@nylorun/runtime 0.23.0-beta → 0.24.0-beta

package/dist/store/postgres/schema.d.ts

@@ -475,8 +475,8 @@ export declare const sessions: import("drizzle-orm/pg-core").PgTableWithColumns<
                 type: 'always';
             };
         }, {}, {}>;
-        sandboxId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "sandboxId";
+        environmentId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "environmentId";
             tableName: "sessions";
             dataType: "string";
             columnType: "PgText";
@@ -872,13 +872,20 @@ export declare const principals: import("drizzle-orm/pg-core").PgTableWithColumn
     };
     dialect: 'pg';
 }>;
-export declare const vaults: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "vaults";
+/**
+ * An Environment (D55, protocol 11): its id, kind, labels, the recipe the app asked for and the
+ * recipe its compute runs (`applied`, copied from `recipe` when a stopped pod is asked to run),
+ * the owner guard, and when it was last used. Kind `pod` adds the pod's lifecycle columns.
+ * Sessions name it by id (the session body's `environmentId`). Not the `sandboxes` document
+ * table, which holds the virtual backend's compute records, keyed by workspace key.
+ */
+export declare const environments: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "environments";
     schema: "nylorun";
     columns: {
         id: import("drizzle-orm/pg-core").PgColumn<{
             name: "id";
-            tableName: "vaults";
+            tableName: "environments";
             dataType: "custom";
             columnType: "PgCustomColumn";
             data: string;
@@ -895,64 +902,68 @@ export declare const vaults: import("drizzle-orm/pg-core").PgTableWithColumns<{
         }, {}, {
             pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
         }>;
-        name: import("drizzle-orm/pg-core").PgColumn<{
-            name: "name";
-            tableName: "vaults";
+        kind: import("drizzle-orm/pg-core").PgColumn<{
+            name: "kind";
+            tableName: "environments";
             dataType: "string";
             columnType: "PgText";
-            data: string;
+            data: "none" | "pod" | "virtual";
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
+            enumValues: ["virtual", "pod", "none"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        ownerUserId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "ownerUserId";
-            tableName: "vaults";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
+        labels: import("drizzle-orm/pg-core").PgColumn<{
+            name: "labels";
+            tableName: "environments";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: unknown;
+            driverParam: unknown;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
+            enumValues: undefined;
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {}>;
-        metadataJson: import("drizzle-orm/pg-core").PgColumn<{
-            name: "metadataJson";
-            tableName: "vaults";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: false;
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+        recipe: import("drizzle-orm/pg-core").PgColumn<{
+            name: "recipe";
+            tableName: "environments";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: unknown;
+            driverParam: unknown;
+            notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
+            enumValues: undefined;
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {}>;
-        createdAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "createdAt";
-            tableName: "vaults";
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+        applied: import("drizzle-orm/pg-core").PgColumn<{
+            name: "applied";
+            tableName: "environments";
             dataType: "custom";
             columnType: "PgCustomColumn";
-            data: string;
-            driverParam: string;
+            data: unknown;
+            driverParam: unknown;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
@@ -965,58 +976,48 @@ export declare const vaults: import("drizzle-orm/pg-core").PgTableWithColumns<{
         }, {}, {
             pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
         }>;
-        scope: import("drizzle-orm/pg-core").PgColumn<{
-            name: "scope";
-            tableName: "vaults";
-            dataType: "string";
-            columnType: "PgText";
-            data: "host" | "installation" | "user";
-            driverParam: string;
+        version: import("drizzle-orm/pg-core").PgColumn<{
+            name: "version";
+            tableName: "environments";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
             notNull: true;
             hasDefault: true;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["user", "installation", "host"];
+            enumValues: undefined;
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-    };
-    dialect: 'pg';
-}>;
-/** A credential of a vault: its binding in the clear, its secret sealed. */
-export declare const vaultCredentials: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "vault_credentials";
-    schema: "nylorun";
-    columns: {
-        id: import("drizzle-orm/pg-core").PgColumn<{
-            name: "id";
-            tableName: "vault_credentials";
-            dataType: "custom";
-            columnType: "PgCustomColumn";
-            data: string;
-            driverParam: string;
+        appliedVersion: import("drizzle-orm/pg-core").PgColumn<{
+            name: "appliedVersion";
+            tableName: "environments";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
             notNull: true;
-            hasDefault: false;
-            isPrimaryKey: true;
+            hasDefault: true;
+            isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
             enumValues: undefined;
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {
-            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
-        }>;
-        vaultId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "vaultId";
-            tableName: "vault_credentials";
+        }, {}, {}>;
+        ownerUserId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "ownerUserId";
+            tableName: "environments";
             dataType: "string";
             columnType: "PgText";
             data: string;
             driverParam: string;
-            notNull: true;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -1026,45 +1027,47 @@ export declare const vaultCredentials: import("drizzle-orm/pg-core").PgTableWith
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        name: import("drizzle-orm/pg-core").PgColumn<{
-            name: "name";
-            tableName: "vault_credentials";
+        lastUsedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "lastUsedAt";
+            tableName: "environments";
             dataType: "string";
-            columnType: "PgText";
+            columnType: "PgTimestampString";
             data: string;
             driverParam: string;
             notNull: true;
-            hasDefault: false;
+            hasDefault: true;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
+            enumValues: undefined;
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        type: import("drizzle-orm/pg-core").PgColumn<{
-            name: "type";
-            tableName: "vault_credentials";
-            dataType: "string";
-            columnType: "PgText";
-            data: "bearer" | "environment_secret" | "environment_variable" | "headers" | "model";
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "createdAt";
+            tableName: "environments";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: string;
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["bearer", "headers", "environment_secret", "environment_variable", "model"];
+            enumValues: undefined;
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {}>;
-        bindingJson: import("drizzle-orm/pg-core").PgColumn<{
-            name: "bindingJson";
-            tableName: "vault_credentials";
-            dataType: "string";
-            columnType: "PgText";
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updatedAt";
+            tableName: "environments";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
             data: string;
             driverParam: string;
             notNull: true;
@@ -1072,16 +1075,18 @@ export declare const vaultCredentials: import("drizzle-orm/pg-core").PgTableWith
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
+            enumValues: undefined;
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {}>;
-        expiresAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "expiresAt";
-            tableName: "vault_credentials";
-            dataType: "string";
-            columnType: "PgText";
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+        k8sName: import("drizzle-orm/pg-core").PgColumn<{
+            name: "k8sName";
+            tableName: "environments";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
             data: string;
             driverParam: string;
             notNull: false;
@@ -1089,20 +1094,22 @@ export declare const vaultCredentials: import("drizzle-orm/pg-core").PgTableWith
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
+            enumValues: undefined;
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {}>;
-        createdAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "createdAt";
-            tableName: "vault_credentials";
-            dataType: "custom";
-            columnType: "PgCustomColumn";
-            data: string;
-            driverParam: string;
