@keystrokehq/snowflake 0.0.1

package/README.md

@@ -0,0 +1,247 @@
+# @keystrokehq/snowflake
+
+Official Keystroke integration for the Snowflake Data Cloud. One package wraps the Snowflake SQL API v2, Snowpipe file REST, Snowpipe Streaming, Streams, Tasks, Warehouses, Roles, Users, Grants, Shares, account admin, and the public Snowflake status page behind a typed, `fetch`-based HTTPS client — plus 22 polling triggers and 3 auto-ingest webhook triggers.
+
+No Node-native dependencies. The runtime is built on `fetch` + `SubtleCrypto`, so it runs in Cloudflare Workers and other isolate tiers without any shim.
+
+See `PLAN.md` for the full action/trigger enumeration and `IMPLEMENTATION_NOTES.md` for the decisions that shipped with this build.
+
+## Install
+
+```bash
+pnpm add @keystrokehq/snowflake
+```
+
+## Credentials
+
+The public `snowflake` connection accepts four auth modes via a discriminated union on `mode`:
+
+| Mode | When to use |
+|------|-------------|
+| `keypair` | Service accounts with an RSA key pair registered on the Snowflake user (recommended). |
+| `oauth` | External IdP or Snowflake-hosted OAuth — supply a bearer access token, optionally refreshable. |
+| `pat` | Programmatic Access Token (Snowflake preview). |
+| `basic` | Legacy username + password. Emits a deprecation warning at client creation time. |
+
+Shared required fields: `SNOWFLAKE_ACCOUNT`, plus `SNOWFLAKE_USER` for any non-OAuth mode. Optional session fields — `SNOWFLAKE_ROLE`, `SNOWFLAKE_WAREHOUSE`, `SNOWFLAKE_DATABASE`, `SNOWFLAKE_SCHEMA`, `SNOWFLAKE_HOST`, `SNOWFLAKE_REGION` — are honored by every operation when the input does not provide an override.
+
+Example vault values for key-pair mode:
+
+```ts
+import type { SnowflakeCredentials } from '@keystrokehq/snowflake/connection';
+
+const credentials: SnowflakeCredentials = {
+  mode: 'keypair',
+  SNOWFLAKE_ACCOUNT: 'my-org-my-account',
+  SNOWFLAKE_USER: 'KEYSTROKE_SVC',
+  SNOWFLAKE_PRIVATE_KEY: '-----BEGIN PRIVATE KEY-----\n...',
+  SNOWFLAKE_ROLE: 'KEYSTROKE_ROLE',
+  SNOWFLAKE_WAREHOUSE: 'KEYSTROKE_WH',
+};
+```
+
+## Client
+
+All domain functions accept a `SnowflakeClient` produced by `createSnowflakeClient(credentials)`. The client is stateless other than an internal OAuth/keypair JWT cache; reuse a single client across many operations.
+
+```ts
+import { createSnowflakeClient } from '@keystrokehq/snowflake/client';
+
+const client = createSnowflakeClient(credentials);
+```
+
+## Quickstart
+
+### Execute a statement
+
+```ts
+import { executeSql } from '@keystrokehq/snowflake/sql';
+
+const result = await executeSql(client, {
+  statement: 'SELECT 1 AS ping',
+  timeout: 60,
+});
+
+for (const row of result.rows) {
+  console.log(row);
+}
+```
+
+### Find rows with parameter binding
+
+```ts
+import { findRows } from '@keystrokehq/snowflake/rows';
+
+const rows = await findRows(client, {
