@nylorun/runtime 0.16.0-beta → 0.19.0-beta

package/dist/store/postgres/schema.d.ts

@@ -388,6 +388,23 @@ export declare const sessions: import("drizzle-orm/pg-core").PgTableWithColumns<
                 type: 'always';
             };
         }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "createdAt";
+            tableName: "sessions";
+            dataType: "string";
+            columnType: "PgTimestampString";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         owner: import("drizzle-orm/pg-core").PgColumn<{
             name: "owner";
             tableName: "sessions";
@@ -646,165 +663,6 @@ export declare const effects: import("drizzle-orm/pg-core").PgTableWithColumns<{
     };
     dialect: 'pg';
 }>;
-export declare const actions: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "actions";
-    schema: "nylorun";
-    columns: {
-        id: import("drizzle-orm/pg-core").PgColumn<{
-            name: "id";
-            tableName: "actions";
-            dataType: "custom";
-            columnType: "PgCustomColumn";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: true;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {
-            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
-        }>;
-        body: import("drizzle-orm/pg-core").PgColumn<{
-            name: "body";
-            tableName: "actions";
-            dataType: "custom";
-            columnType: "PgCustomColumn";
-            data: unknown;
-            driverParam: unknown;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {
-            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
-        }>;
-        sessionId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "sessionId";
-            tableName: "actions";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: {
-                type: 'always';
-            };
-        }, {}, {}>;
-        turnId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "turnId";
-            tableName: "actions";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: {
-                type: 'always';
-            };
-        }, {}, {}>;
-        agentId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "agentId";
-            tableName: "actions";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: {
-                type: 'always';
-            };
-        }, {}, {}>;
-        status: import("drizzle-orm/pg-core").PgColumn<{
-            name: "status";
-            tableName: "actions";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: {
-                type: 'always';
-            };
-        }, {}, {}>;
-        kind: import("drizzle-orm/pg-core").PgColumn<{
-            name: "kind";
-            tableName: "actions";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: {
-                type: 'always';
-            };
-        }, {}, {}>;
-        deadlineAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "deadlineAt";
-            tableName: "actions";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: {
-                type: 'always';
-            };
-        }, {}, {}>;
-    };
-    dialect: 'pg';
-}>;
 export declare const sandboxes: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: string;
     schema: "nylorun";
@@ -914,7 +772,10 @@ export declare const links: import("drizzle-orm/pg-core").PgTableWithColumns<{
     };
     dialect: 'pg';
 }>;
-/** An application principal: who holds a key, by its SHA-256. */
+/**
+ * A principal: who holds a key, by its SHA-256, and what the key reaches (`role`, protocol 8):
+ * `application` the Runtime API, `management` the Management API, `studio` both.
+ */
 export declare const principals: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "principals";
     schema: "nylorun";
@@ -943,7 +804,7 @@ export declare const principals: import("drizzle-orm/pg-core").PgTableWithColumn
             tableName: "principals";
             dataType: "string";
             columnType: "PgText";
-            data: "application" | (string & {});
+            data: "application" | "management" | "studio";
             driverParam: string;
             notNull: true;
             hasDefault: false;
@@ -955,7 +816,7 @@ export declare const principals: import("drizzle-orm/pg-core").PgTableWithColumn
             identity: undefined;
             generated: undefined;
         }, {}, {
-            $type: "application" | (string & {});
+            $type: "application" | "management" | "studio";
         }>;
         tokenHash: import("drizzle-orm/pg-core").PgColumn<{
             name: "tokenHash";
@@ -1109,14 +970,14 @@ export declare const vaults: import("drizzle-orm/pg-core").PgTableWithColumns<{
             tableName: "vaults";
             dataType: "string";
             columnType: "PgText";
-            data: "host" | "user";
+            data: "host" | "installation" | "user";
             driverParam: string;
             notNull: true;
             hasDefault: true;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["user", "host"];
+            enumValues: ["user", "installation", "host"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
@@ -1581,13 +1442,18 @@ export declare const vaultIdempotency: import("drizzle-orm/pg-core").PgTableWith
     };
     dialect: 'pg';
 }>;
-export declare const tenantSettings: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "tenant_settings";
+/**
+ * An MCP OAuth connect between its start and its callback (F9 C2): found by the SHA-256 of its
+ * `state`, used once, for ten minutes. The PKCE verifier and any client secret are sealed under
+ * the vault key (`sealBytes`), which only the keys module holds.
