@hasna/contacts 0.7.0 → 0.9.0

package/dist/cli/status-domain.preload.d.ts

@@ -1,2 +1,2 @@
-declare const originalFetch: typeof fetch;
+export {};
 //# sourceMappingURL=status-domain.preload.d.ts.map

package/dist/cli/status-domain.preload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status-domain.preload.d.ts","sourceRoot":"","sources":["../../src/cli/status-domain.preload.ts"],"names":[],"mappings":"AAKA,QAAA,MAAM,aAAa,cAAmB,CAAC"}
+{"version":3,"file":"status-domain.preload.d.ts","sourceRoot":"","sources":["../../src/cli/status-domain.preload.ts"],"names":[],"mappings":""}

package/dist/cli/status-fixture.d.ts

@@ -0,0 +1,17 @@
+export type StatusFixtureMode = "unconfigured" | "failure" | "success";
+export declare const fixtureStation = "contacts-status-fixture";
+export declare const envFixtureKey = "status-fixture-key";
+export declare const diskFixtureKey = "disk-key-not-a-real-secret";
+export declare function statusFixtureEnv(): Record<string, string>;
+export declare function statusFixtureCommand(home: string, command: string[]): string[];
+export declare function runStatusFixture(args: string[], env: Record<string, string>, mode?: StatusFixtureMode): {
+    exitCode: number | null;
+    pid: number;
+    output: (string | null)[];
+    stdout: string;
+    stderr: string;
+    status: number | null;
+    signal: NodeJS.Signals | null;
+    error?: Error;
+};
+//# sourceMappingURL=status-fixture.d.ts.map

package/dist/cli/status-fixture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-fixture.d.ts","sourceRoot":"","sources":["../../src/cli/status-fixture.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,iBAAiB,GAAG,cAAc,GAAG,SAAS,GAAG,SAAS,CAAC;AACvE,eAAO,MAAM,cAAc,4BAA4B,CAAC;AACxD,eAAO,MAAM,aAAa,uBAAuB,CAAC;AAClD,eAAO,MAAM,cAAc,+BAA+B,CAAC;AAE3D,wBAAgB,gBAAgB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWzD;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAuB9E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,IAAI,GAAE,iBAAkC;;;;;;;;;EAYrH"}

package/dist/cloud/http-storage.d.ts

@@ -2,18 +2,20 @@
  * Canonical contacts client transport.
  *
  * Public clients have exactly one data path: an authenticated HTTPS `/v1`
- * authority. The server URL is always explicit; this module never composes or
- * guesses a hosted URL. API-key resolution and per-request rotation are owned
- * by `@hasna/contracts/client`, so key material is never exposed by status
- * objects or cached in this package.
+ * authority, resolved by `@hasna/contracts/client` — the ONE fleet resolver.
+ * The authority defaults to the fleet gateway `https://api.hasna.com/contacts`
+ * once any credential tier resolves, and `HASNA_CONTACTS_API_URL`, the
+ * Keychain `api-url` item, or the credentials file override it. API-key
+ * resolution and per-request rotation are owned by the shared resolver, so
+ * key material is never exposed by status objects or cached in this package.
  *
  * SQLite, PostgreSQL DSNs, and storage/deployment modes are not client
  * transports. A stale selector is a configuration error, not a reason to read
  * a different data set.
  */
-import { type ClientTransportResolution as SharedClientTransportResolution, type HasnaHttpTransport, type HasnaRequestOptions, type QueryParams } from "@hasna/contracts/client";
-export type Env = Record<string, string | undefined>;
-export type { QueryParams };
+import { type CredentialChainOptions, type CredentialTier, type HasnaHttpTransport, type HasnaRequestOptions, type QueryParams } from "@hasna/contracts/client";
+import type { Env } from "./resolver-inputs.js";
+export type { Env, QueryParams };
 export declare const RETIRED_CLIENT_SELECTOR_KEYS: readonly ["HASNA_CONTACTS_STORAGE_MODE", "CONTACTS_STORAGE_MODE", "HASNA_CONTACTS_MODE", "CONTACTS_MODE", "HASNA_CONTACTS_DB_PATH", "CONTACTS_DB_PATH", "HASNA_CONTACTS_DATABASE_URL", "CONTACTS_DATABASE_URL"];
 export declare class ContactsClientConfigurationError extends Error {
     readonly code: string;
@@ -25,17 +27,23 @@ export interface ClientTransportResolution {
     apiUrlSource: string | null;
     apiKeyPresent: boolean;
     apiKeySource: string | null;
-    apiKeyTier: SharedClientTransportResolution["apiKeyTier"];
+    apiKeyTier: CredentialTier | null;
     configured: boolean;
     misconfigured: boolean;
     issue: string | null;
     warning: string | null;
 }
 /**
- * Resolve value-free connection diagnostics. This function does not invent a
- * default authority and never reports a local transport as usable.
+ * Resolve value-free connection diagnostics.
+ *
+ * @hasna/contracts 1.0.2 THROWS `ClientTransportConfigurationError` for every
+ * incomplete or invalid configuration — nothing resolves to a local or
+ * partial transport any more. A refusal of that class is reported here as
+ * `unconfigured` (never as a usable transport); the shared resolver's own
+ * hard refusals — a blank declared variable, a conflict, an unreadable
+ * credential file — stay hard errors, exactly as the resolver throws them.
  */
-export declare function resolveContactsClientTransport(name: string, env?: Env): ClientTransportResolution;
+export declare function resolveContactsClientTransport(name: string, env?: Env, credentials?: CredentialChainOptions): ClientTransportResolution;
 export interface StorageClient {
     readonly name: string;
     readonly baseUrl: string;
@@ -55,5 +63,5 @@ export interface ResolveStorageClientResult {
     resolution: ClientTransportResolution;
 }
 /** Build the sole contacts client. Any incomplete configuration is terminal. */
-export declare function resolveContactsStorageClient(name: string, env?: Env): ResolveStorageClientResult;
+export declare function resolveContactsStorageClient(name: string, env?: Env, credentials?: CredentialChainOptions): ResolveStorageClientResult;
 //# sourceMappingURL=http-storage.d.ts.map