+  database: 'ANALYTICS',
+  schema: 'PUBLIC',
+  table: 'ORDERS',
+  where: { STATUS: 'OPEN' },
+  orderBy: [{ column: 'CREATED_AT', direction: 'DESC' }],
+  limit: 100,
+});
+```
+
+### Show tables in a schema
+
+```ts
+import { showTables } from '@keystrokehq/snowflake/catalog';
+
+const tables = await showTables(client, {
+  database: 'ANALYTICS',
+  schema: 'PUBLIC',
+});
+```
+
+### Run a task on demand
+
+```ts
+import { executeTask } from '@keystrokehq/snowflake/tasks';
+
+await executeTask(client, {
+  database: 'ANALYTICS',
+  schema: 'PUBLIC',
+  name: 'REFRESH_FACTS',
+});
+```
+
+### Refresh a pipe + insert files over Snowpipe REST
+
+```ts
+import { insertFiles, refreshPipe } from '@keystrokehq/snowflake/pipes';
+
+await refreshPipe(client, {
+  database: 'ANALYTICS',
+  schema: 'RAW',
+  name: 'ORDERS_PIPE',
+});
+
+await insertFiles(client, {
+  database: 'ANALYTICS',
+  schema: 'RAW',
+  name: 'ORDERS_PIPE',
+  files: [{ path: 'orders/2026/04/20.parquet' }],
+});
+```
+
+## Triggers
+
+### Polling trigger — new rows on a stream
+
+```ts
+import { polling } from '@keystrokehq/snowflake/triggers';
+
+const bound = polling.streamHasNewRows({
+  streamName: 'ANALYTICS.PUBLIC.ORDERS_STREAM',
+  schedule: '*/5 * * * *',
+  name: 'Orders stream has new rows',
+  transform: (event) => ({
+    streamName: event.streamName,
+    checkedAt: event.checkedAt,
+  }),
+});
+```
+
+### Polling trigger — signature-diff on `SHOW GRANTS`
+
+```ts
+import { polling } from '@keystrokehq/snowflake/triggers';
+
+const grants = polling.grantsChanged({
+  grantee: { role: 'KEYSTROKE_ROLE' },
+  schedule: '15m',
+});
+```
+
+### Auto-ingest webhook — AWS SNS
+
+```ts
+import { webhooks } from '@keystrokehq/snowflake/triggers';
+
+const s3Sns = webhooks.autoIngestS3Sns({
+  name: 'Snowpipe via SNS',
+  transform: (batch) => ({
+    bucket: batch.events[0]?.bucket,
+    objects: batch.events.length,
+  }),
+});
+```
+
+### Auto-ingest webhook — GCS Pub/Sub push
+
+```ts
+import { webhooks } from '@keystrokehq/snowflake/triggers';
+
+const gcs = webhooks.autoIngestGcsPubSub({
+  transform: (batch) => ({ objects: batch.events.length }),
+});
+```
+
+### Auto-ingest webhook — Azure Event Grid
+
+```ts
+import { webhooks } from '@keystrokehq/snowflake/triggers';
+
+const eg = webhooks.autoIngestAzureEventGrid({
+  transform: (batch) => ({ objects: batch.events.length }),
+});
+```
+
+## Verification helpers
+
+Every auto-ingest webhook verifies itself through the `verify` callback wired by the trigger factory. The underlying helpers are also exported for direct use — for example, from an edge proxy that wants to reject unsigned requests before the payload reaches a workflow.
+
+```ts
+import {
+  SnowflakeWebhookVerificationError,
+  verifyEventGridRequest,
+  verifyPubSubPushAuthorization,
+  verifySnsMessage,
+} from '@keystrokehq/snowflake/verification';
+
+try {