+ */
+export declare const oauthPending: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "oauth_pending";
     schema: "nylorun";
     columns: {
-        key: import("drizzle-orm/pg-core").PgColumn<{
-            name: "key";
-            tableName: "tenant_settings";
+        stateHash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "stateHash";
+            tableName: "oauth_pending";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -1602,9 +1468,9 @@ export declare const tenantSettings: import("drizzle-orm/pg-core").PgTableWithCo
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        value: import("drizzle-orm/pg-core").PgColumn<{
-            name: "value";
-            tableName: "tenant_settings";
+        vaultId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "vaultId";
+            tableName: "oauth_pending";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -1619,70 +1485,60 @@ export declare const tenantSettings: import("drizzle-orm/pg-core").PgTableWithCo
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-    };
-    dialect: 'pg';
-}>;
-/** The Tenant's signing keys (subject tokens): the private half sealed, the public JWK not. */
-export declare const signingKeys: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "signing_keys";
-    schema: "nylorun";
-    columns: {
-        id: import("drizzle-orm/pg-core").PgColumn<{
-            name: "id";
-            tableName: "signing_keys";
-            dataType: "custom";
-            columnType: "PgCustomColumn";
+        server: import("drizzle-orm/pg-core").PgColumn<{
+            name: "server";
+            tableName: "oauth_pending";
+            dataType: "string";
+            columnType: "PgText";
             data: string;
             driverParam: string;
             notNull: true;
             hasDefault: false;
-            isPrimaryKey: true;
+            isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: undefined;
+            enumValues: [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {
-            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
-        }>;
-        state: import("drizzle-orm/pg-core").PgColumn<{
-            name: "state";
-            tableName: "signing_keys";
+        }, {}, {}>;
+        url: import("drizzle-orm/pg-core").PgColumn<{
+            name: "url";
+            tableName: "oauth_pending";
             dataType: "string";
             columnType: "PgText";
-            data: "current" | "previous" | "revoked" | "standby";
+            data: string;
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["standby", "current", "previous", "revoked"];
+            enumValues: [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        alg: import("drizzle-orm/pg-core").PgColumn<{
-            name: "alg";
-            tableName: "signing_keys";
+        tokenEndpoint: import("drizzle-orm/pg-core").PgColumn<{
+            name: "tokenEndpoint";
+            tableName: "oauth_pending";
             dataType: "string";
             columnType: "PgText";
-            data: "ES256";
+            data: string;
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["ES256"];
+            enumValues: [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        publicJwk: import("drizzle-orm/pg-core").PgColumn<{
-            name: "publicJwk";
-            tableName: "signing_keys";
+        clientId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "clientId";
+            tableName: "oauth_pending";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -1697,9 +1553,43 @@ export declare const signingKeys: import("drizzle-orm/pg-core").PgTableWithColum
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        tokenEndpointAuth: import("drizzle-orm/pg-core").PgColumn<{
+            name: "tokenEndpointAuth";
+            tableName: "oauth_pending";
+            dataType: "string";
+            columnType: "PgText";
+            data: "client_secret_basic" | "client_secret_post" | "none";
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["none", "client_secret_basic", "client_secret_post"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        resource: import("drizzle-orm/pg-core").PgColumn<{
+            name: "resource";
+            tableName: "oauth_pending";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         kekId: import("drizzle-orm/pg-core").PgColumn<{
             name: "kekId";
-            tableName: "signing_keys";
+            tableName: "oauth_pending";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -1714,14 +1604,14 @@ export declare const signingKeys: import("drizzle-orm/pg-core").PgTableWithColum
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        nonce: import("drizzle-orm/pg-core").PgColumn<{
-            name: "nonce";
-            tableName: "signing_keys";
+        clientSecret: import("drizzle-orm/pg-core").PgColumn<{
+            name: "clientSecret";
+            tableName: "oauth_pending";
             dataType: "custom";
             columnType: "PgCustomColumn";
             data: Uint8Array<ArrayBufferLike>;
             driverParam: Buffer<ArrayBufferLike>;
-            notNull: true;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -1733,9 +1623,9 @@ export declare const signingKeys: import("drizzle-orm/pg-core").PgTableWithColum
         }, {}, {
             pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
         }>;
-        ciphertext: import("drizzle-orm/pg-core").PgColumn<{
-            name: "ciphertext";
-            tableName: "signing_keys";
+        codeVerifier: import("drizzle-orm/pg-core").PgColumn<{
+            name: "codeVerifier";
+            tableName: "oauth_pending";
             dataType: "custom";
             columnType: "PgCustomColumn";