package/dist/cloud/http-storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-storage.d.ts","sourceRoot":"","sources":["../../src/cloud/http-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAIL,KAAK,yBAAyB,IAAI,+BAA+B,EACjE,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAC;AAGjC,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AACrD,YAAY,EAAE,WAAW,EAAE,CAAC;AAE5B,eAAO,MAAM,4BAA4B,iNAS/B,CAAC;AA2BX,qBAAa,gCAAiC,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAInD;AAED,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,OAAO,GAAG,cAAc,CAAC;IACpC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,OAAO,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,+BAA+B,CAAC,YAAY,CAAC,CAAC;IAC1D,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAoBD;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,GAAiB,GAAG,yBAAyB,CAuC9G;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5E,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9F,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7F,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,mBAAmB,GAAG;QAAE,MAAM,CAAC,EAAE,OAAO,GAAG,KAAK,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzI,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;CACvG;AAqBD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,kBAAkB,GAAG,aAAa,CAgC9F;AAED,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,aAAa,CAAC;IACtB,UAAU,EAAE,yBAAyB,CAAC;CACvC;AAED,gFAAgF;AAChF,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,GAAiB,GAAG,0BAA0B,CA6C7G"}
+{"version":3,"file":"http-storage.d.ts","sourceRoot":"","sources":["../../src/cloud/http-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAML,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAC;AAEhD,YAAY,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;AAEjC,eAAO,MAAM,4BAA4B,iNAS/B,CAAC;AA2BX,qBAAa,gCAAiC,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAInD;AAED,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,OAAO,GAAG,cAAc,CAAC;IACpC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,OAAO,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,cAAc,GAAG,IAAI,CAAC;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAwBD;;;;;;;;;GASG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,EACZ,GAAG,GAAE,GAAiB,EACtB,WAAW,GAAE,sBAA2B,GACvC,yBAAyB,CA4C3B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5E,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9F,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7F,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,mBAAmB,GAAG;QAAE,MAAM,CAAC,EAAE,OAAO,GAAG,KAAK,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzI,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;CACvG;AAqBD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,kBAAkB,GAAG,aAAa,CAgC9F;AAED,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,aAAa,CAAC;IACtB,UAAU,EAAE,yBAAyB,CAAC;CACvC;AAED,gFAAgF;AAChF,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,EACZ,GAAG,GAAE,GAAiB,EACtB,WAAW,GAAE,sBAA2B,GACvC,0BAA0B,CAkD5B"}

