@coffre/db 0.14.4 → 0.15.0

package/README.md

@@ -8,7 +8,8 @@ connections, Hyperdrive's included.
 A deployment does not import it. Its own CLI applies the migrations,
 `pnpm exec coffre migrate`, before the deploy; `coffre-server migrate` does
 the same for local SQLite and tests. The server and vault open the same database with
-separate logins, `coffre_runtime` and `coffre_vault_runtime`. The migrations
+separate logins, `coffre_runtime` and `coffre_vault_runtime`, and the vault's
+hot path, 0.15's uses, a third, `coffre_vault_hot`. The migrations
 grant each its own rights; only the owner runs migrations. The owner needs
 `CREATEROLE` and `CREATEDB`, and `ADMIN OPTION` on existing group roles.
 Superuser is not required.

package/dist/change-records-_fKvahvs.js

@@ -0,0 +1,55 @@
+import { sql } from "drizzle-orm";
+//#region src/active-subject.ts
+/**
+* `identities.active_subject`: the subject while the account is bound, null
+* once revoked. A unique index on (provider, issuer_hash, active_subject)
+* binds an account to one person at a time. Plain column names, so the
+* expression reads the same on both databases.
+*/
+const ACTIVE_SUBJECT = sql`CASE WHEN revoked_at IS NULL THEN subject END`;
+//#endregion
+//#region src/change-records.ts
+/**
+* What a change of 0.15's log records besides its op, which the audit pages
+* list where 0.14's entry stood (D147): a sign-in through a trust binding
+* (`signIn`, T156); a token the vault issued (`issue`); a credential it
+* revoked by request, or that signed itself out (a revoke's `reason`,
+* T164). Each is known by text its payload holds (`holds`), and by how the
+* payload starts (`starts`): the vault writes it canonical, its keys in
+* order, so an issue's is `{"caller":…` and a revoke's
+* `{"op":"credential.revoke",…`. A string the payload holds has its quotes
+* escaped, but an object's keys need not be the vault's own (a role's
+* name, in the roles' change: review r1), so where the text alone could be
+* one, the start says whose payload it is. The partial indexes of
+* `log_changes` hold each set, and a read that is to use one repeats its
+* condition (`recorded`), word for word and with no parameter.
+*/
+const RECORDS = {
+	signIn: { holds: "\"signIn\":{" },
+	issue: {
+		starts: "{\"caller\":\"",
+		holds: "\"issue\":{\"by\":\""
+	},
+	revoke: {
+		starts: "{\"op\":\"credential.revoke\",",
+		holds: "\"reason\":\"revoke\""
+	},
+	signOut: {
+		starts: "{\"op\":\"credential.revoke\",",
+		holds: "\"reason\":\"sign_out\""
+	}
+};
+/** Whether `payload` holds one of `records`, on Postgres or SQLite: an index's condition, and the reads' that use it. */
+function recorded(engine, payload, ...records) {
+	const at = (text) => {
+		const marker = sql.raw(`'${text}'`);
+		return engine === "postgres" ? sql`strpos(${payload}, ${marker})` : sql`instr(${payload}, ${marker})`;
+	};
+	const each = records.map((record) => {
+		const { starts, holds } = RECORDS[record];
+		return starts === void 0 ? sql`${at(holds)} > 0` : sql`(${at(starts)} = 1 AND ${at(holds)} > 0)`;
+	});
+	return each.length === 1 ? each[0] : sql`(${sql.join(each, sql` OR `)})`;
+}
+//#endregion
+export { recorded as n, ACTIVE_SUBJECT as r, RECORDS as t };

package/dist/connect.d.ts

@@ -1,26 +1,38 @@
-import { t as Database } from "./database-CFhTnnzM.js";
+import { _ as quoteIdentifier, d as ClientOptions, f as PostgresClient, g as postgresSession, h as postgresOptions, m as postgresClient, n as Database, p as SessionLost, v as quoteLiteral } from "./database-CVteLhp1.js";
 import { Engine } from "./dialect.js";
-import { ClientConfig } from "pg";
-//#region src/postgres.d.ts
-/** Keep libpq's system-root shortcut from being read as a certificate filename by pg. */
-export declare function postgresConnection(url: string): ClientConfig;
-//#endregion
 //#region src/connect.d.ts
 /**
  * Open a database from its URL, on a Node server:
  *
- *   postgres://… or postgresql://…   node-postgres
+ *   postgres://… or postgresql://…   postgres.js, a pool of up to 10 connections
  *   file:… or libsql:…                @libsql/client (SQLite)
  *
  * The SQLite driver loads only when asked for. The Worker does not
  * come through here; it builds its Postgres database from the Hyperdrive
- * pool with createDatabase.
