db

type AddAddressGroupCIDRParams struct {
	AddressGroupID uuid.UUID
	Cidr           string
}

type AddModeChangeWorkloadParams struct {
	ModeChangeID uuid.UUID
	WorkloadID   uuid.UUID
	PreviousMode int32
}

type AddProvisioningTokenLabelParams struct {
	TokenID uuid.UUID
	Key     string
	Value   string
}

type AddRuleParams struct {
	ID          uuid.UUID
	RulesetID   uuid.UUID
	Ordinal     int32
	Direction   int32
	Enabled     bool
	Description string
	CreatedAt   time.Time
	UpdatedAt   time.Time
	Version     int64
}

type AddRulePeerMatchParams struct {
	RuleID      uuid.UUID
	PeerOrdinal int32
	Key         string
	Values      []string
}

type AddRulePeerParams struct {
	RuleID         uuid.UUID
	Ordinal        int32
	Kind           int32
	AddressGroupID *uuid.UUID
	Cidr           *string
}

type AddRuleServiceEntryParams struct {
	RuleID    uuid.UUID
	Ordinal   int32
	Protocol  int32
	PortStart *int32
	PortEnd   *int32
}

type AddRuleServiceRefParams struct {
	RuleID    uuid.UUID
	ServiceID uuid.UUID
}

type AddRulesetScopeMatchParams struct {
	RulesetID uuid.UUID
	Key       string
	Values    []string
}

type AddServiceEntryParams struct {
	ServiceID uuid.UUID
	Ordinal   int32
	Protocol  int32
	PortStart *int32
	PortEnd   *int32
}

type AddWorkloadAddressParams struct {
	WorkloadID uuid.UUID
	Address    string
}

type AddWorkloadLabelParams struct {
	WorkloadID uuid.UUID
	Key        string
	Value      string
}

type AddWorkloadListeningServiceParams struct {
	WorkloadID  uuid.UUID
	Protocol    int32
	Port        int32
	ProcessName string
	ProcessPath string
}

type AddressGroup struct {
	ID        uuid.UUID
	RegionID  string
	Name      string
	CreatedAt time.Time
	UpdatedAt time.Time
	Version   int64
}

type AddressGroupCidr struct {
	AddressGroupID uuid.UUID
	Cidr           string
}

type CountWorkloadsByStatusRow struct {
	SyncState int32
	Removed   bool
	Retired   bool
	Workloads int64
}

type CreateAddressGroupParams struct {
	ID        uuid.UUID
	Name      string
	CreatedAt time.Time
}

type CreateModeChangeParams struct {
	ID                 uuid.UUID
	CreatedAt          time.Time
	TargetMode         int32
	Selector           []byte
	ExpectedMatchCount int32
	Matched            int32
	DesiredUpdated     int32
}

type CreateOperatorSessionParams struct {
	IDHash    []byte
	CreatedAt time.Time
	ExpiresAt time.Time
}

type CreateOperatorTokenParams struct {
	ID          uuid.UUID
	TokenHash   []byte
	TokenPrefix string
	Name        string
	CreatedAt   time.Time
	ExpiresAt   *time.Time
}

type CreateProvisioningTokenParams struct {
	ID          uuid.UUID
	TokenHash   []byte
	TokenPrefix *string
	Name        string
	ExpiresAt   time.Time
}

type CreateRulesetParams struct {
	ID          uuid.UUID
	Name        string
	Description string
	Enabled     bool
	CreatedAt   time.Time
}

type CreateServiceParams struct {
	ID        uuid.UUID
	Name      string
	CreatedAt time.Time
}

type CreateWorkloadParams struct {
	ID                  uuid.UUID
	ProvisioningTokenID uuid.UUID
	Hostname            string
	EnrolledAt          time.Time
	CredentialSerial    string
	CredentialExpiresAt time.Time
}

type DBTX interface {
	Exec(context.Context, string, ...interface{}) (pgconn.CommandTag, error)
	Query(context.Context, string, ...interface{}) (pgx.Rows, error)
	QueryRow(context.Context, string, ...interface{}) pgx.Row
	CopyFrom(ctx context.Context, tableName pgx.Identifier, columnNames []string, rowSrc pgx.CopyFromSource) (int64, error)
	SendBatch(context.Context, *pgx.Batch) pgx.BatchResults
}

type DeleteAddressGroupParams struct {
	ID       uuid.UUID
	Expected *string
}

type DeleteFlowGapsBeforeParams struct {
	Horizon   time.Time
	BatchSize int32
}

type DeleteFlowWindowsBeforeParams struct {
	Horizon   time.Time
	BatchSize int32
}

type DeleteRulesetParams struct {
	ID       uuid.UUID
	Expected *string
}

type DeleteServiceParams struct {
	ID       uuid.UUID
	Expected *string
}

type FlowGap struct {
	ID         int64
	RegionID   string
	WorkloadID uuid.UUID
	Kind       int32
	Source     int32
	GapFrom    time.Time
	GapTo      time.Time
	LostCount  pgtype.Int8
	ReceivedAt time.Time
}

type FlowTotal struct {
	RegionID        string
	WorkloadID      uuid.UUID
	PeerKind        int32
	PeerKey         string
	PeerLabels      []byte
	DstPort         int32
	Protocol        int32
	Direction       int32
	Decision        int32
	MatchedRuleID   string
	FirstSeen       time.Time
	LastSeen        time.Time
	ConnectionCount int64
	ByteCount       int64
	WindowCount     int64
}

type FlowWindow struct {
	ID              int64
	RegionID        string
	WorkloadID      uuid.UUID
	WindowStart     time.Time
	WindowEnd       time.Time
	PeerKind        int32
	PeerKey         string
	PeerLabels      []byte
	SrcAddress      string
	DstAddress      string
	DstPort         int32
	Protocol        int32
	Direction       int32
	Decision        int32
	MatchedRuleID   string
	ConnectionCount int64
	ByteCount       int64
	FirstSeen       time.Time
	LastSeen        time.Time
	ProcessName     string
}

