@geekmidas/constructs 10.0.0-alpha.20 → 10.0.0-alpha.21

package/dist/cache-AgQUMma6.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-AgQUMma6.d.mts","names":["Cache","CacheClient"],"sources":["../src/cache.ts"],"mappings":";;;;;UA6BiB;;;;;;;;EAQhB;;EAEA;;cAGYA,QAAM,0CACP,UAAU,OAAOC;mBAaV;WAXT,IAAI;WACJ,SAAS,QAAQ,aAAa,QAAQA;;;;;mBAM9B;EAEjB,YACC,IAAI,cAAc,QACD,UAAS;EAc3B,WAAW;;;;;;;;;;;;UAuBG"}

package/dist/cache-obq0fOIM.d.cts

@@ -0,0 +1,44 @@
+import { n as Construct } from "./construct-interface-DIaTNKax.cjs";
+import { Service } from "@geekmidas/services";
+import { ConstructName, Declaration } from "@geekmidas/manifest";
+import { Cache } from "@geekmidas/cache";
+//#region src/cache.d.ts
+interface CacheOptions {
+  /**
+   * The database this cache lives in.
+   *
+   * Set by `database.cache()` rather than written by hand — the point of the
+   * method is that the parent's id comes from the parent rather than from a
+   * string somebody has to keep in step.
+   */
+  of?: string;
+  /** The table entries are kept in. Defaults to `cache`. */
+  table?: string;
+}
+declare class Cache$1<TName extends string = string> implements Construct<TName, Cache> {
+  private readonly options;
+  readonly id: TName;
+  readonly service: Service<Uncapitalize<TName>, Cache>;
+  /**
+   * Declared once and read by both `declare()` and `connect()`, so the key the
+   * target publishes and the key the client reads cannot drift.
+   */
+  private readonly key;
+  constructor(id: ConstructName<TName>, options?: CacheOptions);
+  declare(): Declaration[];
+  /**
+   * Builds the client from the single URL the target supplied.
+   *
+   * Any credential travels in that URL's userinfo rather than in a second key,
+   * for the same reason a Postgres password does: an address and the thing that
+   * opens it are one fact, and splitting them is one more thing to keep in step.
+   *
+   * The scheme selects the driver, so this construct imports no provider and
+   * an app that caches in Postgres never resolves a Redis client. Whoever
+   * assembles the application registers the drivers its target needs.
+   */
+  private connect;
+}
+//#endregion
+export { CacheOptions as n, Cache$1 as t };
+//# sourceMappingURL=cache-obq0fOIM.d.cts.map

package/dist/cache-obq0fOIM.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-obq0fOIM.d.cts","names":["Cache","CacheClient"],"sources":["../src/cache.ts"],"mappings":";;;;;UA6BiB;;;;;;;;EAQhB;;EAEA;;cAGYA,QAAM,0CACP,UAAU,OAAOC;mBAaV;WAXT,IAAI;WACJ,SAAS,QAAQ,aAAa,QAAQA;;;;;mBAM9B;EAEjB,YACC,IAAI,cAAc,QACD,UAAS;EAc3B,WAAW;;;;;;;;;;;;UAuBG"}

package/dist/cache.d.cts

@@ -1,43 +1,2 @@
-import { n as Construct } from "./construct-interface-DIaTNKax.cjs";
-import { Service } from "@geekmidas/services";
-import { ConstructName, Declaration } from "@geekmidas/manifest";
-import { Cache as Cache$1 } from "@geekmidas/cache";
-//#region src/cache.d.ts
-export interface CacheOptions {
-  /**
-   * The database this cache lives in.
-   *
-   * Set by `database.cache()` rather than written by hand — the point of the
-   * method is that the parent's id comes from the parent rather than from a
-   * string somebody has to keep in step.
-   */
-  of?: string;
-  /** The table entries are kept in. Defaults to `cache`. */
-  table?: string;
-}
-export declare class Cache<TName extends string = string> implements Construct<TName, Cache$1> {
-  private readonly options;
-  readonly id: TName;
-  readonly service: Service<Uncapitalize<TName>, Cache$1>;
-  /**
-   * Declared once and read by both `declare()` and `connect()`, so the key the
-   * target publishes and the key the client reads cannot drift.
-   */
-  private readonly key;
-  constructor(id: ConstructName<TName>, options?: CacheOptions);
-  declare(): Declaration[];
-  /**
-   * Builds the client from the single URL the target supplied.
-   *
-   * Any credential travels in that URL's userinfo rather than in a second key,
-   * for the same reason a Postgres password does: an address and the thing that
-   * opens it are one fact, and splitting them is one more thing to keep in step.
-   *
-   * The scheme selects the driver, so this construct imports no provider and
-   * an app that caches in Postgres never resolves a Redis client. Whoever
-   * assembles the application registers the drivers its target needs.
-   */
-  private connect;
-}
-//#endregion
-//# sourceMappingURL=cache.d.cts.map
+import { n as CacheOptions, t as Cache } from "./cache-obq0fOIM.cjs";
+export { Cache, CacheOptions };