+ * pool with createDatabase. `max`, for a pool of its own beside another,
+ * as the vault's checkpointer has (T169).
  */
-export declare function openDatabase(url: string): Promise<OpenDatabase>;
+export declare function openDatabase(url: string, options?: {
+  max?: number;
+}): Promise<OpenDatabase>;
+/** `close` once what was asked has answered; `cut` at once, what is in flight failing (T169). */
 export type OpenDatabase = {
   engine: Engine;
   db: Database;
   close: () => Promise<void>;
+  cut: () => Promise<void>;
 };
 export declare function engineOfUrl(url: string): Engine;
-//#endregion
+/**
+ * Whether a lone statement may write: all but a query (SELECT or VALUES, or
+ * a WITH whose statement is one) and EXPLAIN, read from its words outside
+ * parentheses, strings, quoted names and comments.
+ *
+ *   select … from "mcp_approvals" where …                 reads
+ *   WITH policy AS (SELECT …) SELECT json_object(…)       reads
+ *   WITH old AS (SELECT …) DELETE FROM …                  writes
+ *   update "mcp_connections" set …                        writes
+ */
+export declare function writes(statement: string): boolean;
+//#endregion
+export { type ClientOptions, type PostgresClient, SessionLost, postgresClient, postgresOptions, postgresSession, quoteIdentifier, quoteLiteral };

package/dist/connect.js

@@ -1,27 +1,31 @@
-import { n as createDatabase } from "./database-BadNeeN-.js";
+import { a as quoteIdentifier, i as postgresSession, n as postgresClient, o as quoteLiteral, r as postgresOptions, t as SessionLost } from "./postgres-BI3xTnyw.js";
+import { n as createDatabase } from "./database-D55ENPX-.js";
 import { asPostgresDatabase } from "./portable.js";
-import { t as postgresConnection } from "./postgres-Bmar8y0q.js";
-import pg from "pg";
 import { resolve } from "node:path";
 //#region src/connect.ts
 /**
 * Open a database from its URL, on a Node server:
 *
-*   postgres://… or postgresql://…   node-postgres
+*   postgres://… or postgresql://…   postgres.js, a pool of up to 10 connections
 *   file:… or libsql:…                @libsql/client (SQLite)
 *
 * The SQLite driver loads only when asked for. The Worker does not
 * come through here; it builds its Postgres database from the Hyperdrive
-* pool with createDatabase.
+* pool with createDatabase. `max`, for a pool of its own beside another,
+* as the vault's checkpointer has (T169).
 */
-async function openDatabase(url) {
+async function openDatabase(url, options = {}) {
 	switch (engineOfUrl(url)) {
 		case "postgres": {
-			const pool = new pg.Pool(postgresConnection(url));
+			const client = postgresClient(url, {
+				max: options.max ?? 10,
+				idle_timeout: 10
+			});
 			return {
 				engine: "postgres",
-				db: createDatabase(pool),
-				close: () => pool.end()
+				db: createDatabase(client),
+				close: () => client.end(),
+				cut: () => client.end({ timeout: 0 })
 			};
 		}
 		case "sqlite": {
@@ -43,7 +47,8 @@ async function openDatabase(url) {
 			return {
 				engine: "sqlite",
 				db: asPostgresDatabase(db),
-				close: async () => client.close()
+				close: async () => client.close(),
+				cut: async () => client.close()
 			};
 		}
 	}
@@ -63,6 +68,16 @@ function engineOfUrl(url) {
 * connections reach it. Each begins IMMEDIATE (libsql's default), taking the
 * write lock with its first statement, which is what makes a read inside it
 * as good as a locked one (see forUpdate).
