@keystrokehq/snowflake 0.0.1

package/dist/procedures.mjs

@@ -0,0 +1,79 @@
+import { executeSql } from "./sql.mjs";
+import { a as quoteLiteral, t as buildFqn } from "./sql-safety-CywdR3EP.mjs";
+import { BindingBuilder } from "./rows.mjs";
+import { t as formatOptions } from "./sql-options-DI-OmLU6.mjs";
+import { showProcedures } from "./catalog.mjs";
+
+//#region src/procedures.ts
+function renderArguments(args) {
+	if (!args || args.length === 0) return "()";
+	return `(${args.map((a) => {
+		const suffix = a.defaultExpression ? ` DEFAULT ${a.defaultExpression}` : "";
+		return `${a.name} ${a.type.toUpperCase()}${suffix}`;
+	}).join(", ")})`;
+}
+function renderArgumentTypes(args) {
+	if (!args || args.length === 0) return "()";
+	return `(${args.map((a) => a.type.toUpperCase()).join(", ")})`;
+}
+function renderBody(body, forceDollarQuoted, language) {
+	if (forceDollarQuoted ?? (language !== void 0 && language !== "SQL")) {
+		if (body.includes("$$")) throw new Error("Procedure body contains \"$$\"; cannot safely dollar-quote.");
+		return `$$${body}$$`;
+	}
+	return body;
+}
+async function createProcedure(client, options) {
+	const prefix = `CREATE${options.orReplace ? " OR REPLACE" : ""}${options.secure ? " SECURE" : ""} PROCEDURE${options.ifNotExists ? " IF NOT EXISTS" : ""}`;
+	const args = renderArguments(options.arguments);
+	const language = options.language ? ` LANGUAGE ${options.language}` : "";
+	const executeAs = options.executeAs ? ` EXECUTE AS ${options.executeAs}` : "";
+	const modifiers = options.modifiers && options.modifiers.length > 0 ? ` ${options.modifiers.map((m) => m.toUpperCase()).join(" ")}` : "";
+	const body = options.options && Object.keys(options.options).length > 0 ? ` ${formatOptions(options.options)}` : "";
+	const comment = options.comment ? ` COMMENT = ${quoteLiteral(options.comment)}` : "";
+	const rendered = renderBody(options.as, options.dollarQuotedBody, options.language);
+	await executeSql(client, {
+		statement: `${prefix} ${buildFqn(options.database, options.schema, options.name)}${args} RETURNS ${options.returns}${language}${executeAs}${modifiers}${body}${comment} AS ${rendered}`,
+		warehouse: options.warehouse,
+		role: options.role
+	});
+}
+async function dropProcedure(client, options) {
+	const fqn = buildFqn(options.database, options.schema, options.name);
+	await executeSql(client, {
+		statement: `DROP PROCEDURE${options.ifExists ? " IF EXISTS" : ""} ${fqn}${renderArgumentTypes(options.arguments)}`,
+		warehouse: options.warehouse,
+		role: options.role
+	});
+}
+async function describeProcedure(client, options) {
+	return (await executeSql(client, {
+		statement: `DESCRIBE PROCEDURE ${buildFqn(options.database, options.schema, options.name)}${renderArgumentTypes(options.arguments)}`,
+		warehouse: options.warehouse,
+		role: options.role
+	})).rows;
+}
+async function callProcedure(client, options) {
+	const fqn = buildFqn(options.database, options.schema, options.name);
+	if (options.rawArguments) return executeSql(client, {
+		statement: `CALL ${fqn}(${options.rawArguments.join(", ")})`,
+		warehouse: options.warehouse,
+		role: options.role,
+		bindings: options.bindings
+	});
+	const builder = new BindingBuilder();
+	const placeholders = (options.arguments ?? []).map((a) => builder.add(a));
+	const bindings = options.bindings ? {
+		...builder.toRecord(),
+		...options.bindings
+	} : builder.size() > 0 ? builder.toRecord() : void 0;
+	return executeSql(client, {
+		statement: `CALL ${fqn}(${placeholders.join(", ")})`,
+		warehouse: options.warehouse,
+		role: options.role,
+		bindings
+	});
+}
+
+//#endregion
+export { callProcedure, createProcedure, describeProcedure, dropProcedure, showProcedures };