package/dist/cache.d.mts

@@ -1,43 +1,2 @@
-import { n as Construct } from "./construct-interface-Clz7_BwB.mjs";
-import { ConstructName, Declaration } from "@geekmidas/manifest";
-import { Cache as Cache$1 } from "@geekmidas/cache";
-import { Service } from "@geekmidas/services";
-//#region src/cache.d.ts
-export interface CacheOptions {
-  /**
-   * The database this cache lives in.
-   *
-   * Set by `database.cache()` rather than written by hand — the point of the
-   * method is that the parent's id comes from the parent rather than from a
-   * string somebody has to keep in step.
-   */
-  of?: string;
-  /** The table entries are kept in. Defaults to `cache`. */
-  table?: string;
-}
-export declare class Cache<TName extends string = string> implements Construct<TName, Cache$1> {
-  private readonly options;
-  readonly id: TName;
-  readonly service: Service<Uncapitalize<TName>, Cache$1>;
-  /**
-   * Declared once and read by both `declare()` and `connect()`, so the key the
-   * target publishes and the key the client reads cannot drift.
-   */
-  private readonly key;
-  constructor(id: ConstructName<TName>, options?: CacheOptions);
-  declare(): Declaration[];
-  /**
-   * Builds the client from the single URL the target supplied.
-   *
-   * Any credential travels in that URL's userinfo rather than in a second key,
-   * for the same reason a Postgres password does: an address and the thing that
-   * opens it are one fact, and splitting them is one more thing to keep in step.
-   *
-   * The scheme selects the driver, so this construct imports no provider and
-   * an app that caches in Postgres never resolves a Redis client. Whoever
-   * assembles the application registers the drivers its target needs.
-   */
-  private connect;
-}
-//#endregion
-//# sourceMappingURL=cache.d.mts.map
+import { n as CacheOptions, t as Cache } from "./cache-AgQUMma6.mjs";
+export { Cache, CacheOptions };