+*
+* A lone statement that writes waits its turn too. It cannot wait for the
+* lock itself: libsql's busy wait blocks the thread, so the transaction
+* holding the lock, in this process, cannot go on to commit, and the write
+* fails after `timeout`. A connection whose write failed that way still
+* reads the file as it was then, until its statement is collected:
+*
+*   six MCP calls at once     the first's approval, in a transaction    BEGIN IMMEDIATE, then awaits
+*   another's last_used_at    a lone UPDATE, outside the queue          the thread blocked 5 s, SQLITE_BUSY
+*   it reads the approval     on that connection                        no row
 */
 var WriteQueue = class {
 	#tail = Promise.resolve();
@@ -84,7 +99,16 @@ function writeQueueFor(url) {
 }
 function oneTransactionAtATime(client, queue) {
 	return new Proxy(client, { get(target, key) {
-		if (key === "execute") return async (...args) => numbers(await target.execute(...args));
+		if (key === "execute") return async (...args) => {
+			const [statement] = args;
+			if (!writes(typeof statement === "string" ? statement : statement.sql)) return numbers(await target.execute(...args));
+			const release = await queue.acquire();
+			try {
+				return numbers(await target.execute(...args));
+			} finally {
+				release();
+			}
+		};
 		if (key === "transaction") return async (mode) => {
 			const release = await queue.acquire();
 			try {
@@ -140,6 +164,44 @@ function settling(tx, release) {
 	};
 	return tx;
 }
+/**
+* Whether a lone statement may write: all but a query (SELECT or VALUES, or
+* a WITH whose statement is one) and EXPLAIN, read from its words outside
+* parentheses, strings, quoted names and comments.
+*
+*   select … from "mcp_approvals" where …                 reads
+*   WITH policy AS (SELECT …) SELECT json_object(…)       reads
+*   WITH old AS (SELECT …) DELETE FROM …                  writes
+*   update "mcp_connections" set …                        writes
+*/
+function writes(statement) {
+	let depth = 0;
+	let first = null;
+	for (const [token] of statement.matchAll(/--[^\n]*|\/\*[\s\S]*?(?:\*\/|$)|'(?:[^']|'')*'?|"(?:[^"]|"")*"?|`[^`]*`?|\[[^\]]*\]?|[()]|[A-Za-z_][\w$]*/g)) if (token === "(") depth += 1;
+	else if (token === ")") depth -= 1;
+	else if (depth === 0 && /^[A-Za-z_]/.test(token)) {
+		const word = token.toLowerCase();
+		if (first === null) {
+			first = word;
+			if (word !== "with") return !QUERIES.has(word);
+		} else if (STATEMENTS.has(word)) return !QUERIES.has(word);
+	}
+	return true;
+}
+const QUERIES = /* @__PURE__ */ new Set([
+	"select",
+	"values",
+	"explain"
+]);
+/** The words a WITH's own statement starts with. */
+const STATEMENTS = /* @__PURE__ */ new Set([
+	"select",
+	"values",
+	"insert",
+	"update",
+	"delete",
+	"replace"
+]);
 /** Keep large counters exact; Drizzle's booleans and dates still need safe numbers. */
 function numbers(result) {
 	result.rows = result.rows.map((row) => {
@@ -153,4 +215,4 @@ function numbers(result) {
 	return result;
 }
 //#endregion
-export { engineOfUrl, openDatabase, postgresConnection };
+export { SessionLost, engineOfUrl, openDatabase, postgresClient, postgresOptions, postgresSession, quoteIdentifier, quoteLiteral, writes };

package/dist/database-CVteLhp1.d.ts

@@ -0,0 +1,410 @@