+  await verifySnsMessage(rawBody, {
+    expectedTopicArn: 'arn:aws:sns:us-east-1:123456789012:snowpipe-orders',
+  });
+} catch (err) {
+  if (err instanceof SnowflakeWebhookVerificationError) {
+    // err.reason ∈ 'invalid-json' | 'schema' | 'topic-arn' | 'signing-cert-host' | 'signature' | ...
+  }
+}
+```
+
+## Public surface
+
+- `@keystrokehq/snowflake/connection` — `snowflake` credential set, `snowflakeBundle`, and credential types.
+- `@keystrokehq/snowflake/client` — `createSnowflakeClient(credentials, options?)` for direct SQL API access.
+- `@keystrokehq/snowflake/schemas` — shared Zod schemas (statements, results, pipes, catalog, and more).
+- `@keystrokehq/snowflake/events` — curated Zod event contracts emitted by each trigger.
+- `@keystrokehq/snowflake/triggers` — `polling`, `webhooks`, and `autoIngest` direct-binding helpers.
+- `@keystrokehq/snowflake/verification` — auto-ingest cloud-event verification (SNS, Pub/Sub, Event Grid).
+
+### Operation domains
+
+- `sql` — `submitStatement`, `getStatement`, `cancelStatement`, `executeSql`, `runQuery`, `getStatementResultPartition`, `iterateStatementResult`, `waitForStatement`.
+- `results` — partition iteration + row hydration helpers.
+- `catalog` — `SHOW`/`DESCRIBE` across databases, schemas, tables, views, columns, warehouses, roles, users, stages, pipes, tasks, streams, shares, functions, procedures, file formats, grants; plus Relay-style `findDatabases`/`findSchemas`/`findTables` and BASIC-parity `describeTable`/`exploreColumns`.
+- `rows` — `findRow`, `findRows`, `insertRow`, `batchInsert`, `updateRow`, `deleteRow`, `upsertRow`, `mergeRows`.
+- `databases`, `schemas-catalog`, `tables`, `views`, `stages`, `file-formats`, `streams`, `tasks`, `warehouses`, `roles`, `users`, `grants`, `shares`, `functions`, `procedures`, `accounts`, `org-admin` — DDL + admin.
+- `pipes`, `streaming`, `bulk` — Snowpipe file REST, Snowpipe Streaming channels, stage-oriented bulk helpers.
+- `status-page` — Composio-parity Snowflake status page endpoints.
+
+### Internal repo-only surfaces
+
+- `@keystrokehq/snowflake/_official`
+- `@keystrokehq/snowflake/_runtime`
+
+Do not import these from end-user code.
+
+## Safety
+
+- Destructive DDL operations (`dropTable`, `dropDatabase`, `dropSchema`, `dropUser`, `dropRole`, `dropWarehouse`, `dropShare`, etc.) require an explicit `confirm: true` input and are marked `needsApproval: true` where surfaced through the operation factory.
+- The package never streams file bytes directly through the SQL API. File-oriented helpers (`putFile`, `getFile`) orchestrate `PUT @stage` / `GET @stage` SQL statements and return the result; binary payloads must be supplied through an external stage with its own cloud credentials.
+- `basic` auth emits `console.warn` at client creation time; Snowflake has deprecated password-only programmatic access.
+
+## License
+
+MIT