package/dist/cloud/resolver-inputs.d.ts

@@ -0,0 +1,51 @@
+/**
+ * The credential-chain seam between @hasna/contracts 1.0.2 and this package.
+ *
+ * Contacts never builds its own credential or authority chain: the CLI, the
+ * MCP server and the store all funnel through
+ * `resolveContactsClientTransport`, which hands @hasna/contracts the
+ * environment unchanged, per request, fresh. The one thing this module owns
+ * is the ambient gate for the resolver's Keychain tier (#1788).
+ *
+ * The Keychain belongs to the MACHINE, so the resolver consults it only when
+ * it is handed the live process environment (or a snapshot the resolver
+ * itself marked ambient) — a caller-built env object is the hermetic seam and
+ * must never drag a machine identity into a test. A copy made on the way in
+ * silently loses that gate, and the per-request re-resolution in
+ * `resolveContactsStorageClient` does make a copy: a snapshot of the env so a
+ * concurrent mutation cannot tear one resolution. A copy that drops the
+ * Keychain gate would, on a Mac station whose only credential is the Keychain
+ * item, turn every request into a fresh failure — or, with a credential on
+ * disk, into a DIFFERENT principal with no notice.
+ *
+ * So the ambient answer is decided HERE, on the ORIGINAL env, before any copy
+ * exists, and carried across as the documented `keychain.enabled` control.
+ * A caller's explicit `keychain` options always win; the injected `run`
+ * runner (which @hasna/contracts already treats as "enabled") is left alone.
+ */
+import { type CredentialChainOptions } from "@hasna/contracts/client";
+export type Env = Record<string, string | undefined>;
+/**
+ * Is this the environment the machine's ambient credential stores belong to?
+ *
+ * The same test @hasna/contracts performs, run on the env BEFORE any copy
+ * exists — which is the whole point of asking here.
+ */
+export declare function isAmbientContactsEnv(env: Env): boolean;
+/** Every env name the resolver may consult for the contacts authority or
+ * credential — canonical names, the legacy aliases, the deliberate pointers,
+ * and the profile selector. */
+export declare function contactsAuthorityEnvKeys(): string[];
+/**
+ * The credential chain options a contacts surface hands the resolver.
+ *
+ * On the identity path (`env === process.env`, or a snapshot @hasna/contracts
+ * itself marked ambient) this passes through untouched and the resolver runs
+ * its own ambient test. On a CALLER-BUILT env — every hermetic test env, and
+ * the per-request snapshot in `resolveContactsStorageClient` — the Keychain
+ * tier would silently switch off the moment a copy is made; the caller's
+ * explicit controls still win, and otherwise the tier is pinned to what the
+ * ORIGINAL env was: ambient in, enabled; hermetic in, disabled.
+ */
+export declare function contactsResolverCredentials(env: Env, credentials?: CredentialChainOptions): CredentialChainOptions;
+//# sourceMappingURL=resolver-inputs.d.ts.map

package/dist/cloud/resolver-inputs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver-inputs.d.ts","sourceRoot":"","sources":["../../src/cloud/resolver-inputs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAKL,KAAK,sBAAsB,EAE5B,MAAM,yBAAyB,CAAC;AAEjC,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAMrD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAGtD;AAED;;+BAE+B;AAC/B,wBAAgB,wBAAwB,IAAI,MAAM,EAAE,CASnD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,GAAG,EACR,WAAW,GAAE,sBAA2B,GACvC,sBAAsB,CAMxB"}

package/dist/db/paths.d.ts

@@ -1,4 +1,4 @@
-export type PathKind = "config" | "data" | "state" | "cache";
+export type PathKind = "data" | "state";
 export interface PathsResolverOptions {
     app: string;
     internal?: boolean;
@@ -9,12 +9,12 @@ export interface PathsResolverOptions {
 export declare function dataDir(options: PathsResolverOptions): string;
 export declare function stateDir(options: PathsResolverOptions): string;
 /**
- * The @hasna/paths data root for retained server/legacy utilities. It creates
- * only the requested target directory and never scans or adopts older homes.
+ * The data root for retained server/legacy utilities. It creates only the
+ * requested target directory and never scans or adopts older homes.
  */
 export declare function getDataDir(): string;
 /**
- * The @hasna/paths state root for retained server/legacy utilities.
+ * The state root for retained server/legacy utilities.
  */
 export declare function getStateDir(): string;
 export declare function getDbPath(): string;

package/dist/db/paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/db/paths.ts"],"names":[],"mappings":"AAwBA,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AAS7D,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC1C;AA0DD,wBAAgB,OAAO,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,CAE7D;AACD,wBAAgB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,CAE9D;AAWD;;;GAGG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAKnC;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAKpC;AAED,wBAAgB,SAAS,IAAI,MAAM,CAIlC"}
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/db/paths.ts"],"names":[],"mappings":"AA6BA,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;AAOxC,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC1C;AAmDD,wBAAgB,OAAO,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,CAE7D;AACD,wBAAgB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,CAE9D;AAWD;;;GAGG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAKnC;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAKpC;AAED,wBAAgB,SAAS,IAAI,MAAM,CAIlC"}

package/dist/generated/storage-kit/backend.d.ts

@@ -0,0 +1,19 @@
+export declare const SERVER_DATA_BACKENDS: readonly ["postgresql"];
+export type ServerDataBackend = (typeof SERVER_DATA_BACKENDS)[number];
+export type Env = Record<string, string | undefined>;
+/** Upper-snake env token for an app name, e.g. `todos` -> `TODOS`. */
+export declare function envToken(name: string): string;
+export interface ServerDataBackendEnvKeys {
+    databaseUrlKeys: string[];
+}
+export declare function serverDataBackendEnvKeys(name: string): ServerDataBackendEnvKeys;
+export interface ServerDataBackendResolution {
+    backend: ServerDataBackend;
+    source: string;
+    databaseUrlPresent: boolean;
+    databaseUrlSource: string;
+}
+export declare function resolveServerDataBackend(name: string, env?: Env): ServerDataBackendResolution;
+/** Resolve the required PostgreSQL URL without logging it. */
+export declare function resolveDatabaseUrl(name: string, env?: Env): string;
+//# sourceMappingURL=backend.d.ts.map

