from the tenant's
	// daily run cap.
	CreateScheduledRunByDagID(ctx context.Context, arg CreateScheduledRunByDagIDParams) (int64, error)
	// try_number starts at 1 to match Airflow (1-based attempts): the first run's
	// logs live at .../1.log, which is where the UI's log view looks. Retries bump
	// it via ResetForRetry. pool_slots is the task's EffectivePoolSlots (#1499).
	CreateTaskInstance(ctx context.Context, arg CreateTaskInstanceParams) (TaskInstance, error)
	// Batched form of CreateTaskInstance: materializes every task of one run in a
	// single COPY instead of T INSERT round-trips. The caller supplies one param row
	// per task with try_number pinned to 1 (matching CreateTaskInstance's literal)
	// and pool carried through so cross-DAG pool occupancy is attributed correctly;
	// pool_slots carries the task's EffectivePoolSlots so that occupancy is
	// weighted like the admission gate's (#1499). Columns omitted from the list
	// take their table defaults, so the rows are byte-identical to the loop: only
	// the statement count changes (T INSERTs → 1 COPY).
	CreateTaskInstances(ctx context.Context, arg []CreateTaskInstancesParams) (int64, error)
	CreateUser(ctx context.Context, arg CreateUserParams) (pgtype.UUID, error)
	// Whether run_id of the DAG dag_id in tenant tenant_id exists: the read behind
	// a refused daily run cap charge, so a run that already exists keeps its usual
	// answer (a no-op for a scheduled slot, a conflict for a manual run id) instead
	// of a refusal, and nothing is written (createRunWithinDailyLimit).
	DagRunExistsByDagID(ctx context.Context, arg DagRunExistsByDagIDParams) (bool, error)
	// Ends a sign-in once its outcome was answered: redeemed or denied. The
	// poll answers that outcome only when this deleted the row, so a sign-in is
	// answered once even if two polls read it.
	DeleteCLIDevice(ctx context.Context, id pgtype.UUID) (int64, error)
	DeleteConnection(ctx context.Context, arg DeleteConnectionParams) (int64, error)
	DeleteDag(ctx context.Context, arg DeleteDagParams) (int64, error)
	// Removes one run; its task_instances and XCom rows cascade (ON DELETE CASCADE).
	// The DAG's stored next due time is cleared in the same statement (#2175): the
	// deleted run may have been its latest, which the time was computed from.
	DeleteDagRun(ctx context.Context, arg DeleteDagRunParams) (int64, error)
	// Removes the locked runs whose children are all gone, up to row_limit. The
	// stored next due time of each DAG they belong to is cleared (#2175), in case
	// a run removed was the DAG's latest; a DAG whose run stays is only listed
	// once more.
	DeleteDagRunsByID(ctx context.Context, arg DeleteDagRunsByIDParams) (int64, error)
	// Forgets device sign-ins that expired more than ten minutes ago, with the
	// address each was started from. Run before each create and by a sweep
	// every minute, so the table holds only what is live or just expired (a CLI
	// polling a just-expired sign-in still hears expired_token).
	DeleteExpiredCLIDevices(ctx context.Context) (int64, error)
	// Deletes the oldest usage events in serving order, (xid, id), up to
	// row_limit, stopping at the first one recorded at or after the cutoff, so the
	// deleted rows are always a prefix of what the service API serves. Only
	// events the API can serve are considered, and the pruned mark moves to the
	// last one deleted in the same statement, forward only: an event a very long
	// transaction commits below the mark is deleted without moving it back.
	DeleteExpiredUsageEvents(ctx context.Context, arg DeleteExpiredUsageEventsParams) (int64, error)
	DeleteExpiredXComIndex(ctx context.Context) error
	DeleteImportError(ctx context.Context, arg DeleteImportErrorParams) error
	// The implicit default pool is never deletable (Airflow parity): the guard is in
	// the query so a direct call cannot orphan the fallback pool the gate resolves to.
	DeletePool(ctx context.Context, arg DeletePoolParams) (int64, error)
	DeleteSystemAuditLog(ctx context.Context, arg DeleteSystemAuditLogParams) (int64, error)
	DeleteTaskInstanceHistoryOfRuns(ctx context.Context, arg DeleteTaskInstanceHistoryOfRunsParams) (int64, error)
	// Deletes the task instances of whole runs only, never part of a run's: a run
	// left with some of its task instances could be cleared between two batches,
	// and the clear re-opens it resetting only the instances it finds, so the
	// deleted tasks would never run and the run would never settle. A run whose
	// task instances are all gone is safe to clear: it re-opens queued with none,
	// and the scheduler materializes it again. Runs are taken in id order while
	// their task instances fit row_limit; first_run_always lets the first run go
	// whole even when it alone exceeds the limit, so a run larger than a batch is
	// still deleted (the janitor sets it when the batch has its whole limit left).
	DeleteTaskInstancesOfRuns(ctx context.Context, arg DeleteTaskInstancesOfRunsParams) (int64, error)
	DeleteTenantAuditLog(ctx context.Context, arg DeleteTenantAuditLogParams) (int64, error)
	// Remove every role grant for a user: the delete half of the IdP-authoritative
	// reconcile that sets the grants to exactly the group-mapped set on each login.
	DeleteUserRoles(ctx context.Context, userID pgtype.UUID) error
	DeleteVariable(ctx context.Context, arg DeleteVariableParams) (int64, error)
	// Removes the XCom index rows of task instances a clear is resetting (#1131) and
	// returns their backend keys, so the stored values can be deleted too. XCom
	// carries no try number, so rows left behind would serve the cleared attempt's
	// values to the next attempt's downstream.
	DeleteXComIndexForTasks(ctx context.Context, arg DeleteXComIndexForTasksParams) ([]string, error)
	DeleteXComIndexOfRuns(ctx context.Context, arg DeleteXComIndexOfRunsParams) (int64, error)
	// Records that the person canceled a pending, unexpired sign-in.
	DenyCLIDevice(ctx context.Context, id pgtype.UUID) (int64, error)
	// The consecutive dispatch-failure count of a task still waiting to run
	// (scheduled or queued); no row means it has moved on.
	DispatchAttemptsForActive(ctx context.Context, arg DispatchAttemptsForActiveParams) (int32, error)
	// Creates the dags row of a DAG registered for the first time, with the
	// metadata of the spec that will become its first version. An existing row is
	// left untouched (no write, no lock): RegisterDagVersion then locks it with
	// LockDagByDagID and rewrites the metadata only when a new version becomes
	// current (UpdateDagMetadata). A concurrent first insert of the same dag_id
	// waits on the unique index until the other transaction ends.
	// is_paused is set here, on creation (dags_are_paused_at_creation or the
	// spec's is_paused_upon_creation, #1705): a redeploy never changes it, unless
	// the register asks for a state (is_paused), which SetDagPaused then applies.
	// The row count tells the register whether it created the DAG (1) or found it (0).
	EnsureDag(ctx context.Context, arg EnsureDagParams) (int64, error)
	// The subset of the given conn_ids that exist for the tenant. Used to reject a
	// DAG that declares an unknown connection at registration (ADR 0055 D6); a name
	// absent from the result does not exist.
	ExistingConnectionIDs(ctx context.Context, arg ExistingConnectionIDsParams) ([]string, error)
	// The subset of the given keys that exist for the tenant. Used to reject a DAG
	// that declares an unknown Variable at registration (ADR 0055 D6); a name absent
	// from the result does not exist.
	ExistingVariableKeys(ctx context.Context, arg ExistingVariableKeysParams) ([]string, error)
	// The dispatch-attempt budget is spent (ADR 0031 Amendment A): fail the task with
	// a dispatch_failed reason so the run can finalize instead of looping forever.
	// error_message carries the underlying cause. Guarded to 'scheduled' for the same
	// reason as RecordDispatchFailure. This is distinct from dispatch_lost (a TI that
	// reached 'queued' then vanished) and from a task's own 'failed' (the code ran).
	// dispatch_failed is terminal: a dispatch failure never consumes try_number
	// (ADR 0031 Amendment A), so the user's retry budget is not a second dispatch
	// budget. It is spent the way FailDispatchRefused spends it, by lowering
	// max_tries to the current try, so the planner does not move the task to
	// up_for_retry and dispatch it again on a new try. A clear restores the
	// budget from the task, as after a refusal.
	FailDispatchExhausted(ctx context.Context, arg FailDispatchExhaustedParams) error
	// A dispatch the executor refused (ADR 0066 section 3: the task is larger than
	// its size, or above executor.unit.max_size) fails the task for good. The
	// verdict is permanent, so no retry can change it: the retry budget is spent by
	// lowering max_tries to the current try, which makes the planner's
	// try_number < max_tries check false without counting a try that never ran. A
	// clear restores the budget from the task as usual (#1131), so an operator who
	// fixes the DAG or the unit can run it again. Guarded to the dispatch states:
	// the sync path refuses a scheduled task, the buffered path a scheduled or
	// queued one, and a row that moved on is left alone.
	FailDispatchRefused(ctx context.Context, arg FailDispatchRefusedParams) error
	// Fails the queued and running task instances of a tenant suspended in stop
	// mode (#2181), as a user's mark failed does: the row is the verdict, so the
	// attempt's next heartbeat or state report matches no live row, the agent is
	// told to terminate and kills its task process group. The tenants join keeps
	// it a no-op once the suspension is lifted or changed to another mode, so the
	// service API and every scheduler tick can run it. Scheduled task instances
	// are left alone: nothing dispatches them while the tenant is suspended, and
	// they run once it is resumed. idx_ti_active_tenant serves the scan.
	FailStoppedTenantTaskInstances(ctx context.Context, tenantID pgtype.UUID) (int64, error)
	// Settle a task instance failed from the pod reconciler, guarded by id,
	// try_number and attempt_epoch (ADR 0052, ADR 0051 amendment): try_number bumps
	// IN PLACE on retry (same row id), and an infra re-place or reschedule keeps the
	// try but bumps the epoch, so a stale reconciler acting on a previous attempt's
	// lingering pod must not match the new attempt and clobber it. The pod's epoch
	// comes from its leoflow.io/attempt-epoch label, absent meaning 0. The
	// active-state guard prevents clobbering a terminal row.
	FailTaskInstanceIfActive(ctx context.Context, arg FailTaskInstanceIfActiveParams) error
	// Settle a task instance failed for an infrastructure reason from the pod
	// reconciler (ADR 0051, #1595): the cluster stopped the pod (an eviction, a
	// graceful node shutdown, a preemption), so the attempt goes to the infra
	// re-place rail and keeps the task's own retries. Confirmed at once: the
	// reconciler read the terminal pod and found no SUCCESS record, which is what
	// the confirmation pass would check (ADR 0052 amendment, part 2). Guarded like
	// FailTaskInstanceIfActive on id, try_number, attempt_epoch and the active
	// states.
	FailTaskInstanceInfraIfActive(ctx context.Context, arg FailTaskInstanceInfraIfActiveParams) error
	// The sign-in a person typed the user code of, while it can still be
	// approved.