package/dist/_official/index.d.mts

@@ -0,0 +1,2 @@
+import { c as snowflakeOfficialIntegration, i as snowflake, s as snowflakeBundle } from "../integration-CCWMSTlO.mjs";
+export { snowflake, snowflakeBundle, snowflakeOfficialIntegration };

package/dist/_official/index.mjs

@@ -0,0 +1,3 @@
+import { a as snowflakeBundle, n as snowflake, o as snowflakeOfficialIntegration } from "../integration-Dptv8L0L.mjs";
+
+export { snowflake, snowflakeBundle, snowflakeOfficialIntegration };

package/dist/_runtime/index.d.mts

@@ -0,0 +1 @@
+export { };

package/dist/_runtime/index.mjs

@@ -0,0 +1 @@
+export {  };

package/dist/accounts.d.mts

@@ -0,0 +1,40 @@
+import { SnowflakeClient } from "./client.mjs";
+import { d as HydratedRow, m as ColumnMeta } from "./statements-DJL0qVNA.mjs";
+//#region src/accounts.d.ts
+interface AccountContext {
+  readonly warehouse?: string;
+  readonly role?: string;
+}
+interface DescribeAccountOptions extends AccountContext {}
+/**
+ * Returns a single-row identity snapshot for the account that the
+ * current connection is bound to. Useful as a "whoami" / health probe.
+ *
+ * The helper is deliberately a single SELECT so we don't need any
+ * privileged role; `CURRENT_*` functions work for any authenticated user.
+ */
+declare function describeAccount(client: SnowflakeClient, options?: DescribeAccountOptions): Promise<HydratedRow>;
+interface ShowRegionsOptions extends AccountContext {
+  readonly like?: string;
+}
+interface ShowRegionsResult {
+  readonly columns: readonly ColumnMeta[];
+  readonly rows: readonly HydratedRow[];
+}
+/**
+ * `SHOW REGIONS` — requires ORGADMIN. Returns the globally-available
+ * Snowflake regions along with region-group / cloud-provider metadata.
+ */
+declare function showRegions(client: SnowflakeClient, options?: ShowRegionsOptions): Promise<ShowRegionsResult>;
+interface FetchCatalogIntegrationOptions extends AccountContext {
+  readonly name: string;
+}
+/**
+ * `DESC CATALOG INTEGRATION <name>` — returns the property list for a
+ * Snowflake Iceberg catalog integration (the `SNOWFLAKE_FETCH_CATALOG_INTEGRATION`
+ * Composio op). Every row has a `property` / `value` / `default` / `description`
+ * shape.
+ */
+declare function fetchCatalogIntegration(client: SnowflakeClient, options: FetchCatalogIntegrationOptions): Promise<readonly HydratedRow[]>;
+//#endregion
+export { AccountContext, DescribeAccountOptions, FetchCatalogIntegrationOptions, ShowRegionsOptions, ShowRegionsResult, describeAccount, fetchCatalogIntegration, showRegions };

package/dist/accounts.mjs

@@ -0,0 +1,51 @@
+import { executeSql } from "./sql.mjs";
+import { i as quoteIdentifier, r as likeClause } from "./sql-safety-CywdR3EP.mjs";
+
+//#region src/accounts.ts
+/**
+* Returns a single-row identity snapshot for the account that the
+* current connection is bound to. Useful as a "whoami" / health probe.
+*
+* The helper is deliberately a single SELECT so we don't need any
+* privileged role; `CURRENT_*` functions work for any authenticated user.
+*/
+async function describeAccount(client, options = {}) {
+	const row = (await executeSql(client, {
+		statement: "SELECT CURRENT_ACCOUNT() AS ACCOUNT_LOCATOR, CURRENT_ACCOUNT_NAME() AS ACCOUNT_NAME, CURRENT_REGION() AS REGION, CURRENT_ORGANIZATION_NAME() AS ORGANIZATION_NAME, CURRENT_VERSION() AS SNOWFLAKE_VERSION, CURRENT_ROLE() AS ROLE, CURRENT_WAREHOUSE() AS WAREHOUSE, CURRENT_DATABASE() AS DATABASE, CURRENT_SCHEMA() AS SCHEMA",
+		warehouse: options.warehouse,
+		role: options.role
+	})).rows[0];
+	if (!row) throw new Error("describeAccount: Snowflake returned no rows for identity SELECT");
+	return row;
+}
+/**
+* `SHOW REGIONS` — requires ORGADMIN. Returns the globally-available
+* Snowflake regions along with region-group / cloud-provider metadata.
+*/
+async function showRegions(client, options = {}) {
+	const result = await executeSql(client, {
+		statement: `SHOW REGIONS${likeClause(options.like)}`,
+		warehouse: options.warehouse,
+		role: options.role
+	});
+	return {
+		columns: result.columns,
+		rows: result.rows
+	};
+}
+/**
+* `DESC CATALOG INTEGRATION <name>` — returns the property list for a
+* Snowflake Iceberg catalog integration (the `SNOWFLAKE_FETCH_CATALOG_INTEGRATION`
+* Composio op). Every row has a `property` / `value` / `default` / `description`
+* shape.
+*/
+async function fetchCatalogIntegration(client, options) {
+	return (await executeSql(client, {
+		statement: `DESCRIBE CATALOG INTEGRATION ${quoteIdentifier(options.name)}`,
+		warehouse: options.warehouse,
+		role: options.role
+	})).rows;
+}
+
+//#endregion
+export { describeAccount, fetchCatalogIntegration, showRegions };