package/dist/generated/storage-kit/backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../../../src/generated/storage-kit/backend.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,oBAAoB,yBAA0B,CAAC;AAC5D,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAErD,sEAAsE;AACtE,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED,MAAM,WAAW,wBAAwB;IACvC,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,wBAAwB,CAK/E;AA8CD,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,iBAAiB,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,OAAO,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,GAAG,GAAE,GAAiB,GACrB,2BAA2B,CAS7B;AAED,8DAA8D;AAC9D,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,GAAiB,GAAG,MAAM,CAG/E"}

package/dist/generated/storage-kit/index.d.ts

@@ -1,4 +1,5 @@
-export declare const KIT_VERSION = "0.4.2";
+export declare const KIT_VERSION = "1.0.2";
+export * from "./backend.js";
 export * from "./tls.js";
 export * from "./query.js";
 export * from "./pool.js";

package/dist/generated/storage-kit/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/generated/storage-kit/index.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,WAAW,UAAU,CAAC;AAEnC,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/generated/storage-kit/index.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,WAAW,UAAU,CAAC;AAEnC,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC"}

package/dist/generated/storage-kit/migrations.d.ts

@@ -27,11 +27,32 @@ export declare function checksumSql(sql: string): string;
 export declare function defineMigration(id: string, sql: string): Migration;
 export interface MigrationRunnerOptions {
     ledgerTable?: string;
+    /**
+     * Applied-ledger rows whose ids the build ACKNOWLEDGES as non-reproducible
+     * history: a migration that was applied to the ledger by an out-of-band
+     * operation or by a build whose id scheme no longer exists, so no current
+     * source can reproduce its id or its SQL.
+     *
+     * An acknowledged id:
+     *   - passes the downgrade guard (it IS recognized — as history),
+     *   - is never checksum-compared (its SQL is gone, so no checksum can be
+     *     computed for it; storing an arbitrary placeholder in `checksum` is
+     *     what the prod ledger already holds for such rows),
+     *   - is never re-applied and never re-inserted (it is already in the
+     *     ledger; the plan covers declared migrations only).
+     *
+     * The list is EXPLICIT and OPT-IN: an acknowledged id may not also be a
+     * declared migration (enforced at construction), and any OTHER applied row
+     * unknown to the build still fails the downgrade guard. Every declared
+     * migration keeps its checksum bind unchanged.
+     */
+    acknowledgedLegacyIds?: readonly string[];
 }
 export declare class MigrationLedger {
     private readonly client;
     private readonly migrations;
     private readonly ledgerTable;
+    private readonly acknowledgedLegacyIds;
     constructor(client: TypedQueryClient, migrations: readonly Migration[], options?: MigrationRunnerOptions);
     ensureLedger(): Promise<void>;
     listApplied(): Promise<AppliedMigration[]>;

package/dist/generated/storage-kit/migrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../../src/generated/storage-kit/migrations.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,2EAA2E;AAC3E,eAAO,MAAM,8BAA8B,sBAAsB,CAAC;AAElE,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,MAAM,cAAc,GAAG,iBAAiB,GAAG,SAAS,CAAC;AAE3D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,gBAAgB,EAAE,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,EAAE,CAAC;CACpC;AAED,yDAAyD;AACzD,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG/C;AAED,0EAA0E;AAC1E,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAElE;AAQD,MAAM,WAAW,sBAAsB;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qBAAa,eAAe;IAIxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAJ7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAGlB,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,SAAS,SAAS,EAAE,EACjD,OAAO,GAAE,sBAA2B;IAUhC,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAU7B,WAAW,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAKlC,WAAW;IAWzB,oEAAoE;IACpE,OAAO,CAAC,SAAS;IAsBjB,yEAAyE;IACnE,OAAO,CAAC,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,eAAe,CAAC;CAiBzE;AAED,kEAAkE;AAClE,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,SAAS,SAAS,EAAE,EAChC,OAAO,GAAE,sBAA2B,GACnC,eAAe,CAEjB"}
+{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../../src/generated/storage-kit/migrations.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAuEnD,2EAA2E;AAC3E,eAAO,MAAM,8BAA8B,sBAAsB,CAAC;AAElE,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,MAAM,cAAc,GAAG,iBAAiB,GAAG,SAAS,CAAC;AAE3D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,gBAAgB,EAAE,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,EAAE,CAAC;CACpC;AAED,yDAAyD;AACzD,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG/C;AAED,0EAA0E;AAC1E,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAElE;AAQD,MAAM,WAAW,sBAAsB;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;;;;;;;;;OAkBG;IACH,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED,qBAAa,eAAe;IAKxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAL7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAsB;gBAGzC,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,SAAS,SAAS,EAAE,EACjD,OAAO,GAAE,sBAA2B;IA2BhC,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAU7B,WAAW,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAKlC,WAAW;IAWzB,oEAAoE;IACpE,OAAO,CAAC,SAAS;IA0BjB,yEAAyE;IACnE,OAAO,CAAC,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,eAAe,CAAC;CAqBzE;AAED,kEAAkE;AAClE,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,SAAS,SAAS,EAAE,EAChC,OAAO,GAAE,sBAA2B,GACnC,eAAe,CAEjB"}