+import { n as Socket, r as TlsOptions } from "./platform-Y3gICK6n.js";
+import { T as schema_d_exports } from "./schema-DgoPqqsI.js";
+import { Assume, Query, Table } from "drizzle-orm";
+import { PgDatabase, PgQueryResultHKT } from "drizzle-orm/pg-core";
+//#region src/postgres-js/errors.d.ts
+/** What Postgres said in an ErrorResponse or a NoticeResponse, each field by its name. */
+type Notice = Partial<Record<(typeof FIELDS)[keyof typeof FIELDS], string>>;
+/** An ErrorResponse's fields, by their code. `data type_name` is upstream's spelling, kept. */
+declare const FIELDS: {
+  readonly 83: "severity_local";
+  readonly 86: "severity";
+  readonly 67: "code";
+  readonly 77: "message";
+  readonly 68: "detail";
+  readonly 72: "hint";
+  readonly 80: "position";
+  readonly 112: "internal_position";
+  readonly 113: "internal_query";
+  readonly 87: "where";
+  readonly 115: "schema_name";
+  readonly 116: "table_name";
+  readonly 99: "column_name";
+  readonly 100: "data type_name";
+  readonly 110: "constraint_name";
+  readonly 70: "file";
+  readonly 76: "line";
+  readonly 82: "routine";
+};
+//#endregion
+//#region src/postgres-js/result.d.ts
+/** What Postgres said of a column, in a RowDescription. */
+interface Column {
+  name: string;
+  /** How its text is read, by its type; as text when there is none. */
+  parser: ((text: string) => unknown) | undefined;
+  table: number;
+  number: number;
+  type: number;
+}
+//#endregion
+//#region src/postgres-js/query.d.ts
+/** A statement as sent: its text, its parameters' types (0 for the server to say), and its columns once described. */
+interface Statement {
+  string: string;
+  types: number[];
+  /** Once described: by a RowDescription, or NoData's none. */
+  columns: Column[] | null;
+}
+interface QueryOptions {
+  /** Sent with the simple protocol, one Query message: what a statement with no parameters is, by default. */
+  simple: boolean;
+}
+/**
+ * One statement of a group (`group`, index.ts): its text and values, whether
+ * its rows come as arrays, and what the connection works out as it sends it.
+ */
+interface Member {
+  text: string;
+  args: unknown[];
+  arrays: boolean;
+  parameters: unknown[];
+  statement: Statement | null;
+}
+/**
+ * A statement, sent once awaited (`then`, `catch`, `finally`) or `execute`d,
+ * a task later, through the pool or the transaction that made it: its
+ * `handler`. A promise of its result, its rows as objects or, after
+ * `values()`, as arrays.
+ */
+declare class Query$1<T = unknown> extends Promise<T> {
+  #private;
+  readonly text: string;
+  readonly args: unknown[];
+  readonly options: QueryOptions;
+  /** Its rows as arrays of values rather than objects. */
+  arrays: boolean;
+  executed: boolean;
+  parameters: unknown[];
+  statement: Statement | null;
+  /** Whether its parameters' types are asked of the server before its values go (`typedByServer`, connection.ts). */
+  describeFirst: boolean;
+  /** A transaction's first statement: its BEGIN, sent ahead of it under its Sync (`begin`, index.ts); and whether it took. */
+  begin: string | null;
+  began: boolean;
+  /**
+   * Coffre: a group's statements, sent under one Sync and answered together, each its own result (`group`, index.ts),
+   * and the one answering now. Null for a statement of its own.
