controlstatedb

type AcceptTeamInvitationParams struct {
	AcceptedAt   pgtype.Timestamptz
	IdentityID   pgtype.Text
	MembershipID pgtype.Text
	InvitationID string
}

type ActivateMemberSlugParams struct {
	IdentityID        pgtype.Text
	ActivatedAt       pgtype.Timestamptz
	SlugReservationID string
}

type AdvanceAuthorityRevisionParams struct {
	Issuer         string
	TeamID         string
	PolicyRevision int64
	UpdatedAt      pgtype.Timestamptz
}

type AdvanceTeamPolicyRevisionParams struct {
	UpdatedAt pgtype.Timestamptz
	TeamID    string
}

type ApplyIngressUsageReportParams struct {
	IngressID                      string
	IngressRunID                   string
	RouteID                        string
	RouteVersion                   int64
	BucketStart                    pgtype.Timestamptz
	BucketEnd                      pgtype.Timestamptz
	ObservedThrough                pgtype.Timestamptz
	ReportRevision                 int64
	ConnectionAttempts             int64
	PolicyDenials                  int64
	CapacityDenials                int64
	VisitorStreamOpenFailures      int64
	SuccessfulStreams              int64
	ConnectionNanoseconds          int64
	IngressBytes                   int64
	EgressBytes                    int64
	HistogramData                  []byte
	Final                          bool
	ReceivedAt                     pgtype.Timestamptz
	DeltaConnectionAttempts        int64
	DeltaPolicyDenials             int64
	DeltaCapacityDenials           int64
	DeltaVisitorStreamOpenFailures int64
	DeltaSuccessfulStreams         int64
	DeltaConnectionNanoseconds     int64
	DeltaIngressBytes              int64
	DeltaEgressBytes               int64
	MergedHistogramData            []byte
}

type ApplyIngressUsageReportRow struct {
	ReportInserted       bool
	BucketUpdated        bool
	PolicyDenialsUpdated bool
}

type BeginAdminRelayDrainParams struct {
	DrainDeadline      pgtype.Timestamptz
	DrainedAt          pgtype.Timestamptz
	RelayID            string
	RelayRunID         string
	RelayLeaseRevision int64
}

type BeginAdminRelayDrainRow struct {
	RelayID              string
	RelayServiceID       string
	RelayRunID           string
	RelayLeaseRevision   int64
	ProtocolVersion      int64
	InternalRelayAddress string
	ObservedAddress      *netip.Addr
	InternalNetworks     []netip.Prefix
	ConnectionCapacity   int64
	StreamCapacity       int64
	ReportedConnections  int64
	ReportedStreams      int64
	Draining             bool
	DrainDeadline        pgtype.Timestamptz
	RegisteredAt         pgtype.Timestamptz
	RenewedAt            pgtype.Timestamptz
	LeaseExpiresAt       pgtype.Timestamptz
	RelayAddress         string
	TlsServerName        string
}

type BeginDNSAuthorityReleaseParams struct {
	ReleaseIdempotencyKey pgtype.Text
	UpdatedAt             pgtype.Timestamptz
	AuthorityReference    string
}

type BeginIngressDrainParams struct {
	DrainDeadline        pgtype.Timestamptz
	RenewedAt            pgtype.Timestamptz
	IngressID            string
	IngressRunID         string
	IngressLeaseRevision int64
}

type BeginRelayDrainParams struct {
	DrainDeadline      pgtype.Timestamptz
	RenewedAt          pgtype.Timestamptz
	RelayServiceID     string
	RelayID            string
	RelayRunID         string
	RelayLeaseRevision int64
}

type BeginRelayDrainRow struct {
	RelayID              string
	RelayServiceID       string
	RelayRunID           string
	RelayLeaseRevision   int64
	ProtocolVersion      int64
	InternalRelayAddress string
	ObservedAddress      *netip.Addr
	InternalNetworks     []netip.Prefix
	ConnectionCapacity   int64
	StreamCapacity       int64
	ReportedConnections  int64
	ReportedStreams      int64
	Draining             bool
	DrainDeadline        pgtype.Timestamptz
	RegisteredAt         pgtype.Timestamptz
	RenewedAt            pgtype.Timestamptz
	LeaseExpiresAt       pgtype.Timestamptz
	RelayAddress         string
	TlsServerName        string
}

type CancelOpenRouteRecoveryEpisodeParams struct {
	CanceledAt   pgtype.Timestamptz
	RouteID      string
	RouteVersion int64
}

type CancelRouteSessionACMEAuthorizationsParams struct {
	CanceledAt     pgtype.Timestamptz
	RouteSessionID string
}

type CancelRouteSessionACMEOrdersParams struct {
	CanceledAt     pgtype.Timestamptz
	RouteSessionID string
}

type ClaimACMEOrderWorkParams struct {
	WorkOwner     pgtype.Text
	WorkExpiresAt pgtype.Timestamptz
	ClaimedAt     pgtype.Timestamptz
}

type ClaimDNSAuthorityWorkParams struct {
	WorkOwner     pgtype.Text
	WorkExpiresAt pgtype.Timestamptz
	ClaimedAt     pgtype.Timestamptz
}

type ClaimDNSRouteWorkParams struct {
	WorkOwner     pgtype.Text
	WorkExpiresAt pgtype.Timestamptz
	ClaimedAt     pgtype.Timestamptz
}

type ClaimPublisherConnectionParams struct {
	RelayID                      pgtype.Text
	RelayRunID                   pgtype.Text
	RelayLeaseRevision           pgtype.Int8
	ClaimID                      pgtype.Text
	ConnectedAt                  pgtype.Timestamptz
	PublisherConnectionID        string
	RouteSessionID               string
	RouteID                      string
	RouteVersion                 int64
	ConnectionSlot               int16
	ConnectionAssignmentRevision int64
	RelayServiceID               string
}

type ClaimRelayCertificateOrderWorkParams struct {
	WorkOwner     pgtype.Text
	WorkExpiresAt pgtype.Timestamptz
	ClaimedAt     pgtype.Timestamptz
}

type ClaimRelayServiceForCertificateOrderParams struct {
	Now              pgtype.Timestamptz
	RetryFailedAfter pgtype.Timestamptz
}

type ClaimRouteUsageDeliveriesParams struct {
	WorkOwner     pgtype.Text
	WorkExpiresAt pgtype.Timestamptz
	ClaimedAt     pgtype.Timestamptz
	BatchSize     int32
}

type CloseRouteSessionConnectionsParams struct {
	ClosedAt       pgtype.Timestamptz
	RouteSessionID string
}

type CloseRouteSessionParams struct {
	State          string
	ClosedAt       pgtype.Timestamptz
	CloseReason    pgtype.Text
	RouteSessionID string
}

type CompleteACMEAuthorizationCleanupParams struct {
	CompletedAt pgtype.Timestamptz
	IssuanceID  string
}

type CompleteRouteUsageDeliveryParams struct {
	CompletedAt pgtype.Timestamptz
	DeliveryID  int64
	WorkOwner   pgtype.Text
	WorkEpoch   int64
}

type ConsumeOIDCAssertionParams struct {
	AssertionDigest []byte
	ConsumedAt      pgtype.Timestamptz
	ExpiresAt       pgtype.Timestamptz
}

type ControlAcmeAccount struct {
	ID                     string
	DirectoryUrl           string
	ContactEmail           string
	AccountKeyCiphertext   []byte
	AccountKeyStorageKeyID string
	AccountUrl             pgtype.Text
	AcceptedTermsUrl       pgtype.Text
	CreatedAt              pgtype.Timestamptz
	UpdatedAt              pgtype.Timestamptz
}

type ControlAcmeAuthorization struct {
	ID                    string
	OrderID               string
	Identifier            string
	AuthorizationUrl      string
	ChallengeType         pgtype.Text
	ChallengeUrl          pgtype.Text
	ChallengeToken        pgtype.Text
	ChallengeDigest       []byte
	PresentationReference pgtype.Text
	State                 string
	AuthorizationRevision int64
	WorkOwner             pgtype.Text
	WorkEpoch             int64
	WorkExpiresAt         pgtype.Timestamptz
	Attempts              int64
	AvailableAt           pgtype.Timestamptz
	PresentedAt           pgtype.Timestamptz
	ValidatedAt           pgtype.Timestamptz
	CleanupCompletedAt    pgtype.Timestamptz
	ExpiresAt             pgtype.Timestamptz
	LastError             pgtype.Text
	CreatedAt             pgtype.Timestamptz
	UpdatedAt             pgtype.Timestamptz
}

type ControlAcmeOrder struct {
	ID                     string
	AccountID              string
	RouteSessionID         string
	RouteID                string
	RouteVersion           int64
	IdempotencyKey         string
	RequestDigest          []byte
	CertificateCacheKey    string
	CertificateScope       string
	CertificateIdentifiers []string
	ChallengeMethod        string
	CsrDer                 []byte
	CsrDigest              []byte
	State                  string
	OrderRevision          int64
	OrderUrl               pgtype.Text
	FinalizeUrl            pgtype.Text
	CertificateUrl         pgtype.Text
	CertificatePem         []byte
	NotBefore              pgtype.Timestamptz
	NotAfter               pgtype.Timestamptz
	RenewAt                pgtype.Timestamptz
	InstalledAt            pgtype.Timestamptz
	WorkOwner              pgtype.Text
	WorkEpoch              int64
	WorkExpiresAt          pgtype.Timestamptz
	Attempts               int64
	AvailableAt            pgtype.Timestamptz
	LastError              pgtype.Text
	CreatedAt              pgtype.Timestamptz
	UpdatedAt              pgtype.Timestamptz
}

type ControlAdminAuditEvent struct {
	EventID         int64
	ActorIdentityID pgtype.Text
	Actor           string
	RequestID       string
	Operation       string
	TargetKind      string
	TargetID        string
	Details         []byte
	OccurredAt      pgtype.Timestamptz
}

type ControlAuthorityRevisionState struct {
	Issuer                 string
	TeamID                 string
	ObservedPolicyRevision int64
	AppliedPolicyRevision  int64
	ObservedAt             pgtype.Timestamptz
	AppliedAt              pgtype.Timestamptz
}

type ControlControlSession struct {
	ID                           string
	IdentityID                   string
	AuthenticationMethod         string
	AuthenticationSourceRevision int64
	Administrator                bool
	AccessTokenID                string
	AccessTokenDigest            []byte
	AccessExpiresAt              pgtype.Timestamptz
	RefreshTokenID               string
	RefreshTokenDigest           []byte
	RetrySecretCiphertext        []byte
	RetrySecretStorageKeyID      string
	RefreshExpiresAt             pgtype.Timestamptz
	CreatedAt                    pgtype.Timestamptz
	LastRefreshedAt              pgtype.Timestamptz
	RevokedAt                    pgtype.Timestamptz
	RevokedBy                    pgtype.Text
}

type ControlControlTlsCache struct {
	DirectoryUrl      string
	CacheKey          string
	CacheCiphertext   []byte
	CacheStorageKeyID string
	UpdatedAt         pgtype.Timestamptz
}

type ControlDnsAuthority struct {
	AuthorityReference    string
	TeamID                string
	DomainID              string
	CanonicalDomain       string
	CreateIdempotencyKey  string
	CreateRequestDigest   []byte
	ReleaseIdempotencyKey pgtype.Text
	Provider              string
	ProviderZoneID        pgtype.Text
	State                 string
	Nameservers           []string
	WorkRevision          int64
	WorkOwner             pgtype.Text
	WorkEpoch             int64
	WorkExpiresAt         pgtype.Timestamptz
	Attempts              int64
	AvailableAt           pgtype.Timestamptz
	LastError             pgtype.Text
	CreatedAt             pgtype.Timestamptz
	UpdatedAt             pgtype.Timestamptz
}

type ControlDomain struct {
	ID                      string
	Kind                    string
	TeamID                  pgtype.Text
	CanonicalDomain         string
	DnsAuthorityReference   pgtype.Text
	State                   string
	AuthorityRevision       int64
	VerificationTokenDigest []byte
	CreatedByIdentityID     pgtype.Text
	ClaimIdempotencyKey     pgtype.Text
	ClaimRequestDigest      []byte
	MakeDefaultWhenReady    bool
	CreatedAt               pgtype.Timestamptz
	VerifiedAt              pgtype.Timestamptz
	ReusableAfter           pgtype.Timestamptz
	ReleasedAt              pgtype.Timestamptz
	UpdatedAt               pgtype.Timestamptz
}

type ControlIdentity struct {
	ID              string
	Kind            string
	Issuer          pgtype.Text
	Subject         pgtype.Text
	DisplayName     string
	NormalizedEmail pgtype.Text
	EmailVerified   bool
	Administrator   bool
	CreatedAt       pgtype.Timestamptz
	UpdatedAt       pgtype.Timestamptz
	DisabledAt      pgtype.Timestamptz
}