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+        volumeGen: import("drizzle-orm/pg-core").PgColumn<{
+            name: "volumeGen";
+            tableName: "environments";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
             notNull: true;
-            hasDefault: false;
+            hasDefault: true;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -1110,71 +1117,67 @@ export declare const vaultCredentials: import("drizzle-orm/pg-core").PgTableWith
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {
-            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
-        }>;
-        rotatedAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "rotatedAt";
-            tableName: "vault_credentials";
+        }, {}, {}>;
+        desired: import("drizzle-orm/pg-core").PgColumn<{
+            name: "desired";
+            tableName: "environments";
             dataType: "string";
             columnType: "PgText";
-            data: string;
+            data: "deleted" | "running" | "suspended";
             driverParam: string;
             notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
+            enumValues: ["running", "suspended", "deleted"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        kekId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "kekId";
-            tableName: "vault_credentials";
+        observed: import("drizzle-orm/pg-core").PgColumn<{
+            name: "observed";
+            tableName: "environments";
             dataType: "string";
             columnType: "PgText";
-            data: string;
+            data: "creating" | "deleting" | "failed" | "lost" | "running" | "suspended";
             driverParam: string;
-            notNull: true;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
+            enumValues: ["creating", "running", "suspended", "lost", "failed", "deleting"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        nonce: import("drizzle-orm/pg-core").PgColumn<{
-            name: "nonce";
-            tableName: "vault_credentials";
-            dataType: "custom";
-            columnType: "PgCustomColumn";
-            data: Uint8Array<ArrayBufferLike>;
-            driverParam: Buffer<ArrayBufferLike>;
-            notNull: true;
+        podUid: import("drizzle-orm/pg-core").PgColumn<{
+            name: "podUid";
+            tableName: "environments";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: undefined;
+            enumValues: [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {
-            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
-        }>;
-        ciphertext: import("drizzle-orm/pg-core").PgColumn<{
-            name: "ciphertext";
-            tableName: "vault_credentials";
-            dataType: "custom";
-            columnType: "PgCustomColumn";
-            data: Uint8Array<ArrayBufferLike>;
-            driverParam: Buffer<ArrayBufferLike>;
+        }, {}, {}>;
+        hostEpoch: import("drizzle-orm/pg-core").PgColumn<{
+            name: "hostEpoch";
+            tableName: "environments";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
             notNull: true;
-            hasDefault: false;
+            hasDefault: true;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -1182,123 +1185,78 @@ export declare const vaultCredentials: import("drizzle-orm/pg-core").PgTableWith
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {
-            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
-        }>;
-        wrappedDek: import("drizzle-orm/pg-core").PgColumn<{
-            name: "wrappedDek";
-            tableName: "vault_credentials";
-            dataType: "custom";
-            columnType: "PgCustomColumn";
-            data: Uint8Array<ArrayBufferLike>;
-            driverParam: Buffer<ArrayBufferLike>;
-            notNull: true;
+        }, {}, {}>;
+        joinTokenHash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "joinTokenHash";
+            tableName: "environments";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: undefined;
+            enumValues: [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {
-            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
-        }>;
-    };
-    dialect: 'pg';
-}>;
-export declare const vaultAudit: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "vault_audit";
-    schema: "nylorun";
-    columns: {
-        ord: import("drizzle-orm/pg-core").PgColumn<{
-            name: "ord";
-            tableName: "vault_audit";
+        }, {}, {}>;
+        rev: import("drizzle-orm/pg-core").PgColumn<{
+            name: "rev";
+            tableName: "environments";
             dataType: "number";
-            columnType: "PgBigInt53";
+            columnType: "PgInteger";
             data: number;
             driverParam: string | number;
             notNull: true;
             hasDefault: true;
-            isPrimaryKey: true;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: "always";
-            generated: undefined;
-        }, {}, {}>;
-        id: import("drizzle-orm/pg-core").PgColumn<{
-            name: "id";
-            tableName: "vault_audit";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        at: import("drizzle-orm/pg-core").PgColumn<{
-            name: "at";
-            tableName: "vault_audit";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
+            enumValues: undefined;
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        actor: import("drizzle-orm/pg-core").PgColumn<{
-            name: "actor";
-            tableName: "vault_audit";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
+        lastActiveAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "lastActiveAt";
+            tableName: "environments";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
             driverParam: string;
-            notNull: true;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
+            enumValues: undefined;
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        action: import("drizzle-orm/pg-core").PgColumn<{
-            name: "action";
-            tableName: "vault_audit";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
+        startedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "startedAt";
+            tableName: "environments";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
             driverParam: string;
-            notNull: true;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
+            enumValues: undefined;
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        vaultId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "vaultId";
-            tableName: "vault_audit";
+        reason: import("drizzle-orm/pg-core").PgColumn<{
+            name: "reason";
+            tableName: "environments";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -1313,11 +1271,11 @@ export declare const vaultAudit: import("drizzle-orm/pg-core").PgTableWithColumn
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        credentialId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "credentialId";
-            tableName: "vault_audit";
-            dataType: "string";
-            columnType: "PgText";
+        retiring: import("drizzle-orm/pg-core").PgColumn<{
+            name: "retiring";
+            tableName: "environments";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
             data: string;
             driverParam: string;
             notNull: false;
@@ -1325,14 +1283,16 @@ export declare const vaultAudit: import("drizzle-orm/pg-core").PgTableWithColumn
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
+            enumValues: undefined;
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {}>;
-        sessionId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "sessionId";
-            tableName: "vault_audit";
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+        volumeId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "volumeId";
+            tableName: "environments";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -1347,52 +1307,60 @@ export declare const vaultAudit: import("drizzle-orm/pg-core").PgTableWithColumn
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        target: import("drizzle-orm/pg-core").PgColumn<{
-            name: "target";
-            tableName: "vault_audit";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
+        diskOp: import("drizzle-orm/pg-core").PgColumn<{
+            name: "diskOp";
+            tableName: "environments";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: unknown;
+            driverParam: unknown;
             notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
+            enumValues: undefined;
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {}>;
-        outcome: import("drizzle-orm/pg-core").PgColumn<{
-            name: "outcome";
-            tableName: "vault_audit";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+        diskSeed: import("drizzle-orm/pg-core").PgColumn<{
+            name: "diskSeed";
+            tableName: "environments";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: unknown;
+            driverParam: unknown;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
+            enumValues: undefined;
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {}>;
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
     };
     dialect: 'pg';
 }>;
-export declare const vaultIdempotency: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "vault_idempotency";
+/**
+ * A vault (D56): the host model's (`id = 'host'`), or one Environment's, created and deleted with
+ * it (`environment_id`, unique, deleted with the Environment's row). No other vault exists.