package/dist/bulk.d.mts

@@ -0,0 +1,71 @@
+import { SnowflakeClient } from "./client.mjs";
+import { d as HydratedRow } from "./statements-DJL0qVNA.mjs";
+import { ExecuteSqlResult } from "./sql.mjs";
+import { t as OptionMap } from "./sql-options-2k5xQ-oS.mjs";
+import { StageRef } from "./stages.mjs";
+
+//#region src/bulk.d.ts
+interface TableRef {
+  readonly database?: string;
+  readonly schema?: string;
+  readonly table: string;
+}
+interface BulkContext {
+  readonly warehouse?: string;
+  readonly role?: string;
+}
+interface CopyIntoSourceStage {
+  readonly kind: 'stage';
+  readonly stage: StageRef;
+  readonly pathSuffix?: string;
+  readonly files?: readonly string[];
+  readonly pattern?: string;
+}
+interface CopyIntoSourceExternalLocation {
+  readonly kind: 'location';
+  /** e.g. `'s3://bucket/path/'` — caller is responsible for URL shape. */
+  readonly url: string;
+  readonly credentials?: OptionMap;
+  readonly encryption?: OptionMap;
+  readonly files?: readonly string[];
+  readonly pattern?: string;
+}
+interface CopyIntoSourceQuery {
+  readonly kind: 'query';
+  /** Pre-composed SELECT body (caller owns identifier escaping). */
+  readonly sql: string;
+}
+type CopyIntoSource = CopyIntoSourceStage | CopyIntoSourceExternalLocation | CopyIntoSourceQuery;
+interface CopyIntoOptions extends TableRef, BulkContext {
+  readonly columns?: readonly string[];
+  readonly source: CopyIntoSource;
+  readonly fileFormat?: OptionMap;
+  readonly copyOptions?: OptionMap;
+  /** `VALIDATION_MODE = RETURN_ERRORS | RETURN_ALL_ERRORS | RETURN_n_ROWS`. */
+  readonly validationMode?: string;
+  readonly onError?: string;
+  readonly force?: boolean;
+  readonly truncateColumns?: boolean;
+}
+declare function copyInto(client: SnowflakeClient, options: CopyIntoOptions): Promise<ExecuteSqlResult<HydratedRow | readonly unknown[]>>;
+declare function validateCopyInto(client: SnowflakeClient, options: CopyIntoOptions): Promise<ExecuteSqlResult<HydratedRow | readonly unknown[]>>;
+interface UnloadOptions extends BulkContext {
+  readonly stage: StageRef;
+  readonly pathSuffix?: string;
+  /** Pre-composed SELECT body; the helper wraps it in parens. */
+  readonly query: string;
+  readonly fileFormat?: OptionMap;
+  readonly copyOptions?: OptionMap;
+  readonly overwrite?: boolean;
+  readonly header?: boolean;
+  readonly singleFile?: boolean;
+  readonly maxFileSize?: number | bigint;
+  readonly partitionBy?: string;
+}
+declare function unload(client: SnowflakeClient, options: UnloadOptions): Promise<ExecuteSqlResult<HydratedRow | readonly unknown[]>>;
+interface TruncateTableOptions extends TableRef, BulkContext {
+  readonly ifExists?: boolean;
+}
+declare function truncateTable(client: SnowflakeClient, options: TruncateTableOptions): Promise<void>;
+//#endregion
+export { BulkContext, CopyIntoOptions, CopyIntoSource, CopyIntoSourceExternalLocation, CopyIntoSourceQuery, CopyIntoSourceStage, TableRef, TruncateTableOptions, UnloadOptions, copyInto, truncateTable, unload, validateCopyInto };