             data: Uint8Array<ArrayBufferLike>;
@@ -1752,28 +1642,9 @@ export declare const signingKeys: import("drizzle-orm/pg-core").PgTableWithColum
         }, {}, {
             pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
         }>;
-        wrappedDek: import("drizzle-orm/pg-core").PgColumn<{
-            name: "wrappedDek";
-            tableName: "signing_keys";
-            dataType: "custom";
-            columnType: "PgCustomColumn";
-            data: Uint8Array<ArrayBufferLike>;
-            driverParam: Buffer<ArrayBufferLike>;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {
-            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
-        }>;
-        createdAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "createdAt";
-            tableName: "signing_keys";
+        redirectUri: import("drizzle-orm/pg-core").PgColumn<{
+            name: "redirectUri";
+            tableName: "oauth_pending";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -1788,75 +1659,16 @@ export declare const signingKeys: import("drizzle-orm/pg-core").PgTableWithColum
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        activatedAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "activatedAt";
-            tableName: "signing_keys";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        retiredAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "retiredAt";
-            tableName: "signing_keys";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        revokedAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "revokedAt";
-            tableName: "signing_keys";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-    };
-    dialect: 'pg';
-}>;
-/** Each subject's revocation epoch. */
-export declare const subjectEpochs: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "subject_epochs";
-    schema: "nylorun";
-    columns: {
-        subject: import("drizzle-orm/pg-core").PgColumn<{
-            name: "subject";
-            tableName: "subject_epochs";
+        expiresAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "expiresAt";
+            tableName: "oauth_pending";
             dataType: "custom";
             columnType: "PgCustomColumn";
             data: string;
             driverParam: string;
             notNull: true;
             hasDefault: false;
-            isPrimaryKey: true;
+            isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
             enumValues: undefined;
@@ -1866,58 +1678,16 @@ export declare const subjectEpochs: import("drizzle-orm/pg-core").PgTableWithCol
         }, {}, {
             pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
         }>;
-        epoch: import("drizzle-orm/pg-core").PgColumn<{
-            name: "epoch";
-            tableName: "subject_epochs";
-            dataType: "number";
-            columnType: "PgBigInt53";
-            data: number;
-            driverParam: string | number;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        revokedAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "revokedAt";
-            tableName: "subject_epochs";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-    };
-    dialect: 'pg';
-}>;
-/** Each subject's turn bucket: tokens left and when they were last refilled. */
-export declare const subjectUsage: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "subject_usage";
-    schema: "nylorun";
-    columns: {
-        subject: import("drizzle-orm/pg-core").PgColumn<{
-            name: "subject";
-            tableName: "subject_usage";
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "createdAt";
+            tableName: "oauth_pending";
             dataType: "custom";
             columnType: "PgCustomColumn";
             data: string;
             driverParam: string;
             notNull: true;
             hasDefault: false;
-            isPrimaryKey: true;
+            isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
             enumValues: undefined;
@@ -1927,113 +1697,23 @@ export declare const subjectUsage: import("drizzle-orm/pg-core").PgTableWithColu
         }, {}, {
             pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
         }>;
-        turnTokens: import("drizzle-orm/pg-core").PgColumn<{
-            name: "turnTokens";
-            tableName: "subject_usage";
-            dataType: "number";
-            columnType: "PgDoublePrecision";
-            data: number;
-            driverParam: string | number;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        refilledAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "refilledAt";
-            tableName: "subject_usage";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
     };
     dialect: 'pg';
 }>;
-/** Publishable keys (Host feature `browser-access`): public by design. */
-export declare const publishableKeys: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "publishable_keys";
+export declare const tenantSettings: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "tenant_settings";
     schema: "nylorun";
     columns: {
-        id: import("drizzle-orm/pg-core").PgColumn<{
-            name: "id";
-            tableName: "publishable_keys";
-            dataType: "custom";
-            columnType: "PgCustomColumn";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: true;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {
-            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
-        }>;
         key: import("drizzle-orm/pg-core").PgColumn<{
             name: "key";
-            tableName: "publishable_keys";
-            dataType: "custom";
-            columnType: "PgCustomColumn";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {
-            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