package/dist/generated/storage-kit/own.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Read `key` from `source` only when `source` OWNS it.
+ *
+ * Returns `undefined` for an inherited property and for a null/undefined or
+ * non-object source, so a guarded read is a drop-in for `source?.[key]` that
+ * cannot be answered by the prototype chain.
+ */
+export declare function ownProp<T>(source: unknown, key: string): T | undefined;
+/** `ownProp` narrowed to a string, so a polluted non-string cannot slip through. */
+export declare function ownString(source: unknown, key: string): string | undefined;
+//# sourceMappingURL=own.d.ts.map

package/dist/generated/storage-kit/own.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"own.d.ts","sourceRoot":"","sources":["../../../src/generated/storage-kit/own.ts"],"names":[],"mappings":"AAyCA;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAMtE;AAED,oFAAoF;AACpF,wBAAgB,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG1E"}

package/dist/generated/storage-kit/pool.d.ts

@@ -1,15 +1,6 @@
 import type { Pool } from "pg";
 import { type TlsResolveOptions } from "./tls.js";
 import { type PoolQueryClient } from "./query.js";
-type KitEnv = Record<string, string | undefined>;
-/** Throw when a retired storage-mode variable is set for an app. Safe to call
- * from any server backend resolver: a no-op when no legacy key is set. */
-export declare function assertNoRetiredStorageMode(appName: string, env?: KitEnv): void;
-/** Resolve the Postgres DSN from the standard env aliases, never logging it. */
-export declare function resolveDatabaseUrl(appName: string, env?: KitEnv): {
-    value: string | null;
-    source: string | null;
-};
 export interface CreatePgPoolOptions extends TlsResolveOptions {
     connectionString: string;
     /** Max clients in the pool. Defaults to pg's default (10). */
@@ -23,22 +14,19 @@ export interface CreatePgPoolOptions extends TlsResolveOptions {
 }
 /** Build a `pg.Pool` with fleet-standard TLS handling. */
 export declare function createPgPool(options: CreatePgPoolOptions): Pool;
-export interface CreateCloudPoolFromEnvOptions extends TlsResolveOptions {
+export interface CreateServerPoolFromEnvOptions extends TlsResolveOptions {
     max?: number;
     idleTimeoutMillis?: number;
     connectionTimeoutMillis?: number;
     applicationName?: string;
 }
-export interface CloudPoolFromEnv {
+export interface ServerPoolFromEnv {
     client: PoolQueryClient;
     connectionSource: string;
 }
 /**
- * Resolve the database URL from the environment and build a cloud pool.
- *
- * Throws when a retired storage-mode variable is set (deployment modes no
- * longer exist) or when the database URL is missing. Never logs the URL.
+ * Resolve the required database URL and build the server's PostgreSQL pool.
+ * Missing or invalid configuration throws without logging the URL.
  */
-export declare function createCloudPoolFromEnv(appName: string, options?: CreateCloudPoolFromEnvOptions): CloudPoolFromEnv;
-export {};
+export declare function createServerPoolFromEnv(appName: string, options?: CreateServerPoolFromEnvOptions): ServerPoolFromEnv;
 //# sourceMappingURL=pool.d.ts.map

package/dist/generated/storage-kit/pool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pool.d.ts","sourceRoot":"","sources":["../../../src/generated/storage-kit/pool.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,IAAI,CAAC;AAC3C,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,UAAU,CAAC;AACpE,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAErE,KAAK,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AASjD;0EAC0E;AAC1E,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,GAAE,MAAoB,GAAG,IAAI,CAY3F;AAED,gFAAgF;AAChF,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,GAAE,MAAoB,GAAG;IAC9E,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAOA;AAED,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,gBAAgB,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,2CAA2C;IAC3C,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,yEAAyE;IACzE,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAe/D;AAED,MAAM,WAAW,6BAA8B,SAAQ,iBAAiB;IACtE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,eAAe,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,6BAAkC,GAC1C,gBAAgB,CA0BlB"}
+{"version":3,"file":"pool.d.ts","sourceRoot":"","sources":["../../../src/generated/storage-kit/pool.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,IAAI,CAAC;AAE3C,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAgDrE,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,gBAAgB,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,2CAA2C;IAC3C,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,yEAAyE;IACzE,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAmC/D;AAED,MAAM,WAAW,8BAA+B,SAAQ,iBAAiB;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,eAAe,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,8BAAmC,GAC3C,iBAAiB,CAcnB"}

package/dist/generated/storage-kit/query.d.ts

@@ -17,7 +17,7 @@ export interface PgExecutor {
 export interface TypedQueryClient {
     query<T extends QueryResultRow>(sql: string, params?: readonly unknown[]): Promise<QueryResult<T>>;
     many<T extends QueryResultRow>(sql: string, params?: readonly unknown[]): Promise<T[]>;
-    /** First row or `null`. Restored here after open-knowledge dropped it. */
+    /** First row or `null`. Restored here after knowledge dropped it. */
     get<T extends QueryResultRow>(sql: string, params?: readonly unknown[]): Promise<T | null>;
     /** Exactly one row; throws if zero or more than one row is returned. */
     one<T extends QueryResultRow>(sql: string, params?: readonly unknown[]): Promise<T>;