+ */
+export declare const vaults: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "vaults";
     schema: "nylorun";
     columns: {
         id: import("drizzle-orm/pg-core").PgColumn<{
             name: "id";
-            tableName: "vault_idempotency";
-            dataType: "string";
-            columnType: "PgText";
+            tableName: "vaults";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
             data: string;
             driverParam: string;
             notNull: true;
@@ -1400,14 +1368,16 @@ export declare const vaultIdempotency: import("drizzle-orm/pg-core").PgTableWith
             isPrimaryKey: true;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
+            enumValues: undefined;
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {}>;
-        bodyHash: import("drizzle-orm/pg-core").PgColumn<{
-            name: "bodyHash";
-            tableName: "vault_idempotency";
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+        name: import("drizzle-orm/pg-core").PgColumn<{
+            name: "name";
+            tableName: "vaults";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -1422,14 +1392,14 @@ export declare const vaultIdempotency: import("drizzle-orm/pg-core").PgTableWith
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        response: import("drizzle-orm/pg-core").PgColumn<{
-            name: "response";
-            tableName: "vault_idempotency";
+        metadataJson: import("drizzle-orm/pg-core").PgColumn<{
+            name: "metadataJson";
+            tableName: "vaults";
             dataType: "string";
             columnType: "PgText";
             data: string;
             driverParam: string;
-            notNull: true;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -1439,61 +1409,55 @@ export declare const vaultIdempotency: import("drizzle-orm/pg-core").PgTableWith
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-    };
-    dialect: 'pg';
-}>;
-export declare const tenantSettings: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "tenant_settings";
-    schema: "nylorun";
-    columns: {
-        key: import("drizzle-orm/pg-core").PgColumn<{
-            name: "key";
-            tableName: "tenant_settings";
-            dataType: "string";
-            columnType: "PgText";
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "createdAt";
+            tableName: "vaults";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
             data: string;
             driverParam: string;
             notNull: true;
             hasDefault: false;
-            isPrimaryKey: true;
+            isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
+            enumValues: undefined;
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {}>;
-        value: import("drizzle-orm/pg-core").PgColumn<{
-            name: "value";
-            tableName: "tenant_settings";
-            dataType: "string";
-            columnType: "PgText";
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+        environmentId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "environmentId";
+            tableName: "vaults";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
             data: string;
             driverParam: string;
-            notNull: true;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
+            enumValues: undefined;
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {}>;
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
     };
     dialect: 'pg';
 }>;
-/**
- * The Tenant's signing keys (capability links, run and host tokens): the
- * private half sealed, the public JWK not.
- */
-export declare const signingKeys: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "signing_keys";
+/** A credential of a vault: its binding in the clear, its secret sealed. */
+export declare const vaultCredentials: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "vault_credentials";
     schema: "nylorun";
     columns: {
         id: import("drizzle-orm/pg-core").PgColumn<{
             name: "id";
-            tableName: "signing_keys";
+            tableName: "vault_credentials";
             dataType: "custom";
             columnType: "PgCustomColumn";
             data: string;
@@ -1510,52 +1474,122 @@ export declare const signingKeys: import("drizzle-orm/pg-core").PgTableWithColum
         }, {}, {
             pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
         }>;
-        state: import("drizzle-orm/pg-core").PgColumn<{
-            name: "state";
-            tableName: "signing_keys";
+        vaultId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "vaultId";
+            tableName: "vault_credentials";
             dataType: "string";
             columnType: "PgText";
-            data: "current" | "previous" | "revoked" | "standby";
+            data: string;
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["standby", "current", "previous", "revoked"];
+            enumValues: [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        alg: import("drizzle-orm/pg-core").PgColumn<{
-            name: "alg";
-            tableName: "signing_keys";
+        name: import("drizzle-orm/pg-core").PgColumn<{
+            name: "name";
+            tableName: "vault_credentials";
             dataType: "string";
             columnType: "PgText";
-            data: "ES256";
+            data: string;
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["ES256"];
+            enumValues: [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        publicJwk: import("drizzle-orm/pg-core").PgColumn<{
-            name: "publicJwk";
-            tableName: "signing_keys";
+        type: import("drizzle-orm/pg-core").PgColumn<{
+            name: "type";
+            tableName: "vault_credentials";
             dataType: "string";
             columnType: "PgText";
-            data: string;
+            data: "bearer" | "environment_secret" | "environment_variable" | "headers" | "model";
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["bearer", "headers", "environment_secret", "environment_variable", "model"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        bindingJson: import("drizzle-orm/pg-core").PgColumn<{
+            name: "bindingJson";
+            tableName: "vault_credentials";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        expiresAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "expiresAt";
+            tableName: "vault_credentials";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "createdAt";
+            tableName: "vault_credentials";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: string;
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+        rotatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "rotatedAt";
+            tableName: "vault_credentials";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
             enumValues: [string, ...string[]];
             baseColumn: never;
             identity: undefined;
@@ -1563,7 +1597,7 @@ export declare const signingKeys: import("drizzle-orm/pg-core").PgTableWithColum
         }, {}, {}>;
         kekId: import("drizzle-orm/pg-core").PgColumn<{
             name: "kekId";
-            tableName: "signing_keys";
+            tableName: "vault_credentials";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -1580,7 +1614,7 @@ export declare const signingKeys: import("drizzle-orm/pg-core").PgTableWithColum
         }, {}, {}>;
         nonce: import("drizzle-orm/pg-core").PgColumn<{
             name: "nonce";
-            tableName: "signing_keys";
+            tableName: "vault_credentials";
             dataType: "custom";
             columnType: "PgCustomColumn";
             data: Uint8Array<ArrayBufferLike>;
@@ -1599,7 +1633,7 @@ export declare const signingKeys: import("drizzle-orm/pg-core").PgTableWithColum
         }>;
         ciphertext: import("drizzle-orm/pg-core").PgColumn<{
             name: "ciphertext";
-            tableName: "signing_keys";
+            tableName: "vault_credentials";
             dataType: "custom";
             columnType: "PgCustomColumn";
             data: Uint8Array<ArrayBufferLike>;
@@ -1618,7 +1652,7 @@ export declare const signingKeys: import("drizzle-orm/pg-core").PgTableWithColum
         }>;
         wrappedDek: import("drizzle-orm/pg-core").PgColumn<{
             name: "wrappedDek";
-            tableName: "signing_keys";
+            tableName: "vault_credentials";
             dataType: "custom";
             columnType: "PgCustomColumn";
             data: Uint8Array<ArrayBufferLike>;
@@ -1635,9 +1669,33 @@ export declare const signingKeys: import("drizzle-orm/pg-core").PgTableWithColum
         }, {}, {
             pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
         }>;
-        createdAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "createdAt";
-            tableName: "signing_keys";
+    };
+    dialect: 'pg';
+}>;
+export declare const vaultAudit: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "vault_audit";
+    schema: "nylorun";
+    columns: {
+        ord: import("drizzle-orm/pg-core").PgColumn<{
+            name: "ord";
+            tableName: "vault_audit";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: "always";
+            generated: undefined;
+        }, {}, {}>;
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "vault_audit";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -1652,14 +1710,14 @@ export declare const signingKeys: import("drizzle-orm/pg-core").PgTableWithColum
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        activatedAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "activatedAt";
-            tableName: "signing_keys";
+        at: import("drizzle-orm/pg-core").PgColumn<{
+            name: "at";
+            tableName: "vault_audit";
             dataType: "string";
             columnType: "PgText";
             data: string;
             driverParam: string;
-            notNull: false;
+            notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -1669,14 +1727,14 @@ export declare const signingKeys: import("drizzle-orm/pg-core").PgTableWithColum
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        retiredAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "retiredAt";
-            tableName: "signing_keys";
+        actor: import("drizzle-orm/pg-core").PgColumn<{
+            name: "actor";
+            tableName: "vault_audit";
             dataType: "string";
             columnType: "PgText";
             data: string;
             driverParam: string;
-            notNull: false;
+            notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -1686,14 +1744,14 @@ export declare const signingKeys: import("drizzle-orm/pg-core").PgTableWithColum
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        revokedAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "revokedAt";
-            tableName: "signing_keys";
+        action: import("drizzle-orm/pg-core").PgColumn<{
+            name: "action";
+            tableName: "vault_audit";
             dataType: "string";
             columnType: "PgText";
             data: string;
             driverParam: string;
-            notNull: false;
+            notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -1703,134 +1761,120 @@ export declare const signingKeys: import("drizzle-orm/pg-core").PgTableWithColum
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-    };
-    dialect: 'pg';
-}>;
-/**
- * The model usage ledger (P1.3): one row per model call a gate served, written after the call.