	FindPendingCLIDeviceByUserCode(ctx context.Context, userCodeHash string) (FindPendingCLIDeviceByUserCodeRow, error)
	// The per-request lookup of an API token. Revoked and expired tokens are
	// returned too, so the authenticator decides, and says why in one place.
	GetAPITokenByHash(ctx context.Context, tokenHash string) (GetAPITokenByHashRow, error)
	GetConnection(ctx context.Context, arg GetConnectionParams) (GetConnectionRow, error)
	GetCurrentDagSpec(ctx context.Context, arg GetCurrentDagSpecParams) ([]byte, error)
	GetDagByDagID(ctx context.Context, arg GetDagByDagIDParams) (Dag, error)
	// tenant_id is a predicate here, not only a property of the caller's resolved
	// dag id (#508): a dag id of another tenant finds no run.
	GetDagRun(ctx context.Context, arg GetDagRunParams) (DagRun, error)
	// Unscoped: for the scheduler and the dispatcher, which hold run ids from
	// their own listings. A run id that arrives in an agent token is read with
	// GetDagRunInTenant instead (#508).
	GetDagRunByID(ctx context.Context, id pgtype.UUID) (DagRun, error)
	// A finished run a clear may move to the DAG's current version, read and
	// locked inside the clear's transaction before any of its task instances is
	// written (ADR 0086). The move depends on the run's state, so it is decided
	// on the locked row: a second clear of the same run waits for the first
	// instead of deciding from the same state. Only a finished run is locked:
	// the state predicate is checked again after a wait, so a run another clear
	// re-opened meanwhile is not returned and not held. The orphan reaper
	// share-locks a running run's task instances and then updates the run row,
	// the opposite order. NO KEY UPDATE is enough, since no key changes, and it
	// lets through the key-share lock an XCom insert of a live attempt takes on
	// the run. The retention janitor locks finished runs with SKIP LOCKED and
	// their task instances with NOWAIT, so it skips or gives way and never waits
	// on a clear.
	GetDagRunForUpdate(ctx context.Context, arg GetDagRunForUpdateParams) (DagRun, error)
	// A run by id, only inside the given tenant: the agent RPC reads the run its
	// token names with the token's tenant, so a token of one tenant never loads
	// another tenant's run (#508).
	GetDagRunInTenant(ctx context.Context, arg GetDagRunInTenantParams) (DagRun, error)
	// The run plus the LABEL of the version it is pinned to. The API needs the label
	// to populate bundle_version, which is what makes the UI's clear dialog render
	// its "Run with latest bundle version" control: the SPA shows that control only
	// when the run's bundle_version differs from the DAG's, and hides it when either
	// is null. A null there means the operator has no way to ask for the current
	// version, whatever the API supports.
	//
	// LEFT JOIN is defensive, not load-bearing today: dag_runs.dag_version_id is NOT
	// NULL with a plain FK, so the version row cannot disappear under a live run. It
	// is written this way so that a future ON DELETE SET NULL degrades to a null
	// label instead of dropping the run from the UI.
	GetDagRunWithVersion(ctx context.Context, arg GetDagRunWithVersionParams) (GetDagRunWithVersionRow, error)
	// dag_versions has no tenant_id: the tenant is checked on the parent dag (#508).
	GetDagVersionByHash(ctx context.Context, arg GetDagVersionByHashParams) (DagVersion, error)
	// Unscoped: for the spec cache the scheduler and the dispatcher share, which
	// hold version ids from their own runs. A request path reads a version with
	// GetDagVersionInTenant (#508).
	GetDagVersionByID(ctx context.Context, id pgtype.UUID) (DagVersion, error)
	// A version by id, only when its DAG belongs to the given tenant (#508).
	// dag_versions has no tenant_id of its own; the tenant is its DAG's.
	GetDagVersionInTenant(ctx context.Context, arg GetDagVersionInTenantParams) (DagVersion, error)
	// Unscoped, like GetDagVersionByID: the spec cache's batch fill for a warm
	// pool reconcile tick, which reads the versions of its own targets (#1707).
	GetDagVersionsByIDs(ctx context.Context, ids []pgtype.UUID) ([]DagVersion, error)
	// See ListDagsWithVersion.
	GetDagWithVersion(ctx context.Context, arg GetDagWithVersionParams) (GetDagWithVersionRow, error)
	GetDefaultTenant(ctx context.Context) (GetDefaultTenantRow, error)
	GetPool(ctx context.Context, arg GetPoolParams) (GetPoolRow, error)
	GetRoleByName(ctx context.Context, arg GetRoleByNameParams) (pgtype.UUID, error)
	// Resolve a role name to its id within the user's OWN tenant, so an OIDC login
	// can reconcile the user's grants to the group-mapped set without the caller
	// passing the tenant separately. A name that is not a role in that tenant yields
	// no row, which the reconcile turns into a fail-closed error.
	GetRoleIDForUserTenant(ctx context.Context, arg GetRoleIDForUserTenantParams) (pgtype.UUID, error)
	// The grants of one role, for a CI OIDC session that acts with that role
	// alone (ADR 0092). The caller resolved the role in its tenant first
	// (GetRoleByName), so the tenant predicate is on that lookup.
	GetRolePermissionsByID(ctx context.Context, roleID pgtype.UUID) ([]GetRolePermissionsByIDRow, error)
	GetTenantByName(ctx context.Context, name string) (GetTenantByNameRow, error)
	// The suspension is read with the limits, so run creation learns both from
	// the one row it already reads (#2181).
	GetTenantLimits(ctx context.Context, id pgtype.UUID) (GetTenantLimitsRow, error)
	// The id of a user of the tenant: no row when the user is gone or belongs to
	// another tenant, so a stale token's subject records no creator.
	GetTenantUserID(ctx context.Context, arg GetTenantUserIDParams) (pgtype.UUID, error)
	// Whether recording is on and the pruned mark, read in the snapshot of the
	// page they decide.
	GetUsageEventsState(ctx context.Context) (GetUsageEventsStateRow, error)
	GetUserByEmail(ctx context.Context, arg GetUserByEmailParams) (GetUserByEmailRow, error)
	// The by-id lookup backing the per-request authz reload. Returns the tenant
	// name (not the uuid) so the reconstructed principal matches the login path's
	// User.TenantID, plus the active flag the authenticator gates on.
	GetUserByID(ctx context.Context, id pgtype.UUID) (GetUserByIDRow, error)
	// Resolve an OIDC identity to a Dexaflow user by its immutable (provider,
	// subject) pair (the trusted link key). Returns the tenant name (not the uuid)
	// so the reconstructed principal matches the login path's User.TenantID, plus
	// the active flag the login gates on. Never selects password_hash.
	GetUserByOIDCSubject(ctx context.Context, arg GetUserByOIDCSubjectParams) (GetUserByOIDCSubjectRow, error)
	GetUserPermissions(ctx context.Context, userID pgtype.UUID) ([]GetUserPermissionsRow, error)
	// The per-request authz reload in ONE round trip: what GetUserByID,
	// GetUserRoles and GetUserPermissions return, folded into a single statement.
	// Permissions are a JSON array of distinct [action, resource] pairs.
	GetUserPrincipalByID(ctx context.Context, id pgtype.UUID) (GetUserPrincipalByIDRow, error)
	GetUserRoles(ctx context.Context, userID pgtype.UUID) ([]string, error)
	GetVariable(ctx context.Context, arg GetVariableParams) (GetVariableRow, error)
	GetXComByNames(ctx context.Context, arg GetXComByNamesParams) (GetXComByNamesRow, error)
	GetXComEntry(ctx context.Context, arg GetXComEntryParams) (GetXComEntryRow, error)
	// Stores a new API token (ADR 0074). The caller holds LockAPITokenOwner and
	// has checked the cap in the same transaction.
	InsertAPIToken(ctx context.Context, arg InsertAPITokenParams) (InsertAPITokenRow, error)
	// Starts a device sign-in. The expiry is the database's clock, the one every
	// other statement here compares against.
	InsertCLIDevice(ctx context.Context, arg InsertCLIDeviceParams) (InsertCLIDeviceRow, error)
	// The row is inserted only under a dag of the given tenant (#508): a dag id of
	// another tenant inserts nothing and the query returns no row.
	// build_info is NULL when the register sent none (#1702).
	InsertDagVersion(ctx context.Context, arg InsertDagVersionParams) (DagVersion, error)
	// The implicit default pool every tenant needs (migration 023 seeds it for
	// "default"), copied from default's so the slot count stays in step.
	InsertDefaultPool(ctx context.Context, tenantID pgtype.UUID) error
	// Just-in-time provisioning insert for a first OIDC login: an OIDC-only user
	// (NULL password) linked by (oidc_provider, oidc_subject). The unique
	// (oidc_provider, oidc_subject) constraint makes a concurrent double-provision
	// surface as a conflict rather than a duplicate identity.
	InsertOIDCUser(ctx context.Context, arg InsertOIDCUserParams) (InsertOIDCUserRow, error)
	// Service API (#1283): create a tenant by name, or do nothing when it exists.
	// Zero rows affected means it already existed.
	InsertTenantIfMissing(ctx context.Context, arg InsertTenantIfMissingParams) (int64, error)
	// Mirrors the bootstrap CreateUser insert (tenant_id, email, password_hash) but
	// returns the columns the admin create-user API echoes back to the caller.
	InsertUser(ctx context.Context, arg InsertUserParams) (InsertUserRow, error)
	// Reports whether the attempt (dag_run_id, task_id, try_number) is still live:
	// present and in an active (non-terminal) state. This is exactly the predicate
	// RecordTaskHeartbeat stamps on — the same (dag_run_id, task_id, try_number)
	// tuple and the same state IN ('queued', 'running') guard — but as a pure READ
	// with no write. It is the read-only revocation signal the secret path consults
	// (ADR 0055): a terminal or superseded attempt (try_number moved on) is not
	// live, so a token that carries it stops resolving secrets, even while its
	// signature is still valid.
	//
	// It MUST derive ONLY from (run, task, try) + active state. It must NEVER gain a
	// "run is not current / archived / logical_date in the past" clause: a recency
	// term would deny a legitimate clear-and-rerun of an old run — credential
	// lifetime binds to the attempt, never to the run's age or logical date.
	//
	// The epoch term is the heartbeat's: exact for a token carrying attempt_epoch,
	// absent for a claim-less one (ADR 0051 amendment).
	//
	// 'scheduled' is live too, for a token whose epoch matches (#2201), as in
	// BindWarmAttempt: the dispatcher claims the epoch and hands the attempt out
	// before it records queued, and a subprocess agent or a warm worker can ask for
	// its secrets in that gap. Only the claim mints that epoch and every later
	// dispatch moves it, so the match names the attempt just handed out. A token
	// without an epoch cannot be pinned that way and needs queued or running.
	IsTaskInstanceLive(ctx context.Context, arg IsTaskInstanceLiveParams) (bool, error)
	LatestRunsForDags(ctx context.Context, arg LatestRunsForDagsParams) ([]LatestRunsForDagsRow, error)
	// The tenant's unrevoked tokens, newest first; owner_id NULL lists every
	// owner's. Never selects token_hash.