package/dist/bulk.mjs

@@ -0,0 +1,65 @@
+import { executeSql } from "./sql.mjs";
+import { a as quoteLiteral, t as buildFqn } from "./sql-safety-CywdR3EP.mjs";
+import { n as renderOptionGroup, t as formatOptions } from "./sql-options-DI-OmLU6.mjs";
+import { stagePath } from "./stages.mjs";
+
+//#region src/bulk.ts
+function tableFqn(ref) {
+	return buildFqn(ref.database, ref.schema, ref.table);
+}
+function renderSource(source) {
+	if (source.kind === "query") return `(${source.sql})`;
+	if (source.kind === "stage") return `${stagePath(source.stage, source.pathSuffix)}${source.files && source.files.length > 0 ? ` FILES = (${source.files.map(quoteLiteral).join(", ")})` : ""}${source.pattern ? ` PATTERN = ${quoteLiteral(source.pattern)}` : ""}`;
+	const files = source.files && source.files.length > 0 ? ` FILES = (${source.files.map(quoteLiteral).join(", ")})` : "";
+	const pattern = source.pattern ? ` PATTERN = ${quoteLiteral(source.pattern)}` : "";
+	const creds = renderOptionGroup("CREDENTIALS", source.credentials);
+	const enc = renderOptionGroup("ENCRYPTION", source.encryption);
+	return `${quoteLiteral(source.url)}${creds}${enc}${files}${pattern}`;
+}
+function collectCopyOptions(opts) {
+	const merged = { ...opts.copyOptions ?? {} };
+	if (opts.onError !== void 0) merged.onError = opts.onError;
+	if (opts.force !== void 0) merged.force = opts.force;
+	if (opts.truncateColumns !== void 0) merged.truncateColumns = opts.truncateColumns;
+	return Object.keys(merged).length > 0 ? merged : void 0;
+}
+async function copyInto(client, options) {
+	const columnList = options.columns && options.columns.length > 0 ? `(${options.columns.map((c) => `"${c.replaceAll("\"", "\"\"")}"`).join(", ")})` : "";
+	const copyOpts = collectCopyOptions(options);
+	return executeSql(client, {
+		statement: `COPY INTO ${tableFqn(options)}${columnList ? ` ${columnList}` : ""} FROM ${renderSource(options.source)}` + renderOptionGroup("FILE_FORMAT", options.fileFormat) + (copyOpts ? ` ${formatOptions(copyOpts)}` : "") + (options.validationMode ? ` VALIDATION_MODE = ${options.validationMode}` : ""),
+		warehouse: options.warehouse,
+		role: options.role
+	});
+}
+async function validateCopyInto(client, options) {
+	return copyInto(client, {
+		...options,
+		validationMode: options.validationMode ?? "RETURN_ERRORS"
+	});
+}
+async function unload(client, options) {
+	const scope = stagePath(options.stage, options.pathSuffix);
+	const copyOpts = { ...options.copyOptions ?? {} };
+	if (options.overwrite !== void 0) copyOpts.overwrite = options.overwrite;
+	if (options.header !== void 0) copyOpts.header = options.header;
+	if (options.singleFile !== void 0) copyOpts.singleFile = options.singleFile;
+	if (options.maxFileSize !== void 0) copyOpts.maxFileSize = options.maxFileSize;
+	const copyOptions = Object.keys(copyOpts).length > 0 ? copyOpts : void 0;
+	const partition = options.partitionBy ? ` PARTITION BY (${options.partitionBy})` : "";
+	return executeSql(client, {
+		statement: `COPY INTO ${scope} FROM (${options.query})` + renderOptionGroup("FILE_FORMAT", options.fileFormat) + (copyOptions ? ` ${formatOptions(copyOptions)}` : "") + partition,
+		warehouse: options.warehouse,
+		role: options.role
+	});
+}
+async function truncateTable(client, options) {
+	await executeSql(client, {
+		statement: `TRUNCATE TABLE${options.ifExists ? " IF EXISTS" : ""} ${tableFqn(options)}`,
+		warehouse: options.warehouse,
+		role: options.role
+	});
+}
+
+//#endregion
+export { copyInto, truncateTable, unload, validateCopyInto };