-        }>;
-        name: import("drizzle-orm/pg-core").PgColumn<{
-            name: "name";
-            tableName: "publishable_keys";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        originsJson: import("drizzle-orm/pg-core").PgColumn<{
-            name: "originsJson";
-            tableName: "publishable_keys";
+            tableName: "tenant_settings";
             dataType: "string";
             columnType: "PgText";
             data: string;
             driverParam: string;
             notNull: true;
             hasDefault: false;
-            isPrimaryKey: false;
+            isPrimaryKey: true;
             isAutoincrement: false;
             hasRuntimeDefault: false;
             enumValues: [string, ...string[]];
@@ -2041,9 +1721,9 @@ export declare const publishableKeys: import("drizzle-orm/pg-core").PgTableWithC
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        createdAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "createdAt";
-            tableName: "publishable_keys";
+        value: import("drizzle-orm/pg-core").PgColumn<{
+            name: "value";
+            tableName: "tenant_settings";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -2058,37 +1738,20 @@ export declare const publishableKeys: import("drizzle-orm/pg-core").PgTableWithC
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        revokedAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "revokedAt";
-            tableName: "publishable_keys";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
     };
     dialect: 'pg';
 }>;
 /**
- * Action endpoints: where the Runtime delivers each agent's Actions over HTTP, and the health
- * recent deliveries and the last ping report.
+ * The Tenant's signing keys (capability links, run and host tokens): the
+ * private half sealed, the public JWK not.
  */
-export declare const endpoints: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "endpoints";
+export declare const signingKeys: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "signing_keys";
     schema: "nylorun";
     columns: {
-        agentId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "agentId";
-            tableName: "endpoints";
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "signing_keys";
             dataType: "custom";
             columnType: "PgCustomColumn";
             data: string;
@@ -2105,133 +1768,65 @@ export declare const endpoints: import("drizzle-orm/pg-core").PgTableWithColumns
         }, {}, {
             pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
         }>;
-        url: import("drizzle-orm/pg-core").PgColumn<{
-            name: "url";
-            tableName: "endpoints";
+        state: import("drizzle-orm/pg-core").PgColumn<{
+            name: "state";
+            tableName: "signing_keys";
             dataType: "string";
             columnType: "PgText";
-            data: string;
+            data: "current" | "previous" | "revoked" | "standby";
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
+            enumValues: ["standby", "current", "previous", "revoked"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        implementationVersion: import("drizzle-orm/pg-core").PgColumn<{
-            name: "implementationVersion";
-            tableName: "endpoints";
+        alg: import("drizzle-orm/pg-core").PgColumn<{
+            name: "alg";
+            tableName: "signing_keys";
             dataType: "string";
             columnType: "PgText";
-            data: string;
+            data: "ES256";
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
+            enumValues: ["ES256"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        manifestHash: import("drizzle-orm/pg-core").PgColumn<{
-            name: "manifestHash";
-            tableName: "endpoints";
+        publicJwk: import("drizzle-orm/pg-core").PgColumn<{
+            name: "publicJwk";
+            tableName: "signing_keys";
             dataType: "string";
             columnType: "PgText";
             data: string;
             driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        timeoutMs: import("drizzle-orm/pg-core").PgColumn<{
-            name: "timeoutMs";
-            tableName: "endpoints";
-            dataType: "number";
-            columnType: "PgInteger";
-            data: number;
-            driverParam: string | number;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        maxConcurrent: import("drizzle-orm/pg-core").PgColumn<{
-            name: "maxConcurrent";
-            tableName: "endpoints";
-            dataType: "number";
-            columnType: "PgInteger";
-            data: number;
-            driverParam: string | number;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        principalId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "principalId";
-            tableName: "endpoints";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
             enumValues: [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        lastDeliveryAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "lastDeliveryAt";
-            tableName: "endpoints";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        lastSuccessAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "lastSuccessAt";
-            tableName: "endpoints";
+        kekId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "kekId";
+            tableName: "signing_keys";
             dataType: "string";
             columnType: "PgText";
             data: string;
             driverParam: string;
-            notNull: false;
+            notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -2241,49 +1836,53 @@ export declare const endpoints: import("drizzle-orm/pg-core").PgTableWithColumns