package/dist/results.d.mts

@@ -0,0 +1,16 @@
+import { d as HydratedRow, m as ColumnMeta } from "./statements-DJL0qVNA.mjs";
+//#region src/results.d.ts
+/**
+ * Hydrate a single positional row into an object keyed by column name.
+ * Values are coerced per Snowflake type; unknown / unrepresentable values
+ * are passed through verbatim.
+ */
+declare function hydrateRow(row: readonly unknown[], columns: readonly ColumnMeta[]): HydratedRow;
+declare function hydrateRows(rows: readonly (readonly unknown[])[], columns: readonly ColumnMeta[]): HydratedRow[];
+/**
+ * Coerce a single raw value (already in whatever shape Snowflake sent it
+ * over the wire) into the nearest safe JS primitive / object.
+ */
+declare function hydrateValue(raw: unknown, column: ColumnMeta): unknown;
+//#endregion
+export { hydrateRow, hydrateRows, hydrateValue };

package/dist/results.mjs

@@ -0,0 +1,64 @@
+//#region src/results.ts
+const MAX_SAFE_INT_AS_STRING = String(Number.MAX_SAFE_INTEGER);
+const MIN_SAFE_INT_AS_STRING = String(Number.MIN_SAFE_INTEGER);
+/**
+* Hydrate a single positional row into an object keyed by column name.
+* Values are coerced per Snowflake type; unknown / unrepresentable values
+* are passed through verbatim.
+*/
+function hydrateRow(row, columns) {
+	const hydrated = {};
+	for (let i = 0; i < columns.length; i += 1) {
+		const column = columns[i];
+		if (!column) continue;
+		hydrated[column.name] = hydrateValue(row[i], column);
+	}
+	return hydrated;
+}
+function hydrateRows(rows, columns) {
+	const hydrated = [];
+	for (const row of rows) hydrated.push(hydrateRow(row, columns));
+	return hydrated;
+}
+/**
+* Coerce a single raw value (already in whatever shape Snowflake sent it
+* over the wire) into the nearest safe JS primitive / object.
+*/
+function hydrateValue(raw, column) {
+	if (raw === null || raw === void 0) return null;
+	const type = column.type.toUpperCase();
+	if (typeof raw === "string") return coerceString(raw, type, column);
+	return raw;
+}
+function coerceString(raw, type, column) {
+	if (type === "BOOLEAN") return raw === "true" || raw === "1";
+	if (type === "FIXED") return coerceFixed(raw, column);
+	if (type === "REAL") {
+		const parsed = Number(raw);
+		return Number.isFinite(parsed) ? parsed : raw;
+	}
+	if (type === "BINARY") return raw;
+	if (type === "DATE" || type === "TIME" || type.startsWith("TIMESTAMP")) return raw;
+	if (type === "OBJECT" || type === "ARRAY" || type === "VARIANT") try {
+		return JSON.parse(raw);
+	} catch {
+		return raw;
+	}
+	return raw;
+}
+function coerceFixed(raw, column) {
+	if ((column.scale ?? 0) > 0) {
+		const parsed = Number(raw);
+		return Number.isFinite(parsed) ? parsed : raw;
+	}
+	if (isSafeInteger(raw)) return Number(raw);
+	return raw;
+}
+function isSafeInteger(value) {
+	if (!/^-?\d+$/u.test(value)) return false;
+	if (value.startsWith("-")) return value.length < MIN_SAFE_INT_AS_STRING.length || value.length === MIN_SAFE_INT_AS_STRING.length && value <= MIN_SAFE_INT_AS_STRING;
+	return value.length < MAX_SAFE_INT_AS_STRING.length || value.length === MAX_SAFE_INT_AS_STRING.length && value <= MAX_SAFE_INT_AS_STRING;
+}
+
+//#endregion
+export { hydrateRow, hydrateRows, hydrateValue };