package/dist/generated/storage-kit/query.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../../src/generated/storage-kit/query.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,IAAI,EAAc,cAAc,EAAE,MAAM,IAAI,CAAC;AAE3D,MAAM,WAAW,WAAW,CAAC,CAAC,SAAS,cAAc;IACnD,IAAI,EAAE,CAAC,EAAE,CAAC;IACV,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,CAAC,SAAS,cAAc,EAC5B,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAC1B,OAAO,CAAC;QAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,CAAC,SAAS,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IACnG,IAAI,CAAC,CAAC,SAAS,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IACvF,0EAA0E;IAC1E,GAAG,CAAC,CAAC,SAAS,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3F,wEAAwE;IACxE,GAAG,CAAC,CAAC,SAAS,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACpF,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAED,8FAA8F;AAC9F,wBAAgB,YAAY,CAAC,QAAQ,EAAE,UAAU,GAAG,gBAAgB,CAyBnE;AAED,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;IACvD,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,kFAAkF;IAClF,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,yDAAyD;AACzD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,GAAG,eAAe,CA2B7D"}
+{"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../../src/generated/storage-kit/query.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,IAAI,EAAc,cAAc,EAAE,MAAM,IAAI,CAAC;AAE3D,MAAM,WAAW,WAAW,CAAC,CAAC,SAAS,cAAc;IACnD,IAAI,EAAE,CAAC,EAAE,CAAC;IACV,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,CAAC,SAAS,cAAc,EAC5B,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAC1B,OAAO,CAAC;QAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,CAAC,SAAS,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IACnG,IAAI,CAAC,CAAC,SAAS,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IACvF,qEAAqE;IACrE,GAAG,CAAC,CAAC,SAAS,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3F,wEAAwE;IACxE,GAAG,CAAC,CAAC,SAAS,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACpF,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAED,8FAA8F;AAC9F,wBAAgB,YAAY,CAAC,QAAQ,EAAE,UAAU,GAAG,gBAAgB,CAyBnE;AAED,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;IACvD,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,kFAAkF;IAClF,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,yDAAyD;AACzD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,GAAG,eAAe,CA2B7D"}

package/dist/generated/storage-kit/tls.d.ts

@@ -2,6 +2,9 @@
 export type PgSslConfig = boolean | {
     rejectUnauthorized: boolean;
     ca?: string;
+    cert?: string;
+    key?: string;
+    passphrase?: string;
 };
 export interface TlsResolveOptions {
     /** Inline CA bundle (PEM). Wins over every other CA source. */
@@ -12,15 +15,39 @@ export interface TlsResolveOptions {
     env?: Record<string, string | undefined>;
 }
 export type SslMode = "disable" | "prefer" | "require" | "verify-ca" | "verify-full";
+/**
+ * Remove the TLS query parameters once this module has resolved them into an
+ * explicit `ssl` option. pg re-parses `connectionString` AFTER merging pool
+ * options and lets the parse win, so leaving `sslmode` (or `ssl`, `sslcert`,
+ * `sslkey`, `sslrootcert`, `sslnegotiation`) in the URL replaces the resolved
+ * SSL object with pg's own — discarding the CA bundle with it.
+ *
+ * Non-TLS parameters and any fragment are preserved exactly.
+ */
+export declare function connectionStringWithoutTlsParameters(connectionString: string): string;
+/**
+ * Preserve pg's transport negotiation choice outside the stripped URL, so
+ * `sslnegotiation=direct` survives as an explicit pool option instead of being
+ * silently dropped.
+ */
+export declare function sslNegotiationFromConnectionString(connectionString: string): "postgres" | "direct" | undefined;
 /**
  * Extract the effective `sslmode` from a Postgres connection string. Honors the
- * `sslmode` query param and the legacy `ssl=true` boolean. Returns `disable`
- * when TLS is not requested.
+ * `sslmode` query param, the legacy `ssl=true` boolean, and pg's rule that
+ * `sslnegotiation=direct` implies TLS when no explicit SSL setting is present.
+ * Returns `disable` when TLS is not requested.
  */
 export declare function sslModeFromConnectionString(connectionString: string): SslMode;
 /**
  * Resolve the `pg` ssl config for a connection string. See the module header
- * for the full mode table. Returns `undefined` when TLS should be off.
+ * for the full mode table.
+ *
+ * Returns `false` when TLS was explicitly switched off, and `undefined` when the
+ * DSN expressed no TLS policy at all — those are different answers, and pg
+ * treats them differently: only `undefined` lets `PGSSLMODE` decide.
+ *
+ * The caller MUST hand pg `connectionStringWithoutTlsParameters(connectionString)`
+ * rather than the original DSN, or pg discards everything resolved here.
  */
 export declare function resolveTlsConfig(connectionString: string, options?: TlsResolveOptions): PgSslConfig | undefined;
 //# sourceMappingURL=tls.d.ts.map