	ListAPITokens(ctx context.Context, arg ListAPITokensParams) ([]ListAPITokensRow, error)
	// The runs the scheduler reads on a tick, and the warm-pool reconcile reads:
	// every queued and running run, each with dag_paused, the is_paused of its DAG.
	// No run is filtered out. The scheduler leaves a queued run of a paused DAG
	// waiting (not started, nothing materialized or dispatched) until the DAG is
	// unpaused, whoever created it (a manual trigger, a clear), as Airflow 3 does
	// when it moves queued runs to running (#1705); a running run of a paused DAG
	// advances so the tasks it started finish. The waiting run stays in the result
	// because a clear on a running run puts it back in queued while other tasks of
	// it still run, and those tasks must keep counting against max_active_runs,
	// max_active_tasks and the pool caps. dag_max_active_runs is the DAG's
	// max_active_runs: the tick starts a queued run only while fewer than that
	// many runs of the DAG are running, as Airflow does (#1766). Both come from one
	// primary-key probe of dags per active run; a run whose DAG row is gone reads
	// unpaused with 0, which the scheduler takes as unlimited. The probe is a
	// LATERAL subquery with LIMIT 1 on purpose: a plain LEFT JOIN lets the planner
	// hash every row of dags, a cost that grows with the number of DAGs (about 10
	// ms against 2 ms for 500 active runs over 20000 DAGs), while the scan stays
	// on idx_dag_runs_state and the probe keeps the cost proportional to the
	// active runs. tenant_suspension_mode is the suspension mode of the run's
	// tenant, ” when it is not suspended (#2181): under drain or stop the tick
	// dispatches nothing of the run and does not start it. It is a second
	// primary-key probe, of tenants, for the same reason.
	ListActiveDagRuns(ctx context.Context) ([]ListActiveDagRunsRow, error)
	// run_id is the dag_run's UUID (StagingClaimName uses it), so join on dag_runs.id,
	// which is globally unique. run_state is NULL only when the run row is truly gone.
	// The join compares uuids so it probes dag_runs_pkey; casting dag_runs.id to text
	// instead read every run. run_id is TEXT and older rows may hold something else,
	// so the CASE casts only the canonical lower case form, the one id::text produces,
	// and leaves anything else unmatched rather than failing the cast.
	ListActiveStagingVolumes(ctx context.Context) ([]ListActiveStagingVolumesRow, error)
	// Lists running TIs that have heartbeated at least once and whose latest
	// heartbeat is non-null, alongside enough identity to log + observe.
	// The "non-null" filter is the safety guarantee: a TI that never heartbeated
	// is either inline (no agent ever exists) or fresh — out of scope for this
	// reaper. The LIMIT bounds a single tick's reap work even after a large
	// outage; the rest are picked up on the next tick.
	ListAgentLostCandidates(ctx context.Context) ([]ListAgentLostCandidatesRow, error)
	ListAuditLogs(ctx context.Context, arg ListAuditLogsParams) ([]ListAuditLogsRow, error)
	// Keyset form of ListAuditLogs: the entries strictly before the cursor
	// (occurred_at, id) in the same order, so a deep page costs the same as the
	// first.
	ListAuditLogsAfter(ctx context.Context, arg ListAuditLogsAfterParams) ([]ListAuditLogsAfterRow, error)
	// Lists the DISTINCT warm-worker pod names currently serving an active attempt
	// (ADR 0058 N1d-b): a warm worker is BUSY iff some task_instance in an active
	// state (`queued` or `running`) is durably bound to it (warm_worker_id = the
	// pod's own name — the binding landed in N1d-a1/a2). The busy-aware warm-pool
	// reconciler reads this once per tick to classify each live warm pod as busy
	// (serving an attempt) or idle, so scale-down and drain delete only IDLE workers
	// and never kill an in-flight attempt (review findings M1/M2).
	//
	// The `queued` state MUST be in the busy set, not just `running`: BindWarmAttempt
	// stamps warm_worker_id the instant a warm worker ACKs an assignment as started,
	// while the TI is still `queued`, and the child only reports RUNNING
	// (queued->running) a moment later. Between the ack and that report the worker is
	// actively STARTING the attempt; counting only `running` would classify it IDLE
	// in that window and let the excess-idle-tail delete remove a worker that is
	// starting an attempt — an M1 violation that kills a just-started attempt. The
	// BindWarmAttempt guard binds the scheduled/queued/running window (a scheduled
	// bound row moves to queued or running within the same tick), and every
	// re-dispatch/reset that moves a bound row back out of that window clears
	// warm_worker_id, so a queued+bound row here is always a live starting attempt,
	// never a stale binding.
	//
	// With warm pools off no TI is ever bound, so this is always empty and every
	// worker classifies as idle — byte-for-byte today's dedicated pod-per-task
	// behavior.
	ListBusyWarmWorkerPods(ctx context.Context) ([]*string, error)
	// All of a tenant's connections WITH the encrypted password, for delivering
	// credentials to task pods (ADR 0021). Never use this for UI/API responses,
	// which must mask the password.
	ListConnectionSecrets(ctx context.Context, tenantID pgtype.UUID) ([]ListConnectionSecretsRow, error)
	// The tenant's connections WITH the encrypted password, restricted to the given
	// conn_ids and filtered in the query (ADR 0055 D1: scope in the SQL, never
	// post-filter the decrypted whole vault). Never use this for UI/API responses,
	// which must mask the password. Used under secret_scoping: enforce so a task
	// receives only the connections it declared. An empty conn_id set never reaches
	// here — the handler returns nothing without a query.
	ListConnectionSecretsScoped(ctx context.Context, arg ListConnectionSecretsScopedParams) ([]ListConnectionSecretsScopedRow, error)
	ListConnections(ctx context.Context, arg ListConnectionsParams) ([]ListConnectionsRow, error)
	ListConnectionsFiltered(ctx context.Context, arg ListConnectionsFilteredParams) ([]ListConnectionsFilteredRow, error)
	ListDagRunsByDag(ctx context.Context, arg ListDagRunsByDagParams) ([]DagRun, error)
	// Keyset form of ListDagRunsByDagWithVersion: the runs strictly before the
	// cursor (logical_date, run_id) in the same order, so a deep page costs the
	// same as the first. run_id is unique per DAG, so it makes the order total. An
	// empty states array keeps every state.
	ListDagRunsByDagAfter(ctx context.Context, arg ListDagRunsByDagAfterParams) ([]ListDagRunsByDagAfterRow, error)
	// See GetDagRunWithVersion. One join rather than a lookup per row.
	ListDagRunsByDagWithVersion(ctx context.Context, arg ListDagRunsByDagWithVersionParams) ([]ListDagRunsByDagWithVersionRow, error)
	ListDagRunsFiltered(ctx context.Context, arg ListDagRunsFilteredParams) ([]ListDagRunsFilteredRow, error)
	// created_by is the registering user's id (empty when the register had no
	// user), not their email: any reader of the DAG sees it. is_current marks the
	// version new runs are created with. build_info is where the version was
	// built, NULL when its register sent none.
	ListDagVersions(ctx context.Context, arg ListDagVersionsParams) ([]ListDagVersionsRow, error)
	ListDags(ctx context.Context, arg ListDagsParams) ([]Dag, error)
	// The newest run is looked up per listed DAG through idx_dag_runs_dag_logical,
	// one index probe each, instead of a DISTINCT ON over every run in the table.
	// LEFT JOIN keeps DAGs without runs; they match no run_state filter.
	ListDagsFiltered(ctx context.Context, arg ListDagsFilteredParams) ([]Dag, error)
	// The Airflow 3.3 DAG list's search, tag, owner, favorite and sort controls
	// (#1928). Patterns are SQL LIKE expressions matched case-insensitively; a
	// display name is the dag_id. Sorting by next_dagrun is not done here: the next
	// run is computed per DAG after the page is read, so it falls back to dag_id.
	ListDagsWithFilter(ctx context.Context, arg ListDagsWithFilterParams) ([]ListDagsWithFilterRow, error)
	// The DAG plus the LABEL of its current version. The UI's clear dialog compares
	// this against the RUN's bundle_version and offers "Run with latest bundle
	// version" only when they differ, so leaving it null either hides the control or
	// shows it unconditionally — neither of which tells the operator the truth.
	ListDagsWithVersion(ctx context.Context, arg ListDagsWithVersionParams) ([]ListDagsWithVersionRow, error)
	// Every connection's ciphertext, across every tenant, for the key-rotation
	// pass. The id is returned because the rewrite targets a row, not a
	// (tenant, conn_id) pair, and nothing here decrypts: the caller holds the keys.
	ListEncryptedConnectionSecrets(ctx context.Context) ([]ListEncryptedConnectionSecretsRow, error)
	ListFavoriteDagIDs(ctx context.Context, arg ListFavoriteDagIDsParams) ([]string, error)
	ListImportErrors(ctx context.Context, tenant string) ([]ListImportErrorsRow, error)
	ListImportErrorsFiltered(ctx context.Context, arg ListImportErrorsFilteredParams) ([]ListImportErrorsFilteredRow, error)
	// Lists dag_runs currently in 'running' whose task instances are ALL terminal
	// or never-started (every TI in none/success/failed/skipped/upstream_failed/removed),
	// alongside the timestamp of their most recent observable activity. The "no
	// live TI" filter is the critical safety guarantee: a run that is still
	// progressing stays out of the candidate set, so the reaper can never kill a
	// live execution. Live means any state outside that settled set, which covers
	// a legitimately-active task (scheduled/queued/running: slow image pull,
	// long-running job) AND a task parked for the scheduler to bring back
	// (up_for_retry during its retry_delay, up_for_reschedule between sensor pokes,
	// the reserved deferred state). Parked states stamp no fresh timestamp on entry,
	// so last_activity cannot protect them: a retry_delay or poke_interval longer
	// than the reaper threshold would otherwise fail a healthy run. Listing the
	// settled states (rather than the live ones) keeps any future non-terminal
	// state on the safe side by default. `none` stays reapable: a never-started TI
	// whose upstreams are all settled is decided on the next scheduler tick, and one
	// whose upstream is still pending already has a live sibling keeping the run
	// out. A TI released back to `none` for another attempt (the retry release,
	// the reschedule re-dispatch, the infra re-place, an operator clear) has its
	// per-attempt timestamps cleared and only becomes `scheduled` on the next
	// tick, so each release stamps released_at and last_activity counts it: the
	// release itself is activity, and a run is never reaped in the tick between a
	// release and none -> scheduled. An infra-failed TI parked in its re-place backoff is `failed` and is covered by
	// the threshold itself, which sits above that backoff. The shape this catches
	// is the post-crash one: TIs settled (success/failed/skipped/upstream_failed)
	// but FinalizeRun did not transition the dag_run, e.g. the server died between
	// the last TI report and the next scheduler tick. The LIMIT bounds a single
	// tick's reap work even after a multi-hour outage; the rest are picked up on
	// the next tick (the reaper is a backstop, not a sprint). The list is only a
	// snapshot: MarkRunOrphanedRun re-checks the same predicate atomically, so keep
	// the two in step.