+   */
+  group: Member[] | null;
+  member: number;
+  readonly resolve: (value: unknown) => void;
+  readonly reject: (error: unknown) => void;
+  constructor(text: string, args: unknown[], handler: (query: Query$1) => void, options: QueryOptions, debug: boolean);
+  /** Where it was made, for its error's stack: nothing unless the client debugs. */
+  get origin(): string;
+  /** What `then` and the like make: a plain promise, not another statement. */
+  static get [Symbol.species](): PromiseConstructor;
+  values(): Query$1<RowList<unknown[][]>>;
+  execute(): this;
+  then<A = T, B = never>(onfulfilled?: ((value: T) => A | PromiseLike<A>) | null, onrejected?: ((reason: any) => B | PromiseLike<B>) | null): Promise<A | B>;
+  catch<B = never>(onrejected?: ((reason: any) => B | PromiseLike<B>) | null): Promise<T | B>;
+  finally(onfinally?: (() => void) | null): Promise<T>;
+}
+//#endregion
+//#region src/postgres-js/types.d.ts
+/** How a column's text is read, by its type's oid. */
+type Parsers = Record<number, ((text: string) => unknown) | undefined>;
+/** How a value is written as text, by its parameter's type's oid. */
+type Serializers = Record<number, ((value: unknown) => unknown) | undefined>;
+//#endregion
+//#region src/postgres-js/index.d.ts
+/** What a client is opened with. Nothing is read from the environment: what is not given is the default named. */
+interface Options {
+  /** Default `localhost`. */
+  host?: string;
+  /** Default 5432. */
+  port?: number;
+  /** A Unix socket's path, in place of `host` and `port`. */
+  path?: string | undefined;
+  /** Default the server's: the user's name. */
+  database?: string | undefined;
+  user?: string;
+  pass?: string;
+  /** TLS, with Node's options for it; default none. */
+  ssl?: false | TlsOptions;
+  /** `direct`: TLS from the first byte, with no SSLRequest (Postgres 17). */
+  sslnegotiation?: 'direct' | null | undefined;
+  /** Connections at most. Default 10. */
+  max?: number;
+  /** Statements sent on a connection before the first has answered. Default 100. */
+  max_pipeline?: number;
+  /** Seconds a connection may be idle before it closes. Default none. */
+  idle_timeout?: number | null | undefined;
+  /** Seconds a connection may take to open. Default 30. */
+  connect_timeout?: number | null | undefined;
+  /** Seconds a connection may live, or a function that says how many. Default 30 to 60 minutes. */
+  max_lifetime?: number | null | (() => number);
+  /** Seconds before a closed connection is opened again, by how many in a row closed with an error. */
+  backoff?: number | ((retries: number) => number);
+  /** Seconds of TCP keep-alive. Default 60. */
+  keep_alive?: number | null;
+  /** True to keep where each statement was made, for its error's stack, and its text on its error; or a function told each statement. */
+  debug?: boolean | ((connection: number, query: string, parameters: unknown[], types: number[]) => void);
+  /** Run-time parameters sent as each connection starts. Default `application_name` postgres.js. */
+  connection?: Record<string, string | number | boolean | undefined>;
+  /** Each notice Postgres sends. Default: logged. */
+  onnotice?: (notice: Notice) => void;
+  /** Each connection's close, by its id. */
+  onclose?: (connectionId: number) => void;
+  /** The stream to speak Postgres on, made for each connection, rather than a TCP socket to `host`. */
+  socket?: () => Socket | Promise<Socket>;
+}
+/** A client's options, every one settled, and what it keeps beside them: `parsers` and `serializers`, which it may change. */
+interface Settings {
+  host: string;
+  port: number;
+  path: string | undefined;
+  database: string | undefined;
+  user: string;
+  pass: string;
+  ssl: false | TlsOptions;
+  sslnegotiation: 'direct' | null | undefined;
+  max: number;
+  max_pipeline: number;
+  idle_timeout: number | null | undefined;
+  connect_timeout: number | null | undefined;
+  max_lifetime: number | null | undefined | (() => number);
+  backoff: number | ((retries: number) => number);
+  keep_alive: number | null | undefined;
+  debug: boolean | ((connection: number, query: string, parameters: unknown[], types: number[]) => void);