package/dist/retry-0hMfb8cC.mjs

@@ -0,0 +1,164 @@
+//#region src/jwt.ts
+/**
+* Snowflake JWT signing + public-key fingerprint (RS256, key-pair auth).
+*
+* Isolate-safe — built on `globalThis.crypto.subtle`, no Node `crypto`
+* imports, no native SDKs. Works in Cloudflare Workers, Node 19+,
+* and any modern V8/JSC isolate.
+*
+* Reference: https://docs.snowflake.com/en/user-guide/key-pair-auth
+*/
+const DEFAULT_JWT_LIFETIME_SECONDS = 3300;
+async function createSnowflakeJwt(input) {
+	const now = Math.floor((input.now?.() ?? Date.now()) / 1e3);
+	const exp = now + (input.lifetimeSeconds ?? DEFAULT_JWT_LIFETIME_SECONDS);
+	const account = normalizeAccountForJwt(input.account).toUpperCase();
+	const user = input.user.toUpperCase();
+	const privateKey = await importRsaPrivateKey(input.privateKeyPem);
+	const fingerprint = input.publicKeyFingerprint ?? await derivePublicKeyFingerprint(privateKey);
+	const issuer = `${account}.${user}.${fingerprint}`;
+	const subject = `${account}.${user}`;
+	const header = {
+		alg: "RS256",
+		typ: "JWT"
+	};
+	const payload = {
+		iss: issuer,
+		sub: subject,
+		iat: now,
+		exp
+	};
+	const signingInput = `${base64UrlEncode(JSON.stringify(header))}.${base64UrlEncode(JSON.stringify(payload))}`;
+	const signature = await crypto.subtle.sign({ name: "RSASSA-PKCS1-v1_5" }, privateKey, new TextEncoder().encode(signingInput));
+	return {
+		token: `${signingInput}.${base64UrlEncode(new Uint8Array(signature))}`,
+		expiresAt: exp,
+		fingerprint,
+		issuer,
+		subject
+	};
+}
+/**
+* Compute `SHA256:<base64>` fingerprint over the DER-encoded SPKI public key
+* derived from the PKCS#8 private key. Matches Snowflake's
+* `RSA_PUBLIC_KEY_FP` value shown by `DESC USER`.
+*/
+async function derivePublicKeyFingerprint(privateKey) {
+	const publicKey = await extractPublicKey(privateKey);
+	const spkiDer = await crypto.subtle.exportKey("spki", publicKey);
+	const digest = await crypto.subtle.digest("SHA-256", spkiDer);
+	return `SHA256:${base64Encode(new Uint8Array(digest))}`;
+}
+async function extractPublicKey(privateKey) {
+	const jwk = await crypto.subtle.exportKey("jwk", privateKey);
+	const publicJwk = {
+		kty: jwk.kty,
+		n: jwk.n,
+		e: jwk.e,
+		alg: jwk.alg,
+		ext: true
+	};
+	return crypto.subtle.importKey("jwk", publicJwk, {
+		name: "RSASSA-PKCS1-v1_5",
+		hash: "SHA-256"
+	}, true, ["verify"]);
+}
+async function importRsaPrivateKey(pem) {
+	const armor = peekPemArmor(pem);
+	if (!armor) throw new TypeError("SNOWFLAKE_PRIVATE_KEY is not a PEM-encoded key.");
+	if (armor.type !== "PRIVATE KEY") throw new TypeError(`Unsupported PEM type "${armor.type}". Expected PKCS#8 PEM ("-----BEGIN PRIVATE KEY-----"). Convert PKCS#1 keys with \`openssl pkcs8 -topk8 -nocrypt\`.`);
+	return crypto.subtle.importKey("pkcs8", toArrayBuffer(base64Decode(armor.body)), {
+		name: "RSASSA-PKCS1-v1_5",
+		hash: "SHA-256"
+	}, true, ["sign"]);
+}
+function toArrayBuffer(view) {
+	const copy = new Uint8Array(view.byteLength);
+	copy.set(view);
+	return copy.buffer;
+}