- * A second row for the same effect (a call the gate ran again after a gateway restart) is
- * flagged `duplicate`; both were billed. Budgets read their spend from it. Token counts are 0
- * when the provider sent none.
- */
-export declare const modelUsage: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "model_usage";
-    schema: "nylorun";
-    columns: {
-        id: import("drizzle-orm/pg-core").PgColumn<{
-            name: "id";
-            tableName: "model_usage";
-            dataType: "custom";
-            columnType: "PgCustomColumn";
+        vaultId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "vaultId";
+            tableName: "vault_audit";
+            dataType: "string";
+            columnType: "PgText";
             data: string;
             driverParam: string;
-            notNull: true;
+            notNull: false;
             hasDefault: false;
-            isPrimaryKey: true;
+            isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: undefined;
+            enumValues: [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {
-            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
-        }>;
-        effectKey: import("drizzle-orm/pg-core").PgColumn<{
-            name: "effectKey";
-            tableName: "model_usage";
-            dataType: "custom";
-            columnType: "PgCustomColumn";
+        }, {}, {}>;
+        credentialId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "credentialId";
+            tableName: "vault_audit";
+            dataType: "string";
+            columnType: "PgText";
             data: string;
             driverParam: string;
-            notNull: true;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: undefined;
+            enumValues: [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {
-            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
-        }>;
-        tokensReported: import("drizzle-orm/pg-core").PgColumn<{
-            name: "tokensReported";
-            tableName: "model_usage";
-            dataType: "boolean";
-            columnType: "PgBoolean";
-            data: boolean;
-            driverParam: boolean;
+        }, {}, {}>;
+        sessionId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "sessionId";
+            tableName: "vault_audit";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
             notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: undefined;
+            enumValues: [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        costKnown: import("drizzle-orm/pg-core").PgColumn<{
-            name: "costKnown";
-            tableName: "model_usage";
-            dataType: "boolean";
-            columnType: "PgBoolean";
-            data: boolean;
-            driverParam: boolean;
+        target: import("drizzle-orm/pg-core").PgColumn<{
+            name: "target";
+            tableName: "vault_audit";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
             notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: undefined;
+            enumValues: [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        txid: import("drizzle-orm/pg-core").PgColumn<{
-            name: "txid";
-            tableName: "model_usage";
-            dataType: "custom";
-            columnType: "PgCustomColumn";
+        outcome: import("drizzle-orm/pg-core").PgColumn<{
+            name: "outcome";
+            tableName: "vault_audit";
+            dataType: "string";
+            columnType: "PgText";
             data: string;
-            driverParam: unknown;
+            driverParam: string;
             notNull: true;
-            hasDefault: true;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: undefined;
+            enumValues: [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {
-            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
-        }>;
-        sessionId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "sessionId";
-            tableName: "model_usage";
-            dataType: "custom";
-            columnType: "PgCustomColumn";
+        }, {}, {}>;
+    };
+    dialect: 'pg';
+}>;
+export declare const vaultIdempotency: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "vault_idempotency";
+    schema: "nylorun";
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "vault_idempotency";
+            dataType: "string";
+            columnType: "PgText";
             data: string;
             driverParam: string;
             notNull: true;
             hasDefault: false;
-            isPrimaryKey: false;
+            isPrimaryKey: true;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: undefined;
+            enumValues: [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {
-            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
-        }>;
-        turnId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "turnId";
-            tableName: "model_usage";
-            dataType: "custom";
-            columnType: "PgCustomColumn";
+        }, {}, {}>;
+        bodyHash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "bodyHash";
+            tableName: "vault_idempotency";
+            dataType: "string";
+            columnType: "PgText";
             data: string;
             driverParam: string;
             notNull: true;
@@ -1838,18 +1882,16 @@ export declare const modelUsage: import("drizzle-orm/pg-core").PgTableWithColumn
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: undefined;
+            enumValues: [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {
-            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
-        }>;
-        agentId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "agentId";
-            tableName: "model_usage";
-            dataType: "custom";
-            columnType: "PgCustomColumn";
+        }, {}, {}>;
+        response: import("drizzle-orm/pg-core").PgColumn<{
+            name: "response";
+            tableName: "vault_idempotency";
+            dataType: "string";
+            columnType: "PgText";
             data: string;
             driverParam: string;
             notNull: true;
@@ -1857,23 +1899,28 @@ export declare const modelUsage: import("drizzle-orm/pg-core").PgTableWithColumn
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: undefined;
+            enumValues: [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {
-            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
-        }>;
-        provider: import("drizzle-orm/pg-core").PgColumn<{
-            name: "provider";
-            tableName: "model_usage";
+        }, {}, {}>;
+    };
+    dialect: 'pg';
+}>;
+export declare const tenantSettings: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "tenant_settings";
+    schema: "nylorun";
+    columns: {
+        key: import("drizzle-orm/pg-core").PgColumn<{
+            name: "key";
+            tableName: "tenant_settings";
             dataType: "string";
             columnType: "PgText";
             data: string;
             driverParam: string;
-            notNull: false;
+            notNull: true;
             hasDefault: false;
-            isPrimaryKey: false;
+            isPrimaryKey: true;
             isAutoincrement: false;
             hasRuntimeDefault: false;
             enumValues: [string, ...string[]];
@@ -1881,14 +1928,14 @@ export declare const modelUsage: import("drizzle-orm/pg-core").PgTableWithColumn
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        model: import("drizzle-orm/pg-core").PgColumn<{
-            name: "model";
-            tableName: "model_usage";
+        value: import("drizzle-orm/pg-core").PgColumn<{
+            name: "value";
+            tableName: "tenant_settings";
             dataType: "string";
             columnType: "PgText";
             data: string;
             driverParam: string;
-            notNull: false;
+            notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -1898,98 +1945,111 @@ export declare const modelUsage: import("drizzle-orm/pg-core").PgTableWithColumn
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        inputTokens: import("drizzle-orm/pg-core").PgColumn<{
-            name: "inputTokens";
-            tableName: "model_usage";
-            dataType: "number";
-            columnType: "PgInteger";
-            data: number;
-            driverParam: string | number;
+    };
+    dialect: 'pg';
+}>;
+/**
+ * The Tenant's signing keys (capability links, run and host tokens): the
+ * private half sealed, the public JWK not.