+  connection: Record<string, string | number | boolean | undefined>;
+  onnotice: ((notice: Notice) => void) | undefined;
+  onclose: ((connectionId: number) => void) | undefined;
+  socket: (() => Socket | Promise<Socket>) | undefined;
+  parsers: Parsers;
+  serializers: Serializers;
+  /** The server's run-time parameters, as its ParameterStatus messages said them. */
+  parameters: Record<string, string>;
+  /** What the pool's connections share: how many in a row closed with an error, which backs off reopening. */
+  shared: {
+    retries: number;
+  };
+}
+/** A row, by its columns' names: whatever a hand-written statement selects, as upstream types it. */
+type Row = Record<string, any>;
+/** What a statement's CommandComplete said, beside its rows. */
+interface ResultMeta {
+  /** Rows inserted, updated, deleted or returned; null for a command that counts none. */
+  readonly count: number | null;
+  readonly command: string;
+  /** The backend that ran it: its process id and secret key, what a CancelRequest names. */
+  readonly state: {
+    readonly pid: number;
+    readonly secret: number;
+  };
+  readonly columns: Column[] | null;
+}
+/** A statement's rows, with what Postgres said of it. */
+type RowList<T extends readonly unknown[]> = T & ResultMeta;
+/** A statement, sent once awaited or `execute`d. */
+type PendingQuery<T extends readonly unknown[]> = Query$1<RowList<T>>;
+/** A transaction's statements, and its savepoints. */
+interface TransactionSql {
+  unsafe<T extends readonly unknown[] = Row[]>(query: string, parameters?: unknown[], options?: {
+    simple?: boolean;
+  }): PendingQuery<T>;
+  /** A savepoint, rolled back to if `fn` fails. */
+  savepoint<T>(fn: (sql: TransactionSql) => T | Promise<T>): Promise<Settled<T>>;
+}
+/** A connection held until `release()`. */
+interface ReservedSql {
+  unsafe<T extends readonly unknown[] = Row[]>(query: string, parameters?: unknown[], options?: {
+    simple?: boolean;
+  }): PendingQuery<T>;
+  release(): void;
+}
+/** A pool of connections to Postgres. */
+interface Sql {
+  /**
+   * A statement: with `parameters`, the extended protocol, one round trip;
+   * without, the simple one, unless `simple: false`.
+   */
+  unsafe<T extends readonly unknown[] = Row[]>(query: string, parameters?: unknown[], options?: {
+    simple?: boolean;
+  }): PendingQuery<T>;
+  /**
+   * A transaction, on a connection held for it: BEGIN (`options` after it,
+   * `isolation level serializable` and the like), `fn`, then COMMIT, or
+   * ROLLBACK if `fn` fails, or a statement of it did that `fn` did not wait for.
+   */
+  begin<T>(fn: (sql: TransactionSql) => T | Promise<T>): Promise<Settled<T>>;
+  begin<T>(options: string, fn: (sql: TransactionSql) => T | Promise<T>): Promise<Settled<T>>;
+  /**
+   * Coffre: statements sent together under one Sync, a round trip in all
+   * through a pooler that sends a client's Syncs on one at a time, as
+   * Hyperdrive does; answered once the last has, each with its own rows,
+   * as an array (`arrays` for a statement's rows as arrays of values). They
+   * run as one implicit transaction: if one fails, Postgres skips those
+   * after it, and the group fails, with that error. Plain reads alone
+   * (`select …`), on the pool alone, never in a transaction, whose
+   * statements each go under its own; each with the extended protocol, as
+   * a statement with parameters.
+   */
+  group(statements: readonly {
+    query: string;
+    parameters?: unknown[];
+    arrays?: boolean;
+  }[]): PendingQuery<RowList<Row[]>[]>;
+  /** A connection of the pool, held for the caller until it releases it. */
+  reserve(): Promise<ReservedSql>;
+  /** Close every connection once what it was sent has answered; after `timeout` seconds, at once. */
+  end(options?: {
+    timeout?: number | null;
+  }): Promise<void>;
+  readonly options: Settings;
+}
+/** What a transaction's work answers: an array of promises, each awaited. */
+type Settled<T> = T extends readonly unknown[] ? { -readonly [K in keyof T]: Awaited<T[K]>; } : Awaited<T>;
+//#endregion
+//#region src/postgres.d.ts
+/**
+ * A client of coffre's postgres.js (`./postgres-js`): statements (`unsafe`),
+ * transactions (`begin`), a connection held (`reserve`), and closing it.