type ControlIngressLease struct {
	IngressID            string
	IngressRunID         string
	IngressLeaseRevision int64
	ProtocolVersion      int64
	ConnectionCapacity   int64
	ReportedConnections  int64
	RoutingTableRevision int64
	Draining             bool
	DrainDeadline        pgtype.Timestamptz
	RegisteredAt         pgtype.Timestamptz
	RenewedAt            pgtype.Timestamptz
	LeaseExpiresAt       pgtype.Timestamptz
}

type ControlIngressRoutingTableClock struct {
	Singleton             bool
	CurrentRevision       int64
	RetainedAfterRevision int64
	UpdatedAt             pgtype.Timestamptz
}

type ControlIngressRoutingTableEvent struct {
	RoutingTableRevision int64
	EventKind            string
	RouteID              string
	RouteVersion         int64
	CanonicalHostname    string
	EntryRevision        int64
	Projection           []byte
	RouteExpiresAt       pgtype.Timestamptz
	CreatedAt            pgtype.Timestamptz
}

type ControlIngressUsageReport struct {
	ReportID                  int64
	IngressID                 string
	IngressRunID              string
	RouteID                   string
	RouteVersion              int64
	BucketStart               pgtype.Timestamptz
	BucketEnd                 pgtype.Timestamptz
	ObservedThrough           pgtype.Timestamptz
	ReportRevision            int64
	ConnectionAttempts        int64
	PolicyDenials             int64
	CapacityDenials           int64
	VisitorStreamOpenFailures int64
	SuccessfulStreams         int64
	ConnectionNanoseconds     int64
	IngressBytes              int64
	EgressBytes               int64
	HistogramData             []byte
	Final                     bool
	ReceivedAt                pgtype.Timestamptz
}

type ControlIngressUsageRun struct {
	IngressID            string
	IngressRunID         string
	IngressLeaseRevision int64
	StartedAt            pgtype.Timestamptz
	LeaseExpiresAt       pgtype.Timestamptz
	LastReportedAt       pgtype.Timestamptz
	ObservedThrough      pgtype.Timestamptz
	EndedAt              pgtype.Timestamptz
	CoverageComplete     bool
	IncompleteFrom       pgtype.Timestamptz
	IncompleteUntil      pgtype.Timestamptz
}

type ControlMaintenanceControl struct {
	ControlName string
	Allowed     bool
	Revision    int64
	UpdatedAt   pgtype.Timestamptz
	UpdatedBy   string
}

type ControlManagedLabelReservation struct {
	Label     string
	CreatedAt pgtype.Timestamptz
}

type ControlMemberSlugReservation struct {
	ID                   string
	TeamID               string
	MemberSlug           string
	State                string
	ReservedByIdentityID pgtype.Text
	CreatedAt            pgtype.Timestamptz
	ActivatedAt          pgtype.Timestamptz
	QuarantinedAt        pgtype.Timestamptz
	ReusableAfter        pgtype.Timestamptz
	ReleasedAt           pgtype.Timestamptz
}

type ControlOidcAssertionExchange struct {
	AssertionDigest []byte
	ConsumedAt      pgtype.Timestamptz
	ExpiresAt       pgtype.Timestamptz
}

type ControlRelayCertificateOrder struct {
	ID                     string
	AccountID              string
	RelayServiceID         string
	TlsServerName          string
	PrivateKeyCiphertext   []byte
	PrivateKeyStorageKeyID string
	CsrDer                 []byte
	CsrDigest              []byte
	State                  string
	OrderRevision          int64
	OrderUrl               pgtype.Text
	FinalizeUrl            pgtype.Text
	CertificateUrl         pgtype.Text
	AuthorizationUrl       pgtype.Text
	ChallengeUrl           pgtype.Text
	ChallengeToken         pgtype.Text
	ChallengeDigest        []byte
	PresentationReference  pgtype.Text
	CertificatePem         []byte
	NotBefore              pgtype.Timestamptz
	NotAfter               pgtype.Timestamptz
	RenewAt                pgtype.Timestamptz
	WorkOwner              pgtype.Text
	WorkEpoch              int64
	WorkExpiresAt          pgtype.Timestamptz
	Attempts               int64
	AvailableAt            pgtype.Timestamptz
	LastError              pgtype.Text
	CreatedAt              pgtype.Timestamptz
	UpdatedAt              pgtype.Timestamptz
}

type ControlRelayLease struct {
	RelayID              string
	RelayServiceID       string
	RelayRunID           string
	RelayLeaseRevision   int64
	ProtocolVersion      int64
	InternalRelayAddress string
	ObservedAddress      *netip.Addr
	InternalNetworks     []netip.Prefix
	ConnectionCapacity   int64
	StreamCapacity       int64
	ReportedConnections  int64
	ReportedStreams      int64
	Draining             bool
	DrainDeadline        pgtype.Timestamptz
	RegisteredAt         pgtype.Timestamptz
	RenewedAt            pgtype.Timestamptz
	LeaseExpiresAt       pgtype.Timestamptz
}

type ControlRelayService struct {
	RelayServiceID                  string
	RelayAddress                    string
	TlsServerName                   string
	TransportCertificatePem         pgtype.Text
	TransportPrivateKeyCiphertext   []byte
	TransportPrivateKeyStorageKeyID pgtype.Text
	TransportCertificateSerial      pgtype.Text
	TransportCertificateExpiresAt   pgtype.Timestamptz
	Enabled                         bool
	CreatedAt                       pgtype.Timestamptz
	UpdatedAt                       pgtype.Timestamptz
}

type ControlRelayServiceAssignmentTotal struct {
	RelayServiceID  string
	AssignmentCount int64
}

type ControlRoute struct {
	ID                    string
	TeamID                string
	DomainID              string
	MembershipID          pgtype.Text
	CreatedByIdentityID   string
	IdempotencyKey        string
	RequestDigest         []byte
	CanonicalHostname     string
	Target                string
	RouteScope            string
	PolicyRevision        int64
	IpPolicy              string
	AllowedIpPrefixes     []netip.Prefix
	LifecycleState        string
	DnsAuthorityReference pgtype.Text
	DnsState              string
	DnsRevision           int64
	DnsWorkOwner          pgtype.Text
	DnsWorkEpoch          int64
	DnsWorkExpiresAt      pgtype.Timestamptz
	DnsAttempts           int64
	DnsAvailableAt        pgtype.Timestamptz
	DnsLastError          pgtype.Text
	NextRouteVersion      int64
	MutationRevision      int64
	Ephemeral             bool
	ExpiresAt             pgtype.Timestamptz
	SuspensionRevision    int64
	SuspensionReason      pgtype.Text
	CreatedAt             pgtype.Timestamptz
	UpdatedAt             pgtype.Timestamptz
	SuspendedAt           pgtype.Timestamptz
	DeletedAt             pgtype.Timestamptz
}

type ControlRouteRecoveryEpisode struct {
	RecoveryEpisodeID int64
	RouteID           string
	RouteVersion      int64
	State             string
	OpenedAt          pgtype.Timestamptz
	ObservedAt        pgtype.Timestamptz
	CanceledAt        pgtype.Timestamptz
	ObservedSeconds   pgtype.Float8
}

type ControlRouteRecoveryHistogram struct {
	Singleton             bool
	ObservationCount      int64
	ObservationSumSeconds float64
	BucketLe025           int64
	BucketLe05            int64
	BucketLe1             int64
	BucketLe2             int64
	BucketLe5             int64
	BucketLe10            int64
	BucketLe20            int64
	BucketLe30            int64
	BucketLe45            int64
	BucketLe60            int64
	BucketLe120           int64
	UpdatedAt             pgtype.Timestamptz
}

type ControlRouteSession struct {
	ID                     string
	RouteID                string
	TeamID                 string
	MembershipID           pgtype.Text
	ActingIdentityID       string
	RouteVersion           int64
	IdempotencyKey         string
	RequestDigest          []byte
	SessionTokenID         string
	SessionTokenDigest     []byte
	PolicyRevision         int64
	PolicyDenials          int64
	CertificateCacheKey    string
	CertificateScope       string
	CertificateIdentifiers []string
	CertificateChallenge   string
	State                  string
	CreatedAt              pgtype.Timestamptz
	LastHeartbeatAt        pgtype.Timestamptz
	PublisherExpiresAt     pgtype.Timestamptz
	CertificateInstalledAt pgtype.Timestamptz
	CertificateIssuanceID  pgtype.Text
	CertificateNotAfter    pgtype.Timestamptz
	ReadyAt                pgtype.Timestamptz
	ClosedAt               pgtype.Timestamptz
	CloseReason            pgtype.Text
	AssignmentsOpen        pgtype.Bool
}

type ControlRouteSessionConnection struct {
	RouteSessionID                         string
	RouteID                                string
	RouteVersion                           int64
	ConnectionSlot                         int16
	PublisherConnectionID                  string
	ConnectionAssignmentRevision           int64
	RelayServiceID                         string
	RelayAddress                           string
	TlsServerName                          string
	PublisherConnectionCredentialDigest    []byte
	PublisherConnectionCredentialExpiresAt pgtype.Timestamptz
	ConnectedRelayID                       pgtype.Text
	ConnectedRelayRunID                    pgtype.Text
	ConnectedRelayLeaseRevision            pgtype.Int8
	ClaimID                                pgtype.Text
	State                                  string
	AssignedAt                             pgtype.Timestamptz
	ConnectedAt                            pgtype.Timestamptz
	ReadyAt                                pgtype.Timestamptz
	DisconnectedAt                         pgtype.Timestamptz
	ClosedAt                               pgtype.Timestamptz
	SessionOpen                            bool
}

type ControlRouteUsageBucket struct {
	BucketID                  int64
	RouteID                   string
	RouteVersion              int64
	TeamID                    string
	ActingIdentityID          string
	BucketStart               pgtype.Timestamptz
	BucketEnd                 pgtype.Timestamptz
	BucketRevision            int64
	ObservedThrough           pgtype.Timestamptz
	ConnectionAttempts        int64
	PolicyDenials             int64
	CapacityDenials           int64
	VisitorStreamOpenFailures int64
	SuccessfulStreams         int64
	ConnectionNanoseconds     int64
	IngressBytes              int64
	EgressBytes               int64
	HistogramData             []byte
	Finalized                 bool
	Complete                  bool
	FinalizedAt               pgtype.Timestamptz
	UpdatedAt                 pgtype.Timestamptz
}

type ControlRouteUsageConfiguration struct {
	Singleton                   bool
	VisitorNetworkHashMasterKey []byte
	CreatedAt                   pgtype.Timestamptz
}

type ControlRouteUsageDelivery struct {
	DeliveryID      int64
	BucketID        int64
	SourceRevision  int64
	DeliveryKey     string
	State           string
	WorkOwner       pgtype.Text
	WorkEpoch       int64
	WorkExpiresAt   pgtype.Timestamptz
	Attempts        int64
	AvailableAt     pgtype.Timestamptz
	LastAttemptedAt pgtype.Timestamptz
	DeliveredAt     pgtype.Timestamptz
	LastError       pgtype.Text
	CreatedAt       pgtype.Timestamptz
}

type ControlRuntimeSecret struct {
	Singleton                          bool
	ExternalRetryMasterKeyCiphertext   []byte
	ExternalRetryMasterKeyStorageKeyID string
	CreatedAt                          pgtype.Timestamptz
}

type ControlTeam struct {
	ID                     string
	Kind                   string
	DisplayName            string
	ManagedLabel           string
	DefaultDomainID        pgtype.Text
	PolicyRevision         int64
	CreatedByIdentityID    string
	CreationIdempotencyKey pgtype.Text
	CreationRequestDigest  []byte
	CreatedAt              pgtype.Timestamptz
	UpdatedAt              pgtype.Timestamptz
	DeletedAt              pgtype.Timestamptz
}

type ControlTeamInvitation struct {
	ID                         string
	TeamID                     string
	SlugReservationID          string
	InitialRole                string
	InvitedByIdentityID        string
	IdempotencyKey             string
	RequestDigest              []byte
	TokenDigest                []byte
	NormalizedEmailRestriction pgtype.Text
	State                      string
	CreatedAt                  pgtype.Timestamptz
	ExpiresAt                  pgtype.Timestamptz
	AcceptedAt                 pgtype.Timestamptz
	AcceptedByIdentityID       pgtype.Text
	AcceptedMembershipID       pgtype.Text
	RevokedAt                  pgtype.Timestamptz
	RevokedByIdentityID        pgtype.Text
}

type ControlTeamMembership struct {
	ID                  string
	TeamID              string
	IdentityID          string
	SlugReservationID   string
	ManagedLabel        string
	Role                string
	AuthorityRevision   int64
	CreatedAt           pgtype.Timestamptz
	UpdatedAt           pgtype.Timestamptz
	RemovedAt           pgtype.Timestamptz
	RemovedByIdentityID pgtype.Text
}