type GetWorkloadModesRow struct {
	ID   uuid.UUID
	Mode int32
}

type GetWorkloadWithPolicyRow struct {
	Workload         Workload
	LatestVersion    pgtype.Int8
	LatestRenderedAt *time.Time
}

type InsertFlowGapBatchResults struct {
	// contains filtered or unexported fields
}

type InsertFlowGapParams struct {
	WorkloadID uuid.UUID
	Kind       int32
	Source     int32
	GapFrom    time.Time
	GapTo      time.Time
	LostCount  pgtype.Int8
}

type InsertFlowWindowsParams struct {
	WorkloadID      uuid.UUID
	WindowStart     time.Time
	WindowEnd       time.Time
	PeerKind        int32
	PeerKey         string
	PeerLabels      []byte
	SrcAddress      string
	DstAddress      string
	DstPort         int32
	Protocol        int32
	Direction       int32
	Decision        int32
	MatchedRuleID   string
	ConnectionCount int64
	ByteCount       int64
	FirstSeen       time.Time
	LastSeen        time.Time
	ProcessName     string
}

type ListFlowGapsParams struct {
	WorkloadIds []uuid.UUID
	Until       time.Time
	Since       time.Time
	RowLimit    int32
}

type ListFlowTotalsParams struct {
	WorkloadID uuid.UUID
	Decision   int32
}

type ListFlowWindowPageParams struct {
	WorkloadID  uuid.UUID
	Since       time.Time
	Until       time.Time
	Decision    int32
	Direction   int32
	PeerKey     string
	Protocol    int32
	DstPort     int32
	CursorStart time.Time
	CursorID    int64
	RowLimit    int32
}

type ListFlowWindowsParams struct {
	WorkloadID uuid.UUID
	Since      time.Time
	Until      time.Time
	Decision   int32
	RowLimit   int32
}

type ListWorkloadPageParams struct {
	WorkloadIds []uuid.UUID
	Mode        int32
	SyncState   int32
	Lifecycle   int32
	CursorRank  int32
	CursorSeen  time.Time
	CursorID    uuid.UUID
	RowLimit    int32
}

type ListWorkloadPageRow struct {
	ID                           uuid.UUID
	RegionID                     string
	ProvisioningTokenID          uuid.UUID
	Hostname                     string
	EnrolledAt                   time.Time
	CredentialSerial             string
	CredentialExpiresAt          time.Time
	LastRenewedAt                *time.Time
	Mode                         int32
	Facts                        []byte
	AgentVersion                 string
	AgentCapabilities            []string
	LastSeenAt                   *time.Time
	SyncState                    int32
	AppliedPolicyVersion         int64
	SyncError                    string
	DroppedFlowRecords           int64
	CredentialRenewalError       string
	LastSnapshotSentAt           *time.Time
	LastAckedAt                  *time.Time
	LastApplyFailedAt            *time.Time
	SourceOverruns               int64
	ClockSkewOffsetMs            pgtype.Int8
	ClockSkewObservedAt          *time.Time
	ClockSkewCurrent             bool
	OwnedTableState              int16
	OwnedTableAbsentSince        *time.Time
	LastFlowReportAt             *time.Time
	LateRenewalAt                *time.Time
	LateRenewalExpiredAt         *time.Time
	RetiredAt                    *time.Time
	PresentedCredentialSerial    *string
	PresentedCredentialExpiresAt *time.Time
	SyncRank                     int32
	SeenKey                      time.Time
	LatestVersion                pgtype.Int8
	LatestRenderedAt             *time.Time
}

type LockWorkloadRow struct {
	RetiredAt        *time.Time
	LastFlowReportAt *time.Time
	LastHeartbeatAt  *time.Time
	AgentStartedAt   *time.Time
}

type ModeChange struct {
	ID                 uuid.UUID
	RegionID           string
	CreatedAt          time.Time
	TargetMode         int32
	Selector           []byte
	ExpectedMatchCount int32
	Matched            int32
	DesiredUpdated     int32
}

type ModeChangeWorkload struct {
	ModeChangeID uuid.UUID
	WorkloadID   uuid.UUID
	PreviousMode int32
}

type NotifyDirectiveParams struct {
	Channel string
	Payload string
}

type NotifyPolicyChangedParams struct {
	Channel string
	Payload string
}

type Operator struct {
	ID           bool
	RegionID     string
	PasswordHash string
	DisplayName  *string
	CreatedAt    time.Time
	UpdatedAt    time.Time
}

type OperatorSession struct {
	IDHash    []byte
	RegionID  string
	CreatedAt time.Time
	ExpiresAt time.Time
}

type OperatorToken struct {
	ID          uuid.UUID
	RegionID    string
	TokenHash   []byte
	TokenPrefix string
	Name        string
	CreatedAt   time.Time
	ExpiresAt   *time.Time
	RevokedAt   *time.Time
	LastUsedAt  *time.Time
}

type ProvisioningToken struct {
	ID          uuid.UUID
	RegionID    string
	TokenHash   []byte
	Name        string
	CreatedAt   time.Time
	ExpiresAt   time.Time
	RevokedAt   *time.Time
	UseCount    int64
	LastUsedAt  *time.Time
	TokenPrefix *string
}

type ProvisioningTokenLabel struct {
	TokenID uuid.UUID
	Key     string
	Value   string
}