+ */
+export declare const signingKeys: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "signing_keys";
+    schema: "nylorun";
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "signing_keys";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: string;
+            driverParam: string;
             notNull: true;
             hasDefault: false;
-            isPrimaryKey: false;
+            isPrimaryKey: true;
             isAutoincrement: false;
             hasRuntimeDefault: false;
             enumValues: undefined;
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {}>;
-        outputTokens: import("drizzle-orm/pg-core").PgColumn<{
-            name: "outputTokens";
-            tableName: "model_usage";
-            dataType: "number";
-            columnType: "PgInteger";
-            data: number;
-            driverParam: string | number;
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+        state: import("drizzle-orm/pg-core").PgColumn<{
+            name: "state";
+            tableName: "signing_keys";
+            dataType: "string";
+            columnType: "PgText";
+            data: "current" | "previous" | "revoked" | "standby";
+            driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: undefined;
+            enumValues: ["standby", "current", "previous", "revoked"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        totalTokens: import("drizzle-orm/pg-core").PgColumn<{
-            name: "totalTokens";
-            tableName: "model_usage";
-            dataType: "number";
-            columnType: "PgInteger";
-            data: number;
-            driverParam: string | number;
+        alg: import("drizzle-orm/pg-core").PgColumn<{
+            name: "alg";
+            tableName: "signing_keys";
+            dataType: "string";
+            columnType: "PgText";
+            data: "ES256";
+            driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: undefined;
+            enumValues: ["ES256"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        cachedTokens: import("drizzle-orm/pg-core").PgColumn<{
-            name: "cachedTokens";
-            tableName: "model_usage";
-            dataType: "number";
-            columnType: "PgInteger";
-            data: number;
-            driverParam: string | number;
+        publicJwk: import("drizzle-orm/pg-core").PgColumn<{
+            name: "publicJwk";
+            tableName: "signing_keys";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: undefined;
+            enumValues: [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        cacheWriteTokens: import("drizzle-orm/pg-core").PgColumn<{
-            name: "cacheWriteTokens";
-            tableName: "model_usage";
-            dataType: "number";
-            columnType: "PgInteger";
-            data: number;
-            driverParam: string | number;
+        kekId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "kekId";
+            tableName: "signing_keys";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: undefined;
+            enumValues: [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        reasoningTokens: import("drizzle-orm/pg-core").PgColumn<{
-            name: "reasoningTokens";
-            tableName: "model_usage";
-            dataType: "number";
-            columnType: "PgInteger";
-            data: number;
-            driverParam: string | number;
+        nonce: import("drizzle-orm/pg-core").PgColumn<{
+            name: "nonce";
+            tableName: "signing_keys";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: Uint8Array<ArrayBufferLike>;
+            driverParam: Buffer<ArrayBufferLike>;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
@@ -1999,14 +2059,16 @@ export declare const modelUsage: import("drizzle-orm/pg-core").PgTableWithColumn
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {}>;
-        costUsd: import("drizzle-orm/pg-core").PgColumn<{
-            name: "costUsd";
-            tableName: "model_usage";
-            dataType: "number";
-            columnType: "PgDoublePrecision";
-            data: number;
-            driverParam: string | number;
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+        ciphertext: import("drizzle-orm/pg-core").PgColumn<{
+            name: "ciphertext";
+            tableName: "signing_keys";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: Uint8Array<ArrayBufferLike>;
+            driverParam: Buffer<ArrayBufferLike>;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
@@ -2016,14 +2078,16 @@ export declare const modelUsage: import("drizzle-orm/pg-core").PgTableWithColumn
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {}>;
-        duplicate: import("drizzle-orm/pg-core").PgColumn<{
-            name: "duplicate";
-            tableName: "model_usage";
-            dataType: "boolean";
-            columnType: "PgBoolean";
-            data: boolean;
-            driverParam: boolean;
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+        wrappedDek: import("drizzle-orm/pg-core").PgColumn<{
+            name: "wrappedDek";
+            tableName: "signing_keys";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: Uint8Array<ArrayBufferLike>;
+            driverParam: Buffer<ArrayBufferLike>;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
@@ -2033,10 +2097,12 @@ export declare const modelUsage: import("drizzle-orm/pg-core").PgTableWithColumn
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {}>;
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
         createdAt: import("drizzle-orm/pg-core").PgColumn<{
             name: "createdAt";
-            tableName: "model_usage";
+            tableName: "signing_keys";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -2051,113 +2117,48 @@ export declare const modelUsage: import("drizzle-orm/pg-core").PgTableWithColumn
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-    };
-    dialect: 'pg';
-}>;
-/**
- * Model budgets (P1.3): hard caps the model gate checks before each call, at least one limit
- * set. One row per scope: `turn` and `tenant` use `*`, `agent` the agent id. `period` is the
- * UTC `day` or `month` the spend is counted over, or null for `turn`.
- */
-export declare const modelBudgets: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "model_budgets";
-    schema: "nylorun";
-    columns: {
-        scope: import("drizzle-orm/pg-core").PgColumn<{
-            name: "scope";
-            tableName: "model_budgets";
-            dataType: "string";
-            columnType: "PgText";
-            data: "agent" | "tenant" | "turn";
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: ["tenant", "agent", "turn"];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        scopeId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "scopeId";
-            tableName: "model_budgets";
-            dataType: "custom";
-            columnType: "PgCustomColumn";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {
-            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
-        }>;
-        period: import("drizzle-orm/pg-core").PgColumn<{
-            name: "period";
-            tableName: "model_budgets";
+        activatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "activatedAt";
+            tableName: "signing_keys";
             dataType: "string";
             columnType: "PgText";
-            data: "day" | "month";
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: ["day", "month"];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        limitUsd: import("drizzle-orm/pg-core").PgColumn<{
-            name: "limitUsd";
-            tableName: "model_budgets";
-            dataType: "number";
-            columnType: "PgDoublePrecision";
-            data: number;
-            driverParam: string | number;
+            data: string;
+            driverParam: string;
             notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: undefined;
+            enumValues: [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        limitTokens: import("drizzle-orm/pg-core").PgColumn<{
-            name: "limitTokens";
-            tableName: "model_budgets";
-            dataType: "number";
-            columnType: "PgBigInt53";
-            data: number;
-            driverParam: string | number;
+        retiredAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "retiredAt";
+            tableName: "signing_keys";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
             notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: undefined;
+            enumValues: [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "updatedAt";
-            tableName: "model_budgets";
+        revokedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "revokedAt";
+            tableName: "signing_keys";
             dataType: "string";
             columnType: "PgText";
             data: string;
             driverParam: string;
-            notNull: true;
+            notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -2171,19 +2172,20 @@ export declare const modelBudgets: import("drizzle-orm/pg-core").PgTableWithColu
     dialect: 'pg';
 }>;
 /**
- * The Tool Gate's keyed MCP calls (F4.1 G3): one row per call, written by the gates service
- * before it calls the server and given the answer after. A re-send whose row has an answer
- * gets it; one whose row has none, and that the gateway no longer runs, was lost with an
- * earlier gateway and answers `uncertain`, so a call is never run twice. Rows are deleted a
- * day after they settle.