+function peekPemArmor(pem) {
+	const match = pem.match(/-----BEGIN ([A-Z ]+)-----([\s\S]*?)-----END \1-----/u);
+	if (!match) return void 0;
+	const type = match[1]?.trim();
+	const body = match[2]?.replace(/\s+/gu, "");
+	if (!type || !body) return void 0;
+	return {
+		type,
+		body
+	};
+}
+/**
+* Account identifiers accepted by Snowflake take one of these shapes:
+*   - `orgname-accountname` (preferred)
+*   - `account_locator.region`
+*   - `account_locator.region.aws`
+*   - `account_locator` (legacy single-region)
+*
+* The JWT `iss`/`sub` require just the account segment (everything before the
+* first dot for locator-form identifiers) — the org-account hyphen form is
+* passed through as-is.
+*/
+function normalizeAccountForJwt(account) {
+	const trimmed = account.trim();
+	const firstDot = trimmed.indexOf(".");
+	return firstDot === -1 ? trimmed : trimmed.slice(0, firstDot);
+}
+function base64UrlEncode(input) {
+	return base64Encode(typeof input === "string" ? new TextEncoder().encode(input) : input).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
+}
+function base64Encode(bytes) {
+	let binary = "";
+	for (let i = 0; i < bytes.byteLength; i += 1) binary += String.fromCharCode(bytes[i] ?? 0);
+	if (typeof btoa === "function") return btoa(binary);
+	/* c8 ignore next */
+	return Buffer.from(bytes).toString("base64");
+}
+function base64Decode(input) {
+	if (typeof atob === "function") {
+		const binary = atob(input);
+		const bytes = new Uint8Array(binary.length);
+		for (let i = 0; i < binary.length; i += 1) bytes[i] = binary.charCodeAt(i);
+		return bytes;
+	}
+	/* c8 ignore next */
+	return new Uint8Array(Buffer.from(input, "base64"));
+}
+
+//#endregion
+//#region src/retry.ts
+const DEFAULT_RETRY_POLICY = {
+	maxRetries: 4,
+	baseDelayMs: 500,
+	maxDelayMs: 2e4,
+	jitterMs: 250
+};
+const RETRYABLE_KINDS = new Set([
+	"rate_limit",
+	"server_error",
+	"timeout",
+	"network"
+]);
+function shouldRetry(kind, attempt, policy = DEFAULT_RETRY_POLICY) {
+	if (attempt >= policy.maxRetries) return false;
+	return RETRYABLE_KINDS.has(kind);
+}
+/**
+* Compute the delay (ms) before the next retry. If the server provided a
+* `Retry-After` header we respect it (clamped to `maxDelayMs`). Otherwise we
+* use `baseDelayMs * 2^attempt` with additive jitter, capped at `maxDelayMs`.
+*/
+function computeBackoffMs({ attempt, retryAfterMs, policy = DEFAULT_RETRY_POLICY, random = Math.random }) {
+	if (retryAfterMs !== void 0 && retryAfterMs >= 0) return Math.min(retryAfterMs, policy.maxDelayMs);
+	const exponent = Math.max(0, attempt - 1);
+	const base = policy.baseDelayMs * 2 ** exponent;
+	const jitter = policy.jitterMs > 0 ? random() * policy.jitterMs : 0;
+	return Math.min(policy.maxDelayMs, Math.floor(base + jitter));
+}
+async function defaultSleep(ms) {
+	if (ms <= 0) return;
+	await new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+//#endregion
+export { createSnowflakeJwt as a, shouldRetry as i, computeBackoffMs as n, defaultSleep as r, DEFAULT_RETRY_POLICY as t };