package/dist/database/kysely.d.cts

@@ -1,149 +1,2 @@
-import { n as Construct } from "../construct-interface-DIaTNKax.cjs";
-import { Cache } from "../cache.cjs";
-import { Service } from "@geekmidas/services";
-import { ConstructName, Declaration, PostgresVersion } from "@geekmidas/manifest";
-import { Kysely, KyselyConfig } from "kysely";
-//#region src/database/kysely.d.ts
-/**
- * Everything Kysely takes, plus what this construct declares.
- *
- * `dialect` is omitted because the construct owns it — it is built from the one
- * URL the adapter supplied, which is the whole point of the construct. The rest
- * of `KyselyConfig` (`plugins`, `log`) is the app's business and passes
- * straight through, so anything Kysely adds later arrives without being
- * tracked here.
- */
-export interface KyselyDatabaseOptions extends Omit<KyselyConfig, 'dialect'> {
-  /**
-   * The schema, pinned on both roles' `search_path`.
-   *
-   * Defaults to `app` — the role the schema plays, rather than a restatement
-   * of the database's own name, which reads correctly beside `auth` and
-   * `pgboss` and keeps the application off `public`.
-   */
-  schema?: string;
-  /**
-   * Provision the owner/runtime role split. Defaults to on.
-   *
-   * Off falls back to the cluster's master credential in both URLs, giving up
-   * the DDL/DML split and putting credentials that can drop a table into the
-   * function's environment. A deliberate downgrade, not a default.
-   */
-  roles?: boolean;
-  /**
-   * The Postgres major version to provision.
-   *
-   * Declared here so one statement reaches both targets. It was previously
-   * set in two unrelated places — a container tag locally, nothing at all on
-   * AWS (so Aurora chose) — which is how local came to run 18 while deployed
-   * ran 17.7 with nothing recording the difference.
-   *
-   * Defaults to {@link DEFAULT_POSTGRES_VERSION}.
-   */
-  version?: PostgresVersion;
-}
-/** What makes a construct derived rather than a database in its own right. */
-interface DerivedFrom {
-  kind: 'database-reader' | 'database-schema';
-  of: string;
-  schema?: string;
-}
-/**
- * @typeParam DB - the database's schema.
- * @typeParam TName - the canonical id. TypeScript has no partial
- * type-argument inference, so `new KyselyDatabase<OrdersDB>('orders')` leaves
- * this at its default and the service key widens to `string`. `db` still types
- * through `.database()`, which infers from the service.
- */
-export declare class KyselyDatabase<DB = unknown, TName extends string = string> implements Construct<TName, Kysely<DB>> {
-  private readonly options;
-  readonly id: TName;
-  readonly service: Service<Uncapitalize<TName>, Kysely<DB>>;
-  /**
-   * Declared once and read by both `declare()` and `connect()`, so the key the
-   * build publishes and the key the client reads cannot drift.
-   */
-  private readonly config;
-  private readonly schemaName;
-  private readonly roles;
-  private readonly version;
-  private readonly derivedFrom?;
-  constructor(id: ConstructName<TName>, options?: KyselyDatabaseOptions, derivedFrom?: DerivedFrom);
-  declare(): Declaration[];
-  /**
-   * A read-only endpoint on this database.
-   *
-   * Read-only is enforced by the reader role's grants rather than by which
-   * endpoint it resolves to, so falling back to the writer where no replica
-   * exists is safe rather than a silently writable connection behind a name
-   * that says reader. There is no `writer()`: the database *is* the writer, so
-   * a replica can never be reached by accident.
-   *
-   * The return type is narrower than this class on purpose — see
-   * {@link ReadOnlyDatabase}.
-   */
-  reader(): ReadOnlyDatabase<DB, `${TName}Reader`>;
-  /**
-   * A cache that lives in this database.
-   *
-   * The same strengthening `schema()` is over a second database: `new
-   * Cache('Sessions')` says the app caches and leaves where to the deployment,
-   * while this says it caches *here* — which is a fact about the application
-   * and so belongs in its code.
-   *
-   * What it buys beyond being explicit: the table's schema and the role that
-   * reaches it come from this database rather than from a second convention,
-   * and the backend no longer has to guess which database "the database" meant
-   * when an app declares two.
-   *
-   * A cache is not a `KyselyDatabase`, so this returns a `Cache` — the client
-   * is a key/value store, not a query builder, and typing it as the parent
-   * would be a convenience that lies.
-   */
-  cache<TCache extends string = `${TName}Cache`>(id?: ConstructName<TCache>, options?: {
-    table?: string;
-  }): Cache<TCache>;
-  /**
-   * A second schema in this database, with its own role(s) and its own URL —
-   * so this database's role holds no grant on those tables at all.
-   *
-   * Typed separately because a tenant has its own tables: the point is that
-   * `auth.selectFrom('sessions')` type-checks and
-   * `orders.selectFrom('sessions')` does not.
-   */
-  schema<TenantDB, TTenant extends string>(id: ConstructName<TTenant>, options?: KyselyDatabaseOptions): KyselyDatabase<TenantDB, TTenant>;
-  /**
-   * A connection as the *owner* role — the one that may create, alter and drop.
-   *
-   * A `Service` rather than part of the construct, and deliberately so: a
-   * construct is what `.dependsOn()` accepts, and nothing should be able to
-   * depend on this. A migrator asks for it by name; a handler cannot ask at
-   * all, which is the security property the role split exists for.
-   *
-   * Falls back to the runtime URL where no owner URL was published — the
-   * `roles: false` downgrade, where there is only one credential and it is the
-   * cluster master's.
-   */
-  get owner(): Service<`${Uncapitalize<TName>}Owner`, Kysely<DB>>;
-  private connect;
-}
-/**
- * A database you may read through, and derive nothing from.
- *
- * A reader is terminal in the graph, and this is that fact in the type system.
- * `DERIVES_FROM` gives `cache` and `database-schema` no `database-reader`
- * parent, and there is no reader of a reader — so `orders.reader().cache(…)`
- * has always been illegal, but it type-checked and failed later at
- * `assertDerivations`. That is a long way round to learn that a read-only
- * endpoint cannot own a table something writes to.
- *
- * Omitting the three deriving methods rather than making them throw keeps the
- * failure where it costs least: the editor, on the line that wrote it.
- *
- * The result is deliberately not assignable back to `KyselyDatabase` — a
- * reader is not one, and anything that genuinely needs the writer should say
- * so.
- */
-export type ReadOnlyDatabase<DB, TName extends string> = Omit<KyselyDatabase<DB, TName>, 'reader' | 'cache' | 'schema'>;
-//#endregion
-//# sourceMappingURL=kysely.d.cts.map
+import { n as KyselyDatabaseOptions, r as ReadOnlyDatabase, t as KyselyDatabase } from "../kysely-CXi49zc2.cjs";
+export { KyselyDatabase, KyselyDatabaseOptions, ReadOnlyDatabase };