+ * The model usage ledger (P1.3): one row per model call a gate served, written after the call.
+ * A second row for the same effect (a call the gate ran again after a gateway restart) is
+ * flagged `duplicate`; both were billed. Budgets read their spend from it. Token counts are 0
+ * when the provider sent none. `startedAt`, `endedAt` and `firstTokenMs` are the gate's own
+ * timing of the call (R7.1, migration 0022); null on rows written before, and `firstTokenMs`
+ * when the provider streamed nothing.
  */
-export declare const toolCrossings: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "tool_crossings";
+export declare const modelUsage: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "model_usage";
     schema: "nylorun";
     columns: {
-        key: import("drizzle-orm/pg-core").PgColumn<{
-            name: "key";
-            tableName: "tool_crossings";
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "model_usage";
             dataType: "custom";
             columnType: "PgCustomColumn";
             data: string;
@@ -2200,11 +2202,11 @@ export declare const toolCrossings: import("drizzle-orm/pg-core").PgTableWithCol
         }, {}, {
             pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
         }>;
-        hash: import("drizzle-orm/pg-core").PgColumn<{
-            name: "hash";
-            tableName: "tool_crossings";
-            dataType: "string";
-            columnType: "PgText";
+        effectKey: import("drizzle-orm/pg-core").PgColumn<{
+            name: "effectKey";
+            tableName: "model_usage";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
             data: string;
             driverParam: string;
             notNull: true;
@@ -2212,20 +2214,56 @@ export declare const toolCrossings: import("drizzle-orm/pg-core").PgTableWithCol
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+        tokensReported: import("drizzle-orm/pg-core").PgColumn<{
+            name: "tokensReported";
+            tableName: "model_usage";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        startedAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "startedAt";
-            tableName: "tool_crossings";
+        costKnown: import("drizzle-orm/pg-core").PgColumn<{
+            name: "costKnown";
+            tableName: "model_usage";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        txid: import("drizzle-orm/pg-core").PgColumn<{
+            name: "txid";
+            tableName: "model_usage";
             dataType: "custom";
             columnType: "PgCustomColumn";
             data: string;
-            driverParam: string;
+            driverParam: unknown;
             notNull: true;
-            hasDefault: false;
+            hasDefault: true;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -2236,14 +2274,14 @@ export declare const toolCrossings: import("drizzle-orm/pg-core").PgTableWithCol
         }, {}, {
             pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
         }>;
-        settledAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "settledAt";
-            tableName: "tool_crossings";
+        sessionId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "sessionId";
+            tableName: "model_usage";
             dataType: "custom";
             columnType: "PgCustomColumn";
             data: string;
             driverParam: string;
-            notNull: false;
+            notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -2255,14 +2293,14 @@ export declare const toolCrossings: import("drizzle-orm/pg-core").PgTableWithCol
         }, {}, {
             pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
         }>;
-        answer: import("drizzle-orm/pg-core").PgColumn<{
-            name: "answer";
-            tableName: "tool_crossings";
+        turnId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "turnId";
+            tableName: "model_usage";
             dataType: "custom";
             columnType: "PgCustomColumn";
-            data: unknown;
-            driverParam: unknown;
-            notNull: false;
+            data: string;
+            driverParam: string;
+            notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -2274,29 +2312,16 @@ export declare const toolCrossings: import("drizzle-orm/pg-core").PgTableWithCol
         }, {}, {
             pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
         }>;
-    };
-    dialect: 'pg';
-}>;
-/**
- * A sandbox resource (blueprint D39, F7.1): its id, kind, the spec resolved against the
- * Tenant's limits when it was created, and the developer's labels. Sessions attach to it by id
- * (the session body's `sandboxId`). Not the `sandboxes` document table, which holds the virtual
- * backend's compute records, keyed by workspace key.
- */
-export declare const sandboxResources: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "sandbox_resources";
-    schema: "nylorun";
-    columns: {
-        id: import("drizzle-orm/pg-core").PgColumn<{
-            name: "id";
-            tableName: "sandbox_resources";
+        agentId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "agentId";
+            tableName: "model_usage";
             dataType: "custom";
             columnType: "PgCustomColumn";
             data: string;
             driverParam: string;
             notNull: true;
             hasDefault: false;
-            isPrimaryKey: true;
+            isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
             enumValues: undefined;
@@ -2306,30 +2331,64 @@ export declare const sandboxResources: import("drizzle-orm/pg-core").PgTableWith
         }, {}, {
             pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
         }>;
-        kind: import("drizzle-orm/pg-core").PgColumn<{
-            name: "kind";
-            tableName: "sandbox_resources";
+        provider: import("drizzle-orm/pg-core").PgColumn<{
+            name: "provider";
+            tableName: "model_usage";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        model: import("drizzle-orm/pg-core").PgColumn<{
+            name: "model";
+            tableName: "model_usage";
             dataType: "string";
             columnType: "PgText";
-            data: "pod" | "virtual";
+            data: string;
             driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        inputTokens: import("drizzle-orm/pg-core").PgColumn<{
+            name: "inputTokens";
+            tableName: "model_usage";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["virtual", "pod"];
+            enumValues: undefined;
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        spec: import("drizzle-orm/pg-core").PgColumn<{
-            name: "spec";
-            tableName: "sandbox_resources";
-            dataType: "custom";
-            columnType: "PgCustomColumn";
-            data: unknown;
-            driverParam: unknown;
+        outputTokens: import("drizzle-orm/pg-core").PgColumn<{
+            name: "outputTokens";
+            tableName: "model_usage";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
@@ -2339,16 +2398,14 @@ export declare const sandboxResources: import("drizzle-orm/pg-core").PgTableWith
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {
-            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
-        }>;
-        labels: import("drizzle-orm/pg-core").PgColumn<{
-            name: "labels";
-            tableName: "sandbox_resources";
-            dataType: "custom";
-            columnType: "PgCustomColumn";
-            data: unknown;
-            driverParam: unknown;
+        }, {}, {}>;
+        totalTokens: import("drizzle-orm/pg-core").PgColumn<{
+            name: "totalTokens";
+            tableName: "model_usage";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
@@ -2358,16 +2415,14 @@ export declare const sandboxResources: import("drizzle-orm/pg-core").PgTableWith
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {
-            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
-        }>;
-        createdAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "createdAt";
-            tableName: "sandbox_resources";
-            dataType: "custom";
-            columnType: "PgCustomColumn";
-            data: string;
-            driverParam: string;
+        }, {}, {}>;
+        cachedTokens: import("drizzle-orm/pg-core").PgColumn<{
+            name: "cachedTokens";
+            tableName: "model_usage";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
@@ -2377,16 +2432,14 @@ export declare const sandboxResources: import("drizzle-orm/pg-core").PgTableWith
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {
-            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
-        }>;
-        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "updatedAt";
-            tableName: "sandbox_resources";
-            dataType: "custom";
-            columnType: "PgCustomColumn";
-            data: string;
-            driverParam: string;
+        }, {}, {}>;
+        cacheWriteTokens: import("drizzle-orm/pg-core").PgColumn<{
+            name: "cacheWriteTokens";
+            tableName: "model_usage";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
@@ -2396,17 +2449,15 @@ export declare const sandboxResources: import("drizzle-orm/pg-core").PgTableWith
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {
-            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
-        }>;
-        k8sName: import("drizzle-orm/pg-core").PgColumn<{
-            name: "k8sName";
-            tableName: "sandbox_resources";
-            dataType: "custom";
-            columnType: "PgCustomColumn";
-            data: string;
-            driverParam: string;
-            notNull: false;
+        }, {}, {}>;
+        reasoningTokens: import("drizzle-orm/pg-core").PgColumn<{
+            name: "reasoningTokens";
+            tableName: "model_usage";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -2415,18 +2466,16 @@ export declare const sandboxResources: import("drizzle-orm/pg-core").PgTableWith
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {
-            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
-        }>;
-        volumeGen: import("drizzle-orm/pg-core").PgColumn<{
-            name: "volumeGen";
-            tableName: "sandbox_resources";
+        }, {}, {}>;
+        costUsd: import("drizzle-orm/pg-core").PgColumn<{
+            name: "costUsd";
+            tableName: "model_usage";
             dataType: "number";
-            columnType: "PgInteger";
+            columnType: "PgDoublePrecision";
             data: number;
             driverParam: string | number;
             notNull: true;
-            hasDefault: true;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -2435,43 +2484,60 @@ export declare const sandboxResources: import("drizzle-orm/pg-core").PgTableWith
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        desired: import("drizzle-orm/pg-core").PgColumn<{
-            name: "desired";
-            tableName: "sandbox_resources";
+        duplicate: import("drizzle-orm/pg-core").PgColumn<{
+            name: "duplicate";
+            tableName: "model_usage";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "createdAt";
+            tableName: "model_usage";
             dataType: "string";
             columnType: "PgText";
-            data: "deleted" | "running" | "suspended";
+            data: string;
             driverParam: string;
-            notNull: false;
+            notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["running", "suspended", "deleted"];
+            enumValues: [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        observed: import("drizzle-orm/pg-core").PgColumn<{
-            name: "observed";
-            tableName: "sandbox_resources";
+        startedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "startedAt";
+            tableName: "model_usage";
             dataType: "string";
             columnType: "PgText";
-            data: "creating" | "deleting" | "expired" | "failed" | "lost" | "running" | "suspended";
+            data: string;
             driverParam: string;
             notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["creating", "running", "suspended", "expired", "lost", "failed", "deleting"];
+            enumValues: [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        podUid: import("drizzle-orm/pg-core").PgColumn<{
-            name: "podUid";
-            tableName: "sandbox_resources";
+        endedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "endedAt";
+            tableName: "model_usage";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -2486,15 +2552,15 @@ export declare const sandboxResources: import("drizzle-orm/pg-core").PgTableWith
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        hostEpoch: import("drizzle-orm/pg-core").PgColumn<{
-            name: "hostEpoch";
-            tableName: "sandbox_resources";
+        firstTokenMs: import("drizzle-orm/pg-core").PgColumn<{
+            name: "firstTokenMs";
+            tableName: "model_usage";
             dataType: "number";
             columnType: "PgInteger";
             data: number;
             driverParam: string | number;
-            notNull: true;
-            hasDefault: true;
+            notNull: false;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -2503,32 +2569,44 @@ export declare const sandboxResources: import("drizzle-orm/pg-core").PgTableWith
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        joinTokenHash: import("drizzle-orm/pg-core").PgColumn<{
-            name: "joinTokenHash";
-            tableName: "sandbox_resources";
+    };
+    dialect: 'pg';
+}>;
+/**
+ * Model budgets (P1.3): hard caps the model gate checks before each call, at least one limit
+ * set. One row per scope: `turn` and `tenant` use `*`, `agent` the agent id. `period` is the
+ * UTC `day` or `month` the spend is counted over, or null for `turn`.
+ */
+export declare const modelBudgets: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "model_budgets";
+    schema: "nylorun";
+    columns: {
+        scope: import("drizzle-orm/pg-core").PgColumn<{
+            name: "scope";
+            tableName: "model_budgets";
             dataType: "string";
             columnType: "PgText";
-            data: string;
+            data: "agent" | "tenant" | "turn";
             driverParam: string;
-            notNull: false;
+            notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
+            enumValues: ["tenant", "agent", "turn"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        rev: import("drizzle-orm/pg-core").PgColumn<{
-            name: "rev";
-            tableName: "sandbox_resources";
-            dataType: "number";
-            columnType: "PgInteger";
-            data: number;
-            driverParam: string | number;
+        scopeId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "scopeId";
+            tableName: "model_budgets";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: string;
+            driverParam: string;
             notNull: true;
-            hasDefault: true;
+            hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
@@ -2536,31 +2614,33 @@ export declare const sandboxResources: import("drizzle-orm/pg-core").PgTableWith
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, {}, {}>;
-        lastActiveAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "lastActiveAt";
-            tableName: "sandbox_resources";
-            dataType: "date";
-            columnType: "PgTimestamp";
-            data: Date;
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+        period: import("drizzle-orm/pg-core").PgColumn<{
+            name: "period";
+            tableName: "model_budgets";
+            dataType: "string";
+            columnType: "PgText";
+            data: "day" | "month";
             driverParam: string;
             notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: undefined;
+            enumValues: ["day", "month"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        expiresAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "expiresAt";
-            tableName: "sandbox_resources";
-            dataType: "date";
-            columnType: "PgTimestamp";
-            data: Date;
-            driverParam: string;
+        limitUsd: import("drizzle-orm/pg-core").PgColumn<{
+            name: "limitUsd";
+            tableName: "model_budgets";
+            dataType: "number";
+            columnType: "PgDoublePrecision";
+            data: number;
+            driverParam: string | number;
             notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
@@ -2571,13 +2651,13 @@ export declare const sandboxResources: import("drizzle-orm/pg-core").PgTableWith
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        startedAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "startedAt";
-            tableName: "sandbox_resources";
-            dataType: "date";
-            columnType: "PgTimestamp";
-            data: Date;
-            driverParam: string;
+        limitTokens: import("drizzle-orm/pg-core").PgColumn<{
+            name: "limitTokens";
+            tableName: "model_budgets";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
             notNull: false;
             hasDefault: false;
             isPrimaryKey: false;
@@ -2588,14 +2668,14 @@ export declare const sandboxResources: import("drizzle-orm/pg-core").PgTableWith
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        reason: import("drizzle-orm/pg-core").PgColumn<{
-            name: "reason";
-            tableName: "sandbox_resources";
+        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updatedAt";
+            tableName: "model_budgets";
             dataType: "string";
             columnType: "PgText";
             data: string;
             driverParam: string;
-            notNull: false;
+            notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -2605,16 +2685,30 @@ export declare const sandboxResources: import("drizzle-orm/pg-core").PgTableWith
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        retiring: import("drizzle-orm/pg-core").PgColumn<{
-            name: "retiring";
-            tableName: "sandbox_resources";
+    };
+    dialect: 'pg';
+}>;
+/**
+ * The Tool Gate's keyed MCP calls (F4.1 G3): one row per call, written by the gates service
+ * before it calls the server and given the answer after. A re-send whose row has an answer
+ * gets it; one whose row has none, and that the gateway no longer runs, was lost with an
+ * earlier gateway and answers `uncertain`, so a call is never run twice. Rows are deleted a
+ * day after they settle.