package/dist/retry-w7cTp1QL.d.mts

@@ -0,0 +1,10 @@
+//#region src/retry.d.ts
+interface RetryPolicy {
+  readonly maxRetries: number;
+  readonly baseDelayMs: number;
+  readonly maxDelayMs: number;
+  /** Adds up to `jitterMs` random ms on top of each backoff. */
+  readonly jitterMs: number;
+}
+//#endregion
+export { RetryPolicy as t };

package/dist/roles.d.mts

@@ -0,0 +1,60 @@
+import { SnowflakeClient } from "./client.mjs";
+import { t as OptionMap } from "./sql-options-2k5xQ-oS.mjs";
+import { CatalogResult, ShowOptions, showRoles } from "./catalog.mjs";
+
+//#region src/roles.d.ts
+interface RoleContext {
+  readonly warehouse?: string;
+  readonly sessionRole?: string;
+}
+interface CreateRoleOptions extends RoleContext {
+  readonly name: string;
+  readonly orReplace?: boolean;
+  readonly ifNotExists?: boolean;
+  readonly comment?: string;
+  readonly options?: OptionMap;
+}
+declare function createRole(client: SnowflakeClient, options: CreateRoleOptions): Promise<void>;
+interface AlterRoleOptions extends RoleContext {
+  readonly name: string;
+  readonly rename?: string;
+  readonly set?: OptionMap;
+  readonly unset?: readonly string[];
+  readonly comment?: string;
+  readonly ifExists?: boolean;
+}
+declare function alterRole(client: SnowflakeClient, options: AlterRoleOptions): Promise<void>;
+interface DropRoleOptions extends RoleContext {
+  readonly name: string;
+  readonly ifExists?: boolean;
+}
+declare function dropRole(client: SnowflakeClient, options: DropRoleOptions): Promise<void>;
+interface UseRoleOptions extends RoleContext {
+  readonly name: string;
+}
+declare function useRole(client: SnowflakeClient, options: UseRoleOptions): Promise<void>;
+interface GrantRoleToUserOptions extends RoleContext {
+  /** Role being granted. */
+  readonly role: string;
+  readonly user: string;
+}
+declare function grantRoleToUser(client: SnowflakeClient, options: GrantRoleToUserOptions): Promise<void>;
+interface RevokeRoleFromUserOptions extends RoleContext {
+  readonly role: string;
+  readonly user: string;
+}
+declare function revokeRoleFromUser(client: SnowflakeClient, options: RevokeRoleFromUserOptions): Promise<void>;
+interface GrantRoleToRoleOptions extends RoleContext {
+  /** The child role being granted. */
+  readonly role: string;
+  /** The parent role that will inherit `role`. */
+  readonly parentRole: string;
+}
+declare function grantRoleToRole(client: SnowflakeClient, options: GrantRoleToRoleOptions): Promise<void>;
+interface RevokeRoleFromRoleOptions extends RoleContext {
+  readonly role: string;
+  readonly parentRole: string;
+}
+declare function revokeRoleFromRole(client: SnowflakeClient, options: RevokeRoleFromRoleOptions): Promise<void>;
+//#endregion
+export { AlterRoleOptions, type CatalogResult, CreateRoleOptions, DropRoleOptions, GrantRoleToRoleOptions, GrantRoleToUserOptions, RevokeRoleFromRoleOptions, RevokeRoleFromUserOptions, RoleContext, type ShowOptions, UseRoleOptions, alterRole, createRole, dropRole, grantRoleToRole, grantRoleToUser, revokeRoleFromRole, revokeRoleFromUser, showRoles, useRole };