package/dist/database/kysely.d.mts

@@ -1,149 +1,2 @@
-import { n as Construct } from "../construct-interface-Clz7_BwB.mjs";
-import { Cache } from "../cache.mjs";
-import { ConstructName, Declaration, PostgresVersion } from "@geekmidas/manifest";
-import { Kysely, KyselyConfig } from "kysely";
-import { Service } from "@geekmidas/services";
-//#region src/database/kysely.d.ts
-/**
- * Everything Kysely takes, plus what this construct declares.
- *
- * `dialect` is omitted because the construct owns it — it is built from the one
- * URL the adapter supplied, which is the whole point of the construct. The rest
- * of `KyselyConfig` (`plugins`, `log`) is the app's business and passes
- * straight through, so anything Kysely adds later arrives without being
- * tracked here.
- */
-export interface KyselyDatabaseOptions extends Omit<KyselyConfig, 'dialect'> {
-  /**
-   * The schema, pinned on both roles' `search_path`.
-   *
-   * Defaults to `app` — the role the schema plays, rather than a restatement
-   * of the database's own name, which reads correctly beside `auth` and
-   * `pgboss` and keeps the application off `public`.
-   */
-  schema?: string;
-  /**
-   * Provision the owner/runtime role split. Defaults to on.
-   *
-   * Off falls back to the cluster's master credential in both URLs, giving up
-   * the DDL/DML split and putting credentials that can drop a table into the
-   * function's environment. A deliberate downgrade, not a default.
-   */
-  roles?: boolean;
-  /**
-   * The Postgres major version to provision.
-   *
-   * Declared here so one statement reaches both targets. It was previously
-   * set in two unrelated places — a container tag locally, nothing at all on
-   * AWS (so Aurora chose) — which is how local came to run 18 while deployed
-   * ran 17.7 with nothing recording the difference.
-   *
-   * Defaults to {@link DEFAULT_POSTGRES_VERSION}.
-   */
-  version?: PostgresVersion;
-}
-/** What makes a construct derived rather than a database in its own right. */
-interface DerivedFrom {
-  kind: 'database-reader' | 'database-schema';
-  of: string;
-  schema?: string;
-}
-/**
- * @typeParam DB - the database's schema.
- * @typeParam TName - the canonical id. TypeScript has no partial
- * type-argument inference, so `new KyselyDatabase<OrdersDB>('orders')` leaves
- * this at its default and the service key widens to `string`. `db` still types
- * through `.database()`, which infers from the service.
- */
-export declare class KyselyDatabase<DB = unknown, TName extends string = string> implements Construct<TName, Kysely<DB>> {
-  private readonly options;
-  readonly id: TName;
-  readonly service: Service<Uncapitalize<TName>, Kysely<DB>>;
-  /**
-   * Declared once and read by both `declare()` and `connect()`, so the key the
-   * build publishes and the key the client reads cannot drift.
-   */
-  private readonly config;
-  private readonly schemaName;
-  private readonly roles;
-  private readonly version;
-  private readonly derivedFrom?;
-  constructor(id: ConstructName<TName>, options?: KyselyDatabaseOptions, derivedFrom?: DerivedFrom);
-  declare(): Declaration[];
-  /**
-   * A read-only endpoint on this database.
-   *
-   * Read-only is enforced by the reader role's grants rather than by which
-   * endpoint it resolves to, so falling back to the writer where no replica
-   * exists is safe rather than a silently writable connection behind a name
-   * that says reader. There is no `writer()`: the database *is* the writer, so