package/dist/catalog.d.mts

@@ -0,0 +1,144 @@
+import { SnowflakeClient } from "./client.mjs";
+import { d as HydratedRow } from "./statements-DJL0qVNA.mjs";
+//#region src/catalog.d.ts
+interface ShowOptions {
+  /** Optional `LIKE '<pattern>'` filter. Escaped via {@link quoteLiteral}. */
+  readonly like?: string;
+  /** Cap results. Snowflake supports `LIMIT <n>` on SHOW. */
+  readonly limit?: number;
+  /** Runtime overrides forwarded to {@link executeSql}. */
+  readonly warehouse?: string;
+  readonly role?: string;
+  readonly database?: string;
+  readonly schema?: string;
+}
+interface ShowScopedOptions extends ShowOptions {
+  /** Restrict results to the named database. */
+  readonly inDatabase?: string;
+  /** Restrict to a `DB.SCHEMA` scope. */
+  readonly inSchema?: {
+    readonly database: string;
+    readonly schema: string;
+  };
+  /** Restrict to `SHOW X IN ACCOUNT`. */
+  readonly inAccount?: boolean;
+}
+interface CatalogResult {
+  readonly rows: readonly HydratedRow[];
+  readonly columns: readonly {
+    readonly name: string;
+    readonly type: string;
+  }[];
+}
+interface ShowDatabasesOptions extends ShowOptions {}
+declare function showDatabases(client: SnowflakeClient, options?: ShowDatabasesOptions): Promise<CatalogResult>;
+interface ShowSchemasOptions extends ShowScopedOptions {
+  /** `HISTORY` variant returns dropped schemas too. */
+  readonly history?: boolean;
+}
+declare function showSchemas(client: SnowflakeClient, options?: ShowSchemasOptions): Promise<CatalogResult>;
+interface ShowTablesOptions extends ShowScopedOptions {
+  readonly history?: boolean;
+  /** Cascading to TEMPORARY + TRANSIENT + EXTERNAL tables. */
+  readonly terse?: boolean;
+}
+declare function showTables(client: SnowflakeClient, options?: ShowTablesOptions): Promise<CatalogResult>;
+interface ShowViewsOptions extends ShowScopedOptions {
+  readonly terse?: boolean;
+}
+declare function showViews(client: SnowflakeClient, options?: ShowViewsOptions): Promise<CatalogResult>;
+interface ShowMaterializedViewsOptions extends ShowScopedOptions {}
+declare function showMaterializedViews(client: SnowflakeClient, options?: ShowMaterializedViewsOptions): Promise<CatalogResult>;
+interface ShowColumnsOptions extends ShowOptions {
+  readonly inTable?: {
+    readonly database?: string;
+    readonly schema?: string;
+    readonly table: string;
+  };
+  readonly inView?: {
+    readonly database?: string;
+    readonly schema?: string;
+    readonly view: string;
+  };
+  readonly inSchema?: {
+    readonly database: string;
+    readonly schema: string;
+  };
+  readonly inDatabase?: string;
+}
+declare function showColumns(client: SnowflakeClient, options?: ShowColumnsOptions): Promise<CatalogResult>;
+declare function showWarehouses(client: SnowflakeClient, options?: ShowOptions): Promise<CatalogResult>;
+declare function showRoles(client: SnowflakeClient, options?: ShowOptions): Promise<CatalogResult>;
+declare function showUsers(client: SnowflakeClient, options?: ShowOptions): Promise<CatalogResult>;
+declare function showStages(client: SnowflakeClient, options?: ShowScopedOptions): Promise<CatalogResult>;
+declare function showPipes(client: SnowflakeClient, options?: ShowScopedOptions): Promise<CatalogResult>;
+declare function showTasks(client: SnowflakeClient, options?: ShowScopedOptions & {
+  readonly terse?: boolean;
+}): Promise<CatalogResult>;
+declare function showStreams(client: SnowflakeClient, options?: ShowScopedOptions): Promise<CatalogResult>;
+declare function showShares(client: SnowflakeClient, options?: ShowOptions): Promise<CatalogResult>;