	ListOrphanCandidates(ctx context.Context) ([]ListOrphanCandidatesRow, error)
	ListPools(ctx context.Context, arg ListPoolsParams) ([]ListPoolsRow, error)
	// Provisional infra marks for the reconciler's confirmation pass (ADR 0052
	// amendment, part 2), oldest first. The LIMIT bounds one sweep's work; the
	// rest are picked up next sweep. Only queued or running runs: the planner reads
	// no other run, and the valve is shorter than the orphan threshold, so a mark
	// of a finished run gates nothing. The join keeps this per-sweep query on
	// idx_dag_runs_state and idx_ti_run instead of a scan of every failed task
	// instance, and keeps old unconfirmed marks (a rollback window, marks written
	// by a previous release) from filling the LIMIT ahead of live ones.
	ListProvisionalInfraFailures(ctx context.Context) ([]ListProvisionalInfraFailuresRow, error)
	// Lists every TI currently in `running` alongside the timestamp it entered
	// running, for the pod-lost reaper (#527). A running TI whose backing pod
	// vanished before its first heartbeat is invisible to the agent-lost reaper
	// (its null-heartbeat zero-guard) and to the reconciler (which only sees pods
	// that still exist), so it would sit `running` until the 5-minute orphan reaper.
	// Warm-pool attempts (warm_worker_id set) are excluded: they run in a shared
	// warm pod with no per-task labels, so the reaper's presence check would always
	// read them as lost; the warm-worker-lost reaper owns them. The grace period is
	// applied here, before the LIMIT, so attempts still inside it never take the
	// slots of those past it; a NULL started_at is never listed (too poorly observed
	// to reap). The reaper re-checks grace and pod liveness per candidate in Go.
	// heartbeated lets Lite (no pods) judge a TI whose agent died before its first
	// heartbeat, which the agent-lost query never lists (#916). The page is
	// keyset-paged on (started_at, id) after the reaper's cursor (R-07, #1597):
	// with a fixed "oldest 100", 100 attempts with live pods hid a newer attempt
	// whose pod vanished forever. The reaper keeps the cursor across sweeps and
	// passes '-infinity' and the nil uuid to start over. The LIMIT bounds a single
	// sweep's reap work.
	ListRunningTasks(ctx context.Context, arg ListRunningTasksParams) ([]ListRunningTasksRow, error)
	// Returns each cron-scheduled DAG with the bits the scheduler needs to decide
	// both "is there a slot due?" (schedule + last_logical), "how many slots
	// should I backfill on this tick?" (catchup + start_date, see #129), and
	// "may this DAG take another active run?" (max_active_runs, see #200). The
	// owning tenant is returned because a dag_id is unique only within its tenant
	// (#209). The DAGs of a suspended tenant are left out (#2181); a suspension
	// that lands after this read is refused when the run is created.
	// Only the DAGs that may be due are listed (#2175): no stored next_run_at yet,
	// or one at or before now, the scheduler's clock. idx_dags_next_run (054)
	// holds exactly the DAGs the first four conditions keep.
	ListScheduledDags(ctx context.Context, now pgtype.Timestamptz) ([]ListScheduledDagsRow, error)
	// Of the given (tenant, run) pairs, the settled runs: run in success or failed
	// and no task instance outside success, failed, skipped, upstream_failed and
	// removed.
	// This is the same "settled" the retention janitor's LockExpiredSettledRuns
	// uses (duplicated there on purpose, keep the two identical). A run marked
	// failed while a task still runs is not settled, so the reconciler never
	// collects a pod whose outcome it may not have recorded yet. The pairs come
	// from the pods' tenant and run labels; a pair whose tenant does not own the
	// run matches nothing.
	ListSettledRunIDs(ctx context.Context, arg ListSettledRunIDsParams) ([]ListSettledRunIDsRow, error)
	// Lists one page of the TIs in `queued` for at least the dispatch-lost
	// threshold, with their queued_at, for the dispatch-lost reaper (#202). The
	// threshold is applied here, before the LIMIT, so attempts inside it never
	// take the slots of those past it; a NULL queued_at is never listed (too
	// poorly observed to reap). The reaper re-checks the threshold in Go.
	// The page is keyset-paged on (queued_at, id) after the reaper's cursor
	// (R-07, #1597): with a fixed "oldest 100", 100 queued attempts whose pods
	// are Pending (a capacity shortage) hid a newer lost dispatch forever. The
	// reaper keeps the cursor across sweeps and passes '-infinity' and the nil
	// uuid to start over. The LIMIT bounds a sweep's reap work.
	// warm_worker_id rides along (ADR 0058 N1d-a2, review finding H3): a queued warm
	// attempt whose serving warm worker is still alive is just slow to transition
	// queued->running, so the dispatch-lost reaper must DEFER it rather than fail it
	// (the double-run bug). It is NULL for a dedicated attempt and for a warm attempt
	// not yet acked, in which case the reaper falls back to its existing pod-liveness
	// gate unchanged.
	// attempt_epoch rides along (ADR 0051 amendment) so the mark and the pod
	// teardown name exactly the attempt that was listed.
	// tenant_id rides along so a start_expired reap can append its marker to the
	// attempt's log (#1126).
	ListStaleQueuedTaskInstances(ctx context.Context, arg ListStaleQueuedTaskInstancesParams) ([]ListStaleQueuedTaskInstancesRow, error)
	// Returns every attempt for (run, task), oldest first. UNIONs the current
	// task_instances row with all archived task_instance_history rows so the UI's
	// /tries endpoint can render one navigable tab per attempt (Lima bug #241).
	// One entry per try (ADR 0051 amendment, #863): an infra re-place archives the
	// try and keeps it on the current row, so a history row for the current try is
	// left out and the current row, the try's latest execution, stands for it.
	// Each row carries the per-attempt fields PLUS the run-constant fields
	// (operator, max_tries, map_index) copied from the current TI; archived rows
	// get them via the JOIN. pool and pool_slots are the current TI's too: history
	// does not record them, so every attempt reports the pool the task is charged
	// to now (#1589).
	ListTaskInstanceAttempts(ctx context.Context, arg ListTaskInstanceAttemptsParams) ([]ListTaskInstanceAttemptsRow, error)
	ListTaskInstancesByRun(ctx context.Context, arg ListTaskInstancesByRunParams) ([]TaskInstance, error)
	// The batched form of ListTaskInstancesByRun for the scheduler tick: every
	// active run's task instances in one round trip instead of one per run. Rows
	// come grouped by run and, within a run, in the same task_id order the per-run
	// query returns, so the caller can split them without re-sorting.
	ListTaskInstancesByRuns(ctx context.Context, dagRunIds []pgtype.UUID) ([]TaskInstance, error)
	ListTaskInstancesFiltered(ctx context.Context, arg ListTaskInstancesFilteredParams) ([]TaskInstance, error)
	ListTenantDagTags(ctx context.Context, arg ListTenantDagTagsParams) ([]string, error)
	// Retention janitor (performance item D5). Every statement is tenant scoped and
	// bounded; the janitor in internal/retention paces and caps them.
	ListTenantIDs(ctx context.Context) ([]pgtype.UUID, error)
	// "role:action:resource" for every grant of a tenant's built-in roles.
	ListTenantRolePermissions(ctx context.Context, name string) ([]string, error)
	// The events after the cursor in serving order, (xid, id), among those whose
	// writing transaction is below the snapshot's xmin: every transaction that
	// wrote them has finished, and every row written later sorts after them. The
	// tenant name and the DAG and run ids are resolved here; they are empty once
	// the tenant or the run is deleted.
	ListUsageEvents(ctx context.Context, arg ListUsageEventsParams) ([]ListUsageEventsRow, error)
	// One row per user in the tenant, newest first, with every granted role name
	// aggregated into a text array (empty when the user holds none). Paged by the
	// caller. Never selects password_hash — the list must not expose secrets.
	ListUsers(ctx context.Context, arg ListUsersParams) ([]ListUsersRow, error)
	ListVariables(ctx context.Context, arg ListVariablesParams) ([]ListVariablesRow, error)
	ListVariablesFiltered(ctx context.Context, arg ListVariablesFilteredParams) ([]ListVariablesFilteredRow, error)
	// Every variable across every tenant whose stored value does (sealed = true) or
	// does not (sealed = false) start with the ciphertext tag (#507). It backs the
	// variable_encryption boot sweeps, which seal plaintext rows ("on") or restore
	// them ("decrypt"), and the key rotation sweep, which reads the sealed ones.
	ListVariablesForEncryptionSweep(ctx context.Context, arg ListVariablesForEncryptionSweepParams) ([]ListVariablesForEncryptionSweepRow, error)
	// The tenant's variables restricted to the given keys, filtered in the query
	// (ADR 0055 D1: scope in the SQL, never post-filter the decrypted whole vault in
	// the handler). Used under secret_scoping: enforce so a task receives only the
	// Variables it declared. An empty key set never reaches here — the handler
	// returns nothing without a query.
	ListVariablesScoped(ctx context.Context, arg ListVariablesScopedParams) ([]ListVariablesScopedRow, error)
	// Lists every `running` TI that is durably bound to a warm worker (ADR 0058
	// N1d-a2): warm_worker_id names the warm pod that acked and is serving this
	// attempt. The failover reaper matches that name against the live warm-pod set;
	// a bound TI whose worker is no longer live has lost its serving pod and is
	// routed to infra via MarkTaskPodLost (fan-out: every attempt a dead worker
	// held is marked). Only `running` rows carry a live attempt, and the
	// IS NOT NULL filter keeps dedicated (non-warm) tasks out of this reaper
	// entirely — with warm pools off no TI is ever bound, so this returns empty and
	// the reaper is inert. The LIMIT bounds a single tick's work after a large
	// outage; the rest are picked up next tick.
	// tenant_id and dag_id locate the attempt's log stream for the reaper's
	// killed marker (#861).
	ListWarmBoundRunningTIs(ctx context.Context) ([]ListWarmBoundRunningTIsRow, error)
	// The current version of the DAGs the warm-pool reconcile looks at (#1707,
	// ADR 0082): with prewarm, every active unpaused DAG whose current version
	// declares min_idle_workers, which gets its pool before its first run; and
	// every DAG in dag_ids (the DAGs of the active runs), whose current version
	// tells which versions of those runs were superseded by a register, a
	// rollback or a promote and so drain. prewarm is true for the first kind. The
	// declared value is read from the spec here, so the reconcile loads no spec
	// of a DAG it will not prewarm. The version is a LATERAL primary-key probe
	// with LIMIT 1, and the first predicate repeats the dags-only half of the
	// second, so the scan is of dags and each probe reads one spec: the cost
	// follows the unpaused DAGs and the DAGs of active runs, never the number of
	// versions (a plain join hashes every row of dag_versions). A cross-tenant
	// read like ListActiveDagRuns: the reconcile serves every tenant, and each
	// row carries its tenant_id.