-   * a replica can never be reached by accident.
-   *
-   * The return type is narrower than this class on purpose — see
-   * {@link ReadOnlyDatabase}.
-   */
-  reader(): ReadOnlyDatabase<DB, `${TName}Reader`>;
-  /**
-   * A cache that lives in this database.
-   *
-   * The same strengthening `schema()` is over a second database: `new
-   * Cache('Sessions')` says the app caches and leaves where to the deployment,
-   * while this says it caches *here* — which is a fact about the application
-   * and so belongs in its code.
-   *
-   * What it buys beyond being explicit: the table's schema and the role that
-   * reaches it come from this database rather than from a second convention,
-   * and the backend no longer has to guess which database "the database" meant
-   * when an app declares two.
-   *
-   * A cache is not a `KyselyDatabase`, so this returns a `Cache` — the client
-   * is a key/value store, not a query builder, and typing it as the parent
-   * would be a convenience that lies.
-   */
-  cache<TCache extends string = `${TName}Cache`>(id?: ConstructName<TCache>, options?: {
-    table?: string;
-  }): Cache<TCache>;
-  /**
-   * A second schema in this database, with its own role(s) and its own URL —
-   * so this database's role holds no grant on those tables at all.
-   *
-   * Typed separately because a tenant has its own tables: the point is that
-   * `auth.selectFrom('sessions')` type-checks and
-   * `orders.selectFrom('sessions')` does not.
-   */
-  schema<TenantDB, TTenant extends string>(id: ConstructName<TTenant>, options?: KyselyDatabaseOptions): KyselyDatabase<TenantDB, TTenant>;
-  /**
-   * A connection as the *owner* role — the one that may create, alter and drop.
-   *
-   * A `Service` rather than part of the construct, and deliberately so: a
-   * construct is what `.dependsOn()` accepts, and nothing should be able to
-   * depend on this. A migrator asks for it by name; a handler cannot ask at
-   * all, which is the security property the role split exists for.
-   *
-   * Falls back to the runtime URL where no owner URL was published — the
-   * `roles: false` downgrade, where there is only one credential and it is the
-   * cluster master's.
-   */
-  get owner(): Service<`${Uncapitalize<TName>}Owner`, Kysely<DB>>;
-  private connect;
-}
-/**
- * A database you may read through, and derive nothing from.
- *
- * A reader is terminal in the graph, and this is that fact in the type system.
- * `DERIVES_FROM` gives `cache` and `database-schema` no `database-reader`
- * parent, and there is no reader of a reader — so `orders.reader().cache(…)`
- * has always been illegal, but it type-checked and failed later at
- * `assertDerivations`. That is a long way round to learn that a read-only
- * endpoint cannot own a table something writes to.
- *
- * Omitting the three deriving methods rather than making them throw keeps the
- * failure where it costs least: the editor, on the line that wrote it.
- *
- * The result is deliberately not assignable back to `KyselyDatabase` — a
- * reader is not one, and anything that genuinely needs the writer should say
- * so.
- */
-export type ReadOnlyDatabase<DB, TName extends string> = Omit<KyselyDatabase<DB, TName>, 'reader' | 'cache' | 'schema'>;
-//#endregion
-//# sourceMappingURL=kysely.d.mts.map
+import { n as KyselyDatabaseOptions, r as ReadOnlyDatabase, t as KyselyDatabase } from "../kysely-D3-G5b0j.mjs";
+export { KyselyDatabase, KyselyDatabaseOptions, ReadOnlyDatabase };