type Querier interface {
	// Rendered per-workload policy and its version (ADR-0018). The render
	// transaction holds an advisory lock so that two renders never interleave
	// their version bumps, and it notifies listeners of every changed workload
	// on commit so that the replica holding the workload's stream pushes the
	// change without anything polling (ADR-0002).
	AcquireRenderLock(ctx context.Context, key int64) error
	AddAddressGroupCIDR(ctx context.Context, arg AddAddressGroupCIDRParams) error
	AddModeChangeWorkload(ctx context.Context, arg AddModeChangeWorkloadParams) error
	AddProvisioningTokenLabel(ctx context.Context, arg AddProvisioningTokenLabelParams) error
	AddRule(ctx context.Context, arg AddRuleParams) error
	AddRulePeer(ctx context.Context, arg AddRulePeerParams) error
	AddRulePeerMatch(ctx context.Context, arg AddRulePeerMatchParams) error
	AddRuleServiceEntry(ctx context.Context, arg AddRuleServiceEntryParams) error
	AddRuleServiceRef(ctx context.Context, arg AddRuleServiceRefParams) error
	AddRulesetScopeMatch(ctx context.Context, arg AddRulesetScopeMatchParams) error
	AddServiceEntry(ctx context.Context, arg AddServiceEntryParams) error
	AddWorkloadAddress(ctx context.Context, arg AddWorkloadAddressParams) error
	AddWorkloadLabel(ctx context.Context, arg AddWorkloadLabelParams) error
	AddWorkloadListeningService(ctx context.Context, arg AddWorkloadListeningServiceParams) error
	CountFlowWindows(ctx context.Context) (int64, error)
	CountRulesReferencingAddressGroup(ctx context.Context, addressGroupID *uuid.UUID) (int64, error)
	CountRulesReferencingService(ctx context.Context, serviceID uuid.UUID) (int64, error)
	// How many workloads hold each sync state, split by whether their owned
	// table is recorded absent (migration 00012) and by whether they are
	// retired (ADR-0023), in one statement so the counts agree with each
	// other. A combination no workload holds has no row.
	CountWorkloadsByStatus(ctx context.Context) ([]CountWorkloadsByStatusRow, error)
	// Address groups: named CIDR sets for peers that are not managed workloads
	// (ADR-0018).
	CreateAddressGroup(ctx context.Context, arg CreateAddressGroupParams) error
	// Recorded bulk mode changes (ADR-0007 as amended): the intent as
	// submitted, the set it resolved to, and what changed. Written inside the
	// render transaction that flips the modes, so the record and the flip are
	// one unit.
	CreateModeChange(ctx context.Context, arg CreateModeChangeParams) error
	CreateOperatorSession(ctx context.Context, arg CreateOperatorSessionParams) error
	CreateOperatorToken(ctx context.Context, arg CreateOperatorTokenParams) error
	// Provisioning tokens (ADR-0016 as amended). A token is looked up only by
	// its SHA-256 hash; beside it only token_prefix, the listing hint, is kept,
	// NULL for tokens minted before it was. No query here touches plaintext.
	CreateProvisioningToken(ctx context.Context, arg CreateProvisioningTokenParams) (ProvisioningToken, error)
	// Rulesets and their rules: the authored policy model (ADR-0018). A ruleset
	// is written and replaced as a unit; its child rows are deleted and
	// reinserted inside one transaction on update.
	CreateRuleset(ctx context.Context, arg CreateRulesetParams) error
	// Named service definitions: reusable protocol/port sets (ADR-0018).
	CreateService(ctx context.Context, arg CreateServiceParams) error
	// Workload identity registry (ADR-0016). The id column is the workload_id
	// carried in the credential's URI SAN; labels are assigned at enrollment from
	// the provisioning token's scope and are never read from a certificate.
	CreateWorkload(ctx context.Context, arg CreateWorkloadParams) error
	DeleteAddressGroup(ctx context.Context, arg DeleteAddressGroupParams) (int64, error)
	DeleteAddressGroupCIDRs(ctx context.Context, addressGroupID uuid.UUID) error
	// Retention: expired sessions are removed on the same schedule as aged
	// flow windows (ADR-0019, ADR-0021).
	DeleteExpiredOperatorSessions(ctx context.Context, now time.Time) (int64, error)
	// Retention: one bounded batch of the gaps that ended before the horizon,
	// so a gap outlives every window it could describe.
	DeleteFlowGapsBefore(ctx context.Context, arg DeleteFlowGapsBeforeParams) (int64, error)
	// Retention: one bounded batch of the oldest windows before the horizon.
	// The caller loops until a batch deletes nothing, so no single statement
	// holds locks for the whole backlog (ADR-0019).
	DeleteFlowWindowsBefore(ctx context.Context, arg DeleteFlowWindowsBeforeParams) (int64, error)
	DeleteOperatorSession(ctx context.Context, idHash []byte) (int64, error)
	DeleteRules(ctx context.Context, rulesetID uuid.UUID) error
	DeleteRuleset(ctx context.Context, arg DeleteRulesetParams) (int64, error)
	DeleteRulesetScopeMatches(ctx context.Context, rulesetID uuid.UUID) error
	DeleteService(ctx context.Context, arg DeleteServiceParams) (int64, error)
	DeleteServiceEntries(ctx context.Context, serviceID uuid.UUID) error
	DeleteWorkloadAddresses(ctx context.Context, workloadID uuid.UUID) error
	DeleteWorkloadLabels(ctx context.Context, workloadID uuid.UUID) error
	DeleteWorkloadListeningServices(ctx context.Context, workloadID uuid.UUID) error
	GetAddressGroup(ctx context.Context, id uuid.UUID) (AddressGroup, error)
	GetModeChange(ctx context.Context, id uuid.UUID) (ModeChange, error)
	// Operator surface (ADR-0021). Passwords are stored as argon2id strings;
	// session identifiers and operator tokens only as SHA-256 digests. No query
	// here touches a plaintext credential.
	GetOperator(ctx context.Context) (Operator, error)
	GetOperatorSession(ctx context.Context, idHash []byte) (OperatorSession, error)