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        lastErrorCode: import("drizzle-orm/pg-core").PgColumn<{
-            name: "lastErrorCode";
-            tableName: "endpoints";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: false;
+        nonce: import("drizzle-orm/pg-core").PgColumn<{
+            name: "nonce";
+            tableName: "signing_keys";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: Uint8Array<ArrayBufferLike>;
+            driverParam: Buffer<ArrayBufferLike>;
+            notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
+            enumValues: undefined;
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {}>;
-        lastErrorMessage: import("drizzle-orm/pg-core").PgColumn<{
-            name: "lastErrorMessage";
-            tableName: "endpoints";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: false;
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+        ciphertext: import("drizzle-orm/pg-core").PgColumn<{
+            name: "ciphertext";
+            tableName: "signing_keys";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: Uint8Array<ArrayBufferLike>;
+            driverParam: Buffer<ArrayBufferLike>;
+            notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
+            enumValues: undefined;
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {}>;
-        consecutiveFailures: import("drizzle-orm/pg-core").PgColumn<{
-            name: "consecutiveFailures";
-            tableName: "endpoints";
-            dataType: "number";
-            columnType: "PgInteger";
-            data: number;
-            driverParam: string | number;
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+        wrappedDek: import("drizzle-orm/pg-core").PgColumn<{
+            name: "wrappedDek";
+            tableName: "signing_keys";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: Uint8Array<ArrayBufferLike>;
+            driverParam: Buffer<ArrayBufferLike>;
             notNull: true;
-            hasDefault: true;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -2291,15 +1890,17 @@ export declare const endpoints: import("drizzle-orm/pg-core").PgTableWithColumns
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {}>;
-        servedImplementationVersion: import("drizzle-orm/pg-core").PgColumn<{
-            name: "servedImplementationVersion";
-            tableName: "endpoints";
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "createdAt";
+            tableName: "signing_keys";
             dataType: "string";
             columnType: "PgText";
             data: string;
             driverParam: string;
-            notNull: false;
+            notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -2309,9 +1910,9 @@ export declare const endpoints: import("drizzle-orm/pg-core").PgTableWithColumns
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        servedManifestHash: import("drizzle-orm/pg-core").PgColumn<{
-            name: "servedManifestHash";
-            tableName: "endpoints";
+        activatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "activatedAt";
+            tableName: "signing_keys";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -2326,14 +1927,14 @@ export declare const endpoints: import("drizzle-orm/pg-core").PgTableWithColumns
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        createdAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "createdAt";
-            tableName: "endpoints";
+        retiredAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "retiredAt";
+            tableName: "signing_keys";
             dataType: "string";
             columnType: "PgText";
             data: string;
             driverParam: string;
-            notNull: true;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -2343,14 +1944,14 @@ export declare const endpoints: import("drizzle-orm/pg-core").PgTableWithColumns
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "updatedAt";
-            tableName: "endpoints";
+        revokedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "revokedAt";
+            tableName: "signing_keys";
             dataType: "string";
             columnType: "PgText";
             data: string;
             driverParam: string;
-            notNull: true;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -2411,6 +2012,59 @@ export declare const modelUsage: import("drizzle-orm/pg-core").PgTableWithColumn
         }, {}, {
             pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
         }>;
+        tokensReported: import("drizzle-orm/pg-core").PgColumn<{
+            name: "tokensReported";
+            tableName: "model_usage";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        costKnown: import("drizzle-orm/pg-core").PgColumn<{
+            name: "costKnown";
+            tableName: "model_usage";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        txid: import("drizzle-orm/pg-core").PgColumn<{
+            name: "txid";
+            tableName: "model_usage";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: string;
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
         sessionId: import("drizzle-orm/pg-core").PgColumn<{
             name: "sessionId";
             tableName: "model_usage";
@@ -3653,6 +3307,177 @@ export declare const artifactContent: import("drizzle-orm/pg-core").PgTableWithC
     };
     dialect: 'pg';
 }>;
+/**
+ * The definition files the Tenant holds (track R2 M4): files a definition names by the SHA-256
+ * of their bytes (a skill's folder), uploaded with `PUT /v1/files/sha256:<hex>`. The bytes are
+ * in the Object store at `definitions/sha256/<hex>`; a row counts them only once they are
+ * stored. `sha256` is `sha256:<hex>`.