package/dist/kysely-CXi49zc2.d.cts

@@ -0,0 +1,150 @@
+import { n as Construct } from "./construct-interface-DIaTNKax.cjs";
+import { t as Cache } from "./cache-obq0fOIM.cjs";
+import { Service } from "@geekmidas/services";
+import { ConstructName, Declaration, PostgresVersion } from "@geekmidas/manifest";
+import { Kysely, KyselyConfig } from "kysely";
+//#region src/database/kysely.d.ts
+/**
+ * Everything Kysely takes, plus what this construct declares.
+ *
+ * `dialect` is omitted because the construct owns it — it is built from the one
+ * URL the adapter supplied, which is the whole point of the construct. The rest
+ * of `KyselyConfig` (`plugins`, `log`) is the app's business and passes
+ * straight through, so anything Kysely adds later arrives without being
+ * tracked here.
+ */
+interface KyselyDatabaseOptions extends Omit<KyselyConfig, 'dialect'> {
+  /**
+   * The schema, pinned on both roles' `search_path`.
+   *
+   * Defaults to `app` — the role the schema plays, rather than a restatement
+   * of the database's own name, which reads correctly beside `auth` and
+   * `pgboss` and keeps the application off `public`.
+   */
+  schema?: string;
+  /**
+   * Provision the owner/runtime role split. Defaults to on.
+   *
+   * Off falls back to the cluster's master credential in both URLs, giving up
+   * the DDL/DML split and putting credentials that can drop a table into the
+   * function's environment. A deliberate downgrade, not a default.
+   */
+  roles?: boolean;
+  /**
+   * The Postgres major version to provision.
+   *
+   * Declared here so one statement reaches both targets. It was previously
+   * set in two unrelated places — a container tag locally, nothing at all on
+   * AWS (so Aurora chose) — which is how local came to run 18 while deployed
+   * ran 17.7 with nothing recording the difference.
+   *
+   * Defaults to {@link DEFAULT_POSTGRES_VERSION}.
+   */
+  version?: PostgresVersion;
+}
+/** What makes a construct derived rather than a database in its own right. */
+interface DerivedFrom {
+  kind: 'database-reader' | 'database-schema';
+  of: string;
+  schema?: string;
+}
+/**
+ * @typeParam DB - the database's schema.
+ * @typeParam TName - the canonical id. TypeScript has no partial
+ * type-argument inference, so `new KyselyDatabase<OrdersDB>('orders')` leaves
+ * this at its default and the service key widens to `string`. `db` still types
+ * through `.database()`, which infers from the service.
+ */
+declare class KyselyDatabase<DB = unknown, TName extends string = string> implements Construct<TName, Kysely<DB>> {
+  private readonly options;
+  readonly id: TName;
+  readonly service: Service<Uncapitalize<TName>, Kysely<DB>>;
+  /**
+   * Declared once and read by both `declare()` and `connect()`, so the key the
+   * build publishes and the key the client reads cannot drift.
+   */
+  private readonly config;
+  private readonly schemaName;
+  private readonly roles;
+  private readonly version;
+  private readonly derivedFrom?;
+  constructor(id: ConstructName<TName>, options?: KyselyDatabaseOptions, derivedFrom?: DerivedFrom);
+  declare(): Declaration[];
+  /**
+   * A read-only endpoint on this database.
+   *
+   * Read-only is enforced by the reader role's grants rather than by which
+   * endpoint it resolves to, so falling back to the writer where no replica
+   * exists is safe rather than a silently writable connection behind a name
+   * that says reader. There is no `writer()`: the database *is* the writer, so
+   * a replica can never be reached by accident.
+   *
+   * The return type is narrower than this class on purpose — see
+   * {@link ReadOnlyDatabase}.
+   */
+  reader(): ReadOnlyDatabase<DB, `${TName}Reader`>;
+  /**
+   * A cache that lives in this database.
+   *
+   * The same strengthening `schema()` is over a second database: `new
+   * Cache('Sessions')` says the app caches and leaves where to the deployment,
+   * while this says it caches *here* — which is a fact about the application
+   * and so belongs in its code.
+   *
+   * What it buys beyond being explicit: the table's schema and the role that
+   * reaches it come from this database rather than from a second convention,
+   * and the backend no longer has to guess which database "the database" meant
+   * when an app declares two.
+   *
+   * A cache is not a `KyselyDatabase`, so this returns a `Cache` — the client
+   * is a key/value store, not a query builder, and typing it as the parent
+   * would be a convenience that lies.
+   */
+  cache<TCache extends string = `${TName}Cache`>(id?: ConstructName<TCache>, options?: {
+    table?: string;
+  }): Cache<TCache>;
+  /**
+   * A second schema in this database, with its own role(s) and its own URL —
+   * so this database's role holds no grant on those tables at all.
+   *
+   * Typed separately because a tenant has its own tables: the point is that
+   * `auth.selectFrom('sessions')` type-checks and
+   * `orders.selectFrom('sessions')` does not.
+   */
+  schema<TenantDB, TTenant extends string>(id: ConstructName<TTenant>, options?: KyselyDatabaseOptions): KyselyDatabase<TenantDB, TTenant>;
+  /**
+   * A connection as the *owner* role — the one that may create, alter and drop.
+   *
+   * A `Service` rather than part of the construct, and deliberately so: a
+   * construct is what `.dependsOn()` accepts, and nothing should be able to
+   * depend on this. A migrator asks for it by name; a handler cannot ask at
+   * all, which is the security property the role split exists for.
+   *
+   * Falls back to the runtime URL where no owner URL was published — the
+   * `roles: false` downgrade, where there is only one credential and it is the
+   * cluster master's.
+   */
+  get owner(): Service<`${Uncapitalize<TName>}Owner`, Kysely<DB>>;
+  private connect;
+}
+/**
+ * A database you may read through, and derive nothing from.
+ *
+ * A reader is terminal in the graph, and this is that fact in the type system.
+ * `DERIVES_FROM` gives `cache` and `database-schema` no `database-reader`
+ * parent, and there is no reader of a reader — so `orders.reader().cache(…)`
+ * has always been illegal, but it type-checked and failed later at
+ * `assertDerivations`. That is a long way round to learn that a read-only
+ * endpoint cannot own a table something writes to.
+ *
+ * Omitting the three deriving methods rather than making them throw keeps the
+ * failure where it costs least: the editor, on the line that wrote it.
+ *
+ * The result is deliberately not assignable back to `KyselyDatabase` — a
+ * reader is not one, and anything that genuinely needs the writer should say
+ * so.
+ */
+type ReadOnlyDatabase<DB, TName extends string> = Omit<KyselyDatabase<DB, TName>, 'reader' | 'cache' | 'schema'>;
+//#endregion
+export { KyselyDatabaseOptions as n, ReadOnlyDatabase as r, KyselyDatabase as t };
+//# sourceMappingURL=kysely-CXi49zc2.d.cts.map