+ */
+export declare const toolCrossings: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "tool_crossings";
+    schema: "nylorun";
+    columns: {
+        key: import("drizzle-orm/pg-core").PgColumn<{
+            name: "key";
+            tableName: "tool_crossings";
             dataType: "custom";
             columnType: "PgCustomColumn";
             data: string;
             driverParam: string;
-            notNull: false;
+            notNull: true;
             hasDefault: false;
-            isPrimaryKey: false;
+            isPrimaryKey: true;
             isAutoincrement: false;
             hasRuntimeDefault: false;
             enumValues: undefined;
@@ -2624,14 +2718,14 @@ export declare const sandboxResources: import("drizzle-orm/pg-core").PgTableWith
         }, {}, {
             pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
         }>;
-        volumeId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "volumeId";
-            tableName: "sandbox_resources";
+        hash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "hash";
+            tableName: "tool_crossings";
             dataType: "string";
             columnType: "PgText";
             data: string;
             driverParam: string;
-            notNull: false;
+            notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
@@ -2641,6 +2735,63 @@ export declare const sandboxResources: import("drizzle-orm/pg-core").PgTableWith
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        startedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "startedAt";
+            tableName: "tool_crossings";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+        settledAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "settledAt";
+            tableName: "tool_crossings";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
+        answer: import("drizzle-orm/pg-core").PgColumn<{
+            name: "answer";
+            tableName: "tool_crossings";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: unknown;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
     };
     dialect: 'pg';
 }>;
@@ -2813,6 +2964,25 @@ export declare const artifacts: import("drizzle-orm/pg-core").PgTableWithColumns
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        environmentId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "environmentId";
+            tableName: "artifacts";
+            dataType: "custom";
+            columnType: "PgCustomColumn";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            pgColumnBuilderBrand: 'PgCustomColumnBuilderBrand';
+        }>;
     };
     dialect: 'pg';
 }>;
@@ -2930,14 +3100,14 @@ export declare const artifactVersions: import("drizzle-orm/pg-core").PgTableWith
             tableName: "artifact_versions";
             dataType: "string";
             columnType: "PgText";
-            data: "engine" | "export" | "upload";
+            data: "engine" | "export" | "snapshot" | "upload";
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["upload", "engine", "export"];
+            enumValues: ["upload", "engine", "export", "snapshot"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
@@ -3705,16 +3875,16 @@ export declare const sandboxSignals: import("drizzle-orm/pg-core").PgTableWithCo
     dialect: 'pg';
 }>;
 /**
- * Each sandbox's lifecycle stream (`nylorun.sandbox-event/1`), numbered from 0 per sandbox id.
- * Written only by the record module; not published to the stream relay.
+ * Each Environment's lifecycle stream (`nylorun.environment-event/1`), numbered from 0 per
+ * Environment id. Written only by the record module; not published to the stream relay.
  */
-export declare const sandboxEvents: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "sandbox_events";
+export declare const environmentEvents: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "environment_events";
     schema: "nylorun_streams";
     columns: {
-        sandboxId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "sandboxId";
-            tableName: "sandbox_events";
+        environmentId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "environmentId";
+            tableName: "environment_events";
             dataType: "custom";
             columnType: "PgCustomColumn";
             data: string;
@@ -3733,7 +3903,7 @@ export declare const sandboxEvents: import("drizzle-orm/pg-core").PgTableWithCol
         }>;
         seq: import("drizzle-orm/pg-core").PgColumn<{
             name: "seq";
-            tableName: "sandbox_events";
+            tableName: "environment_events";
             dataType: "number";
             columnType: "PgBigInt53";
             data: number;
@@ -3750,7 +3920,7 @@ export declare const sandboxEvents: import("drizzle-orm/pg-core").PgTableWithCol
         }, {}, {}>;
         type: import("drizzle-orm/pg-core").PgColumn<{
             name: "type";
-            tableName: "sandbox_events";
+            tableName: "environment_events";
             dataType: "string";
             columnType: "PgText";
             data: string;
@@ -3767,7 +3937,7 @@ export declare const sandboxEvents: import("drizzle-orm/pg-core").PgTableWithCol
         }, {}, {}>;
         body: import("drizzle-orm/pg-core").PgColumn<{
             name: "body";
-            tableName: "sandbox_events";
+            tableName: "environment_events";
             dataType: "custom";
             columnType: "PgCustomColumn";
             data: unknown;
@@ -3786,7 +3956,7 @@ export declare const sandboxEvents: import("drizzle-orm/pg-core").PgTableWithCol
         }>;
         committedAt: import("drizzle-orm/pg-core").PgColumn<{
             name: "committedAt";
-            tableName: "sandbox_events";
+            tableName: "environment_events";
             dataType: "string";
             columnType: "PgTimestampString";
             data: string;
@@ -4034,11 +4204,14 @@ export type SigningKeyRow = typeof signingKeys.$inferSelect;
 export type ModelUsageRow = typeof modelUsage.$inferSelect;
 export type ModelBudgetRow = typeof modelBudgets.$inferSelect;
 export type ToolCrossingRow = typeof toolCrossings.$inferSelect;
-export type SandboxResourceRow = typeof sandboxResources.$inferSelect;
+export type EnvironmentRowColumns = typeof environments.$inferSelect;
 export type ArtifactRow = typeof artifacts.$inferSelect;
 export type ArtifactVersionRow = typeof artifactVersions.$inferSelect;
 export type DefinitionFileRow = typeof definitionFiles.$inferSelect;
-export type ModelUsageWrite = Omit<ModelUsageRow, "duplicate" | "txid" | "tokensReported" | "costKnown"> & {
+export type ModelUsageWrite = Omit<ModelUsageRow, "duplicate" | "txid" | "tokensReported" | "costKnown" | "startedAt" | "endedAt" | "firstTokenMs"> & {
     tokensReported?: boolean | null;
     costKnown?: boolean | null;
+    startedAt?: string | null;
+    endedAt?: string | null;
+    firstTokenMs?: number | null;
 };