	ListWarmCurrentVersions(ctx context.Context, arg ListWarmCurrentVersionsParams) ([]ListWarmCurrentVersionsRow, error)
	ListXComEntries(ctx context.Context, arg ListXComEntriesParams) ([]ListXComEntriesRow, error)
	// Locks the user row a token is created for, so concurrent creates for one
	// user run one at a time and the live-token cap holds (ADR 0074). FOR NO KEY
	// UPDATE does not block the key-share locks that inserts referencing the user
	// take. No row: the user is not in the tenant. The email names the owner in
	// the audit rows the create writes.
	LockAPITokenOwner(ctx context.Context, arg LockAPITokenOwnerParams) (LockAPITokenOwnerRow, error)
	// Locks the sign-in a poll names, with what the poll decides from: whether
	// it expired, and whether this poll came sooner than the interval allows
	// (with a fifth of it as slack for network jitter).
	LockCLIDeviceForPoll(ctx context.Context, deviceCodeHash string) (LockCLIDeviceForPollRow, error)
	// Serializes starts for the rest of the transaction, so the caps the count
	// below checks hold exactly under concurrent starts on any replica. The key
	// is this table's own; nothing else takes it.
	LockCLIDeviceStarts(ctx context.Context) error
	// Locks the DAG's row for the rest of the transaction, so registers of the same
	// DAG are serialized: the spec-hash check of one register sees the version the
	// previous one committed. FOR NO KEY UPDATE, not FOR UPDATE: it still excludes
	// another register, but not the KEY SHARE lock every dag_runs insert takes on
	// its DAG, so run creation is not blocked while a version registers.
	LockDagByDagID(ctx context.Context, arg LockDagByDagIDParams) (Dag, error)
	// A tenant's runs that settled (success or failed) before the cutoff, oldest
	// first, whose task instances are all settled and that no live staging volume
	// still points at. "Settled" is the predicate the pod reconciler's settled-run
	// collection uses too: run in success or failed, and no task instance outside
	// success, failed, skipped, upstream_failed and removed. none is unsettled on purpose:
	// it is a task a clear just reset, waiting to be scheduled, while the run row
	// still says success until the clear reopens it. Any state added later counts
	// as unsettled, so it is kept rather than deleted. The janitor calls this once
	// per batch, so a run whose children span several batches is re-checked each
	// time. FOR UPDATE keeps the run row itself from changing, and SKIP LOCKED
	// lets the janitor pass over a run another transaction holds. It does NOT stop
	// a clear: a clear resets task_instances before it touches the run row, so the
	// janitor then locks and re-checks the task instances
	// (LockTaskInstancesOfRuns) before it deletes anything.
	//
	// The newest run of each DAG (by logical date) is never selected: the
	// scheduler takes a DAG's last logical date from it (ListScheduledDags), so
	// deleting it would make a cron DAG run its latest slot again, a catchup DAG
	// backfill its whole history, and an @once DAG fire a second time. Airflow's
	// `db clean` likewise keeps each DAG's latest (non-manual) run. The probe is
	// one step on idx_dag_runs_dag_logical.
	LockExpiredSettledRuns(ctx context.Context, arg LockExpiredSettledRunsParams) ([]pgtype.UUID, error)
	// Share-locks every task instance of a run inside the reap transaction, before
	// MarkRunOrphanedRun re-checks the orphan predicate, so the re-check (a fresh
	// snapshot under READ COMMITTED) sees committed state and no TI of the run can
	// change until the reap commits or rolls back. NOWAIT: a TI another transaction
	// is writing right now is activity, so the reap gives up (lock_not_available,
	// treated as a no-op by ReapRun) instead of waiting. Waiting would let these
	// share locks, taken in scan order, form a cycle with a writer that locks
	// several TIs of the run in another order (a multi-task clear, a batched
	// scheduler transition); a reap that never waits on a TI cannot be in one.
	LockRunTaskInstancesForReap(ctx context.Context, dagRunID pgtype.UUID) error
	// Locks every task instance of the locked runs and reports whether each is
	// still settled. A clear that moves a finished run to the current version
	// locks the run row first (ADR 0086), so LockExpiredSettledRuns skips it; any
	// other clear resets task instances without locking the run row
	// first, so the run lock alone does not keep it out: a clear that committed
	// since LockExpiredSettledRuns shows here as an unsettled state, and the
	// janitor drops that run from the batch. Once these locks are held no clear can
	// change the rows until the batch commits. NOWAIT: a task instance another
	// transaction is writing (a clear in flight) fails the lock with
	// lock_not_available instead of waiting, because that clear will next update
	// the run row the janitor holds, and waiting would deadlock; the janitor skips
	// the batch and retries on a later cycle.
	LockTaskInstancesOfRuns(ctx context.Context, arg LockTaskInstancesOfRunsParams) ([]LockTaskInstancesOfRunsRow, error)
	// Records a poll, and the longer interval a slow_down answered with.
	MarkCLIDevicePolled(ctx context.Context, arg MarkCLIDevicePolledParams) error
	// Stamp a run's on-failure alert as DELIVERED. Called only after a successful
	// send, which is the whole point of the split: alerted_at now answers "did the
	// page get through", not "did we try".
	//
	// Guarded on the attempt it is reporting for. The send runs in a goroutine
	// detached from the tick, so an operator clear can land between the claim and the
	// stamp: the clear resets alert_attempts to 0 and starts a NEW failure episode,
	// and an unguarded stamp from the old in-flight send would mark that new episode
	// delivered without ever paging it. Requiring the attempt to still match means a
	// stamp from a superseded episode simply matches no row. Same shape as the guard
	// on ReportTaskResult: a late writer must never clobber newer state.
	MarkRunAlertDelivered(ctx context.Context, arg MarkRunAlertDeliveredParams) error
	// Fails an orphaned dag run, but only if it is STILL orphaned: the same
	// predicate ListOrphanCandidates applies (running, no live TI, last activity at
	// or before the reaper's cutoff) is re-checked in this statement, because the
	// list is a snapshot and a TI may have moved (failed -> up_for_retry, none ->
	// scheduled) or fresh activity may have landed since. Keep the two in step. The
	// `state = 'running'` guard also makes the reap a safety net, never a takeover:
	// a competing finalizer (the normal scheduler path) cannot be overwritten.
	// Zero rows means the run is no longer an orphan and nothing may be touched.
	// Idempotent: a second call on a run already failed updates zero rows.
	MarkRunOrphanedRun(ctx context.Context, arg MarkRunOrphanedRunParams) (int64, error)
	// Fails any still-active task instance under an orphaned run. Called together
	// with MarkRunOrphanedRun inside a single transaction (the repository owns the
	// atomicity); split because sqlc cannot generate a CTE+UPDATE that reuses one
	// parameter across an UPDATE-inside-WITH and the outer UPDATE.
	MarkRunOrphanedTaskInstances(ctx context.Context, dagRunID pgtype.UUID) error
	MarkStagingDeleted(ctx context.Context, arg MarkStagingDeletedParams) error
	// Fails a TI whose agent went silent. The WHERE state='running' guard
	// prevents overwriting a TI the agent's last terminal report finally
	// delivered between our list and our write (defense in depth — a late
	// report wins over the reaper). Idempotent on a second call. Pinned to the
	// listed attempt, (try_number, attempt_epoch) (ADR 0051 amendment), so a mark
	// computed for a superseded attempt never fails its replacement.
	MarkTaskAgentLost(ctx context.Context, arg MarkTaskAgentLostParams) (int64, error)
	// Fails a TI whose agent went silent after the attempt outlived
	// auth.max_attempt_credential_lifetime (#1461). Renewal stops at the ceiling,
	// so the silence is the credential lapsing, not a lost agent: this is a TASK
	// failure (last_failure_kind NULL, the retry policy applies), never an infra
	// mark the planner would re-place with a fresh credential. Same guards as
	// MarkTaskAgentLost: state='running' (a late report wins) and the listed
	// attempt, (try_number, attempt_epoch) (ADR 0051 amendment).
	MarkTaskCredentialCeiling(ctx context.Context, arg MarkTaskCredentialCeilingParams) (int64, error)
	// Fails a TI whose asynchronous dispatch (BufferedDispatcher worker) errored
	// inside the inner dispatcher. Targets the active row by (dag_run_id,
	// task_id) and the active states (scheduled/queued) — a TI that already
	// moved to running/terminal between the worker accepting the request and
	// the dispatch failing is left alone (defense in depth).
	// The failure is dispatch_failed, which is terminal: the retry budget is
	// spent as in FailDispatchExhausted, so the planner does not retry it.
	MarkTaskDispatchFailed(ctx context.Context, arg MarkTaskDispatchFailedParams) error
	// Fails one queued TI with a dispatch_lost error. The WHERE state='queued'
	// guard makes the operation idempotent: a second call on a TI that has
	// since transitioned (real dispatch landed, or already failed) is a no-op,
	// never overwriting a more meaningful state. It is also pinned to the listed
	// attempt, (try_number, attempt_epoch) (ADR 0051 amendment): a row that was
	// re-placed and re-dispatched between the list and this write is a different
	// attempt, and a mark computed for the old one must not fail it.
	MarkTaskDispatchLost(ctx context.Context, arg MarkTaskDispatchLostParams) (int64, error)
	// The scheduler's scheduled -> queued write after a dispatch was accepted.
	// Guarded to the exact slot the tick planned: still 'scheduled', with the
	// next_dispatch_at the tick read. Under buffered dispatch the worker can finish
	// before this write lands: it may have failed the task (MarkTaskDispatchFailed),
	// re-offered it with a new backoff (RequeueDispatch), or the agent may already
	// have reported running. Each of those moves the row off the planned slot, so
	// this write touches zero rows instead of overwriting the newer outcome.
	MarkTaskInstanceQueued(ctx context.Context, arg MarkTaskInstanceQueuedParams) (int64, error)
	// A clear that moves a finished run to a version that no longer declares
	// these tasks marks their task instances removed (ADR 0086), as Airflow's
	// verify_integrity does. Their history, logs and XCom stay. A queued or
	// running task instance is never marked: the clear does not move a run that
	// has one, and the guard keeps a racing attempt's row as it is.
	MarkTaskInstancesRemoved(ctx context.Context, arg MarkTaskInstancesRemovedParams) error
	// Fails a running TI whose pod has vanished (deleted/evicted/node lost). The
	// WHERE state='running' guard makes it idempotent and prevents overwriting a
	// late terminal report that landed between our list and our write (a live
	// report wins over the reaper). Idempotent on a second call. Pinned to the
	// listed attempt, (try_number, attempt_epoch) (ADR 0051 amendment), so a mark
	// computed for a superseded attempt never fails its replacement.
