/** * Global-scope `cleo.db` — **LLM credential pool** (`accounts`, 1 table). * * EP-PROVIDER-VAULT (epic T10410 · task T11709 · saga SG-VAULT-CORE T10409). This * table is the queryable, `cleo health`-visible home for the **pooled LLM provider * credentials** that today live as a plaintext JSON blob with no schema, no index, * and no health surface. Each row is one credential ("account") for one provider — * an API key or OAuth token pair — plus the rotation / cooldown / health metadata * the pool runner uses to pick the next live account and to retire dead ones. * * ## NOT `agent_registry_accounts` (do not confuse the two) * * The consolidated global `cleo.db` ALSO carries `agent_registry_accounts` — the * better-auth OAuth-account table from the agent-identity tier (the cloud-sync * `accounts` source, renamed under T11622). That table is a SaaS account record; * THIS table (`accounts`, bare) is the local machine-wide LLM-credential pool. The * two never overlap: the physical names differ (`accounts` vs * `agent_registry_accounts`) and the JS exports differ (`accounts` here vs * `agentRegistryAccounts`). The bare name `accounts` is the credential pool. * * ## Encrypted at rest (global KDF — T11710) * * `secretEnc` / `refreshEnc` are ciphertext, NEVER plaintext. They are produced by * `encryptGlobal()` (packages/core/src/crypto/credentials.ts, T11710) — the * project-INDEPENDENT KDF `HMAC-SHA256(machine-key || globalSalt, id)` reusing the * machine-local `getGlobalSalt()` (store/global-salt.ts). The ciphertext keeps the * versioned `0x01 + 12B IV + 16B authTag` framing. Global (not project-bound) * encryption is required because an LLM credential must decrypt consistently for * the same machine regardless of which project's cwd the pool is read from. * * ## Active-account pointer (`isActive`) * * `isActive` is the per-provider "currently-selected" pointer: AT MOST ONE row per * `provider` may carry `isActive = 1`. drizzle-orm cannot model a partial-`WHERE` * unique index, so the one-active-per-provider invariant is enforced by a raw-SQL * **partial unique index** `ux_accounts_active_provider ON accounts (provider) * WHERE is_active = 1` emitted in the forward migration (the established repo * pattern — cf. `_writer_leases.active`, T11627). This module declares only the * full-column table plus the non-partial `(provider, label)` unique index, which * drizzle CAN emit. * * @task T11709 * @epic T10410 * @saga T10409 * @see ../../../crypto/credentials.ts — `encryptGlobal` / `decryptGlobal` (T11710) * @see ../../global-salt.ts — `getGlobalSalt` (the reused machine-local salt) * @see ./agent-registry.ts — `agentRegistryAccounts` (the UNRELATED OAuth-account table) * @see ../../../../migrations/drizzle-cleo-global — the forward migration (raw partial index) */ /** * Legal `accounts.status` values — the health lifecycle of a pooled credential. * * - `ok` — usable; the pool may select it. * - `exhausted` — rate-limited / quota-hit; usable again after `cooldownResetAt`. * - `dead` — permanently unusable (revoked key, hard auth failure); never selected. * * @task T11709 */ export declare const ACCOUNT_STATUSES: readonly ["ok", "exhausted", "dead"]; /** TypeScript union derived from {@link ACCOUNT_STATUSES}. */ export type AccountStatus = (typeof ACCOUNT_STATUSES)[number]; /** * `accounts` — the machine-wide pooled-LLM-credential table. * * One row per credential ("account") for one provider. Carries the encrypted * secret/refresh material plus the rotation, cooldown, and health metadata the * pool runner consults to choose the next live account (highest `priority` among * `status = 'ok'`) and to retire dead ones. The `(provider, label)` pair is unique; * `isActive` is the per-provider active pointer (one active row per provider, * enforced by the raw-SQL partial unique index in the migration). * * @task T11709 */ export declare const accounts: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{ name: "accounts"; schema: undefined; columns: { id: import("drizzle-orm/sqlite-core").SQLiteColumn<{ name: string; tableName: "accounts"; dataType: "number int53"; data: number; driverParam: number; notNull: true; hasDefault: true; isPrimaryKey: true; isAutoincrement: false; hasRuntimeDefault: false; enumValues: undefined; baseColumn: never; identity: undefined; generated: undefined; }, {}>; provider: import("drizzle-orm/sqlite-core").SQLiteColumn<{ name: string; tableName: "accounts"; dataType: "string"; data: string; driverParam: string; notNull: true; hasDefault: false; isPrimaryKey: false; isAutoincrement: false; hasRuntimeDefault: false; enumValues: [string, ...string[]]; baseColumn: never; identity: undefined; generated: undefined; }, {}>; label: import("drizzle-orm/sqlite-core").SQLiteColumn<{ name: string; tableName: "accounts"; dataType: "string"; data: string; driverParam: string; notNull: true; hasDefault: false; isPrimaryKey: false; isAutoincrement: false; hasRuntimeDefault: false; enumValues: [string, ...string[]]; baseColumn: never; identity: undefined; generated: undefined; }, {}>; authType: import("drizzle-orm/sqlite-core").SQLiteColumn<{ name: string; tableName: "accounts"; dataType: "string"; data: string; driverParam: string; notNull: true; hasDefault: false; isPrimaryKey: false; isAutoincrement: false; hasRuntimeDefault: false; enumValues: [string, ...string[]]; baseColumn: never; identity: undefined; generated: undefined; }, {}>; secretEnc: import("drizzle-orm/sqlite-core").SQLiteColumn<{ name: string; tableName: "accounts"; dataType: "string"; data: string; driverParam: string; notNull: false; hasDefault: false; isPrimaryKey: false; isAutoincrement: false; hasRuntimeDefault: false; enumValues: [string, ...string[]]; baseColumn: never; identity: undefined; generated: undefined; }, {}>; refreshEnc: import("drizzle-orm/sqlite-core").SQLiteColumn<{ name: string; tableName: "accounts"; dataType: "string"; data: string; driverParam: string; notNull: false; hasDefault: false; isPrimaryKey: false; isAutoincrement: false; hasRuntimeDefault: false; enumValues: [string, ...string[]]; baseColumn: never; identity: undefined; generated: undefined; }, {}>; expiresAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{ name: string; tableName: "accounts"; dataType: "string"; data: string; driverParam: string; notNull: false; hasDefault: false; isPrimaryKey: false; isAutoincrement: false; hasRuntimeDefault: false; enumValues: [string, ...string[]]; baseColumn: never; identity: undefined; generated: undefined; }, {}>; priority: import("drizzle-orm/sqlite-core").SQLiteColumn<{ name: string; tableName: "accounts"; dataType: "number int53"; data: number; driverParam: number; notNull: true; hasDefault: true; isPrimaryKey: false; isAutoincrement: false; hasRuntimeDefault: false; enumValues: undefined; baseColumn: never; identity: undefined; generated: undefined; }, {}>; source: import("drizzle-orm/sqlite-core").SQLiteColumn<{ name: string; tableName: "accounts"; dataType: "string"; data: string; driverParam: string; notNull: false; hasDefault: false; isPrimaryKey: false; isAutoincrement: false; hasRuntimeDefault: false; enumValues: [string, ...string[]]; baseColumn: never; identity: undefined; generated: undefined; }, {}>; status: import("drizzle-orm/sqlite-core").SQLiteColumn<{ name: string; tableName: "accounts"; dataType: "string enum"; data: "ok" | "exhausted" | "dead"; driverParam: string; notNull: true; hasDefault: true; isPrimaryKey: false; isAutoincrement: false; hasRuntimeDefault: false; enumValues: ["ok", "exhausted", "dead"]; baseColumn: never; identity: undefined; generated: undefined; }, {}>; lastErrorCode: import("drizzle-orm/sqlite-core").SQLiteColumn<{ name: string; tableName: "accounts"; dataType: "string"; data: string; driverParam: string; notNull: false; hasDefault: false; isPrimaryKey: false; isAutoincrement: false; hasRuntimeDefault: false; enumValues: [string, ...string[]]; baseColumn: never; identity: undefined; generated: undefined; }, {}>; cooldownResetAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{ name: string; tableName: "accounts"; dataType: "string"; data: string; driverParam: string; notNull: false; hasDefault: false; isPrimaryKey: false; isAutoincrement: false; hasRuntimeDefault: false; enumValues: [string, ...string[]]; baseColumn: never; identity: undefined; generated: undefined; }, {}>; requestCount: import("drizzle-orm/sqlite-core").SQLiteColumn<{ name: string; tableName: "accounts"; dataType: "number int53"; data: number; driverParam: number; notNull: true; hasDefault: true; isPrimaryKey: false; isAutoincrement: false; hasRuntimeDefault: false; enumValues: undefined; baseColumn: never; identity: undefined; generated: undefined; }, {}>; metadata: import("drizzle-orm/sqlite-core").SQLiteColumn<{ name: string; tableName: "accounts"; dataType: "string"; data: string; driverParam: string; notNull: true; hasDefault: true; isPrimaryKey: false; isAutoincrement: false; hasRuntimeDefault: false; enumValues: [string, ...string[]]; baseColumn: never; identity: undefined; generated: undefined; }, {}>; isActive: import("drizzle-orm/sqlite-core").SQLiteColumn<{ name: string; tableName: "accounts"; dataType: "boolean"; data: boolean; driverParam: number; notNull: true; hasDefault: true; isPrimaryKey: false; isAutoincrement: false; hasRuntimeDefault: false; enumValues: undefined; baseColumn: never; identity: undefined; generated: undefined; }, {}>; createdAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{ name: string; tableName: "accounts"; dataType: "string"; data: string; driverParam: string; notNull: true; hasDefault: true; isPrimaryKey: false; isAutoincrement: false; hasRuntimeDefault: false; enumValues: [string, ...string[]]; baseColumn: never; identity: undefined; generated: undefined; }, {}>; updatedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{ name: string; tableName: "accounts"; dataType: "string"; data: string; driverParam: string; notNull: true; hasDefault: true; isPrimaryKey: false; isAutoincrement: false; hasRuntimeDefault: false; enumValues: [string, ...string[]]; baseColumn: never; identity: undefined; generated: undefined; }, {}>; }; dialect: "sqlite"; }>; /** Row type for `accounts` SELECT queries. */ export type AccountRow = typeof accounts.$inferSelect; /** Row type for `accounts` INSERT/UPSERT operations. */ export type NewAccountRow = typeof accounts.$inferInsert; //# sourceMappingURL=accounts.d.ts.map