package/dist/roles.mjs

@@ -0,0 +1,74 @@
+import { executeSql } from "./sql.mjs";
+import { a as quoteLiteral, i as quoteIdentifier } from "./sql-safety-CywdR3EP.mjs";
+import { t as formatOptions } from "./sql-options-DI-OmLU6.mjs";
+import { showRoles } from "./catalog.mjs";
+
+//#region src/roles.ts
+async function createRole(client, options) {
+	const prefix = `CREATE${options.orReplace ? " OR REPLACE" : ""} ROLE${options.ifNotExists ? " IF NOT EXISTS" : ""}`;
+	const body = options.options && Object.keys(options.options).length > 0 ? ` ${formatOptions(options.options)}` : "";
+	const comment = options.comment ? ` COMMENT = ${quoteLiteral(options.comment)}` : "";
+	await executeSql(client, {
+		statement: `${prefix} ${quoteIdentifier(options.name)}${body}${comment}`,
+		warehouse: options.warehouse,
+		role: options.sessionRole
+	});
+}
+async function alterRole(client, options) {
+	let tail;
+	if (options.rename) tail = `RENAME TO ${quoteIdentifier(options.rename)}`;
+	else if (options.set && Object.keys(options.set).length > 0) tail = `SET ${formatOptions(options.set)}`;
+	else if (options.unset && options.unset.length > 0) tail = `UNSET ${options.unset.map((k) => k.toUpperCase()).join(", ")}`;
+	else if (options.comment !== void 0) tail = `SET COMMENT = ${quoteLiteral(options.comment)}`;
+	else throw new Error("alterRole requires one of: rename / set / unset / comment");
+	await executeSql(client, {
+		statement: `ALTER ROLE${options.ifExists ? " IF EXISTS" : ""} ${quoteIdentifier(options.name)} ${tail}`,
+		warehouse: options.warehouse,
+		role: options.sessionRole
+	});
+}
+async function dropRole(client, options) {
+	await executeSql(client, {
+		statement: `DROP ROLE${options.ifExists ? " IF EXISTS" : ""} ${quoteIdentifier(options.name)}`,
+		warehouse: options.warehouse,
+		role: options.sessionRole
+	});
+}
+async function useRole(client, options) {
+	await executeSql(client, {
+		statement: `USE ROLE ${quoteIdentifier(options.name)}`,
+		warehouse: options.warehouse,
+		role: options.sessionRole
+	});
+}
+async function grantRoleToUser(client, options) {
+	await executeSql(client, {
+		statement: `GRANT ROLE ${quoteIdentifier(options.role)} TO USER ${quoteIdentifier(options.user)}`,
+		warehouse: options.warehouse,
+		role: options.sessionRole
+	});
+}
+async function revokeRoleFromUser(client, options) {
+	await executeSql(client, {
+		statement: `REVOKE ROLE ${quoteIdentifier(options.role)} FROM USER ${quoteIdentifier(options.user)}`,
+		warehouse: options.warehouse,
+		role: options.sessionRole
+	});
+}
+async function grantRoleToRole(client, options) {
+	await executeSql(client, {
+		statement: `GRANT ROLE ${quoteIdentifier(options.role)} TO ROLE ${quoteIdentifier(options.parentRole)}`,
+		warehouse: options.warehouse,
+		role: options.sessionRole
+	});
+}
+async function revokeRoleFromRole(client, options) {
+	await executeSql(client, {
+		statement: `REVOKE ROLE ${quoteIdentifier(options.role)} FROM ROLE ${quoteIdentifier(options.parentRole)}`,
+		warehouse: options.warehouse,
+		role: options.sessionRole
+	});
+}
+
+//#endregion
+export { alterRole, createRole, dropRole, grantRoleToRole, grantRoleToUser, revokeRoleFromRole, revokeRoleFromUser, showRoles, useRole };