package/dist/kysely-CXi49zc2.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kysely-CXi49zc2.d.cts","names":[],"sources":["../src/database/kysely.ts"],"mappings":";;;;;;;;;;;;;;;UAwCiB,8BAA8B,KAAK;;;;;;;;EAQnD;;;;;;;;EAQA;;;;;;;;;;;EAWA,UAAU;;;UAID;EACT;EACA;EACA;;;;;;;;;cAUY,eAAe,cAAc,0CAC9B,UAAU,OAAO,OAAO;mBAiBjB;WAfT,IAAI;WACJ,SAAS,QAAQ,aAAa,QAAQ,OAAO;;;;;mBAMrC;mBACA;mBACA;mBACA;mBACA;EAEjB,YACC,IAAI,cAAc,QACD,UAAS,uBAC1B,cAAc;EAyBf,WAAW;;;;;;;;;;;;;EAqDX,UAAU,iBAAiB,OAAO;;;;;;;;;;;;;;;;;;EAyBlC,MAAM,2BAA2B,cAChC,KAAI,cAAc,SAClB;IAAW;MACT,MAAM;;;;;;;;;EAeT,OAAO,UAAU,wBAChB,IAAI,cAAc,UAClB,UAAS,wBACP,eAAe,UAAU;;;;;;;;;;;;;MAoBxB,SAAS,WAAW,aAAa,eAAe,OAAO;UAQ7C;;;;;;;;;;;;;;;;;;;KAkEH,iBAAiB,IAAI,wBAAwB,KACxD,eAAe,IAAI"}