	GetOperatorToken(ctx context.Context, id uuid.UUID) (OperatorToken, error)
	GetOperatorTokenByHash(ctx context.Context, tokenHash []byte) (OperatorToken, error)
	GetProvisioningToken(ctx context.Context, id uuid.UUID) (ProvisioningToken, error)
	GetProvisioningTokenByHash(ctx context.Context, tokenHash []byte) (ProvisioningToken, error)
	GetRuleset(ctx context.Context, id uuid.UUID) (Ruleset, error)
	GetService(ctx context.Context, id uuid.UUID) (Service, error)
	GetWorkload(ctx context.Context, id uuid.UUID) (Workload, error)
	// The modes of a resolved set before it is flipped, and the flip itself,
	// by explicit id: the set was resolved once, in this transaction, and a
	// label change committed meanwhile does not move it.
	GetWorkloadModes(ctx context.Context, workloadIds []uuid.UUID) ([]GetWorkloadModesRow, error)
	GetWorkloadPolicy(ctx context.Context, workloadID uuid.UUID) (WorkloadPolicy, error)
	// Why a conditioned write found no row: absent, or retired since when.
	GetWorkloadRetiredAt(ctx context.Context, id uuid.UUID) (*time.Time, error)
	// One workload with its latest rendered version, for the detail read.
	GetWorkloadWithPolicy(ctx context.Context, id uuid.UUID) (GetWorkloadWithPolicyRow, error)
	// --- evidence gaps -------------------------------------------------------------
	//
	// Intervals in which a workload's evidence is known to be incomplete
	// (ADR-0019 as amended). Delivery is at least once: an interval repeated
	// exactly is stored once.
	InsertFlowGap(ctx context.Context, arg []InsertFlowGapParams) *InsertFlowGapBatchResults
	// Flow storage (ADR-0009, ADR-0019). These are the only statements that
	// touch flow_windows, flow_totals, and flow_gaps; every caller goes through
	// the FlowStore interface in internal/flowstore.
	InsertFlowWindows(ctx context.Context, arg []InsertFlowWindowsParams) (int64, error)
	ListAddressGroupCIDRs(ctx context.Context, addressGroupID uuid.UUID) ([]AddressGroupCidr, error)
	ListAddressGroups(ctx context.Context) ([]AddressGroup, error)
	ListAllAddressGroupCIDRs(ctx context.Context) ([]AddressGroupCidr, error)
	ListAllProvisioningTokenLabels(ctx context.Context) ([]ProvisioningTokenLabel, error)
	ListAllRulePeerMatches(ctx context.Context) ([]RulePeerMatch, error)
	ListAllRulePeers(ctx context.Context) ([]RulePeer, error)
	ListAllRuleServiceEntries(ctx context.Context) ([]RuleServiceEntry, error)
	ListAllRuleServiceRefs(ctx context.Context) ([]RuleServiceRef, error)
	ListAllRules(ctx context.Context) ([]Rule, error)
	ListAllRulesetScopeMatches(ctx context.Context) ([]RulesetScopeMatch, error)
	ListAllServiceEntries(ctx context.Context) ([]ServiceEntry, error)
	ListAllWorkloadAddresses(ctx context.Context) ([]WorkloadAddress, error)
	ListAllWorkloadLabels(ctx context.Context) ([]WorkloadLabel, error)
	// The gaps of a workload set that intersect [since, until): a gap
	// [gap_from, gap_to) intersects it when it starts before the range ends
	// and ends after the range starts; an instantaneous gap intersects when
	// its instant lies in the range. Newest first, bounded; an empty workload
	// id array means every workload.
	ListFlowGaps(ctx context.Context, arg ListFlowGapsParams) ([]FlowGap, error)
	ListFlowTotals(ctx context.Context, arg ListFlowTotalsParams) ([]FlowTotal, error)
	// One page of a workload's windows, newest first, keyed by
	// (window_start, id) so a page never shifts when new windows land. The
	// first page passes a cursor beyond any row. An empty peer key means every
	// peer; a zero protocol means every service.
	ListFlowWindowPage(ctx context.Context, arg ListFlowWindowPageParams) ([]FlowWindow, error)
	ListFlowWindows(ctx context.Context, arg ListFlowWindowsParams) ([]FlowWindow, error)
	ListModeChangeWorkloads(ctx context.Context, modeChangeID uuid.UUID) ([]ModeChangeWorkload, error)
	ListOperatorTokens(ctx context.Context) ([]OperatorToken, error)
	ListProvisioningTokenLabels(ctx context.Context, tokenID uuid.UUID) ([]ProvisioningTokenLabel, error)
	ListProvisioningTokens(ctx context.Context) ([]ProvisioningToken, error)
	ListRulesets(ctx context.Context) ([]Ruleset, error)
	ListServiceEntries(ctx context.Context, serviceID uuid.UUID) ([]ServiceEntry, error)
	ListServices(ctx context.Context) ([]Service, error)
	ListWorkloadAddresses(ctx context.Context, workloadID uuid.UUID) ([]string, error)
	ListWorkloadAddressesFor(ctx context.Context, workloadIds []uuid.UUID) ([]WorkloadAddress, error)
	ListWorkloadLabels(ctx context.Context, workloadID uuid.UUID) ([]WorkloadLabel, error)
	// The children of the workloads on one page, fetched once per page.
	ListWorkloadLabelsFor(ctx context.Context, workloadIds []uuid.UUID) ([]WorkloadLabel, error)
	ListWorkloadListeningServices(ctx context.Context, workloadID uuid.UUID) ([]WorkloadListeningService, error)
	ListWorkloadListeningServicesFor(ctx context.Context, workloadIds []uuid.UUID) ([]WorkloadListeningService, error)
	// --- operator read model (ADR-0007 as amended) -------------------------------
	// One page of the fleet in the order the fleet screen shows it: the
	// workloads needing attention first (degraded or enforcement removed,
	// then offline, then pending, then synced), most recently seen first
	// within a rank, then by id. A workload whose owned table is recorded
	// absent (migration 00012) ranks with the degraded ones whatever its
	// stored sync state, which stays the agent's honest record (issue #96). The cursor is the (rank, last seen, id) of the last row served; the
	// first page passes a rank below every row. A workload never seen sorts
	// as if seen at the epoch. An empty id array means every workload; a zero