package/dist/generated/storage-kit/tls.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tls.d.ts","sourceRoot":"","sources":["../../../src/generated/storage-kit/tls.ts"],"names":[],"mappings":"AAkCA,iEAAiE;AACjE,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG;IAAE,kBAAkB,EAAE,OAAO,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjF,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC1C;AAED,MAAM,MAAM,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,aAAa,CAAC;AAErF;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAwB7E;AAUD;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,gBAAgB,EAAE,MAAM,EACxB,OAAO,GAAE,iBAAsB,GAC9B,WAAW,GAAG,SAAS,CA2BzB"}
+{"version":3,"file":"tls.d.ts","sourceRoot":"","sources":["../../../src/generated/storage-kit/tls.ts"],"names":[],"mappings":"AAwNA,iEAAiE;AACjE,MAAM,MAAM,WAAW,GACnB,OAAO,GACP;IACE,kBAAkB,EAAE,OAAO,CAAC;IAC5B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEN,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC1C;AAED,MAAM,MAAM,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,aAAa,CAAC;AA+BrF;;;;;;;;GAQG;AACH,wBAAgB,oCAAoC,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAOrF;AAgBD;;;;GAIG;AACH,wBAAgB,kCAAkC,CAChD,gBAAgB,EAAE,MAAM,GACvB,UAAU,GAAG,QAAQ,GAAG,SAAS,CAKnC;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAmD7E;AA6CD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,gBAAgB,EAAE,MAAM,EACxB,OAAO,GAAE,iBAAsB,GAC9B,WAAW,GAAG,SAAS,CAgEzB"}