package/dist/rows.d.mts

@@ -0,0 +1,106 @@
+import { SnowflakeClient } from "./client.mjs";
+import { d as HydratedRow, v as SqlBinding } from "./statements-DJL0qVNA.mjs";
+//#region src/rows.d.ts
+/**
+ * A value a caller can pass into an `insert` / `update` / `where` map. The
+ * binding helper below maps each JS primitive onto a Snowflake type (`TEXT`,
+ * `FIXED`, `REAL`, `BOOLEAN`, `TIMESTAMP_LTZ`) so the SQL API receives a
+ * faithful typed value. Callers needing a specific Snowflake type can pass a
+ * pre-built `SqlBinding` directly.
+ */
+type RowValue = string | number | bigint | boolean | Date | null | undefined | SqlBinding;
+type RowRecord = Readonly<Record<string, RowValue>>;
+interface RowTableRef {
+  readonly database?: string;
+  readonly schema?: string;
+  readonly table: string;
+}
+interface RowContext {
+  readonly warehouse?: string;
+  readonly role?: string;
+}
+/**
+ * Map a JS value to its Snowflake typed binding. Callers who need full
+ * control can pre-build a `{type, value}` object and pass it through.
+ */
+declare function inferBinding(value: RowValue): SqlBinding;
+/**
+ * Mutable binding builder. Internally indexes bindings starting at 1 and
+ * returns the `?` placeholder for each append so callers can weave them into
+ * their SQL composition.
+ */
+declare class BindingBuilder {
+  private readonly map;
+  private counter;
+  add(value: RowValue): string;
+  toRecord(): Readonly<Record<string, SqlBinding>>;
+  size(): number;
+}
+type OrderDirection = 'ASC' | 'DESC';
+interface FindRowsOptions extends RowTableRef, RowContext {
+  readonly where?: RowRecord;
+  readonly columns?: readonly string[];
+  readonly orderBy?: readonly {
+    readonly column: string;
+    readonly direction?: OrderDirection;
+  }[];
+  readonly limit?: number;
+  readonly offset?: number;
+}
+interface FindRowOptions extends RowTableRef, RowContext {
+  readonly where: RowRecord;
+  readonly columns?: readonly string[];
+}
+declare function findRows(client: SnowflakeClient, options: FindRowsOptions): Promise<readonly HydratedRow[]>;
+declare function findRow(client: SnowflakeClient, options: FindRowOptions): Promise<HydratedRow | undefined>;
+interface InsertRowOptions extends RowTableRef, RowContext {
+  readonly row: RowRecord;
+}
+declare function insertRow(client: SnowflakeClient, options: InsertRowOptions): Promise<number>;
+interface BatchInsertOptions extends RowTableRef, RowContext {
+  readonly rows: readonly RowRecord[];
+  /**
+   * When provided, use this explicit column list and look up each row's
+   * value by column; when missing, use the union of keys from the first
+   * row (all subsequent rows must share the same shape).
+   */
+  readonly columns?: readonly string[];
+}
+declare function batchInsert(client: SnowflakeClient, options: BatchInsertOptions): Promise<number>;
+interface UpdateRowOptions extends RowTableRef, RowContext {
+  readonly where: RowRecord;
+  readonly set: RowRecord;
+}
+declare function updateRow(client: SnowflakeClient, options: UpdateRowOptions): Promise<number>;
+interface DeleteRowOptions extends RowTableRef, RowContext {
+  readonly where: RowRecord;
+}
+declare function deleteRow(client: SnowflakeClient, options: DeleteRowOptions): Promise<number>;
+interface UpsertRowOptions extends RowTableRef, RowContext {
+  readonly row: RowRecord;
+  /** Columns whose equality defines the MATCH condition. */
+  readonly matchColumns: readonly string[];
+  /**
+   * Columns to write on UPDATE (defaults to every column in `row` except the
+   * match columns, which are left untouched on match).
+   */
+  readonly updateColumns?: readonly string[];
+}
+interface UpsertRowResult {
+  readonly inserted: number;
+  readonly updated: number;
+}
+declare function upsertRow(client: SnowflakeClient, options: UpsertRowOptions): Promise<UpsertRowResult>;
+interface MergeRowsOptions extends RowTableRef, RowContext {
+  /**
+   * Raw MERGE statement source. Useful when callers want full control over
+   * a merge and just want the client/context/binding infra. `statement`
+   * should already reference the resolved FQN from
+   * {@link buildFqn}/{@link quoteIdentifier}.
+   */
+  readonly statement: string;
+  readonly bindings?: Readonly<Record<string, SqlBinding>>;
+}
+declare function mergeRows(client: SnowflakeClient, options: MergeRowsOptions): Promise<UpsertRowResult>;
+//#endregion
+export { BatchInsertOptions, BindingBuilder, DeleteRowOptions, FindRowOptions, FindRowsOptions, InsertRowOptions, MergeRowsOptions, OrderDirection, RowContext, RowRecord, RowTableRef, RowValue, UpdateRowOptions, UpsertRowOptions, UpsertRowResult, batchInsert, deleteRow, findRow, findRows, inferBinding, insertRow, mergeRows, updateRow, upsertRow };