type CountOpenRouteSessionAssignmentsByRelayServiceRow struct {
	RelayServiceID  string
	AssignmentCount int64
}

type CountRelayActiveConnectionsParams struct {
	RelayID            pgtype.Text
	RelayRunID         pgtype.Text
	RelayLeaseRevision pgtype.Int8
}

type CreateActiveSlugReservationParams struct {
	ID         string
	TeamID     string
	MemberSlug string
	IdentityID pgtype.Text
	CreatedAt  pgtype.Timestamptz
}

type CreateClaimedDNSAuthorityParams struct {
	AuthorityReference   string
	TeamID               string
	DomainID             string
	CanonicalDomain      string
	CreateIdempotencyKey string
	CreateRequestDigest  []byte
	CreatedAt            pgtype.Timestamptz
}

type CreateClaimedDomainParams struct {
	ID                    string
	TeamID                pgtype.Text
	CanonicalDomain       string
	DnsAuthorityReference pgtype.Text
	AuthorityRevision     int64
	CreatedByIdentityID   pgtype.Text
	ClaimIdempotencyKey   pgtype.Text
	ClaimRequestDigest    []byte
	MakeDefaultWhenReady  bool
	CreatedAt             pgtype.Timestamptz
}

type CreateControlSessionParams struct {
	ID                           string
	IdentityID                   string
	AuthenticationMethod         string
	AuthenticationSourceRevision int64
	Administrator                bool
	AccessTokenID                string
	AccessTokenDigest            []byte
	AccessExpiresAt              pgtype.Timestamptz
	RefreshTokenID               string
	RefreshTokenDigest           []byte
	RetrySecretCiphertext        []byte
	RetrySecretStorageKeyID      string
	RefreshExpiresAt             pgtype.Timestamptz
	CreatedAt                    pgtype.Timestamptz
}

type CreateIdentityParams struct {
	ID              string
	Kind            string
	DisplayName     string
	NormalizedEmail pgtype.Text
	EmailVerified   bool
	Administrator   bool
	CreatedAt       pgtype.Timestamptz
	UpdatedAt       pgtype.Timestamptz
}

type CreateManagedDomainParams struct {
	ID              string
	CanonicalDomain string
	CreatedAt       pgtype.Timestamptz
}

type CreateOIDCIdentityParams struct {
	ID              string
	Issuer          pgtype.Text
	Subject         pgtype.Text
	DisplayName     string
	NormalizedEmail pgtype.Text
	EmailVerified   bool
	CreatedAt       pgtype.Timestamptz
}

type CreateOrGetDNSAuthorityParams struct {
	AuthorityReference   string
	TeamID               string
	DomainID             string
	CanonicalDomain      string
	CreateIdempotencyKey string
	CreateRequestDigest  []byte
	CreatedAt            pgtype.Timestamptz
}

type CreateOrganizationTeamParams struct {
	ID                     string
	DisplayName            string
	ManagedLabel           string
	DefaultDomainID        pgtype.Text
	CreatedByIdentityID    string
	CreationIdempotencyKey pgtype.Text
	CreationRequestDigest  []byte
	CreatedAt              pgtype.Timestamptz
}

type CreateOrganizationTeamRow struct {
	ID              string
	Kind            string
	DisplayName     string
	ManagedLabel    string
	DefaultDomainID pgtype.Text
	PolicyRevision  int64
	CreatedAt       pgtype.Timestamptz
	UpdatedAt       pgtype.Timestamptz
}

type CreateOwnerMembershipParams struct {
	ID                string
	TeamID            string
	IdentityID        string
	SlugReservationID string
	ManagedLabel      string
	CreatedAt         pgtype.Timestamptz
}

type CreatePersonalTeamParams struct {
	ID                  string
	DisplayName         string
	ManagedLabel        string
	CreatedByIdentityID string
	CreatedAt           pgtype.Timestamptz
}

type CreateTeamInvitationParams struct {
	ID                         string
	TeamID                     string
	SlugReservationID          string
	InitialRole                string
	InvitedByIdentityID        string
	IdempotencyKey             string
	RequestDigest              []byte
	TokenDigest                []byte
	NormalizedEmailRestriction pgtype.Text
	CreatedAt                  pgtype.Timestamptz
	ExpiresAt                  pgtype.Timestamptz
}

type CreateTeamMembershipParams struct {
	ID                string
	TeamID            string
	IdentityID        string
	SlugReservationID string
	ManagedLabel      string
	Role              string
	AuthorityRevision int64
	CreatedAt         pgtype.Timestamptz
}

type DBTX interface {
	Exec(context.Context, string, ...interface{}) (pgconn.CommandTag, error)
	Query(context.Context, string, ...interface{}) (pgx.Rows, error)
	QueryRow(context.Context, string, ...interface{}) pgx.Row
}

type DNSAuthorityReleaseReadyParams struct {
	AuthorityDomainID string
	ObservedAt        pgtype.Timestamptz
}

type DeleteControlTLSCacheEntryParams struct {
	DirectoryUrl string
	CacheKey     string
}

type DeleteRouteParams struct {
	DeletedAt                pgtype.Timestamptz
	RouteID                  string
	ExpectedMutationRevision int64
}

type DisconnectPublisherConnectionParams struct {
	DisconnectedAt               pgtype.Timestamptz
	PublisherConnectionID        string
	RouteSessionID               string
	RouteID                      string
	RouteVersion                 int64
	ConnectionSlot               int16
	ConnectionAssignmentRevision int64
	RelayServiceID               string
	RelayID                      pgtype.Text
	RelayRunID                   pgtype.Text
	RelayLeaseRevision           pgtype.Int8
	ClaimID                      pgtype.Text
}

type EnsureACMEAccountParams struct {
	ID                     string
	DirectoryUrl           string
	ContactEmail           string
	AccountKeyCiphertext   []byte
	AccountKeyStorageKeyID string
	CreatedAt              pgtype.Timestamptz
}

type EnsureExternalAuthorityPrincipalParams struct {
	IdentityID string
	CreatedAt  pgtype.Timestamptz
}

type EnsureExternalRetryMasterKeyParams struct {
	ExternalRetryMasterKeyCiphertext   []byte
	ExternalRetryMasterKeyStorageKeyID string
	CreatedAt                          pgtype.Timestamptz
}

type EnsureExternalRetryMasterKeyRow struct {
	ExternalRetryMasterKeyCiphertext   []byte
	ExternalRetryMasterKeyStorageKeyID string
}

type EnsureIngressUsageRunParams struct {
	IngressID            string
	IngressRunID         string
	IngressLeaseRevision int64
	StartedAt            pgtype.Timestamptz
	LeaseExpiresAt       pgtype.Timestamptz
	ObservedThrough      pgtype.Timestamptz
}

type EnsureRouteUsageConfigurationParams struct {
	VisitorNetworkHashMasterKey []byte
	CreatedAt                   pgtype.Timestamptz
}

type ExpirePublisherConnectionParams struct {
	ExpiredAt                    pgtype.Timestamptz
	PublisherConnectionID        string
	RouteSessionID               string
	ConnectionAssignmentRevision int64
}

type ExpireTeamInvitationsParams struct {
	TeamID string
	Now    pgtype.Timestamptz
}

type FinalizeRouteUsageBucketsParams struct {
	FinalizedAt pgtype.Timestamptz
	Through     pgtype.Timestamptz
}

type FindOIDCIdentityParams struct {
	Issuer  pgtype.Text
	Subject pgtype.Text
}

type GetACMEOrderByIdempotencyParams struct {
	RouteSessionID string
	IdempotencyKey string
}

type GetActiveRouteSessionChallengeExpiryParams struct {
	RouteSessionID string
	Now            pgtype.Timestamptz
}

type GetActiveRouteSessionMembershipParams struct {
	TeamID     string
	IdentityID string
}

type GetActiveRouteSessionMembershipRow struct {
	ID             string
	Role           string
	PolicyRevision int64
}

type GetAdminRuntimeCountsRow struct {
	EnabledRoutes         int64
	SuspendedRoutes       int64
	StartingRouteSessions int64
	ReadyRouteSessions    int64
	IngressLeases         int64
	RelayLeases           int64
}

type GetAuthorizedRouteByHostnameParams struct {
	TeamID            string
	CanonicalHostname string
}

type GetAuthorizedRouteByHostnameRow struct {
	ID                    string
	TeamID                string
	DomainID              string
	MembershipID          pgtype.Text
	CreatedByIdentityID   string
	IdempotencyKey        string
	RequestDigest         []byte
	CanonicalHostname     string
	Target                string
	RouteScope            string
	PolicyRevision        int64
	IpPolicy              string
	AllowedIpPrefixes     []netip.Prefix
	LifecycleState        string
	DnsAuthorityReference pgtype.Text
	DnsState              string
	DnsRevision           int64
	DnsWorkOwner          pgtype.Text
	DnsWorkEpoch          int64
	DnsWorkExpiresAt      pgtype.Timestamptz
	DnsAttempts           int64
	DnsAvailableAt        pgtype.Timestamptz
	DnsLastError          pgtype.Text
	NextRouteVersion      int64
	MutationRevision      int64
	Ephemeral             bool
	ExpiresAt             pgtype.Timestamptz
	SuspensionRevision    int64
	SuspensionReason      pgtype.Text
	CreatedAt             pgtype.Timestamptz
	UpdatedAt             pgtype.Timestamptz
	SuspendedAt           pgtype.Timestamptz
	DeletedAt             pgtype.Timestamptz
	OpenRouteSessionID    string
}

type GetClaimedDomainByIdempotencyParams struct {
	IdentityID     pgtype.Text
	TeamID         pgtype.Text
	IdempotencyKey pgtype.Text
}

type GetClaimedDomainByIdempotencyRow struct {
	ID                      string
	Kind                    string
	TeamID                  pgtype.Text
	CanonicalDomain         string
	DnsAuthorityReference   pgtype.Text
	State                   string
	AuthorityRevision       int64
	VerificationTokenDigest []byte
	CreatedByIdentityID     pgtype.Text
	ClaimIdempotencyKey     pgtype.Text
	ClaimRequestDigest      []byte
	MakeDefaultWhenReady    bool
	CreatedAt               pgtype.Timestamptz
	VerifiedAt              pgtype.Timestamptz
	ReusableAfter           pgtype.Timestamptz
	ReleasedAt              pgtype.Timestamptz
	UpdatedAt               pgtype.Timestamptz
	Nameservers             []string
}

type GetControlSessionByAccessIDRow struct {
	ID                           string
	IdentityID                   string
	AuthenticationMethod         string
	AuthenticationSourceRevision int64
	AccessTokenDigest            []byte
	AccessExpiresAt              pgtype.Timestamptz
	RetrySecretCiphertext        []byte
	RetrySecretStorageKeyID      string
	RefreshExpiresAt             pgtype.Timestamptz
	Administrator                bool
}

type GetControlTLSCacheEntryParams struct {
	DirectoryUrl string
	CacheKey     string
}

type GetControlTLSCacheEntryRow struct {
	CacheCiphertext   []byte
	CacheStorageKeyID string
}

type GetDNSChallengeContextParams struct {
	RouteID         string
	AuthorizationID string
}

type GetDNSChallengeContextRow struct {
	RouteID               string
	TeamID                string
	DomainID              string
	DnsAuthorityReference pgtype.Text
	CanonicalHostname     string
	CanonicalDomain       string
	AuthorizationID       string
	Identifier            string
	ChallengeDigest       []byte
	PresentationReference pgtype.Text
	State                 string
}

type GetExternalAuthorityRouteParams struct {
	RouteSessionIdempotencyKey string
	RouteID                    string
}

type GetExternalAuthorityRouteRow struct {
	ID                        string
	TeamID                    string
	DomainID                  string
	MembershipID              pgtype.Text
	CreatedByIdentityID       string
	IdempotencyKey            string
	RequestDigest             []byte
	CanonicalHostname         string
	Target                    string
	RouteScope                string
	PolicyRevision            int64
	IpPolicy                  string
	AllowedIpPrefixes         []netip.Prefix
	LifecycleState            string
	DnsAuthorityReference     pgtype.Text
	DnsState                  string
	DnsRevision               int64
	DnsWorkOwner              pgtype.Text
	DnsWorkEpoch              int64
	DnsWorkExpiresAt          pgtype.Timestamptz
	DnsAttempts               int64
	DnsAvailableAt            pgtype.Timestamptz
	DnsLastError              pgtype.Text
	NextRouteVersion          int64
	MutationRevision          int64
	Ephemeral                 bool
	ExpiresAt                 pgtype.Timestamptz
	SuspensionRevision        int64
	SuspensionReason          pgtype.Text
	CreatedAt                 pgtype.Timestamptz
	UpdatedAt                 pgtype.Timestamptz
	SuspendedAt               pgtype.Timestamptz
	DeletedAt                 pgtype.Timestamptz
	OpenRouteSessionID        string
	AuthorizationRouteVersion int64
}