+ */
+type PostgresClient = Sql;
+/** What a client may be opened with beside its URL. */
+type ClientOptions = Pick<Options, 'max' | 'idle_timeout' | 'connect_timeout' | 'max_lifetime' | 'onnotice' | 'debug' | 'onclose'> & {
+  /** The stream to speak Postgres on, made for each connection, rather than a TCP socket: a tunnel's. */
+  socket?: Options['socket'];
+  /** Postgres's `application_name` for the connection. */
+  application_name?: string;
+  /** Run-time parameters sent when the connection starts, `statement_timeout` and the like. */
+  connection?: Record<string, string | number | boolean>;
+};
+/**
+ * A client for `url`, as coffre opens every one: the driver's defaults (10
+ * connections, every statement unnamed, as node-postgres sends them), but
+ *
+ * - notices dropped rather than logged;
+ * - no connection closed for its age (`max_lifetime`), as node-postgres
+ *   closed none: a backup's session holds its snapshot while pg_dump reads.
+ *
+ * The driver reads no array type from `pg_type` (postgres.js's
+ * `fetch_types`, a round trip more per connection), and would answer one as
+ * its text: Postgres's own are taken as known instead (`ARRAYS`). Arrays and
+ * dates go as node-postgres sends them (`asPgSends`).
+ */
+declare function postgresClient(url: string, options?: ClientOptions): PostgresClient;
+/** A statement asked of a session that lost its connection, and with it its transaction, its locks and its settings. */
+declare class SessionLost extends Error {
+  constructor();
+}
+/**
+ * One connection to `url`, kept as a session, as node-postgres's Client
+ * kept one: what a statement sets (SET, BEGIN, a session's advisory lock)
+ * holds for every statement after. A client of postgres.js would dial a new
+ * connection for the next statement once its own closed, which holds none of
+ * it: a migration going on without its lock, a probe meant to be rolled back
+ * committed, a backup read outside its snapshot. A session does not: once
+ * its connection has closed, by the server, the network or `end`, every
+ * statement after fails, `SessionLost`.
+ */
+declare function postgresSession(url: string, options?: Omit<ClientOptions, 'max'>): PostgresClient;
+/**
+ * The connection `url` names, as node-postgres and its pg-connection-string
+ * read one. The driver reads no URL: it is given the parts. (Upstream
+ * postgres.js read URLs otherwise: it sent every query parameter it did not
+ * know to the server as a setting, which refused the connection over one it
+ * did not know either, `sslrootcert` or `uselibpqcompat`; its
+ * `sslmode=require` skipped the certificate check, where coffre's URLs, as
+ * pg reads them, verify; and it checked an IP address against `localhost`.)
+ *
+ * TLS is:
+ *
+ *   no sslmode, sslmode=disable               none
+ *   sslmode=prefer, require, verify-ca,       the certificate chain and the host verified
+ *     verify-full; ssl=true or 1
+ *   sslmode=no-verify                         TLS, nothing verified
+ *   uselibpqcompat=true                       libpq's modes: prefer and require verify nothing
+ *                                             (require with a sslrootcert, the chain), verify-ca
+ *                                             the chain, verify-full the chain and the host
+ *   sslrootcert=system                        Node's trusted CAs; only with verify-full or no sslmode
+ *   sslrootcert, sslcert, sslkey (files)      read from disk, as pg does
+ *
+ * The host is verified against the URL's own, an IP address included.