	// mode or sync state means any. The latest rendered version rides along
	// from workload_policies so sync drift is one read.
	//
	// A retired workload is outside the attention ordering (ADR-0023): the
	// lifecycle argument selects active workloads (1) or retired ones (2),
	// never both, and a retired one takes a rank of its own below every
	// other with its retirement instant as the sort key, so the retired list
	// runs most recently retired first through the same cursor.
	ListWorkloadPage(ctx context.Context, arg ListWorkloadPageParams) ([]ListWorkloadPageRow, error)
	ListWorkloadPolicies(ctx context.Context) ([]WorkloadPolicy, error)
	// --- inventory and status (ADR-0018) ------------------------------------------
	ListWorkloads(ctx context.Context) ([]Workload, error)
	// --- retirement (ADR-0023) ----------------------------------------------------
	// The row a retirement or a label write locks before it reads, so the two
	// serialize with each other and with flow ingest's receipt: the instant it
	// was retired (NULL while active), and what the silence derivation reads,
	// the last report's receipt and the latest heartbeat's pair.
	LockWorkload(ctx context.Context, id uuid.UUID) (LockWorkloadRow, error)
	// A directive for the stream of one workload rides the same channel as
	// render announcements, keyed by the workload; the replica holding that
	// stream, if any, sends it (ADR-0018 as amended). It is sent outside any
	// transaction, so it is delivered at once.
	NotifyDirective(ctx context.Context, arg NotifyDirectiveParams) error
	NotifyPolicyChanged(ctx context.Context, arg NotifyPolicyChangedParams) error
	// Queries are hand-written SQL compiled by sqlc into internal/store/db
	// (ADR-0006). One file per concern; every production query lives here.
	//
	// Ping is a connectivity probe that touches no tables. It exists so the data
	// layer is exercised end to end before the first migration lands.
	Ping(ctx context.Context) (int32, error)
	RecordOperatorTokenUse(ctx context.Context, arg RecordOperatorTokenUseParams) error
	RecordProvisioningTokenUse(ctx context.Context, arg RecordProvisioningTokenUseParams) error
	// The Hello also stamps the credential the stream opened on (migration
	// 00018); a caller that knows of none passes both NULL and leaves the
	// stamp as it was, so the pair is never half-written or made up.
	RecordWorkloadAgent(ctx context.Context, arg RecordWorkloadAgentParams) (int64, error)
	// An APPLIED acknowledgement: the version, the resulting state, and the
	// instant. Nothing else writes last_acked_at (migration 00007). An apply
	// that succeeded installed the owned table, so a table recorded absent is
	// present again (migration 00012).
	RecordWorkloadApplied(ctx context.Context, arg RecordWorkloadAppliedParams) (int64, error)
	// A FAILED acknowledgement: the degraded state, the agent's detail, and the
	// instant. The applied version is untouched; the agent is still on it.
	// Nothing else writes last_apply_failed_at (migration 00007).
	RecordWorkloadApplyFailed(ctx context.Context, arg RecordWorkloadApplyFailedParams) (int64, error)
	// One flow report's reading of the agent's clock (migration 00010). A
	// skewed reading records its offset and instant and marks the skew current;
	// a reading within tolerance only clears the mark, and writes nothing when
	// there is no mark to clear, so a healthy agent's reports cost no write.
	RecordWorkloadClockReading(ctx context.Context, arg RecordWorkloadClockReadingParams) error
	// The receipt of one flow report (migration 00013). Never moved backwards,
	// so reports handled out of order across replicas leave the latest. The
	// row it replaces comes back so ingest can derive the agent-silence gap
	// (migration 00015): the locking subquery serializes concurrent reports of
	// one workload, so each silence is seen by exactly one of them. The latest
	// heartbeat's receipt and process start ride along, read under the same
	// lock, so the derivation can tell a quiet agent from an absent one
	// (migration 00016). No row means the receipt did not advance (a stale
	// report, or no such workload). A retired workload's receipt never moves:
	// its retirement closed the silence the receipt would bound, under the same
	// row lock, so a report racing it derives nothing twice (ADR-0023).
	RecordWorkloadFlowReport(ctx context.Context, arg RecordWorkloadFlowReportParams) ([]RecordWorkloadFlowReportRow, error)
	// A heartbeat's counters, renewal status, and owned-table state (migration
	// 00012). An unknown state leaves the stored one; the absent instant is the
	// first heartbeat's that said absent, kept while the state stays absent.
	// The heartbeat's receipt and the start of the process it came from are
	// written together, so the pair is always one heartbeat's (migration 00016).
	RecordWorkloadHeartbeat(ctx context.Context, arg RecordWorkloadHeartbeatParams) (int64, error)
	RecordWorkloadHeartbeatSeen(ctx context.Context, arg RecordWorkloadHeartbeatSeenParams) (int64, error)
	// The writes a sync stream makes from what its agent sends (inventory,
	// Hello, heartbeats, acknowledgements) are conditioned on the workload not
	// being retired: no row means it is unknown or retired, and the stream of a
	// retired workload ends at the next one (ADR-0023).
	RecordWorkloadInventory(ctx context.Context, arg RecordWorkloadInventoryParams) (int64, error)
	// A late renewal (one made with an already-expired credential, within the
	// grace) also replaces the workload's late-renewal record; an on-time one
	// leaves it (ADR-0016 as amended).
	// A retired workload renews nothing (ADR-0023): the write is conditioned