	MarkTaskPodLost(ctx context.Context, arg MarkTaskPodLostParams) (int64, error)
	// Fails one queued TI whose task pod is still Pending (image pull, node
	// provisioning, init containers) when the attempt credential minted at dispatch
	// is about to run out (#1126). The agent has not started, so it could only
	// start with a dead credential: it would be refused at Register, stream no log
	// and fail the attempt against the user's retry budget. Marked infra instead,
	// so the planner re-places it off-budget with a fresh credential. Same guards
	// and provisional rule as MarkTaskDispatchLost: state='queued' (an agent that
	// reported RUNNING wins) and the listed attempt, (try_number, attempt_epoch).
	MarkTaskStartExpired(ctx context.Context, arg MarkTaskStartExpiredParams) (int64, error)
	// Every named pool's slot cap across all tenants, for the scheduler's per-tick
	// cross-DAG admission budget (ADR 0053 Stage 3). Keyed by (tenant_id, name) so a
	// pool name is scoped to its tenant. Pro-only: Lite never calls this.
	PoolBudgets(ctx context.Context) ([]PoolBudgetsRow, error)
	// Per-pool occupancy for a tenant: how many slots the tenant's task instances
	// take in each non-terminal state, grouped by the instance's pool (a NULL pool
	// is the implicit default_pool). Each instance weighs its pool_slots, the size
	// the admission gate charges it (ADR 0066, #1499), not 1. Feeds the Airflow
	// PoolResponse occupancy fields; the gate itself counts queued+running as the
	// occupied slots.
	PoolSlotUsage(ctx context.Context, tenantID pgtype.UUID) ([]PoolSlotUsageRow, error)
	// A pod CREATE was refused by cluster backpressure — a ResourceQuota 403 or an
	// API Priority & Fairness 429 (ADR 0053). Back off the next attempt to $3 WITHOUT
	// touching dispatch_attempts: backpressure is a temporary "no room," retriable
	// forever, and must never accumulate toward the dispatch_failed budget the way a
	// permanent failure does (RecordDispatchFailure). The planner gates
	// scheduled->queued on next_dispatch_at alone, so setting it holds and re-offers
	// the task without a counter bump. Guarded to 'scheduled' for the same reason as
	// RecordDispatchFailure; try_number is untouched — this is infra, not a task
	// failure. The apiserver answered the create, so dispatch_unavailable_since is
	// cleared as in RecordDispatchFailure.
	RecordDispatchBackpressure(ctx context.Context, arg RecordDispatchBackpressureParams) error
	// A synchronous dispatch attempt failed (ADR 0031 Amendment A). Increment the
	// consecutive-failure counter and back off the next attempt to $3, so the planner
	// (which gates scheduled->queued on next_dispatch_at) does not re-attempt every
	// tick. Guarded to 'scheduled' so a report that raced the dispatch cannot clobber
	// a row that has since progressed. try_number is untouched: this is infra, not a
	// task failure.
	// last_heartbeat_at is cleared and attempt_epoch bumped for the reasons given on
	// ResetTaskInstanceToNone. The apiserver answered the create, so the outage
	// window of ADR 0093 is closed: dispatch_unavailable_since is cleared, and a
	// later unavailable failure starts a new window.
	RecordDispatchFailure(ctx context.Context, arg RecordDispatchFailureParams) error
	// A pod CREATE failed because the Kubernetes API was unavailable: a 503, a
	// 504, a 500 (a fail-closed admission webhook that is down), a connection
	// refused or reset, or the client deadline (#1606). Re-offer the task the way
	// backpressure is re-offered, back to 'scheduled' and held until
	// next_dispatch_at, WITHOUT touching dispatch_attempts, and stamp the start of
	// the outage window on the first such failure (COALESCE keeps the first one).
	// The caller fails the task as dispatch_failed once the window it returns is
	// older than the scheduler's bound (ADR 0093), so an API that never comes back
	// cannot hold the task forever.
	//
	// The hold grows with the outage: the next attempt waits as long as the task
	// has already been riding it out, at least min_delay and at most max_delay.
	// That doubles the interval without a counter, so a recovering apiserver is
	// not hit by every due task every few seconds, and a recovery is still seen
	// within max_delay.
	//
	// The create may have succeeded on the server before the response was lost,
	// so this is a rail like RequeueDispatch: attempt_epoch is bumped, and the
	// re-dispatch claims a new epoch on top, so an orphan pod from the ambiguous
	// create is fenced (its reports get ErrStaleReport). Guarded to
	// scheduled/queued: the sync path re-offers a scheduled row, a buffered
	// worker a scheduled or queued one, and a row the agent has since reported on
	// (the orphan pod won the race and runs the attempt) is left alone. The other
	// fields are cleared for the reasons given on RequeueDispatch.
	RecordDispatchUnavailable(ctx context.Context, arg RecordDispatchUnavailableParams) (RecordDispatchUnavailableRow, error)
	// One audit entry per scope a retention cycle purged audit rows from, so the
	// purge itself is on the record. tenant_id NULL is the system rows.
	RecordRetentionPurge(ctx context.Context, arg RecordRetentionPurgeParams) error
	// Idempotent per task of a run: an active row is left as it is. A deleted row is
	// brought back to active with a fresh created_at, because a cleared and re-run
	// run recreates the same deterministic PVC after GC freed it; left deleted, the
	// orphan sweep would take the live claim for an unrecorded one.
	RecordStagingVolume(ctx context.Context, arg RecordStagingVolumeParams) error
	// Stamps last_heartbeat_at on the active TI of an attempt. Bounded by the
	// (dag_run_id, task_id, try_number) tuple to match the agent's identity. The
	// state IN guard avoids stamping a heartbeat on a TI the scheduler already
	// transitioned to terminal between the agent's last heartbeat and now — a
	// terminal TI must stay terminal even if a late heartbeat arrives.
	//
	// Returns the affected row count. Zero means the heartbeating agent's attempt
	// no longer matches the live row — its try_number is behind, or a reaper
	// already settled the row terminal — the same "moved on" predicate the state
	// report is guarded by (#467). The agent RPC turns a zero here into a
	// should_terminate signal so a reaped-but-alive pod stops itself (#474).
	//
	// A token carrying attempt_epoch must match it exactly (ADR 0051 amendment). A
	// claim-less token matches on try_number alone: it is either a pre-upgrade
	// token or one an old replica re-minted during a rolling upgrade, which drops
	// the claim it does not know. Fencing its heartbeat would kill a live attempt
	// for a missing claim; its reports are still fenced as epoch 0.
	RecordTaskHeartbeat(ctx context.Context, arg RecordTaskHeartbeatParams) (int64, error)
	RecordXCom(ctx context.Context, arg RecordXComParams) error
	// Re-dispatch a task parked in up_for_reschedule once its reschedule_at has passed:
	// back to 'none' with the per-attempt timestamps cleared (so the next dispatch
	// stamps fresh — queued_at MUST be NULL or the dispatch-lost reaper re-flags it)
	// and reschedule_at cleared. Unlike ResetTaskInstanceToNone (retry), try_number is
	// PRESERVED and no task_instance_history row is archived: reschedule is not a retry,
	// it consumes no attempt (#380). Guarded to the parked state so it is idempotent.
	// last_heartbeat_at is cleared and attempt_epoch bumped for the reasons given on
	// ResetTaskInstanceToNone.
	RedispatchRescheduledTaskInstance(ctx context.Context, arg RedispatchRescheduledTaskInstanceParams) error
	RemoveFavorite(ctx context.Context, arg RemoveFavoriteParams) error
	// The same re-open as ResetDagRunToVersion, WITHOUT touching dag_version_id: the
	// run stays pinned to the version it was created with, so the re-run executes the
	// image that produced the original attempt.
	//
	// Two separate decisions used to be one. Re-opening a run (state, timestamps,
	// alert bookkeeping) is what `reset_dag_runs` means; WHICH version the re-run
	// executes is what Airflow calls `run_on_latest_version`. Folding the second into
	// the first left no way to re-run last week's task as it was last week, and left
	// `reset_dag_runs=false` meaning "do not re-open either", which strands the
	// cleared task instance in a terminal run the scheduler never looks at again.
	//
	// Alert bookkeeping is cleared here for the same reason it is there: the clear
	// starts a new failure episode, so a genuine re-failure re-pages, and a spent
	// retry budget is not carried into an episode that has not been attempted.
	ReopenDagRunKeepingVersion(ctx context.Context, arg ReopenDagRunKeepingVersionParams) error
	// $3 is cast to task_state in every usage: without the cast Postgres deduces an
	// enum type from `state = $3` but text from the literal comparisons below and
	// rejects the parameter as having inconsistent types (SQLSTATE 42P08). The pod
	// agent path is the first to exercise this query end-to-end.
	//
	// Guarded on both the source state and the attempt, matching the other three
	// writes to this table (FailTaskInstanceIfActive, RescheduleTaskInstance,
	// RecordHeartbeat). Two writers touch task_instances — the scheduler tick and
	// this report — so an unguarded UPDATE lets a report that arrives late land
	// wherever the row happens to be:
	//   * after a reaper settled the row, it resurrects a terminal state (a run
	//     reports success on work the system already abandoned, and downstream
	//     tasks fire on it);
	//   * after a retry, it lands on the next attempt, because ResetTaskInstanceToNone
	//     bumps try_number in place rather than inserting a new row.
	// The agent token already carries the try_number it was dispatched with, so the
	// value that tells the attempts apart is present at the call site.
	//
	// try_number alone is not enough: an infra re-place, a reschedule poke and a
	// repeated dispatch reuse it. attempt_epoch (ADR 0051 amendment) is the
	// execution within the try. A token minted without the claim is read as epoch
	// 0: it matches its own pre-upgrade attempt (rows migrate at 0) and never an
	// attempt dispatched after the upgrade (the dispatch claim makes those >= 1).
	// That keeps a superseded agent's RUNNING report off its replacement (#911).
	// Returns the affected row count so the caller can tell a real write from a
	// rejected late report instead of dropping it silently.
	//
	// The state set is deliberately wider than the siblings' ('scheduled','queued',
	// 'running'): it also admits 'none'. Those writes are driven by the scheduler,
	// which only touches rows it has already advanced; this one is driven by the
	// agent, which starts reporting earlier. launchQueued dispatches the pod BEFORE
	// recording `queued`, so between those two statements a fast-starting task —
	// routine under the Lite subprocess executor — legitimately reports `running`
	// while the row is still `none`. Excluding it would reject a correct report,
	// trading a rare silent corruption for a frequent one. The settled states
	// (success/failed/skipped/upstream_failed) are what this guard is for.
	ReportTaskResult(ctx context.Context, arg ReportTaskResultParams) (int64, error)
	// A buffered dispatch failed inside the worker for a retriable reason: re-offer
	// the task the way a synchronous failure is re-offered (RecordDispatchFailure,
	// RecordDispatchBackpressure). Back to 'scheduled' with the next attempt held
	// until next_dispatch_at, adding one dispatch attempt only when counted
	// (backpressure is not). Guarded to scheduled/queued, so a task the agent has
	// since reported on is left alone. warm_worker_id is cleared as in
	// RequeueForRedispatch: the attempt never ran. last_heartbeat_at is cleared
	// as on every rail that starts a new execution of the row (ADR 0051
	// amendment, A0). The requeue is a rail, so attempt_epoch is bumped: a late
	// start or report from the abandoned dispatch is fenced (ADR 0051, A1).