type GetIdentityContextIdentityRow struct {
	ID              string
	DisplayName     string
	NormalizedEmail pgtype.Text
	EmailVerified   bool
	Administrator   bool
	CreatedAt       pgtype.Timestamptz
	PersonalTeamID  string
}

type GetIdentityRouteParams struct {
	RouteID    string
	IdentityID string
}

type GetIdentityRouteRow struct {
	ID                    string
	TeamID                string
	DomainID              string
	MembershipID          pgtype.Text
	CreatedByIdentityID   string
	IdempotencyKey        string
	RequestDigest         []byte
	CanonicalHostname     string
	Target                string
	RouteScope            string
	PolicyRevision        int64
	IpPolicy              string
	AllowedIpPrefixes     []netip.Prefix
	LifecycleState        string
	DnsAuthorityReference pgtype.Text
	DnsState              string
	DnsRevision           int64
	DnsWorkOwner          pgtype.Text
	DnsWorkEpoch          int64
	DnsWorkExpiresAt      pgtype.Timestamptz
	DnsAttempts           int64
	DnsAvailableAt        pgtype.Timestamptz
	DnsLastError          pgtype.Text
	NextRouteVersion      int64
	MutationRevision      int64
	Ephemeral             bool
	ExpiresAt             pgtype.Timestamptz
	SuspensionRevision    int64
	SuspensionReason      pgtype.Text
	CreatedAt             pgtype.Timestamptz
	UpdatedAt             pgtype.Timestamptz
	SuspendedAt           pgtype.Timestamptz
	DeletedAt             pgtype.Timestamptz
	OpenRouteSessionID    string
}

type GetIdentityTeamParams struct {
	IdentityID string
	TeamID     string
}

type GetIdentityTeamRow struct {
	ID              string
	Kind            string
	DisplayName     string
	ManagedLabel    string
	DefaultDomainID pgtype.Text
	PolicyRevision  int64
	CreatedAt       pgtype.Timestamptz
	UpdatedAt       pgtype.Timestamptz
}

type GetIngressLeaseParams struct {
	IngressID            string
	IngressRunID         string
	IngressLeaseRevision int64
	Now                  pgtype.Timestamptz
}

type GetIngressUsageReportParams struct {
	IngressID      string
	IngressRunID   string
	RouteID        string
	RouteVersion   int64
	BucketStart    pgtype.Timestamptz
	ReportRevision int64
}

type GetInvitationByIdempotencyParams struct {
	IdentityID     string
	TeamID         string
	IdempotencyKey string
}

type GetInvitationByIdempotencyRow struct {
	ID                         string
	TeamID                     string
	SlugReservationID          string
	InitialRole                string
	InvitedByIdentityID        string
	IdempotencyKey             string
	RequestDigest              []byte
	TokenDigest                []byte
	NormalizedEmailRestriction pgtype.Text
	State                      string
	CreatedAt                  pgtype.Timestamptz
	ExpiresAt                  pgtype.Timestamptz
	AcceptedAt                 pgtype.Timestamptz
	AcceptedByIdentityID       pgtype.Text
	AcceptedMembershipID       pgtype.Text
	RevokedAt                  pgtype.Timestamptz
	RevokedByIdentityID        pgtype.Text
	MemberSlug                 string
}

type GetOpenRouteRecoveryEpisodeParams struct {
	RouteID      string
	RouteVersion int64
}

type GetOrganizationTeamByIdempotencyParams struct {
	IdentityID     string
	IdempotencyKey pgtype.Text
}

type GetOrganizationTeamByIdempotencyRow struct {
	ID                    string
	Kind                  string
	DisplayName           string
	ManagedLabel          string
	DefaultDomainID       pgtype.Text
	PolicyRevision        int64
	CreationRequestDigest []byte
	CreatedAt             pgtype.Timestamptz
	UpdatedAt             pgtype.Timestamptz
}

type GetRelayDNSChallengeContextRow struct {
	ID                    string
	RelayServiceID        string
	TlsServerName         string
	State                 string
	ChallengeDigest       []byte
	PresentationReference pgtype.Text
}

type GetRelayLeaseForClaimRow struct {
	RelayID              string
	RelayServiceID       string
	RelayRunID           string
	RelayLeaseRevision   int64
	ProtocolVersion      int64
	InternalRelayAddress string
	ObservedAddress      *netip.Addr
	InternalNetworks     []netip.Prefix
	ConnectionCapacity   int64
	StreamCapacity       int64
	ReportedConnections  int64
	ReportedStreams      int64
	Draining             bool
	DrainDeadline        pgtype.Timestamptz
	RegisteredAt         pgtype.Timestamptz
	RenewedAt            pgtype.Timestamptz
	LeaseExpiresAt       pgtype.Timestamptz
	RelayAddress         string
	TlsServerName        string
}

type GetRelayLeaseForReadyRow struct {
	RelayID              string
	RelayServiceID       string
	RelayRunID           string
	RelayLeaseRevision   int64
	ProtocolVersion      int64
	InternalRelayAddress string
	ObservedAddress      *netip.Addr
	InternalNetworks     []netip.Prefix
	ConnectionCapacity   int64
	StreamCapacity       int64
	ReportedConnections  int64
	ReportedStreams      int64
	Draining             bool
	DrainDeadline        pgtype.Timestamptz
	RegisteredAt         pgtype.Timestamptz
	RenewedAt            pgtype.Timestamptz
	LeaseExpiresAt       pgtype.Timestamptz
	RelayAddress         string
	TlsServerName        string
}

type GetRelayTransportCertificateParams struct {
	RelayServiceID     string
	RelayID            string
	RelayRunID         string
	RelayLeaseRevision int64
	Now                pgtype.Timestamptz
}

type GetRouteByCreatorIdempotencyParams struct {
	IdentityID     string
	IdempotencyKey string
}

type GetRouteByCreatorIdempotencyRow struct {
	ID                    string
	TeamID                string
	DomainID              string
	MembershipID          pgtype.Text
	CreatedByIdentityID   string
	IdempotencyKey        string
	RequestDigest         []byte
	CanonicalHostname     string
	Target                string
	RouteScope            string
	PolicyRevision        int64
	IpPolicy              string
	AllowedIpPrefixes     []netip.Prefix
	LifecycleState        string
	DnsAuthorityReference pgtype.Text
	DnsState              string
	DnsRevision           int64
	DnsWorkOwner          pgtype.Text
	DnsWorkEpoch          int64
	DnsWorkExpiresAt      pgtype.Timestamptz
	DnsAttempts           int64
	DnsAvailableAt        pgtype.Timestamptz
	DnsLastError          pgtype.Text
	NextRouteVersion      int64
	MutationRevision      int64
	Ephemeral             bool
	ExpiresAt             pgtype.Timestamptz
	SuspensionRevision    int64
	SuspensionReason      pgtype.Text
	CreatedAt             pgtype.Timestamptz
	UpdatedAt             pgtype.Timestamptz
	SuspendedAt           pgtype.Timestamptz
	DeletedAt             pgtype.Timestamptz
	OpenRouteSessionID    string
}

type GetRouteCreationContextParams struct {
	IdentityID string
	DomainID   string
	TeamID     string
}

type GetRouteCreationContextRow struct {
	TeamKind              string
	TeamCreatorIdentityID string
	PolicyRevision        int64
	IdentityKind          string
	ActorMembershipID     string
	ActorRole             string
	ActorManagedLabel     string
	ActorMemberSlug       string
	DomainKind            string
	DomainTeamID          pgtype.Text
	CanonicalDomain       string
	DomainState           string
	DnsAuthorityReference pgtype.Text
}

type GetRouteSessionByIdempotencyParams struct {
	RouteID        string
	IdempotencyKey string
}

type GetRouteUsageBucketForUpdateParams struct {
	RouteID      string
	RouteVersion int64
	BucketStart  pgtype.Timestamptz
}

type GetTeamActorContextParams struct {
	IdentityID string
	TeamID     string
}

type GetTeamActorContextRow struct {
	ID                string
	Kind              string
	DisplayName       string
	ManagedLabel      string
	DefaultDomainID   pgtype.Text
	PolicyRevision    int64
	CreatedAt         pgtype.Timestamptz
	UpdatedAt         pgtype.Timestamptz
	ActorMembershipID string
	ActorRole         string
}

type GetTeamMembershipContextParams struct {
	MembershipID string
	TeamID       string
}

type GetTeamMembershipContextRow struct {
	ID              string
	TeamID          string
	IdentityID      string
	TeamDisplayName string
	TeamKind        string
	Role            string
	MemberSlug      string
	ManagedLabel    string
	PolicyRevision  int64
	CreatedAt       pgtype.Timestamptz
	UpdatedAt       pgtype.Timestamptz
}

type HeartbeatRouteSessionParams struct {
	HeartbeatAt    pgtype.Timestamptz
	ExpiresAt      pgtype.Timestamptz
	RouteSessionID string
	RouteID        string
	RouteVersion   int64
}

type InsertACMEOrderParams struct {
	ID                     string
	AccountID              string
	RouteSessionID         string
	RouteID                string
	RouteVersion           int64
	IdempotencyKey         string
	RequestDigest          []byte
	CertificateCacheKey    string
	CertificateScope       string
	CertificateIdentifiers []string
	ChallengeMethod        string
	CsrDer                 []byte
	CsrDigest              []byte
	CreatedAt              pgtype.Timestamptz
}

type InsertAdminAuditEventParams struct {
	ActorIdentityID pgtype.Text
	Actor           string
	RequestID       string
	Operation       string
	TargetKind      string
	TargetID        string
	Details         []byte
	OccurredAt      pgtype.Timestamptz
}

type InsertCertificateIssuanceAuditEventParams struct {
	ActorIdentityID pgtype.Text
	RequestID       string
	IssuanceID      string
	OccurredAt      pgtype.Timestamptz
}

type InsertExpiredEphemeralRouteDeleteAuditEventParams struct {
	RequestID  string
	RouteID    string
	OccurredAt pgtype.Timestamptz
}

type InsertFinalIngressRoutingTableEventParams struct {
	EventKind         string
	RouteID           string
	RouteVersion      int64
	CanonicalHostname string
	EntryRevision     int64
	Projection        []byte
	RouteExpiresAt    pgtype.Timestamptz
	CreatedAt         pgtype.Timestamptz
	UpdatedAt         pgtype.Timestamptz
}

type InsertIngressRoutingTableEventParams struct {
	EventKind         string
	RouteID           string
	RouteVersion      int64
	CanonicalHostname string
	EntryRevision     int64
	Projection        []byte
	RouteExpiresAt    pgtype.Timestamptz
	CreatedAt         pgtype.Timestamptz
}

type InsertRelayCertificateOrderParams struct {
	ID                     string
	AccountID              string
	RelayServiceID         string
	TlsServerName          string
	PrivateKeyCiphertext   []byte
	PrivateKeyStorageKeyID string
	CsrDer                 []byte
	CsrDigest              []byte
	CreatedAt              pgtype.Timestamptz
}

type InsertRouteCreateAuditEventParams struct {
	ActorIdentityID pgtype.Text
	RequestID       string
	RouteID         string
	OccurredAt      pgtype.Timestamptz
}

type InsertRouteDeleteAuditEventParams struct {
	ActorIdentityID pgtype.Text
	RequestID       string
	RouteID         string
	OccurredAt      pgtype.Timestamptz
}

type InsertRouteParams struct {
	ID                    string
	TeamID                string
	DomainID              string
	MembershipID          pgtype.Text
	CreatedByIdentityID   string
	IdempotencyKey        string
	RequestDigest         []byte
	CanonicalHostname     string
	Target                string
	RouteScope            string
	PolicyRevision        int64
	IpPolicy              string
	AllowedIpPrefixes     []netip.Prefix
	DnsAuthorityReference pgtype.Text
	DnsState              string
	CreatedAt             pgtype.Timestamptz
	Ephemeral             bool
	ExpiresAt             pgtype.Timestamptz
}

type InsertRouteSessionAuditEventParams struct {
	ActorIdentityID pgtype.Text
	Actor           string
	RequestID       string
	RouteSessionID  string
	OccurredAt      pgtype.Timestamptz
}

type InsertRouteSessionConnectionsParams struct {
	RouteSessionID                         string
	RouteID                                string
	RouteVersion                           int64
	PublisherConnectionIds                 []string
	RelayServiceIds                        []string
	RelayAddresses                         []string
	TlsServerNames                         []string
	CredentialDigests                      [][]byte
	PublisherConnectionCredentialExpiresAt pgtype.Timestamptz
	AssignedAt                             pgtype.Timestamptz
}