	// on it, so a retirement committed after the renewal was admitted still
	// refuses it here.
	RecordWorkloadRenewal(ctx context.Context, arg RecordWorkloadRenewalParams) (int64, error)
	// Stamped by the sync path whenever it sends the workload a snapshot,
	// whatever caused it; nothing else writes it (ADR-0018 as amended).
	RecordWorkloadSnapshotSent(ctx context.Context, arg RecordWorkloadSnapshotSentParams) (int64, error)
	// Retirement stamps the instant once; nothing clears it.
	RetireWorkload(ctx context.Context, arg RetireWorkloadParams) (int64, error)
	RevokeOperatorToken(ctx context.Context, arg RevokeOperatorTokenParams) (int64, error)
	RevokeProvisioningToken(ctx context.Context, arg RevokeProvisioningTokenParams) (int64, error)
	// The rollup the operator console issues for a label scope: the scope is
	// resolved to workload ids by the caller, and the rows are grouped by
	// resolved peer and service (destination port and protocol). A decision of
	// 0 means every decision.
	RollupFlowWindows(ctx context.Context, arg RollupFlowWindowsParams) ([]RollupFlowWindowsRow, error)
	// Grouped by the reporting workload and the service reached on it: the
	// cells of the matrix.
	RollupFlowsByDstService(ctx context.Context, arg RollupFlowsByDstServiceParams) ([]RollupFlowsByDstServiceRow, error)
	// Grouped by the resolved peer and the service it reached, across every
	// workload in scope, with the number of distinct workloads that saw it:
	// the rows of a simulation review (ADR-0019 decision 4(b)). The label
	// snapshot of a peer is the one stored with its most recently seen
	// record.
	RollupFlowsByPeerService(ctx context.Context, arg RollupFlowsByPeerServiceParams) ([]RollupFlowsByPeerServiceRow, error)
	// --- operator read model -----------------------------------------------------
	//
	// The rollups the operator surface and the command line issue (ADR-0007 as
	// amended, ADR-0019 decision 4). Each grouping the surface offers is one
	// named statement over the same windows; the caller picks the statement
	// and never assembles one. Every rollup shares one filter convention: an
	// empty workload id array means every workload; a non-empty one selects
	// the records those workloads reported, and with either_endpoint also the
	// records whose source resolved at ingest to one of them (peer kind 1, a
	// workload, keyed by its id), each record once; a zero decision or
	// direction means any, and a zero protocol means every service (a service
	// is one destination port and protocol). Ordering is by connection count
	// unless order_by is 'recent', in which case the most recently seen group
	// comes first. The window bounds actually covered, the number of groups,
	// and the totals across every group ride on each row as window aggregates,
	// so a truncated result still says how it relates to the whole. The
	// decision-and-time and workload-and-time indexes serve all five.
	// Grouped by the resolved rule that admitted the traffic; records with no
	// matched rule form the group with the empty rule id. Each group counts
	// the distinct workloads that reported it, since a rule's key names none.
	RollupFlowsByRule(ctx context.Context, arg RollupFlowsByRuleParams) ([]RollupFlowsByRuleRow, error)
	// Grouped by rule and the resolved peer that hit it. The label snapshot
	// of a peer is the one stored with its most recently seen record.
	RollupFlowsByRulePeer(ctx context.Context, arg RollupFlowsByRulePeerParams) ([]RollupFlowsByRulePeerRow, error)
	// Grouped by the resolved source peer and the reporting workload: the
	// edges of the dependency map. Inbound only in this version, so the
	// source is the peer and the destination is the workload.
	RollupFlowsBySrcDst(ctx context.Context, arg RollupFlowsBySrcDstParams) ([]RollupFlowsBySrcDstRow, error)
	SetOperator(ctx context.Context, arg SetOperatorParams) (Operator, error)
	SetWorkloadMode(ctx context.Context, arg SetWorkloadModeParams) (int64, error)
	SetWorkloadModes(ctx context.Context, arg SetWorkloadModesParams) (int64, error)
	SetWorkloadSyncState(ctx context.Context, arg SetWorkloadSyncStateParams) (int64, error)
	// Retention runs singly across replicas: whichever replica acquires the
	// lock prunes, the others skip this round (ADR-0017).
	TryAcquireRetentionLock(ctx context.Context, key int64) (bool, error)
	// Conditional writes: expected is the version token the caller last read,
	// compared byte-exact against the stored version's decimal form, or NULL
	// for an unconditional write. Every write advances the version by one.
	UpdateAddressGroup(ctx context.Context, arg UpdateAddressGroupParams) (int64, error)
	// A conditional write: expected is the version token the caller last
	// read, compared byte-exact against the stored version's decimal form, or
	// NULL for an unconditional write (the command line's default). Every
	// write advances the version by one and returns it. No row with a NULL
	// expected means the ruleset does not exist; no row with one set means
	// either that or a version the caller did not see.
	UpdateRuleset(ctx context.Context, arg UpdateRulesetParams) (int64, error)
	// Conditional writes: expected is the version token the caller last read,
	// compared byte-exact against the stored version's decimal form, or NULL
	// for an unconditional write. Every write advances the version by one.
	UpdateService(ctx context.Context, arg UpdateServiceParams) (int64, error)
	UpsertFlowTotal(ctx context.Context, arg []UpsertFlowTotalParams) *UpsertFlowTotalBatchResults
	UpsertWorkloadPolicy(ctx context.Context, arg UpsertWorkloadPolicyParams) error
}