	// queued_at is cleared too, so the next queued episode stamps a fresh one:
	// MarkTaskInstanceQueued only stamps a NULL queued_at, and a kept one would
	// make the dispatch-lost reaper fail the re-offered task as soon as it is
	// queued again. dispatch_unavailable_since is cleared when clear_unavailable
	// is set, for a failure the apiserver answered (a rejection, backpressure), as
	// in RecordDispatchFailure. It is kept for a failure that says nothing about
	// the API (a buffer wait past its bound), so a saturated buffer during an
	// outage cannot reset the window. It is not cleared when the row is marked
	// queued either: a buffered row is queued before its create is sent.
	RequeueDispatch(ctx context.Context, arg RequeueDispatchParams) (int64, error)
	// Re-place a reclaimed warm assignment (ADR 0058 N1d-c, H2): a warm worker was
	// handed this attempt but demonstrably will NOT run it (its stream ended holding
	// an unacked lease, or it acked started=false), so the attempt sits `queued`
	// having never run. Move it back to `scheduled` so the planner re-admits it and
	// re-dispatches (the planner plans scheduled->queued; it never re-plans a TI
	// that is already `queued`, which is why a no-op reclaim left it stuck until the
	// 3-minute dispatch-lost reaper).
	//
	// Guarded to state='queued' and bounded by (dag_run_id, task_id, try_number,
	// attempt_epoch) to the exact attempt the assignment named, so it never disturbs a running or settled
	// TI: zero rows is the guard working, a benign no-op, never an error. It does NOT
	// bump try_number or infra_attempts: the attempt never ran, this is a re-offer of
	// the SAME attempt, and the existing dispatch_attempts/backoff on the re-dispatch
	// bounds a reclaim loop.
	//
	// warm_worker_id is CLEARED: the reclaimed worker demonstrably will not run this
	// attempt, so the SAME row must not carry its stale binding back into the next
	// queued/running window — with the busy set now spanning queued+running
	// (ListBusyWarmWorkerPods), a stale binding would falsely mark the OLD (gone)
	// worker busy. This is a same-row re-dispatch (the try_number is preserved), so
	// the clear must happen here; a fresh try lands on a new row that is already NULL.
	// last_heartbeat_at is cleared and attempt_epoch bumped for the reasons given on
	// ResetTaskInstanceToNone.
	// queued_at is cleared for the reason given on RequeueDispatch: the re-dispatch
	// starts a new queued episode, and a kept stamp would let the dispatch-lost
	// reaper fail it as soon as it is queued again (#1604).
	RequeueForRedispatch(ctx context.Context, arg RequeueForRedispatchParams) (int64, error)
	// A reschedule-mode sensor (mode='reschedule') poked not-ready: park the active TI
	// in up_for_reschedule with its next-poke time ($3) so the scheduler re-dispatches
	// it once reschedule_at passes (#380), without consuming retry budget. Guarded to
	// the active states so a late report never clobbers a terminal row, and on the
	// attempt (try_number and attempt_epoch, the same rule as ReportTaskResult) so a
	// poke from a superseded attempt never parks its replacement. Returns the row
	// count; zero is a stale report. ended_at is left untouched (the task is not
	// finished); started_at is preserved.
	RescheduleTaskInstance(ctx context.Context, arg RescheduleTaskInstanceParams) (int64, error)
	// Settle a lost reschedule from the durable outcome record (ADR 0052): park the TI
	// in up_for_reschedule with the record's next-poke time, guarded by id,
	// try_number and attempt_epoch (never clobber a different attempt or a terminal
	// row), consuming no
	// retry budget. Mirrors RescheduleTaskInstance but keyed by id, for the reconciler.
	RescheduleTaskInstanceByIDIfActive(ctx context.Context, arg RescheduleTaskInstanceByIDIfActiveParams) error
	// Takes one of the tenant's runs for the current UTC day, resetting the count
	// when the day has turned. Zero rows means the tenant has no daily cap or has
	// reached it; the caller tells the two apart from the limit it read. It runs
	// before the run's INSERT in the same transaction, so a refusal writes nothing.
	// The UPDATE locks the tenant row until the transaction ends, and Postgres
	// re-checks the WHERE against the row a concurrent winner committed, so the
	// count can never pass the cap.
	ReserveTenantDailyRun(ctx context.Context, id pgtype.UUID) (int64, error)
	// Archives every failed attempt in the run into task_instance_history then
	// resets. See ResetTaskInstanceToNone for the per-attempt rationale. Returns the
	// task ids it reset, so the clear can delete exactly their XCom.
	ResetAllFailedTaskInstances(ctx context.Context, arg ResetAllFailedTaskInstancesParams) ([]string, error)
	// Clear with run_on_latest_version re-binds the run to the DAG's current
	// registered version (ADR 0020; opt-in since the 2026-09-15 amendment; only a
	// finished run with no queued or running task instance, ADR 0086): a
	// re-run after a code/yaml fix picks up the newest image and config — in dev that
	// is the last hot-reload, in prod the last deploy — while everything within a
	// version stays reproducible. Clearing the alert bookkeeping (#431) makes the clear
	// a new failure episode, so a genuine re-failure re-pages while a re-tick of the
	// same failed state does not. All three columns reset together: leaving
	// alert_attempts behind would carry a spent retry budget into an episode that has
	// not been attempted, so a cleared run could exhaust its attempts without ever
	// having tried.
	ResetDagRunToVersion(ctx context.Context, arg ResetDagRunToVersionParams) error
	// Archives the current attempt into task_instance_history then resets the
	// live row. See ResetTaskInstanceToNone for the per-attempt rationale.
	ResetFailedTaskInstance(ctx context.Context, arg ResetFailedTaskInstanceParams) (int64, error)
	// The scheduler retry rail's reset: identical to ResetTaskInstanceToNone but
	// GUARDED to state='up_for_retry' on both the history snapshot and the update.
	// The planner emits up_for_retry → none, but by apply time the TI may have been
	// re-dispatched (a stale/concurrent decision); without this guard the reset
	// would yank a now-running TI back to none and bump try_number, orphaning its
	// live pod. Mirrors the source-state guard on RedispatchRescheduledTaskInstance.
	// The admin clear-task path deliberately uses the unguarded primitive above.
	ResetTaskInstanceForRetry(ctx context.Context, arg ResetTaskInstanceForRetryParams) (int64, error)
	// The scheduler infra-fault rail's reset (ADR 0051 Phase 1): re-place a task that
	// a reaper failed as infra (agent/pod/dispatch lost, last_failure_kind='infra')
	// back to 'none' WITHOUT consuming the retry budget — try_number is left
	// untouched and infra_attempts is bumped instead, mirroring how dispatch_attempts
	// counts synchronous-dispatch faults. GUARDED to state='failed' AND
	// last_failure_kind='infra' on both the history snapshot and the update: by apply
	// time a late terminal report may have moved the TI, and only a genuine infra
	// failure may re-place off-budget (an app failure at state='failed' must fall to
	// the normal retry rail). last_failure_kind is cleared so the next attempt's
	// outcome is classified fresh.
	// last_heartbeat_at is cleared and attempt_epoch bumped for the reasons given on
	// ResetTaskInstanceToNone.
	// A provisional mark (infra_confirmed_at NULL, ADR 0052 amendment) is not
	// re-placed until the reconciler confirms it or InfraConfirmMaxWait has passed
	// since ended_at (the liveness valve), so a durable SUCCESS record can still
	// settle the attempt it guessed lost. Both halves carry the guard, so a refused
	// re-place archives nothing.
	ResetTaskInstanceInfraReplace(ctx context.Context, arg ResetTaskInstanceInfraReplaceParams) (int64, error)
	// Resets a TI for retry: snapshot the current per-attempt state into
	// task_instance_history (so the UI's /tries endpoint can render one tab per
	// attempt, Lima bug #241), then state back to `none`, all per-attempt
	// timestamps cleared (including queued_at), and try_number bumped. queued_at
	// MUST be NULLed so the next TransitionTaskState(queued) stamps a fresh now()
	// — without that, the dispatch-lost reaper sees the stale pre-clear timestamp
	// and re-marks the TI dispatch_lost on every tick (Lima Bug 1).
	// This is the UNCONDITIONAL clear primitive: the admin "clear task" action
	// (ClearTaskInstances, onlyFailed=false) resets a TI to none from ANY state, so
	// it carries no source-state guard. The scheduler's retry rail uses the guarded
	// ResetTaskInstanceForRetry instead — do not add a guard here or clear-task
	// silently no-ops on non-up_for_retry tasks.
	// last_heartbeat_at is cleared on this and every other rail that starts a new
	// execution of the row (ADR 0051 amendment, A0): the next attempt reports
	// RUNNING one heartbeat interval before its first beat, and an inherited value
	// from the previous attempt would make the agent-lost reaper fail it in that
	// window.
	// The same rails bump attempt_epoch (ADR 0051 amendment, A1), so a reset alone
	// already fences the attempt it superseded before the next dispatch claims its
	// own epoch (ClaimAttemptEpoch). The archive row records the superseded
	// attempt's epoch. The archive key stays (task_instance_id, try_number) for
	// compatibility with the previous release until PR A6 widens it, so one try
	// keeps one history row: a later execution of the try (higher epoch) replaces
	// the row an earlier one archived, and the row always holds the try's latest
	// execution, which is what the tries endpoint shows (ADR 0051 amendment, A5).
	// An older binary archives with DO NOTHING against the same key, which still
	// plans and runs. Each execution's log is kept apart by its epoch-keyed object.
	ResetTaskInstanceToNone(ctx context.Context, arg ResetTaskInstanceToNoneParams) error
	ResolveRunRef(ctx context.Context, arg ResolveRunRefParams) (ResolveRunRefRow, error)
	// Lifts a tenant's suspension; a tenant that is not suspended is unchanged.
	ResumeTenant(ctx context.Context, id pgtype.UUID) error
	// Revokes the user's expired, unrevoked tokens with this name, so an expired
	// token does not hold its name forever, and returns them so the create audits
	// each one as api_token.retire_expired rather than leaving it to read as a
	// manual revoke (#1768).
	RetireExpiredAPITokenName(ctx context.Context, arg RetireExpiredAPITokenNameParams) ([]RetireExpiredAPITokenNameRow, error)
	// Revokes a live token of the tenant; owner_id NULL revokes any owner's. A
	// revoked token matches no row, so it is not revoked or audited twice.
	RevokeAPIToken(ctx context.Context, arg RevokeAPITokenParams) (RevokeAPITokenRow, error)
	// A new current version can change the schedule, start_date or catchup, so the
	// stored next due time is cleared and the schedule epoch bumped (#2175).