type InsertRouteSessionParams struct {
	ID                       string
	RouteID                  string
	TeamID                   string
	MembershipID             pgtype.Text
	ActingIdentityID         string
	IdempotencyKey           string
	RequestDigest            []byte
	SessionTokenID           string
	SessionTokenDigest       []byte
	PolicyRevision           int64
	CertificateCacheKey      string
	CertificateScope         string
	CertificateIdentifiers   []string
	CertificateChallenge     string
	CreatedAt                pgtype.Timestamptz
	LastHeartbeatAt          pgtype.Timestamptz
	PublisherExpiresAt       pgtype.Timestamptz
	ExpectedMutationRevision int64
}

type InsertRouteUpdateAuditEventParams struct {
	ActorIdentityID pgtype.Text
	RequestID       string
	RouteID         string
	OccurredAt      pgtype.Timestamptz
}

type InsertRouteUsageDeliveryParams struct {
	BucketID       int64
	SourceRevision int64
	DeliveryKey    string
	AvailableAt    pgtype.Timestamptz
	CreatedAt      pgtype.Timestamptz
}

type LatestIngressRoutingEntryRevisionParams struct {
	RouteID      string
	RouteVersion int64
}

type ListAdminRelayLeasesParams struct {
	Now       pgtype.Timestamptz
	Cursor    pgtype.Text
	PageLimit int32
}

type ListAdminRelayLeasesRow struct {
	RelayID              string
	RelayServiceID       string
	RelayRunID           string
	RelayLeaseRevision   int64
	ProtocolVersion      int64
	InternalRelayAddress string
	ObservedAddress      *netip.Addr
	InternalNetworks     []netip.Prefix
	ConnectionCapacity   int64
	StreamCapacity       int64
	ReportedConnections  int64
	ReportedStreams      int64
	Draining             bool
	DrainDeadline        pgtype.Timestamptz
	RegisteredAt         pgtype.Timestamptz
	RenewedAt            pgtype.Timestamptz
	LeaseExpiresAt       pgtype.Timestamptz
	RelayAddress         string
	TlsServerName        string
}

type ListDNSChallengePresentationsRow struct {
	ChallengeDigest []byte
	State           string
}

type ListExternalAuthorityRoutesParams struct {
	TeamID string
	Cursor pgtype.Text
}

type ListExternalAuthorityRoutesRow struct {
	ID                    string
	TeamID                string
	DomainID              string
	MembershipID          pgtype.Text
	CreatedByIdentityID   string
	IdempotencyKey        string
	RequestDigest         []byte
	CanonicalHostname     string
	Target                string
	RouteScope            string
	PolicyRevision        int64
	IpPolicy              string
	AllowedIpPrefixes     []netip.Prefix
	LifecycleState        string
	DnsAuthorityReference pgtype.Text
	DnsState              string
	DnsRevision           int64
	DnsWorkOwner          pgtype.Text
	DnsWorkEpoch          int64
	DnsWorkExpiresAt      pgtype.Timestamptz
	DnsAttempts           int64
	DnsAvailableAt        pgtype.Timestamptz
	DnsLastError          pgtype.Text
	NextRouteVersion      int64
	MutationRevision      int64
	Ephemeral             bool
	ExpiresAt             pgtype.Timestamptz
	SuspensionRevision    int64
	SuspensionReason      pgtype.Text
	CreatedAt             pgtype.Timestamptz
	UpdatedAt             pgtype.Timestamptz
	SuspendedAt           pgtype.Timestamptz
	DeletedAt             pgtype.Timestamptz
	OpenRouteSessionID    string
}

type ListIdentityMembershipContextsRow struct {
	ID              string
	TeamID          string
	IdentityID      string
	TeamDisplayName string
	TeamKind        string
	Role            string
	MemberSlug      string
	ManagedLabel    string
	PolicyRevision  int64
	CreatedAt       pgtype.Timestamptz
	UpdatedAt       pgtype.Timestamptz
}

type ListIdentityRoutesParams struct {
	TeamID     string
	Cursor     pgtype.Text
	IdentityID string
}

type ListIdentityRoutesRow struct {
	ID                    string
	TeamID                string
	DomainID              string
	MembershipID          pgtype.Text
	CreatedByIdentityID   string
	IdempotencyKey        string
	RequestDigest         []byte
	CanonicalHostname     string
	Target                string
	RouteScope            string
	PolicyRevision        int64
	IpPolicy              string
	AllowedIpPrefixes     []netip.Prefix
	LifecycleState        string
	DnsAuthorityReference pgtype.Text
	DnsState              string
	DnsRevision           int64
	DnsWorkOwner          pgtype.Text
	DnsWorkEpoch          int64
	DnsWorkExpiresAt      pgtype.Timestamptz
	DnsAttempts           int64
	DnsAvailableAt        pgtype.Timestamptz
	DnsLastError          pgtype.Text
	NextRouteVersion      int64
	MutationRevision      int64
	Ephemeral             bool
	ExpiresAt             pgtype.Timestamptz
	SuspensionRevision    int64
	SuspensionReason      pgtype.Text
	CreatedAt             pgtype.Timestamptz
	UpdatedAt             pgtype.Timestamptz
	SuspendedAt           pgtype.Timestamptz
	DeletedAt             pgtype.Timestamptz
	OpenRouteSessionID    string
}

type ListIdentityTeamDomainsParams struct {
	TeamID     pgtype.Text
	IdentityID string
}

type ListIdentityTeamDomainsRow struct {
	ID                    string
	Kind                  string
	TeamID                pgtype.Text
	CanonicalDomain       string
	DnsAuthorityReference pgtype.Text
	State                 string
	AuthorityRevision     int64
	Nameservers           []string
	CreatedAt             pgtype.Timestamptz
	VerifiedAt            pgtype.Timestamptz
	UpdatedAt             pgtype.Timestamptz
}

type ListIdentityTeamsRow struct {
	ID              string
	Kind            string
	DisplayName     string
	ManagedLabel    string
	DefaultDomainID pgtype.Text
	PolicyRevision  int64
	CreatedAt       pgtype.Timestamptz
	UpdatedAt       pgtype.Timestamptz
}

type ListIngressRoutingTableEventsParams struct {
	AfterRevision   int64
	ThroughRevision int64
	PageLimit       int32
}

type ListIngressRoutingTableSnapshotParams struct {
	Now             pgtype.Timestamptz
	ThroughRevision int64
}

type ListLatestIngressUsageReportsParams struct {
	IngressID     string
	IngressRunID  string
	RouteIds      []string
	RouteVersions []int64
	BucketStarts  []pgtype.Timestamptz
}

type ListLatestIngressUsageReportsRow struct {
	RouteID                   string
	RouteVersion              int64
	BucketStart               pgtype.Timestamptz
	BucketEnd                 pgtype.Timestamptz
	ObservedThrough           pgtype.Timestamptz
	ReportRevision            int64
	ConnectionAttempts        int64
	PolicyDenials             int64
	CapacityDenials           int64
	VisitorStreamOpenFailures int64
	SuccessfulStreams         int64
	ConnectionNanoseconds     int64
	IngressBytes              int64
	EgressBytes               int64
	Final                     bool
}

type ListRelayDNSChallengePresentationsRow struct {
	ChallengeDigest []byte
	State           string
}

type ListTeamInvitationsRow struct {
	ID                         string
	TeamID                     string
	SlugReservationID          string
	InitialRole                string
	InvitedByIdentityID        string
	IdempotencyKey             string
	RequestDigest              []byte
	TokenDigest                []byte
	NormalizedEmailRestriction pgtype.Text
	State                      string
	CreatedAt                  pgtype.Timestamptz
	ExpiresAt                  pgtype.Timestamptz
	AcceptedAt                 pgtype.Timestamptz
	AcceptedByIdentityID       pgtype.Text
	AcceptedMembershipID       pgtype.Text
	RevokedAt                  pgtype.Timestamptz
	RevokedByIdentityID        pgtype.Text
	MemberSlug                 string
}

type ListTeamMemberNamespaceLabelsRow struct {
	ManagedLabel string
	MemberSlug   string
}

type ListTeamMembershipContextsRow struct {
	ID              string
	TeamID          string
	IdentityID      string
	TeamDisplayName string
	TeamKind        string
	Role            string
	MemberSlug      string
	ManagedLabel    string
	PolicyRevision  int64
	CreatedAt       pgtype.Timestamptz
	UpdatedAt       pgtype.Timestamptz
}

type ListValidReadyPublisherConnectionsParams struct {
	RouteSessionID string
	Now            pgtype.Timestamptz
}

type ListValidReadyPublisherConnectionsRow struct {
	RouteSessionID               string
	RouteID                      string
	RouteVersion                 int64
	ConnectionSlot               int16
	PublisherConnectionID        string
	ConnectionAssignmentRevision int64
	RelayServiceID               string
	ConnectedRelayID             pgtype.Text
	ConnectedRelayRunID          pgtype.Text
	ConnectedRelayLeaseRevision  pgtype.Int8
	InternalRelayAddress         string
	TlsServerName                string
	LeaseExpiresAt               pgtype.Timestamptz
}

type LockACMEOrderForInstallParams struct {
	IssuanceID             string
	TeamID                 string
	CertificateCacheKey    string
	CertificateScope       string
	CertificateIdentifiers []string
	ChallengeMethod        string
	InstalledAt            pgtype.Timestamptz
	NotAfter               pgtype.Timestamptz
}

type LockControlSessionByRefreshIDRow struct {
	ID                           string
	IdentityID                   string
	AuthenticationMethod         string
	AuthenticationSourceRevision int64
	RefreshTokenDigest           []byte
	RefreshExpiresAt             pgtype.Timestamptz
	Administrator                bool
}

type LockDomainRoutesParams struct {
	TeamID   string
	DomainID string
}

type LockEligibleRelayLeasesParams struct {
	Now             pgtype.Timestamptz
	RelayServiceIds []string
	ProtocolVersion int64
}

type LockEligibleRelayLeasesRow struct {
	RelayID              string
	RelayServiceID       string
	RelayRunID           string
	RelayLeaseRevision   int64
	ProtocolVersion      int64
	InternalRelayAddress string
	ObservedAddress      *netip.Addr
	InternalNetworks     []netip.Prefix
	ConnectionCapacity   int64
	StreamCapacity       int64
	ReportedConnections  int64
	ReportedStreams      int64
	Draining             bool
	DrainDeadline        pgtype.Timestamptz
	RegisteredAt         pgtype.Timestamptz
	RenewedAt            pgtype.Timestamptz
	LeaseExpiresAt       pgtype.Timestamptz
	RelayAddress         string
	TlsServerName        string
}

type LockExpiredEphemeralRoutesParams struct {
	Now       pgtype.Timestamptz
	BatchSize int32
}

type LockIdentityRouteForDeleteParams struct {
	IdentityID string
	RouteID    string
}

type LockIdentityRouteForDeleteRow struct {
	ID                    string
	TeamID                string
	DomainID              string
	MembershipID          pgtype.Text
	CreatedByIdentityID   string
	IdempotencyKey        string
	RequestDigest         []byte
	CanonicalHostname     string
	Target                string
	RouteScope            string
	PolicyRevision        int64
	IpPolicy              string
	AllowedIpPrefixes     []netip.Prefix
	LifecycleState        string
	DnsAuthorityReference pgtype.Text
	DnsState              string
	DnsRevision           int64
	DnsWorkOwner          pgtype.Text
	DnsWorkEpoch          int64
	DnsWorkExpiresAt      pgtype.Timestamptz
	DnsAttempts           int64
	DnsAvailableAt        pgtype.Timestamptz
	DnsLastError          pgtype.Text
	NextRouteVersion      int64
	MutationRevision      int64
	Ephemeral             bool
	ExpiresAt             pgtype.Timestamptz
	SuspensionRevision    int64
	SuspensionReason      pgtype.Text
	CreatedAt             pgtype.Timestamptz
	UpdatedAt             pgtype.Timestamptz
	SuspendedAt           pgtype.Timestamptz
	DeletedAt             pgtype.Timestamptz
	ActorMembershipID     string
	ActorRole             string
}

type LockIngressLeaseParams struct {
	IngressID            string
	IngressRunID         string
	IngressLeaseRevision int64
	Now                  pgtype.Timestamptz
}

type LockInvitationByTokenDigestParams struct {
	IdentityID  string
	TokenDigest []byte
}

type LockInvitationByTokenDigestRow struct {
	ID                         string
	TeamID                     string
	SlugReservationID          string
	InitialRole                string
	InvitedByIdentityID        string
	IdempotencyKey             string
	RequestDigest              []byte
	TokenDigest                []byte
	NormalizedEmailRestriction pgtype.Text
	State                      string
	CreatedAt                  pgtype.Timestamptz
	ExpiresAt                  pgtype.Timestamptz
	AcceptedAt                 pgtype.Timestamptz
	AcceptedByIdentityID       pgtype.Text
	AcceptedMembershipID       pgtype.Text
	RevokedAt                  pgtype.Timestamptz
	RevokedByIdentityID        pgtype.Text
	MemberSlug                 string
	TeamKind                   string
	TeamDisplayName            string
	AcceptingNormalizedEmail   pgtype.Text
	AcceptingEmailVerified     bool
}