type Queries struct {
	// contains filtered or unexported fields
}

type RecordOperatorTokenUseParams struct {
	ID         uuid.UUID
	LastUsedAt *time.Time
}

type RecordProvisioningTokenUseParams struct {
	ID         uuid.UUID
	LastUsedAt *time.Time
}

type RecordWorkloadAgentParams struct {
	AgentVersion         string
	AgentCapabilities    []string
	AppliedPolicyVersion int64
	LastSeenAt           *time.Time
	PresentedSerial      *string
	PresentedExpiresAt   *time.Time
	ID                   uuid.UUID
}

type RecordWorkloadAppliedParams struct {
	ID                   uuid.UUID
	AppliedPolicyVersion int64
	SyncState            int32
	LastSeenAt           *time.Time
}

type RecordWorkloadApplyFailedParams struct {
	ID         uuid.UUID
	SyncState  int32
	SyncError  string
	LastSeenAt *time.Time
}

type RecordWorkloadClockReadingParams struct {
	Skewed     bool
	OffsetMs   int64
	ObservedAt time.Time
	ID         uuid.UUID
}

type RecordWorkloadFlowReportParams struct {
	ReceivedAt *time.Time
	ID         uuid.UUID
}

type RecordWorkloadFlowReportRow struct {
	Prev        *time.Time
	HeartbeatAt *time.Time
	StartedAt   *time.Time
}

type RecordWorkloadHeartbeatParams struct {
	LastSeenAt             *time.Time
	DroppedFlowRecords     int64
	AgentStartedAt         *time.Time
	CredentialRenewalError string
	SourceOverruns         int64
	OwnedTableState        int16
	ID                     uuid.UUID
}

type RecordWorkloadHeartbeatSeenParams struct {
	ID         uuid.UUID
	LastSeenAt *time.Time
}

type RecordWorkloadInventoryParams struct {
	ID         uuid.UUID
	Facts      []byte
	Hostname   string
	LastSeenAt *time.Time
}

type RecordWorkloadRenewalParams struct {
	CredentialSerial    string
	CredentialExpiresAt time.Time
	LastRenewedAt       *time.Time
	LateExpiredAt       *time.Time
	ID                  uuid.UUID
}

type RecordWorkloadSnapshotSentParams struct {
	ID                 uuid.UUID
	LastSnapshotSentAt *time.Time
}

type RetireWorkloadParams struct {
	RetiredAt *time.Time
	ID        uuid.UUID
}

type RevokeOperatorTokenParams struct {
	ID        uuid.UUID
	RevokedAt *time.Time
}

type RevokeProvisioningTokenParams struct {
	ID        uuid.UUID
	RevokedAt *time.Time
}

type RollupFlowWindowsParams struct {
	WorkloadIds []uuid.UUID
	Since       time.Time
	Until       time.Time
	Decision    int32
}

type RollupFlowWindowsRow struct {
	PeerKind        int32
	PeerKey         string
	DstPort         int32
	Protocol        int32
	Decision        int32
	WorkloadCount   int64
	ConnectionCount int64
	ByteCount       int64
	FirstSeen       time.Time
	LastSeen        time.Time
}

type RollupFlowsByDstServiceParams struct {
	WorkloadIds    []uuid.UUID
	EitherEndpoint bool
	Since          time.Time
	Until          time.Time
	Decision       int32
	Direction      int32
	Protocol       int32
	DstPort        int32
	OrderBy        string
	GroupLimit     int32
}

type RollupFlowsByDstServiceRow struct {
	WorkloadID           uuid.UUID
	DstPort              int32
	Protocol             int32
	FlowCount            int64
	ConnectionCount      int64
	ByteCount            int64
	FirstSeen            time.Time
	LastSeen             time.Time
	EffectiveFrom        time.Time
	EffectiveTo          time.Time
	GroupCount           int64
	TotalFlowCount       int64
	TotalConnectionCount int64
	TotalByteCount       int64
}

type RollupFlowsByPeerServiceParams struct {
	WorkloadIds    []uuid.UUID
	EitherEndpoint bool
	Since          time.Time
	Until          time.Time
	Decision       int32
	Direction      int32
	Protocol       int32
	DstPort        int32
	OrderBy        string
	GroupLimit     int32
}

type RollupFlowsByPeerServiceRow struct {
	PeerKind             int32
	PeerKey              string
	PeerLabels           []byte
	DstPort              int32
	Protocol             int32
	WorkloadCount        int64
	FlowCount            int64
	ConnectionCount      int64
	ByteCount            int64
	FirstSeen            time.Time
	LastSeen             time.Time
	EffectiveFrom        time.Time
	EffectiveTo          time.Time
	GroupCount           int64
	TotalFlowCount       int64
	TotalConnectionCount int64
	TotalByteCount       int64
}

type RollupFlowsByRuleParams struct {
	WorkloadIds    []uuid.UUID
	EitherEndpoint bool
	Since          time.Time
	Until          time.Time
	Decision       int32
	Direction      int32
	Protocol       int32
	DstPort        int32
	OrderBy        string
	GroupLimit     int32
}

type RollupFlowsByRulePeerParams struct {
	WorkloadIds    []uuid.UUID
	EitherEndpoint bool
	Since          time.Time
	Until          time.Time
	Decision       int32
	Direction      int32
	Protocol       int32
	DstPort        int32
	OrderBy        string
	GroupLimit     int32
}

type RollupFlowsByRulePeerRow struct {
	MatchedRuleID        string
	PeerKind             int32
	PeerKey              string
	PeerLabels           []byte
	FlowCount            int64
	ConnectionCount      int64
	ByteCount            int64
	FirstSeen            time.Time
	LastSeen             time.Time
	EffectiveFrom        time.Time
	EffectiveTo          time.Time
	GroupCount           int64
	TotalFlowCount       int64
	TotalConnectionCount int64
	TotalByteCount       int64
}

type RollupFlowsByRuleRow struct {
	MatchedRuleID        string
	WorkloadCount        int64
	FlowCount            int64
	ConnectionCount      int64
	ByteCount            int64
	FirstSeen            time.Time
	LastSeen             time.Time
	EffectiveFrom        time.Time
	EffectiveTo          time.Time
	GroupCount           int64
	TotalFlowCount       int64
	TotalConnectionCount int64
	TotalByteCount       int64
}