+ */
+export declare const definitionFiles: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "definition_files";
+    schema: "nylorun";
+    columns: {
+        sha256: import("drizzle-orm/pg-core").PgColumn<{
+            name: "sha256";
+            tableName: "definition_files";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+        kind: import("drizzle-orm/pg-core").PgColumn<{
+            name: "kind";
+            tableName: "definition_files";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        size: import("drizzle-orm/pg-core").PgColumn<{
+            name: "size";
+            tableName: "definition_files";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        contentType: import("drizzle-orm/pg-core").PgColumn<{
+            name: "contentType";
+            tableName: "definition_files";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "createdAt";
+            tableName: "definition_files";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+    };
+    dialect: 'pg';
+}>;
+/**
+ * Which definition version names which definition file: one row per agent id, manifest hash
+ * and file, written when the definition is stored. A later sweep deletes the files no
+ * definition uses.
+ */
+export declare const definitionFileUses: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "definition_file_uses";
+    schema: "nylorun";
+    columns: {
+        agentId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "agentId";
+            tableName: "definition_file_uses";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+        manifestHash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "manifestHash";
+            tableName: "definition_file_uses";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+        sha256: import("drizzle-orm/pg-core").PgColumn<{
+            name: "sha256";
+            tableName: "definition_file_uses";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+    };
+    dialect: 'pg';
+}>;
 /**
  * Each sandbox's lifecycle stream (`nylorun.sandbox-event/1`), numbered from 0 per sandbox id.
  * Written only by the record module; not published to the stream relay.
@@ -3979,12 +3804,16 @@ export type VaultRow = typeof vaults.$inferSelect;
 export type VaultCredentialRow = typeof vaultCredentials.$inferSelect;
 export type VaultAuditRow = Omit<typeof vaultAudit.$inferSelect, "ord">;
 export type VaultIdempotencyRow = typeof vaultIdempotency.$inferSelect;
+export type OAuthPendingRow = typeof oauthPending.$inferSelect;
 export type SigningKeyRow = typeof signingKeys.$inferSelect;
-export type SubjectUsageRow = typeof subjectUsage.$inferSelect;
-export type PublishableKeyRow = typeof publishableKeys.$inferSelect;
 export type ModelUsageRow = typeof modelUsage.$inferSelect;
 export type ModelBudgetRow = typeof modelBudgets.$inferSelect;
 export type ToolCrossingRow = typeof toolCrossings.$inferSelect;
 export type SandboxResourceRow = typeof sandboxResources.$inferSelect;
 export type ArtifactRow = typeof artifacts.$inferSelect;
 export type ArtifactVersionRow = typeof artifactVersions.$inferSelect;
+export type DefinitionFileRow = typeof definitionFiles.$inferSelect;
+export type ModelUsageWrite = Omit<ModelUsageRow, "duplicate" | "txid" | "tokensReported" | "costKnown"> & {
+    tokensReported?: boolean | null;
+    costKnown?: boolean | null;
+};