package/dist/index.d.ts

@@ -3,7 +3,7 @@ export type { ContactProjectMembershipListResult, ContactProjectMembershipMutati
 export { ContactProjectMembershipConflictError } from "./types/project-memberships.js";
 export type { EmailType, PhoneType, AddressType, SocialPlatform, RelationshipType, ContactSource, PreferredContactMethod, ContactStatus, Sensitivity, EntityType, CompanyRelationshipType, VendorCommType, VendorCommDirection, VendorCommStatus, ApplicationType, ApplicationStatus, ApplicationMethod, DealStage, EventType, Email, Phone, Address, SocialProfile, Tag, Contact, ContactWithDetails, Company, CompanyWithDetails, ContactRelationship, CompanyRelationship, ActivityLog, Webhook, Group, CreateGroupInput, UpdateGroupInput, ContactNote, OrgMember, VendorCommunication, EscalationRule, ContactTask, Application, Deal, ContactEvent, CreateEmailInput, CreatePhoneInput, CreateAddressInput, CreateSocialProfileInput, CreateTagInput, UpdateTagInput, CreateContactInput, UpdateContactInput, ContactListOptions, CreateCompanyInput, UpdateCompanyInput, CompanyListOptions, CreateRelationshipInput, CreateCompanyRelationshipInput, CreateActivityInput, CreateWebhookInput, UpdateWebhookInput, DuplicateByEmail, DuplicateByName, CreateOrgMemberInput, UpdateOrgMemberInput, CreateVendorCommunicationInput, UpdateVendorCommunicationInput, CreateContactTaskInput, UpdateContactTaskInput, CreateApplicationInput, UpdateApplicationInput, ListApplicationsOptions, CreateDealInput, UpdateDealInput, CreateEventInput, AudienceChannel, ConsentStatus, ConsentPolicy, AudienceMatch, AudiencePredicateKind, AudiencePredicateOp, AudiencePredicateValue, AudiencePredicate, Audience, AudienceRow, CreateAudienceInput, UpdateAudienceInput, ContactConsent, ContactSuppression, AudienceRecipient, AudienceExclusion, AudienceResolution, ContactRow, CompanyRow, EmailRow, PhoneRow, AddressRow, SocialProfileRow, TagRow, RelationshipRow, ActivityRow, WebhookRow, } from "./types/index.js";
 export { ContactNotFoundError, CompanyNotFoundError, TagNotFoundError, DuplicateTagNameError, AudienceNotFoundError, DuplicateAudienceIdError, InvalidAudienceDefinitionError, AUDIENCE_CHANNELS, CONSENT_STATUSES, CONSENT_POLICIES, } from "./types/index.js";
-export { ContactsV1Client, ContactsV1ApiError, } from "./sdk/index.js";
-export type { ContactsV1ClientOptions, ContactsV1Contact, ContactsV1Company, ContactsV1Tag, ContactsV1CreateContactInput, ContactsV1UpdateContactInput, ContactsV1CreateCompanyInput, ContactsV1UpdateCompanyInput, ContactsV1CreateTagInput, ContactsV1UpdateTagInput, ContactsV1ProjectMembershipSnapshot, ContactsV1ProjectMembershipMutationInput, ContactsV1ProjectMembershipMutationResult, ContactsV1ProjectMembershipListResult, } from "./sdk/index.js";
+export { ContactsV1Client, ContactsV1ApiError, createContactsClient, contactsSdkAuthorityPinMessage, } from "./sdk/index.js";
+export type { ContactsV1ClientOptions, CreateContactsClientOptions, ContactsV1Contact, ContactsV1Company, ContactsV1Tag, ContactsV1CreateContactInput, ContactsV1UpdateContactInput, ContactsV1CreateCompanyInput, ContactsV1UpdateCompanyInput, ContactsV1CreateTagInput, ContactsV1UpdateTagInput, ContactsV1ProjectMembershipSnapshot, ContactsV1ProjectMembershipMutationInput, ContactsV1ProjectMembershipMutationResult, ContactsV1ProjectMembershipListResult, } from "./sdk/index.js";
 export { buildV1OpenApiDocument } from "./server/openapi.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,QAAQ,EACR,eAAe,EACf,mBAAmB,EACnB,KAAK,KAAK,EACV,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,kCAAkC,EAClC,yCAAyC,EACzC,qCAAqC,EACrC,sCAAsC,EACtC,gCAAgC,GACjC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,qCAAqC,EAAE,MAAM,gCAAgC,CAAC;AAGvF,YAAY,EAEV,SAAS,EACT,SAAS,EACT,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,sBAAsB,EACtB,aAAa,EACb,WAAW,EACX,UAAU,EACV,uBAAuB,EACvB,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,SAAS,EACT,SAAS,EAET,KAAK,EACL,KAAK,EACL,OAAO,EACP,aAAa,EAEb,GAAG,EACH,OAAO,EACP,kBAAkB,EAClB,OAAO,EACP,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,EACX,OAAO,EACP,KAAK,EACL,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,SAAS,EACT,mBAAmB,EACnB,cAAc,EACd,WAAW,EACX,WAAW,EACX,IAAI,EACJ,YAAY,EAEZ,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,wBAAwB,EACxB,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,8BAA8B,EAC9B,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EACpB,oBAAoB,EACpB,8BAA8B,EAC9B,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,eAAe,EACf,eAAe,EACf,gBAAgB,EAEhB,eAAe,EACf,aAAa,EACb,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,EACjB,QAAQ,EACR,WAAW,EACX,mBAAmB,EACnB,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAElB,UAAU,EACV,UAAU,EACV,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,gBAAgB,EAChB,MAAM,EACN,eAAe,EACf,WAAW,EACX,UAAU,GACX,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAEL,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,8BAA8B,EAE9B,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,4BAA4B,EAC5B,4BAA4B,EAC5B,4BAA4B,EAC5B,4BAA4B,EAC5B,wBAAwB,EACxB,wBAAwB,EACxB,mCAAmC,EACnC,wCAAwC,EACxC,yCAAyC,EACzC,qCAAqC,GACtC,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,QAAQ,EACR,eAAe,EACf,mBAAmB,EACnB,KAAK,KAAK,EACV,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,kCAAkC,EAClC,yCAAyC,EACzC,qCAAqC,EACrC,sCAAsC,EACtC,gCAAgC,GACjC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,qCAAqC,EAAE,MAAM,gCAAgC,CAAC;AAGvF,YAAY,EAEV,SAAS,EACT,SAAS,EACT,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,sBAAsB,EACtB,aAAa,EACb,WAAW,EACX,UAAU,EACV,uBAAuB,EACvB,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,SAAS,EACT,SAAS,EAET,KAAK,EACL,KAAK,EACL,OAAO,EACP,aAAa,EAEb,GAAG,EACH,OAAO,EACP,kBAAkB,EAClB,OAAO,EACP,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,EACX,OAAO,EACP,KAAK,EACL,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,SAAS,EACT,mBAAmB,EACnB,cAAc,EACd,WAAW,EACX,WAAW,EACX,IAAI,EACJ,YAAY,EAEZ,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,wBAAwB,EACxB,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,8BAA8B,EAC9B,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EACpB,oBAAoB,EACpB,8BAA8B,EAC9B,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,eAAe,EACf,eAAe,EACf,gBAAgB,EAEhB,eAAe,EACf,aAAa,EACb,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,EACjB,QAAQ,EACR,WAAW,EACX,mBAAmB,EACnB,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAElB,UAAU,EACV,UAAU,EACV,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,gBAAgB,EAChB,MAAM,EACN,eAAe,EACf,WAAW,EACX,UAAU,GACX,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAEL,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,8BAA8B,EAE9B,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,8BAA8B,GAC/B,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,uBAAuB,EACvB,2BAA2B,EAC3B,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,4BAA4B,EAC5B,4BAA4B,EAC5B,4BAA4B,EAC5B,4BAA4B,EAC5B,wBAAwB,EACxB,wBAAwB,EACxB,mCAAmC,EACnC,wCAAwC,EACxC,yCAAyC,EACzC,qCAAqC,GACtC,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC"}