+declare function showFunctions(client: SnowflakeClient, options?: ShowScopedOptions): Promise<CatalogResult>;
+declare function showProcedures(client: SnowflakeClient, options?: ShowScopedOptions): Promise<CatalogResult>;
+declare function showFileFormats(client: SnowflakeClient, options?: ShowScopedOptions): Promise<CatalogResult>;
+interface ShowGrantsOptions extends ShowOptions {
+  /** `SHOW GRANTS ON <object>`. Object keyword is caller-provided (TABLE, DATABASE, etc.). */
+  readonly on?: {
+    readonly objectType: string;
+    readonly name: string;
+    readonly schema?: string;
+    readonly database?: string;
+  };
+  /** `SHOW GRANTS TO {ROLE | USER | SHARE} <name>`. */
+  readonly toRole?: string;
+  readonly toUser?: string;
+  readonly toShare?: string;
+  /** `SHOW GRANTS OF ROLE <name>`. */
+  readonly ofRole?: string;
+  readonly ofShare?: string;
+}
+declare function showGrants(client: SnowflakeClient, options?: ShowGrantsOptions): Promise<CatalogResult>;
+interface DescribeTableOptions extends Pick<ShowOptions, 'warehouse' | 'role'> {
+  readonly database?: string;
+  readonly schema?: string;
+  readonly table: string;
+  /** `DESCRIBE TABLE X TYPE = STAGE | COLUMNS` (default COLUMNS). */
+  readonly type?: 'COLUMNS' | 'STAGE';
+}
+declare function describeTable(client: SnowflakeClient, options: DescribeTableOptions): Promise<CatalogResult>;
+interface ExploreColumnsOptions extends Pick<ShowOptions, 'warehouse' | 'role'> {
+  readonly database?: string;
+  readonly schema?: string;
+  readonly table: string;
+  /** Restrict to these columns; when empty, all columns are sampled. */
+  readonly columns?: readonly string[];
+  /** Distinct-value sample cap per column (default 100). */
+  readonly limit?: number;
+}
+interface ExploreColumnsResult {
+  readonly table: string;
+  readonly samples: readonly {
+    readonly column: string;
+    readonly distinctValues: readonly unknown[];
+  }[];
+}
+/**
+ * Composio `SNOWFLAKE_BASIC_EXPLORE_COLUMNS` parity — pull a small distinct
+ * sample from each requested column to help LLMs disambiguate column
+ * semantics.
+ */
+declare function exploreColumns(client: SnowflakeClient, options: ExploreColumnsOptions): Promise<ExploreColumnsResult>;
+interface FindDatabasesOptions extends ShowOptions {
+  /** Optional case-insensitive substring match applied client-side. */
+  readonly nameContains?: string;
+}
+declare function findDatabases(client: SnowflakeClient, options?: FindDatabasesOptions): Promise<CatalogResult>;
+interface FindSchemasOptions extends ShowSchemasOptions {
+  readonly nameContains?: string;
+}
+declare function findSchemas(client: SnowflakeClient, options?: FindSchemasOptions): Promise<CatalogResult>;
+interface FindTablesOptions extends ShowTablesOptions {
+  readonly nameContains?: string;
+}
+declare function findTables(client: SnowflakeClient, options?: FindTablesOptions): Promise<CatalogResult>;
+//#endregion
+export { CatalogResult, DescribeTableOptions, ExploreColumnsOptions, ExploreColumnsResult, FindDatabasesOptions, FindSchemasOptions, FindTablesOptions, ShowColumnsOptions, ShowDatabasesOptions, ShowGrantsOptions, ShowMaterializedViewsOptions, ShowOptions, ShowSchemasOptions, ShowScopedOptions, ShowTablesOptions, ShowViewsOptions, describeTable, exploreColumns, findDatabases, findSchemas, findTables, showColumns, showDatabases, showFileFormats, showFunctions, showGrants, showMaterializedViews, showPipes, showProcedures, showRoles, showSchemas, showShares, showStages, showStreams, showTables, showTasks, showUsers, showViews, showWarehouses };