type LockMembershipRoutesParams struct {
	TeamID       string
	MembershipID pgtype.Text
}

type LockRouteSessionForUsageParams struct {
	RouteVersion int64
	RouteID      string
}

type LockTeamActorContextParams struct {
	IdentityID string
	TeamID     string
}

type LockTeamActorContextRow struct {
	ID                string
	Kind              string
	DisplayName       string
	ManagedLabel      string
	DefaultDomainID   pgtype.Text
	PolicyRevision    int64
	CreatedAt         pgtype.Timestamptz
	UpdatedAt         pgtype.Timestamptz
	ActorMembershipID string
	ActorRole         string
}

type LockTeamDomainParams struct {
	DomainID string
	TeamID   pgtype.Text
}

type LockTeamDomainRow struct {
	ID                      string
	Kind                    string
	TeamID                  pgtype.Text
	CanonicalDomain         string
	DnsAuthorityReference   pgtype.Text
	State                   string
	AuthorityRevision       int64
	VerificationTokenDigest []byte
	CreatedByIdentityID     pgtype.Text
	ClaimIdempotencyKey     pgtype.Text
	ClaimRequestDigest      []byte
	MakeDefaultWhenReady    bool
	CreatedAt               pgtype.Timestamptz
	VerifiedAt              pgtype.Timestamptz
	ReusableAfter           pgtype.Timestamptz
	ReleasedAt              pgtype.Timestamptz
	UpdatedAt               pgtype.Timestamptz
	Nameservers             []string
}

type LockTeamInvitationParams struct {
	InvitationID string
	TeamID       string
}

type LockTeamInvitationRow struct {
	ID                         string
	TeamID                     string
	SlugReservationID          string
	InitialRole                string
	InvitedByIdentityID        string
	IdempotencyKey             string
	RequestDigest              []byte
	TokenDigest                []byte
	NormalizedEmailRestriction pgtype.Text
	State                      string
	CreatedAt                  pgtype.Timestamptz
	ExpiresAt                  pgtype.Timestamptz
	AcceptedAt                 pgtype.Timestamptz
	AcceptedByIdentityID       pgtype.Text
	AcceptedMembershipID       pgtype.Text
	RevokedAt                  pgtype.Timestamptz
	RevokedByIdentityID        pgtype.Text
	MemberSlug                 string
}

type LockTeamMembershipParams struct {
	MembershipID string
	TeamID       string
}

type LockTeamMembershipRow struct {
	ID                  string
	TeamID              string
	IdentityID          string
	SlugReservationID   string
	ManagedLabel        string
	Role                string
	AuthorityRevision   int64
	CreatedAt           pgtype.Timestamptz
	UpdatedAt           pgtype.Timestamptz
	RemovedAt           pgtype.Timestamptz
	RemovedByIdentityID pgtype.Text
	MemberSlug          string
}

type MarkACMEAuthorizationsPresentedParams struct {
	PresentedAt pgtype.Timestamptz
	IssuanceID  string
}

type MarkACMEOrderInstalledParams struct {
	InstalledAt pgtype.Timestamptz
	IssuanceID  string
}

type MarkClaimedDomainReleasingParams struct {
	AuthorityRevision int64
	UpdatedAt         pgtype.Timestamptz
	DomainID          string
	TeamID            pgtype.Text
}

type MarkDNSAuthorityReleasingParams struct {
	UpdatedAt          pgtype.Timestamptz
	AuthorityReference string
}

type MarkExpiredIngressUsageRunIncompleteParams struct {
	EndedAt      pgtype.Timestamptz
	IngressID    string
	IngressRunID string
}

type MarkIngressUsageRunReportedParams struct {
	ReportedAt           pgtype.Timestamptz
	ObservedThrough      pgtype.Timestamptz
	Complete             bool
	IngressID            string
	IngressRunID         string
	IngressLeaseRevision int64
}

type MarkPublisherConnectionReadyParams struct {
	ReadyAt                      pgtype.Timestamptz
	PublisherConnectionID        string
	RouteSessionID               string
	RouteID                      string
	RouteVersion                 int64
	ConnectionSlot               int16
	ConnectionAssignmentRevision int64
	RelayServiceID               string
	RelayID                      pgtype.Text
	RelayRunID                   pgtype.Text
	RelayLeaseRevision           pgtype.Int8
	ClaimID                      pgtype.Text
}

type MarkRouteSessionCertificateInstalledParams struct {
	IssuanceID     pgtype.Text
	InstalledAt    pgtype.Timestamptz
	NotAfter       pgtype.Timestamptz
	RouteSessionID string
	RouteID        string
	RouteVersion   int64
}

type MarkRouteSessionReadyParams struct {
	ReadyAt        pgtype.Timestamptz
	RouteSessionID string
	RouteID        string
	RouteVersion   int64
}

type ObserveAuthorityRevisionParams struct {
	Issuer         string
	TeamID         string
	PolicyRevision int64
	UpdatedAt      pgtype.Timestamptz
}

type ObserveRouteRecoveryEpisodeParams struct {
	ObservedAt        pgtype.Timestamptz
	ObservedSeconds   pgtype.Float8
	RecoveryEpisodeID int64
	RouteID           string
	RouteVersion      int64
}

type OpenRouteRecoveryEpisodeParams struct {
	RouteID      string
	RouteVersion int64
	OpenedAt     pgtype.Timestamptz
}

type PruneIngressRoutingHistoryBatchRow struct {
	NextRevision int64
	Scanned      int64
	Deleted      int64
}

type PutControlTLSCacheEntryParams struct {
	DirectoryUrl      string
	CacheKey          string
	CacheCiphertext   []byte
	CacheStorageKeyID string
	UpdatedAt         pgtype.Timestamptz
}

type QuarantineMemberSlugParams struct {
	QuarantinedAt     pgtype.Timestamptz
	SlugReservationID string
}