	SetCurrentDagVersion(ctx context.Context, arg SetCurrentDagVersionParams) error
	// Stores when the DAG is next due, unless a change
	// bumped its schedule_epoch since the scheduler listed it (#2175). SKIP LOCKED:
	// a register or a retention delete holding the row would otherwise stall the
	// tick until it commits. The time is only a hint, so a skipped write leaves the
	// earlier one, and such a change usually clears it anyway.
	SetDagNextRunAt(ctx context.Context, arg SetDagNextRunAtParams) error
	SetDagPaused(ctx context.Context, arg SetDagPausedParams) (Dag, error)
	SetTaskInstanceNote(ctx context.Context, arg SetTaskInstanceNoteParams) error
	// The mark-state endpoint's write (mark success / mark failed). Same stamping
	// as UpdateTaskInstanceStateByRunTask, and a user's state is a verdict, not a
	// guess: it clears last_failure_kind and confirms the row, so a reaped task a
	// user marks failed is neither re-placed nor overridden by a late SUCCESS
	// record (ADR 0052 amendment).
	SetTaskInstanceStateByUser(ctx context.Context, arg SetTaskInstanceStateByUserParams) error
	// Writes the one row of usage_events_switch that the usage event trigger
	// reads (ADR 0096 point 7). It reports a row only when the value moved, so
	// the leader can log a change and stay quiet when it rewrites the same value.
	SetUsageEventsEnabled(ctx context.Context, enabled bool) (int64, error)
	// Transitions a run's state and stamps the run's own timestamps so the UI can
	// show its duration: started_at on first entry into 'running', ended_at on a
	// terminal state. Other timestamps are preserved (the scheduler may re-run).
	// Guarded on the state the caller read (from_state), as the tick's task-level
	// writes are (#1605): a run a clear re-opened or a user marked after the tick's
	// snapshot is left alone, and no row is affected (#2047).
	StampDagRunState(ctx context.Context, arg StampDagRunStateParams) (int64, error)
	// Moves a queued run to running when the tick admits it (#1766), guarded on
	// the run still being queued: a run a user marked success or failed, or
	// deleted, after the tick read it is left alone, and no row comes back.
	// started_at is stamped on the first start only, as StampDagRunState does; a
	// clear resets it, so a re-queued run gets a new one.
	StartQueuedRun(ctx context.Context, arg StartQueuedRunParams) (pgtype.UUID, error)
	// Settle a task instance succeeded from its durable outcome record (ADR 0052),
	// recovering a success whose report was lost. Guarded by id, try_number and
	// attempt_epoch so a stale reconciler never marks a LIVE retry or re-place
	// succeeded (#1130), which would fire downstream
	// tasks on incomplete work, strictly worse than the bug being fixed. The
	// active-state guard prevents clobbering a terminal row. It reports the rows
	// it changed, so the reconciler can tell a settle that found nothing active
	// (a reaper may have marked the attempt meanwhile) and try
	// SucceedTaskInstanceOverInfraMark (ADR 0052 amendment).
	SucceedTaskInstanceIfActive(ctx context.Context, arg SucceedTaskInstanceIfActiveParams) (int64, error)
	// A durable SUCCESS overrides a reaper's infra guess (ADR 0052 amendment,
	// part 1). Admits only a provisional infra mark (agent_lost, pod_lost,
	// dispatch_lost) of exactly the attempt the pod's labels name, while the
	// planner still treats it as active: not yet confirmed by the reconciler and
	// inside the confirmation valve. A run that already finalized is never
	// touched. An application failure, a user's verdict (SetTaskInstanceStateByUser
	// clears the infra kind) and every other state are left alone. Returns the
	// overridden mark (the reaper's reason prefix) and the attempt's log location;
	// no row means nothing was overridden.
	SucceedTaskInstanceOverInfraMark(ctx context.Context, arg SucceedTaskInstanceOverInfraMarkParams) (SucceedTaskInstanceOverInfraMarkRow, error)
	// Sets or changes a tenant's suspension (#2181). A tenant already suspended
	// keeps its suspended_at, so changing the reason does not restart the clock.
	SuspendTenant(ctx context.Context, arg SuspendTenantParams) error
	// The per-attempt fields the agent spec carries from the task instance row.
	// first_reschedule_at is the time a reschedule-mode sensor first entered
	// reschedule (NULL until it does), delivered to each re-dispatched pod so
	// get_first_reschedule_date returns the real value and the sensor honors its
	// cumulative timeout across pokes (#380). max_tries is the attempt budget the
	// scheduler enforces, which a clear moves past the spec's retries + 1 (#1131),
	// so the runtime's on_failure_callback gate must read it from here (#424).
	TaskInstanceAttemptFields(ctx context.Context, arg TaskInstanceAttemptFieldsParams) (TaskInstanceAttemptFieldsRow, error)
	TaskInstancesForDagRuns(ctx context.Context, arg TaskInstancesForDagRunsParams) ([]TaskInstancesForDagRunsRow, error)
	TenantHasDefaultPool(ctx context.Context, name string) (bool, error)
	// The five-minute throttle is this predicate, so concurrent requests write
	// once and an older time never moves the last use back.
	TouchAPIToken(ctx context.Context, arg TouchAPITokenParams) (int64, error)
	// The range of attempt epochs one try's executions can have, for the log
	// reader (ADR 0051 amendment, #863). Epochs grow monotonically per row and the
	// try only grows, so every execution of try N has an epoch above the latest
	// epoch archived for an earlier try (low, exclusive) and at most the try's own
	// latest epoch (high, inclusive): the current row's when it is still on try N,
	// else the try's history row, which holds its latest archived execution. A row
	// the previous release archived carries epoch 0, so its try reads as epoch 0
	// alone. Epoch 0 is always read as well, since every pre-upgrade log has it.
	TryAttemptEpochBounds(ctx context.Context, arg TryAttemptEpochBoundsParams) (TryAttemptEpochBoundsRow, error)
	// Rewrite one row's ciphertext in place during a key rotation. It touches only
	// the two encrypted columns, so a re-encryption can never alter a connection's
	// identity, host, or any field a user set.
	//
	// The WHERE carries the ciphertext we read, so a row a user changed between our
	// read and our write is NOT overwritten. Without it the rotation re-seals stale
	// plaintext over a password the user just set, and bumps updated_at so the row
	// looks freshly written. Reachable whenever more than one replica serves, which
	// the chart calls the recommended production posture.
	UpdateConnectionCiphertext(ctx context.Context, arg UpdateConnectionCiphertextParams) (int64, error)
	// Applies the spec of the version that is becoming current to the dags row, in
	// the same transaction as SetCurrentDagVersion. is_paused is never touched:
	// pausing is an operator decision, not a deploy one.
	UpdateDagMetadata(ctx context.Context, arg UpdateDagMetadataParams) error
	UpdateDagRunState(ctx context.Context, arg UpdateDagRunStateParams) (DagRun, error)
	UpdateTaskInstanceState(ctx context.Context, arg UpdateTaskInstanceStateParams) (TaskInstance, error)
	// Stamps the per-state entry timestamps the UI shows (scheduled_when /
	// queued_when / start_date). Each is set on first entry only ("IS NULL"), so a
	// re-emitted transition does not move the recorded time. $3 is cast to
	// task_state (see ReportTaskResult for why the cast is required).
	UpdateTaskInstanceStateByRunTask(ctx context.Context, arg UpdateTaskInstanceStateByRunTaskParams) error
	// Batched form of UpdateTaskInstanceStateByRunTask: applies ONE target state to
	// every listed task of a run in a single statement. The per-row stamping is
	// identical (scheduled_at/queued_at/started_at set on first entry only), as is
	// the task_state cast. The scheduler groups a tick's plain state-set transitions
	// (scheduled/skipped/upstream_failed from none, up_for_retry from failed) by
	// source and target state and flushes each group through this query.
	// The write is guarded on the source state the tick's snapshot read
	// (from_state), so a row a concurrent writer moved after the snapshot (a user's
	// mark or clear, an agent's RUNNING report under an overlapping leader) is left
	// alone instead of being overwritten (#1605, ADR 0031 leader-overlap
	// correctness). The ids it returns are the rows that actually moved, so the
	// tick records only those.
	UpdateTaskInstanceStatesByRunTasks(ctx context.Context, arg UpdateTaskInstanceStatesByRunTasksParams) ([]string, error)
	// Sets the limits given and keeps the others: a NULL argument leaves that
	// column as it is, 0 makes the limit unlimited (migrations 040 and 041).
	UpdateTenantLimits(ctx context.Context, arg UpdateTenantLimitsParams) error
	UpdateUserPassword(ctx context.Context, arg UpdateUserPasswordParams) (int64, error)
	// Rewrites one stored value only if it is still the one the sweep read, so a
	// concurrent write wins and the sweep counts the row as skipped. updated_at is
	// left alone: the variable's value did not change, only its stored form.
	UpdateVariableValueGuarded(ctx context.Context, arg UpdateVariableValueGuardedParams) (int64, error)
	// Tri-state write (#887): COALESCE(EXCLUDED.col, connections.col) preserves the
	// stored value when the param is NULL, overwrites it when the param is a value,
	// and clears it when the param is a non-NULL empty string. A NULL param is how a
	// partial `set` stays safe — changing only --host must not wipe the (unreadable)
	// password — while an explicit empty string now clears a field, and a masked
	// secret ("***") is mapped to NULL by the caller so it preserves rather than
	// overwrites (#874). conn_type is required on every write, so it is a plain
	// overwrite.
	UpsertConnection(ctx context.Context, arg UpsertConnectionParams) error
	// Sizes a tenant's default pool to an explicit slot count: inserts it under the
	// given name with the seed description, or re-sizes the row already there. A
	// row with that name left without is_default (a tenant created before the
	// default pool was seeded per tenant) is marked default, so the delete guard
	// and the pools view treat it as the pool the scheduler falls back to.
	UpsertDefaultPoolSlots(ctx context.Context, arg UpsertDefaultPoolSlotsParams) error
	UpsertImportError(ctx context.Context, arg UpsertImportErrorParams) error
	UpsertPool(ctx context.Context, arg UpsertPoolParams) error
	// value is always supplied (the variable IS its value, and the `value` column is
	// NOT NULL, so a NULL param cannot reach the COALESCE — Postgres rejects it on
	// the INSERT arm). The tri-state write (#887) therefore resolves value in the
	// handler: an omitted or masked ("***") value on update is replaced with the
	// stored value before it reaches here, so this always overwrites value.
	// description is nullable, so it keeps the COALESCE preserve semantics: a NULL
	// param keeps the stored description rather than wiping it.
	UpsertVariable(ctx context.Context, arg UpsertVariableParams) error
	// The oldest transaction still running, or the next to start: every event
	// served now has a lower xid, and every event committed later a higher or
	// equal one.
	UsageEventsHorizon(ctx context.Context) (pgtype.Uint64, error)
	// The age in seconds of the oldest event the route cannot serve yet, because
	// a transaction older than it is still open; 0 when there is none.
	UsageEventsLagSeconds(ctx context.Context) (float64, error)
}