type RollupFlowsBySrcDstParams struct {
	WorkloadIds    []uuid.UUID
	EitherEndpoint bool
	Since          time.Time
	Until          time.Time
	Decision       int32
	Direction      int32
	Protocol       int32
	DstPort        int32
	OrderBy        string
	GroupLimit     int32
}

type RollupFlowsBySrcDstRow struct {
	PeerKind             int32
	PeerKey              string
	PeerLabels           []byte
	WorkloadID           uuid.UUID
	FlowCount            int64
	ConnectionCount      int64
	ByteCount            int64
	FirstSeen            time.Time
	LastSeen             time.Time
	EffectiveFrom        time.Time
	EffectiveTo          time.Time
	GroupCount           int64
	TotalFlowCount       int64
	TotalConnectionCount int64
	TotalByteCount       int64
}

type Rule struct {
	ID          uuid.UUID
	RulesetID   uuid.UUID
	Ordinal     int32
	Direction   int32
	Enabled     bool
	Description string
	CreatedAt   time.Time
	UpdatedAt   time.Time
	Version     int64
}

type RulePeer struct {
	RuleID         uuid.UUID
	Ordinal        int32
	Kind           int32
	AddressGroupID *uuid.UUID
	Cidr           *string
}

type RulePeerMatch struct {
	RuleID      uuid.UUID
	PeerOrdinal int32
	Key         string
	Values      []string
}

type RuleServiceEntry struct {
	RuleID    uuid.UUID
	Ordinal   int32
	Protocol  int32
	PortStart *int32
	PortEnd   *int32
}

type RuleServiceRef struct {
	RuleID    uuid.UUID
	ServiceID uuid.UUID
}

type Ruleset struct {
	ID          uuid.UUID
	RegionID    string
	Name        string
	Description string
	Enabled     bool
	CreatedAt   time.Time
	UpdatedAt   time.Time
	Version     int64
}

type RulesetScopeMatch struct {
	RulesetID uuid.UUID
	Key       string
	Values    []string
}

type Service struct {
	ID        uuid.UUID
	RegionID  string
	Name      string
	CreatedAt time.Time
	UpdatedAt time.Time
	Version   int64
}

type ServiceEntry struct {
	ServiceID uuid.UUID
	Ordinal   int32
	Protocol  int32
	PortStart *int32
	PortEnd   *int32
}

type SetOperatorParams struct {
	PasswordHash string
	DisplayName  *string
	CreatedAt    time.Time
}

type SetWorkloadModeParams struct {
	ID   uuid.UUID
	Mode int32
}

type SetWorkloadModesParams struct {
	Mode        int32
	WorkloadIds []uuid.UUID
}

type SetWorkloadSyncStateParams struct {
	ID         uuid.UUID
	SyncState  int32
	SyncError  string
	LastSeenAt *time.Time
}

type UpdateAddressGroupParams struct {
	ID        uuid.UUID
	Name      string
	UpdatedAt time.Time
	Expected  *string
}

type UpdateRulesetParams struct {
	ID          uuid.UUID
	Name        string
	Description string
	Enabled     bool
	UpdatedAt   time.Time
	Expected    *string
}

type UpdateServiceParams struct {
	ID        uuid.UUID
	Name      string
	UpdatedAt time.Time
	Expected  *string
}

type UpsertFlowTotalBatchResults struct {
	// contains filtered or unexported fields
}

type UpsertFlowTotalParams struct {
	WorkloadID      uuid.UUID
	PeerKind        int32
	PeerKey         string
	PeerLabels      []byte
	DstPort         int32
	Protocol        int32
	Direction       int32
	Decision        int32
	MatchedRuleID   string
	FirstSeen       time.Time
	LastSeen        time.Time
	ConnectionCount int64
	ByteCount       int64
}

type UpsertWorkloadPolicyParams struct {
	WorkloadID uuid.UUID
	Version    int64
	Policy     []byte
	RenderedAt time.Time
}

type Workload struct {
	ID                           uuid.UUID
	RegionID                     string
	ProvisioningTokenID          uuid.UUID
	Hostname                     string
	EnrolledAt                   time.Time
	CredentialSerial             string
	CredentialExpiresAt          time.Time
	LastRenewedAt                *time.Time
	Mode                         int32
	Facts                        []byte
	AgentVersion                 string
	AgentCapabilities            []string
	LastSeenAt                   *time.Time
	SyncState                    int32
	AppliedPolicyVersion         int64
	SyncError                    string
	DroppedFlowRecords           int64
	CredentialRenewalError       string
	LastSnapshotSentAt           *time.Time
	LastAckedAt                  *time.Time
	LastApplyFailedAt            *time.Time
	SourceOverruns               int64
	ClockSkewOffsetMs            pgtype.Int8
	ClockSkewObservedAt          *time.Time
	ClockSkewCurrent             bool
	OwnedTableState              int16
	OwnedTableAbsentSince        *time.Time
	LastFlowReportAt             *time.Time
	LateRenewalAt                *time.Time
	LateRenewalExpiredAt         *time.Time
	LastHeartbeatAt              *time.Time
	AgentStartedAt               *time.Time
	RetiredAt                    *time.Time
	PresentedCredentialSerial    *string
	PresentedCredentialExpiresAt *time.Time
}

type WorkloadAddress struct {
	WorkloadID uuid.UUID
	Address    string
}

type WorkloadLabel struct {
	WorkloadID uuid.UUID
	Key        string
	Value      string
}

type WorkloadListeningService struct {
	WorkloadID  uuid.UUID
	Protocol    int32
	Port        int32
	ProcessName string
	ProcessPath string
}

type WorkloadPolicy struct {
	WorkloadID uuid.UUID
	Version    int64
	Policy     []byte
	RenderedAt time.Time
}