type Querier interface {
	AcceptTeamInvitation(ctx context.Context, arg AcceptTeamInvitationParams) (int64, error)
	ActivateMemberSlug(ctx context.Context, arg ActivateMemberSlugParams) (int64, error)
	AdvanceAuthorityRevision(ctx context.Context, arg AdvanceAuthorityRevisionParams) (int64, error)
	// Commit this short clock update BEFORE pruning in a different transaction.
	// A crash in between retains excess data, never an advertised but missing suffix.
	AdvanceIngressRoutingRetentionFloor(ctx context.Context, revision int64) (int64, error)
	AdvanceTeamPolicyRevision(ctx context.Context, arg AdvanceTeamPolicyRevisionParams) (int64, error)
	// The caller holds the ingress/run, route/session and existing bucket guards.
	// Dependencies make the immutable report, aggregate delta and denial update
	// one ordered write command. The caller checks insertion/aggregation and any
	// nonzero denial delta, rolling back all writes if a required step was rejected.
	ApplyIngressUsageReport(ctx context.Context, arg ApplyIngressUsageReportParams) (ApplyIngressUsageReportRow, error)
	BeginAdminRelayDrain(ctx context.Context, arg BeginAdminRelayDrainParams) (BeginAdminRelayDrainRow, error)
	BeginDNSAuthorityRelease(ctx context.Context, arg BeginDNSAuthorityReleaseParams) (ControlDnsAuthority, error)
	BeginIngressDrain(ctx context.Context, arg BeginIngressDrainParams) (ControlIngressLease, error)
	BeginRelayDrain(ctx context.Context, arg BeginRelayDrainParams) (BeginRelayDrainRow, error)
	CancelOpenRouteRecoveryEpisode(ctx context.Context, arg CancelOpenRouteRecoveryEpisodeParams) (ControlRouteRecoveryEpisode, error)
	CancelRouteSessionACMEAuthorizations(ctx context.Context, arg CancelRouteSessionACMEAuthorizationsParams) error
	CancelRouteSessionACMEOrders(ctx context.Context, arg CancelRouteSessionACMEOrdersParams) error
	ClaimACMEOrderWork(ctx context.Context, arg ClaimACMEOrderWorkParams) (ControlAcmeOrder, error)
	ClaimDNSAuthorityWork(ctx context.Context, arg ClaimDNSAuthorityWorkParams) (ControlDnsAuthority, error)
	ClaimDNSRouteWork(ctx context.Context, arg ClaimDNSRouteWorkParams) (ControlRoute, error)
	ClaimPublisherConnection(ctx context.Context, arg ClaimPublisherConnectionParams) (ControlRouteSessionConnection, error)
	ClaimRelayCertificateOrderWork(ctx context.Context, arg ClaimRelayCertificateOrderWorkParams) (ControlRelayCertificateOrder, error)
	ClaimRelayServiceForCertificateOrder(ctx context.Context, arg ClaimRelayServiceForCertificateOrderParams) (ControlRelayService, error)
	ClaimRouteUsageDeliveries(ctx context.Context, arg ClaimRouteUsageDeliveriesParams) ([]ControlRouteUsageDelivery, error)
	CloseRouteSession(ctx context.Context, arg CloseRouteSessionParams) (ControlRouteSession, error)
	CloseRouteSessionConnections(ctx context.Context, arg CloseRouteSessionConnectionsParams) error
	CompleteACMEAuthorizationCleanup(ctx context.Context, arg CompleteACMEAuthorizationCleanupParams) (int64, error)
	CompleteRouteUsageDelivery(ctx context.Context, arg CompleteRouteUsageDeliveryParams) (ControlRouteUsageDelivery, error)
	ConsumeOIDCAssertion(ctx context.Context, arg ConsumeOIDCAssertionParams) (int64, error)
	// Diagnostic/test oracle only; placement reads the trigger-maintained totals.
	CountOpenRouteSessionAssignmentsByRelayService(ctx context.Context) ([]CountOpenRouteSessionAssignmentsByRelayServiceRow, error)
	CountRelayActiveConnections(ctx context.Context, arg CountRelayActiveConnectionsParams) (int64, error)
	CountTeamOwners(ctx context.Context, teamID string) (int64, error)
	CreateActiveSlugReservation(ctx context.Context, arg CreateActiveSlugReservationParams) error
	CreateClaimedDNSAuthority(ctx context.Context, arg CreateClaimedDNSAuthorityParams) error
	CreateClaimedDomain(ctx context.Context, arg CreateClaimedDomainParams) (ControlDomain, error)
	CreateControlSession(ctx context.Context, arg CreateControlSessionParams) error
	CreateIdentity(ctx context.Context, arg CreateIdentityParams) error
	CreateManagedDomain(ctx context.Context, arg CreateManagedDomainParams) error
	CreateOIDCIdentity(ctx context.Context, arg CreateOIDCIdentityParams) (ControlIdentity, error)
	CreateOrGetDNSAuthority(ctx context.Context, arg CreateOrGetDNSAuthorityParams) (ControlDnsAuthority, error)
	CreateOrganizationTeam(ctx context.Context, arg CreateOrganizationTeamParams) (CreateOrganizationTeamRow, error)
	CreateOwnerMembership(ctx context.Context, arg CreateOwnerMembershipParams) error
	CreatePersonalTeam(ctx context.Context, arg CreatePersonalTeamParams) error
	CreateTeamInvitation(ctx context.Context, arg CreateTeamInvitationParams) (ControlTeamInvitation, error)
	CreateTeamMembership(ctx context.Context, arg CreateTeamMembershipParams) error
	DNSAuthorityReleaseReady(ctx context.Context, arg DNSAuthorityReleaseReadyParams) (pgtype.Bool, error)
	DeleteControlTLSCacheEntry(ctx context.Context, arg DeleteControlTLSCacheEntryParams) error
	DeleteExpiredOIDCAssertionExchanges(ctx context.Context, now pgtype.Timestamptz) error
	DeleteRoute(ctx context.Context, arg DeleteRouteParams) (int64, error)
	DisconnectPublisherConnection(ctx context.Context, arg DisconnectPublisherConnectionParams) (ControlRouteSessionConnection, error)
	EnsureACMEAccount(ctx context.Context, arg EnsureACMEAccountParams) (ControlAcmeAccount, error)
	EnsureExternalAuthorityPrincipal(ctx context.Context, arg EnsureExternalAuthorityPrincipalParams) (ControlIdentity, error)
	EnsureExternalRetryMasterKey(ctx context.Context, arg EnsureExternalRetryMasterKeyParams) (EnsureExternalRetryMasterKeyRow, error)
	EnsureIngressUsageRun(ctx context.Context, arg EnsureIngressUsageRunParams) (ControlIngressUsageRun, error)
	EnsureRouteUsageConfiguration(ctx context.Context, arg EnsureRouteUsageConfigurationParams) (ControlRouteUsageConfiguration, error)
	ExpirePublisherConnection(ctx context.Context, arg ExpirePublisherConnectionParams) (ControlRouteSessionConnection, error)
	ExpireTeamInvitations(ctx context.Context, arg ExpireTeamInvitationsParams) ([]string, error)
	FinalizeRouteUsageBuckets(ctx context.Context, arg FinalizeRouteUsageBucketsParams) ([]ControlRouteUsageBucket, error)
	FindBuiltinIdentity(ctx context.Context) (ControlIdentity, error)
	FindInvitationTeamByTokenDigest(ctx context.Context, tokenDigest []byte) (string, error)
	FindManagedDomain(ctx context.Context) (ControlDomain, error)
	FindOIDCIdentity(ctx context.Context, arg FindOIDCIdentityParams) (ControlIdentity, error)
	GetACMEAccountByDirectory(ctx context.Context, directoryUrl string) (ControlAcmeAccount, error)
	GetACMEOrder(ctx context.Context, issuanceID string) (ControlAcmeOrder, error)
	GetACMEOrderByIdempotency(ctx context.Context, arg GetACMEOrderByIdempotencyParams) (ControlAcmeOrder, error)
	GetActiveRouteSessionChallengeExpiry(ctx context.Context, arg GetActiveRouteSessionChallengeExpiryParams) (pgtype.Timestamptz, error)
	GetActiveRouteSessionMembership(ctx context.Context, arg GetActiveRouteSessionMembershipParams) (GetActiveRouteSessionMembershipRow, error)
	GetAdminRuntimeCounts(ctx context.Context, now pgtype.Timestamptz) (GetAdminRuntimeCountsRow, error)
	GetAuthorizedRouteByHostname(ctx context.Context, arg GetAuthorizedRouteByHostnameParams) (GetAuthorizedRouteByHostnameRow, error)
	GetClaimedDomainByIdempotency(ctx context.Context, arg GetClaimedDomainByIdempotencyParams) (GetClaimedDomainByIdempotencyRow, error)
	GetControlSessionByAccessID(ctx context.Context, accessTokenID string) (GetControlSessionByAccessIDRow, error)
	GetControlTLSCacheEntry(ctx context.Context, arg GetControlTLSCacheEntryParams) (GetControlTLSCacheEntryRow, error)
	GetDNSAuthority(ctx context.Context, authorityReference string) (ControlDnsAuthority, error)
	GetDNSAuthorityByReleaseIdempotency(ctx context.Context, releaseIdempotencyKey pgtype.Text) (ControlDnsAuthority, error)
	GetDNSChallengeContext(ctx context.Context, arg GetDNSChallengeContextParams) (GetDNSChallengeContextRow, error)
	GetExternalAuthorityRoute(ctx context.Context, arg GetExternalAuthorityRouteParams) (GetExternalAuthorityRouteRow, error)
	GetIdentityContextIdentity(ctx context.Context, identityID string) (GetIdentityContextIdentityRow, error)
	GetIdentityRoute(ctx context.Context, arg GetIdentityRouteParams) (GetIdentityRouteRow, error)
	GetIdentityTeam(ctx context.Context, arg GetIdentityTeamParams) (GetIdentityTeamRow, error)
	GetIngressLease(ctx context.Context, arg GetIngressLeaseParams) (ControlIngressLease, error)
	GetIngressUsageReport(ctx context.Context, arg GetIngressUsageReportParams) (ControlIngressUsageReport, error)
	GetInvitationByIdempotency(ctx context.Context, arg GetInvitationByIdempotencyParams) (GetInvitationByIdempotencyRow, error)
	GetOpenRouteRecoveryEpisode(ctx context.Context, arg GetOpenRouteRecoveryEpisodeParams) (ControlRouteRecoveryEpisode, error)
	GetOpenRouteSession(ctx context.Context, routeID string) (ControlRouteSession, error)
	GetOrganizationTeamByIdempotency(ctx context.Context, arg GetOrganizationTeamByIdempotencyParams) (GetOrganizationTeamByIdempotencyRow, error)
	GetPublisherConnectionForClaim(ctx context.Context, publisherConnectionID string) (ControlRouteSessionConnection, error)
	GetRelayDNSChallengeContext(ctx context.Context, orderID string) (GetRelayDNSChallengeContextRow, error)
	// Claims and readiness read service configuration without changing it. Share
	// that guard across processes. Claims exclusively lock the selected lease's
	// non-key fields so capacity checks cannot race each other, renewal, or drain.
	// NO KEY UPDATE also permits readiness's KEY SHARE guard: becoming ready does
	// not consume another connection. Registration and placement take the service
	// exclusively before leases; keep that order here too.
	GetRelayLeaseForClaim(ctx context.Context, relayID string) (GetRelayLeaseForClaimRow, error)
	// Readiness retains the service guard through routing publication so process
	// registration/replacement cannot change its identity. KEY SHARE protects the
	// lease's existence without serializing claims or other readiness publications.
	// Renewal/drain may overlap; readiness validates the lease it reads, and routing
	// projection reads independently exclude a lease that has since drained.
	GetRelayLeaseForReady(ctx context.Context, relayID string) (GetRelayLeaseForReadyRow, error)
	GetRelayTransportCertificate(ctx context.Context, arg GetRelayTransportCertificateParams) (ControlRelayService, error)
	GetRouteByCreatorIdempotency(ctx context.Context, arg GetRouteByCreatorIdempotencyParams) (GetRouteByCreatorIdempotencyRow, error)
	GetRouteCreationContext(ctx context.Context, arg GetRouteCreationContextParams) (GetRouteCreationContextRow, error)
	GetRouteSession(ctx context.Context, routeSessionID string) (ControlRouteSession, error)
	GetRouteSessionByIdempotency(ctx context.Context, arg GetRouteSessionByIdempotencyParams) (ControlRouteSession, error)
	GetRouteSessionByTokenID(ctx context.Context, sessionTokenID string) (ControlRouteSession, error)
	GetRouteUsageBucketByID(ctx context.Context, bucketID int64) (ControlRouteUsageBucket, error)
	GetRouteUsageBucketForUpdate(ctx context.Context, arg GetRouteUsageBucketForUpdateParams) (ControlRouteUsageBucket, error)
	GetTeamActorContext(ctx context.Context, arg GetTeamActorContextParams) (GetTeamActorContextRow, error)
	GetTeamMembershipContext(ctx context.Context, arg GetTeamMembershipContextParams) (GetTeamMembershipContextRow, error)
	HeartbeatRouteSession(ctx context.Context, arg HeartbeatRouteSessionParams) (ControlRouteSession, error)
	InsertACMEOrder(ctx context.Context, arg InsertACMEOrderParams) (ControlAcmeOrder, error)
	InsertAdminAuditEvent(ctx context.Context, arg InsertAdminAuditEventParams) error
	InsertCertificateIssuanceAuditEvent(ctx context.Context, arg InsertCertificateIssuanceAuditEventParams) error
	InsertExpiredEphemeralRouteDeleteAuditEvent(ctx context.Context, arg InsertExpiredEphemeralRouteDeleteAuditEventParams) error
	// Acquire the clock before identity allocation in this same command. Single-event
	// publishers avoid a separate round trip while holding the global clock; callers
	// with earlier events already hold it. Keep the lock through transaction commit.
	InsertFinalIngressRoutingTableEvent(ctx context.Context, arg InsertFinalIngressRoutingTableEventParams) (int64, error)
	InsertIngressRoutingTableEvent(ctx context.Context, arg InsertIngressRoutingTableEventParams) (int64, error)
	InsertRelayCertificateOrder(ctx context.Context, arg InsertRelayCertificateOrderParams) (ControlRelayCertificateOrder, error)
	InsertRoute(ctx context.Context, arg InsertRouteParams) (ControlRoute, error)
	InsertRouteCreateAuditEvent(ctx context.Context, arg InsertRouteCreateAuditEventParams) error
	InsertRouteDeleteAuditEvent(ctx context.Context, arg InsertRouteDeleteAuditEventParams) error
	InsertRouteSession(ctx context.Context, arg InsertRouteSessionParams) (ControlRouteSession, error)
	InsertRouteSessionAuditEvent(ctx context.Context, arg InsertRouteSessionAuditEventParams) error
	InsertRouteSessionConnections(ctx context.Context, arg InsertRouteSessionConnectionsParams) ([]ControlRouteSessionConnection, error)
	InsertRouteUpdateAuditEvent(ctx context.Context, arg InsertRouteUpdateAuditEventParams) error
	InsertRouteUsageDelivery(ctx context.Context, arg InsertRouteUsageDeliveryParams) (ControlRouteUsageDelivery, error)
	LatestIngressRoutingEntryRevision(ctx context.Context, arg LatestIngressRoutingEntryRevisionParams) (int64, error)
	ListACMEOrderAuthorizations(ctx context.Context, issuanceID string) ([]ControlAcmeAuthorization, error)
	ListAdminRelayLeases(ctx context.Context, arg ListAdminRelayLeasesParams) ([]ListAdminRelayLeasesRow, error)
	ListCurrentDomainNames(ctx context.Context) ([]string, error)
	ListDNSChallengePresentations(ctx context.Context, baseIdentifier string) ([]ListDNSChallengePresentationsRow, error)
	ListExternalAuthorityRoutes(ctx context.Context, arg ListExternalAuthorityRoutesParams) ([]ListExternalAuthorityRoutesRow, error)
	ListIdentityMembershipContexts(ctx context.Context, identityID string) ([]ListIdentityMembershipContextsRow, error)
	ListIdentityRoutes(ctx context.Context, arg ListIdentityRoutesParams) ([]ListIdentityRoutesRow, error)
	ListIdentityTeamDomains(ctx context.Context, arg ListIdentityTeamDomainsParams) ([]ListIdentityTeamDomainsRow, error)
	ListIdentityTeams(ctx context.Context, identityID string) ([]ListIdentityTeamsRow, error)