+ */
+declare function postgresOptions(url: string): Partial<Options> & {
+  connection: Record<string, string>;
+};
+/** `name` as a Postgres identifier, quoted, as node-postgres's `escapeIdentifier` writes one. */
+declare function quoteIdentifier(name: string): string;
+/** `text` as a Postgres string literal, as node-postgres's `escapeLiteral` writes one: `E'…'` when it holds a backslash. */
+declare function quoteLiteral(text: string): string;
+//#endregion
+//#region src/prepared.d.ts
+/** The part of a select builder `prepared` reads, once. */
+type Select = PromiseLike<unknown> & {
+  toSQL(): Query;
+  prepare(...name: never[]): unknown;
+};
+/**
+ * A select built once per process, or once per isolate on Workers, and run
+ * with new values each time. Drizzle rebuilds a query's SQL from its
+ * builder at every run, and that was most of a short query's CPU; this
+ * builds it from `build` the first time a database of its dialect asks,
+ * then hands the SQL and its columns to that call's own session
+ * (`session.prepareQuery`), which binds `values` to the placeholders
+ * (`sql.placeholder`) and maps the rows as the builder would.
+ *
+ * `build` must not depend on anything but the database's dialect, and the
+ * values go to the driver as they are, not through a column's encoding:
+ * strings, numbers, bigints and bytes.
+ *
+ *   const member = prepared((db) => db.select().from(tablesOf(db).vaultMembers).where(eq(…, sql.placeholder('principal'))));
+ *   const [row] = await member(db, { principal });
+ */
+declare function prepared<Q extends Select>(build: (db: Queryable) => Q): (db: Queryable, values?: Record<string, unknown>) => Promise<Awaited<Q>>;
+//#endregion
+//#region src/database.d.ts
+/** What a hand-written statement answers on Postgres: its rows, with `count` and `command`. */
+interface QueryResult extends PgQueryResultHKT {
+  type: RowList<Assume<this['row'], Row>[]>;
+}
+/**
+ * A database, typed as Postgres whichever it is; see portable.ts for why
+ * that holds. connect.ts opens one of each from a URL.
+ */
+type Database = PgDatabase<QueryResult, typeof schema_d_exports, NoRelations>;
+type Transaction = Parameters<Parameters<Database['transaction']>[0]>[0];
+/** Anything a read can run on: the database, or an open transaction. */
+type Queryable = Database | Transaction;
+/**
+ * A query made on the database from inside one of its own transactions,
+ * rather than through the transaction. With one connection per call, as on
+ * Workers, it would wait for the transaction, which waits for it: a call
+ * Cloudflare cancels as hung, and nothing says why. So it is refused at
+ * once, with this, wherever the database runs.
+ */
+declare class QueryOutsideTransaction extends Error {
+  constructor();
+}
+/**
+ * Coffre runs no relational query (`db.query.*`), and Drizzle's work out of
+ * them, `extractTablesRelationalConfig` and a query builder per table for
+ * every database, was 4 to 11 ms of a cold isolate's CPU and 0.1 ms of each
+ * later call on Workers, where a database is made per call. So the database
+ * has none: `db.query` is empty, in type and at run time, and a `db.query.x`
+ * fails the typecheck. Only the tables stay, for `tablesOf`.
+ */
+type NoRelations = Record<never, never>;
+/**
+ * What a database runs on: a postgres.js client (`postgresClient`), or
+ * Workers' `HyperdrivePool`, which makes them. Drizzle asks it for
+ * statements (`unsafe`) and transactions (`begin`).
+ */
+type Client = Pick<PostgresClient, 'unsafe' | 'begin'>;
+declare function createDatabase(client: Client): Database;
+/**
+ * The tables of the database's own dialect: the Postgres ones on Postgres,
+ * the SQLite ones on SQLite. Every query builds on these.
+ */
+declare function tablesOf(db: Queryable): typeof schema_d_exports;
+/**
+ * The database's own twin of `table`, which may be another dialect's: the
+ * server names tables by importing schema.ts, and the database decides
+ * which one that means.
+ */
+declare function own<T extends Table>(db: Queryable, table: T): T;
+//#endregion
+export { quoteIdentifier as _, Queryable as a, own as c, ClientOptions as d, PostgresClient as f, postgresSession as g, postgresOptions as h, QueryResult as i, tablesOf as l, postgresClient as m, Database as n, Transaction as o, SessionLost as p, QueryOutsideTransaction as r, createDatabase as s, Client as t, prepared as u, quoteLiteral as v };