	ListIngressRoutingTableEvents(ctx context.Context, arg ListIngressRoutingTableEventsParams) ([]ControlIngressRoutingTableEvent, error)
	// Group only entry keys and revisions across history, then fetch the selected
	// payloads. Filter after selection so tombstones/expiry cannot revive old rows.
	ListIngressRoutingTableSnapshot(ctx context.Context, arg ListIngressRoutingTableSnapshotParams) ([]ControlIngressRoutingTableEvent, error)
	// The ingress/run guards serialize this source's append-only history. Fetch only
	// bounded metadata, not histogram blobs; exact replays still load their payload.
	ListLatestIngressUsageReports(ctx context.Context, arg ListLatestIngressUsageReportsParams) ([]ListLatestIngressUsageReportsRow, error)
	ListMaintenanceControls(ctx context.Context) ([]ControlMaintenanceControl, error)
	ListRelayDNSChallengePresentations(ctx context.Context, tlsServerName string) ([]ListRelayDNSChallengePresentationsRow, error)
	ListRelayServiceAssignmentTotals(ctx context.Context) ([]ControlRelayServiceAssignmentTotal, error)
	ListRouteSessionConnections(ctx context.Context, routeSessionID string) ([]ControlRouteSessionConnection, error)
	ListTeamInvitations(ctx context.Context, teamID string) ([]ListTeamInvitationsRow, error)
	ListTeamMemberNamespaceLabels(ctx context.Context, teamID string) ([]ListTeamMemberNamespaceLabelsRow, error)
	ListTeamMembershipContexts(ctx context.Context, teamID string) ([]ListTeamMembershipContextsRow, error)
	ListValidReadyPublisherConnections(ctx context.Context, arg ListValidReadyPublisherConnectionsParams) ([]ListValidReadyPublisherConnectionsRow, error)
	LockACMEOrder(ctx context.Context, issuanceID string) (ControlAcmeOrder, error)
	LockACMEOrderForInstall(ctx context.Context, arg LockACMEOrderForInstallParams) (ControlAcmeOrder, error)
	LockCertificateIssuanceControl(ctx context.Context) (bool, error)
	LockControlSessionByRefreshID(ctx context.Context, refreshTokenID string) (LockControlSessionByRefreshIDRow, error)
	LockDNSAuthority(ctx context.Context, authorityReference string) (ControlDnsAuthority, error)
	LockDNSAuthorityLocalDomain(ctx context.Context, authorityReference pgtype.Text) error
	LockDNSAuthorityLocalTeam(ctx context.Context, authorityReference pgtype.Text) error
	LockDomainRoutes(ctx context.Context, arg LockDomainRoutesParams) ([]ControlRoute, error)
	LockEligibleRelayLeases(ctx context.Context, arg LockEligibleRelayLeasesParams) ([]LockEligibleRelayLeasesRow, error)
	LockExpiredEphemeralRoutes(ctx context.Context, arg LockExpiredEphemeralRoutesParams) ([]ControlRoute, error)
	LockHostedTeamRoutes(ctx context.Context, teamID string) ([]ControlRoute, error)
	LockIdentityBootstrap(ctx context.Context) error
	LockIdentityForTeamCreation(ctx context.Context, identityID string) (string, error)
	LockIdentityRouteForDelete(ctx context.Context, arg LockIdentityRouteForDeleteParams) (LockIdentityRouteForDeleteRow, error)
	LockIngressLease(ctx context.Context, arg LockIngressLeaseParams) (ControlIngressLease, error)
	LockIngressRoutingTableClock(ctx context.Context) (int64, error)
	LockInvalidReadyPublisherConnections(ctx context.Context, now pgtype.Timestamptz) ([]ControlRouteSessionConnection, error)
	LockInvitationByTokenDigest(ctx context.Context, arg LockInvitationByTokenDigestParams) (LockInvitationByTokenDigestRow, error)
	LockLocalRouteTeamForMutation(ctx context.Context, routeID string) (string, error)
	// Local authority mutations lock the team before identities, memberships,
	// domains, DNS authorities, and routes. Authorization is rechecked under this
	// transaction-held guard; hosted teams never require fabricated local rows.
	// Queue writers with the session readers using a transaction advisory lock:
	// PostgreSQL row-lock readers alone can bypass a waiting writer indefinitely.
	LockLocalTeamForMutation(ctx context.Context, teamID string) (string, error)
	// Session creation reads authority under this guard before locking its route.
	// Different routes may start together; team/role/domain mutations must wait.
	// Callers must not upgrade this guard by writing the team later in the transaction.
	LockLocalTeamForSession(ctx context.Context, teamID string) (string, error)
	LockManagedDomainForClaim(ctx context.Context) (ControlDomain, error)
	LockMembershipRoutes(ctx context.Context, arg LockMembershipRoutesParams) ([]ControlRoute, error)
	LockRelayServiceForCertificate(ctx context.Context, relayServiceID string) (string, error)
	// Acquire the reservation guard before service guards and rows, in one command.
	// Callers finish locking all services before locking leases or checking capacity.
	LockRelayServicesForPlacement(ctx context.Context) ([]string, error)
	LockRouteCreationControl(ctx context.Context) (bool, error)
	// Serialize creators without blocking session and audit foreign-key checks.
	LockRouteCreator(ctx context.Context, identityID string) (string, error)
	// Session operations serialize route mutations but never change the route's
	// identity. Let usage's KEY SHARE references coexist; overlapping usage pages
	// can otherwise starve a waiting heartbeat's stronger UPDATE lock.
	LockRouteForSession(ctx context.Context, routeID string) (ControlRoute, error)
	LockRouteForUsage(ctx context.Context, routeID string) (string, error)
	LockRouteRecoveryEpisode(ctx context.Context, recoveryEpisodeID int64) (ControlRouteRecoveryEpisode, error)
	LockRouteSession(ctx context.Context, routeSessionID string) (ControlRouteSession, error)
	LockRouteSessionCreationControl(ctx context.Context) (bool, error)
	// Acquire the immutable route reference before the session, in one round trip.
	// Read the bucket in a LATER statement: a competing ingress may create it while
	// this statement waits for the session lock, after this statement's snapshot.
	LockRouteSessionForUsage(ctx context.Context, arg LockRouteSessionForUsageParams) (ControlRouteSession, error)
	LockTeamActorContext(ctx context.Context, arg LockTeamActorContextParams) (LockTeamActorContextRow, error)
	LockTeamDomain(ctx context.Context, arg LockTeamDomainParams) (LockTeamDomainRow, error)
	LockTeamForInvitationAcceptance(ctx context.Context, teamID string) (string, error)
	LockTeamInvitation(ctx context.Context, arg LockTeamInvitationParams) (LockTeamInvitationRow, error)
	LockTeamMembership(ctx context.Context, arg LockTeamMembershipParams) (LockTeamMembershipRow, error)
	MarkACMEAuthorizationsPresented(ctx context.Context, arg MarkACMEAuthorizationsPresentedParams) (int64, error)
	MarkACMEOrderInstalled(ctx context.Context, arg MarkACMEOrderInstalledParams) (ControlAcmeOrder, error)
	MarkClaimedDomainReleasing(ctx context.Context, arg MarkClaimedDomainReleasingParams) (int64, error)
	MarkDNSAuthorityReleasing(ctx context.Context, arg MarkDNSAuthorityReleasingParams) (int64, error)
	MarkExpiredIngressUsageRunIncomplete(ctx context.Context, arg MarkExpiredIngressUsageRunIncompleteParams) error
	MarkExpiredIngressUsageRunsIncomplete(ctx context.Context, now pgtype.Timestamptz) ([]ControlIngressUsageRun, error)
	MarkIngressUsageRunReported(ctx context.Context, arg MarkIngressUsageRunReportedParams) (ControlIngressUsageRun, error)
	MarkInvitationExpired(ctx context.Context, invitationID string) (int64, error)
	MarkPublisherConnectionReady(ctx context.Context, arg MarkPublisherConnectionReadyParams) (ControlRouteSessionConnection, error)
	MarkRouteSessionCertificateInstalled(ctx context.Context, arg MarkRouteSessionCertificateInstalledParams) (ControlRouteSession, error)
	MarkRouteSessionReady(ctx context.Context, arg MarkRouteSessionReadyParams) (ControlRouteSession, error)
	ObserveAuthorityRevision(ctx context.Context, arg ObserveAuthorityRevisionParams) (int64, error)
	ObserveRouteRecoveryEpisode(ctx context.Context, arg ObserveRouteRecoveryEpisodeParams) (ControlRouteRecoveryEpisode, error)
	OpenRouteRecoveryEpisode(ctx context.Context, arg OpenRouteRecoveryEpisodeParams) error
	// Bound candidates visited as well as rows deleted. Advance past anchors even
	// when no row can be removed. Keep the newest hostname/category projection
	// (including tombstones/expired entries) AND each route-version's latest revision.
	// All checks use this statement's snapshot. Concurrent publications can only
	// make an old anchor redundant; they cannot make a superseded event current.
	PruneIngressRoutingHistoryBatch(ctx context.Context, afterRevision int64) (PruneIngressRoutingHistoryBatchRow, error)
	PutControlTLSCacheEntry(ctx context.Context, arg PutControlTLSCacheEntryParams) error
	QuarantineMemberSlug(ctx context.Context, arg QuarantineMemberSlugParams) (int64, error)
	ReadIngressRoutingTableClock(ctx context.Context) (ControlIngressRoutingTableClock, error)
	RegisterIngress(ctx context.Context, arg RegisterIngressParams) (ControlIngressLease, error)
	// Blocking service operations acquire a transaction advisory guard before any
	// service/lease row locks. Shared row readers alone can bypass a queued writer;
	// the advisory queue lets registration, placement and certificate writes progress.
	// SKIP LOCKED certificate preparation and bulk key rotation remain opportunistic
	// row-only writers: they never wait for a service row or acquire this guard after
	// holding one. Keep their nonblocking behavior rather than adding a lock upgrade.
	RegisterRelay(ctx context.Context, arg RegisterRelayParams) (RegisterRelayRow, error)
	ReleaseInvitedMemberSlug(ctx context.Context, arg ReleaseInvitedMemberSlugParams) (int64, error)
	RemoveTeamMembership(ctx context.Context, arg RemoveTeamMembershipParams) (int64, error)
	RenewEphemeralRouteExpiry(ctx context.Context, arg RenewEphemeralRouteExpiryParams) (pgtype.Timestamptz, error)
	RenewIngress(ctx context.Context, arg RenewIngressParams) (ControlIngressLease, error)
	RenewRelay(ctx context.Context, arg RenewRelayParams) (RenewRelayRow, error)
	// A failed ready connection can keep its existing service reservation. This
	// atomic ready -> assigned transition has zero counter delta and needs only the
	// caller's route/session locks, not placement's global/service/lease guards.
	// Check failure and eligible service capacity in the statement snapshot. A
	// concurrent lease/configuration change may invalidate the returned assignment,
	// just as one immediately after commit can; claim checks the exact current lease
	// and process capacity under its exclusive lease guard. No capacity is added here.
	// Closed/expired slots have no reservation and require guarded placement first.
	ReplaceRouteSessionConnection(ctx context.Context, arg ReplaceRouteSessionConnectionParams) (ControlRouteSessionConnection, error)
	ReserveInvitedMemberSlug(ctx context.Context, arg ReserveInvitedMemberSlugParams) (string, error)
	ReserveManagedLabel(ctx context.Context, arg ReserveManagedLabelParams) (string, error)
	RetryRouteUsageDelivery(ctx context.Context, arg RetryRouteUsageDeliveryParams) (ControlRouteUsageDelivery, error)
	RevokeControlSession(ctx context.Context, arg RevokeControlSessionParams) (int64, error)
	RevokeTeamInvitation(ctx context.Context, arg RevokeTeamInvitationParams) (int64, error)
	RotateACMEAccountKey(ctx context.Context, arg RotateACMEAccountKeyParams) error
	RotateControlSessionCredentials(ctx context.Context, arg RotateControlSessionCredentialsParams) (int64, error)
	RotateControlSessionRetrySecret(ctx context.Context, arg RotateControlSessionRetrySecretParams) error
	RotateControlTLSCacheEntry(ctx context.Context, arg RotateControlTLSCacheEntryParams) error
	RotateExternalRetryMasterKey(ctx context.Context, arg RotateExternalRetryMasterKeyParams) error
	RotateRelayCertificateOrderPrivateKey(ctx context.Context, arg RotateRelayCertificateOrderPrivateKeyParams) error
	RotateRelayServicePrivateKey(ctx context.Context, arg RotateRelayServicePrivateKeyParams) error
	SaveACMEAuthorizationWork(ctx context.Context, arg SaveACMEAuthorizationWorkParams) (ControlAcmeAuthorization, error)
	SaveACMEOrderWork(ctx context.Context, arg SaveACMEOrderWorkParams) (ControlAcmeOrder, error)
	SaveDNSAuthorityWork(ctx context.Context, arg SaveDNSAuthorityWorkParams) (ControlDnsAuthority, error)
	SaveDNSRouteWork(ctx context.Context, arg SaveDNSRouteWorkParams) (ControlRoute, error)
	SaveRelayCertificateOrderWork(ctx context.Context, arg SaveRelayCertificateOrderWorkParams) (ControlRelayCertificateOrder, error)
	// Find an old committed PREFIX, not the largest old timestamp. Request-start
	// timestamps can be out of revision order; preserve every still-recent event.
	// This scan happens before acquiring the publication clock.
	SelectIngressRoutingRetentionFloor(ctx context.Context, cutoff pgtype.Timestamptz) (int64, error)
	SetDNSReadyDomainDefault(ctx context.Context, arg SetDNSReadyDomainDefaultParams) (int64, error)
	SetDomainAuthorityRevision(ctx context.Context, arg SetDomainAuthorityRevisionParams) error
	SetMaintenanceControl(ctx context.Context, arg SetMaintenanceControlParams) (ControlMaintenanceControl, error)
	SetPersonalTeamDefaultDomain(ctx context.Context, arg SetPersonalTeamDefaultDomainParams) error
	SetTeamDefaultDomain(ctx context.Context, arg SetTeamDefaultDomainParams) (int64, error)
	StoreRelayTransportCertificate(ctx context.Context, arg StoreRelayTransportCertificateParams) (ControlRelayService, error)
	SuspendAuthorityRoute(ctx context.Context, arg SuspendAuthorityRouteParams) (int64, error)
	TeamMembershipIdentityExists(ctx context.Context, arg TeamMembershipIdentityExistsParams) (bool, error)
	// Cleanup-only coordination; no route, reservation, service, lease, or clock locks.
	TryLockIngressRoutingHistoryCleanup(ctx context.Context) (bool, error)
	UpdateACMEAccountRegistration(ctx context.Context, arg UpdateACMEAccountRegistrationParams) (ControlAcmeAccount, error)
	UpdateLocalDomainForDNSAuthority(ctx context.Context, arg UpdateLocalDomainForDNSAuthorityParams) (UpdateLocalDomainForDNSAuthorityRow, error)
	UpdateMembershipRole(ctx context.Context, arg UpdateMembershipRoleParams) (int64, error)
	UpdateOIDCIdentity(ctx context.Context, arg UpdateOIDCIdentityParams) (ControlIdentity, error)
	UpdateRoute(ctx context.Context, arg UpdateRouteParams) (ControlRoute, error)
	UpdateRouteRecoveryHistogram(ctx context.Context, arg UpdateRouteRecoveryHistogramParams) (ControlRouteRecoveryHistogram, error)
	// A publisher transition invalidates the worker's authorization snapshot.
	// Call only after changing authorizations while holding the order lock.
	WakeACMEOrder(ctx context.Context, arg WakeACMEOrderParams) error
}