@palbase/backend 16.0.0 → 17.0.0

package/dist/{endpoint-BW8bn1y-.d.cts → index-D6mRh4yq.d.cts}

@@ -1,3 +1,4 @@
+import { Tables, TableTypes } from './db/env.cjs';
 import { ZodSchema, z } from 'zod';
 
 /** Supported HTTP methods for endpoints. */
@@ -2001,4 +2002,656 @@ type Middleware = (ctx: MiddlewareContext, next: () => Promise<void>) => Promise
  */
 type AuthSpec = boolean | Partial<AuthConfig>;
 
-export { type PalbaseDeviceTokenView as $, type AuthSpec as A, BadRequest as B, type CacheClient as C, type DBClient as D, type ErrorDef as E, type FileContext as F, type PalbaseAuthClient as G, HttpError as H, type PalbaseBatchOverrideOperation as I, type PalbaseBatchSetOverridesResult as J, type PalbaseBindDeviceParams as K, type Logger as L, type Materialized as M, NotFound as N, type PalbaseBucketClient as O, type PBRequest as P, type PalbaseClearAllOverridesResult as Q, type RateLimitConfig as R, type PalbaseClearOverrideResult as S, type PalbaseCohortQueryInput as T, type User as U, type PalbaseCohortResult as V, type PalbaseCollectionRef as W, type PalbaseCountQueryInput as X, type PalbaseCountResult as Y, type PalbaseCreateLinkParams as Z, type PalbaseDeviceInfo as _, type PalbaseModuleClients as a, type PalbaseWhereOperator as a$, type PalbaseDocumentRef as a0, type PalbaseDocumentSnapshot as a1, type PalbaseEmailClient as a2, type PalbaseEmailSendParams as a3, type PalbaseEmailSendResponse as a4, type PalbaseEventNamesResult as a5, type PalbaseEventsQueryInput as a6, type PalbaseEventsResult as a7, type PalbaseFileObject as a8, type PalbaseFlag as a9, type PalbaseOverviewResult as aA, type PalbasePreferences as aB, type PalbasePreferencesClient as aC, type PalbasePushClient as aD, type PalbasePushSendParams as aE, type PalbasePushSendResponse as aF, type PalbaseQrCodeOptions as aG, type PalbaseQuerySnapshot as aH, type PalbaseRegisterDeviceParams as aI, type PalbaseResult as aJ, type PalbaseRetentionQueryInput as aK, type PalbaseRetentionResult as aL, type PalbaseSession as aM, type PalbaseSetOverrideResult as aN, type PalbaseSetOverridesResult as aO, type PalbaseSignedUrlResponse as aP, type PalbaseSmsClient as aQ, type PalbaseSmsSendParams as aR, type PalbaseSmsSendResponse as aS, type PalbaseTransformOptions as aT, type PalbaseUpdateLinkParams as aU, type PalbaseUploadOptions as aV, type PalbaseUser as aW, type PalbaseUserDetailResult as aX, type PalbaseUsersQueryInput as aY, type PalbaseUsersResult as aZ, type PalbaseVerifyRequestSignatureParams as a_, type PalbaseFlagContext as aa, type PalbaseFlagSource as ab, type PalbaseFlagValue as ac, type PalbaseFlagVariant as ad, type PalbaseFlagsServiceClient as ae, type PalbaseFunctionsClient as af, type PalbaseFunnelQueryInput as ag, type PalbaseFunnelResult as ah, type PalbaseIdentifyTraits as ai, type PalbaseInboxClient as aj, type PalbaseInboxListOptions as ak, type PalbaseInboxListResult as al, type PalbaseInboxMessage as am, type PalbaseInboxSendParams as an, type PalbaseInboxSendResponse as ao, type PalbaseInitialLink as ap, type PalbaseInvokeOptions as aq, type PalbaseLink as ar, type PalbaseLinkAnalytics as as, type PalbaseLinkDetails as at, type PalbaseLinksClient as au, type PalbaseListLinksOptions as av, type PalbaseListLinksResult as aw, type PalbaseListOptions as ax, type PalbaseMatchParams as ay, type PalbaseMultiChannelResponse as az, type PalbaseDocsClient as b, type Ref as b0, TooManyRequests as b1, type TxColumnExpr as b2, type TxInsertShape as b3, type TxInsertValue as b4, type TxNow as b5, type TxPlanBody as b6, TxPlanError as b7, type TxPlanHandle as b8, type TxPlanOpResult as b9, type TxPlanRejection as ba, type TxPlanResponse as bb, TxRefError as bc, type TxRow as bd, type TxRows as be, type TxSelectOptions as bf, type TxSetShape as bg, type TxSetValue as bh, type TxTable as bi, type TxWhere as bj, type TxWireExpr as bk, type TxWireGuard as bl, type TxWireOp as bm, type TxWireRef as bn, type TxWireValue as bo, Unauthorized as bp, type VerifiedDevice as bq, dec as br, defineMiddleware as bs, inc as bt, now as bu, type PalbaseFlagsClient as c, type PalbaseNotificationsClient as d, type PalbaseRealtimeClient as e, type PalbaseStorageClient as f, type AuthConfig as g, type ClientInfo as h, Conflict as i, type DBOps as j, type ErrorMap as k, type ErrorThrowers as l, Forbidden as m, type HttpMethod as n, type Middleware as o, type MiddlewareContext as p, type MiddlewareHandler as q, PalError as r, type PalbaseAnalyticsClient as s, type PalbaseAnalyticsManagementNamespace as t, type PalbaseAnalyticsProperties as u, type PalbaseAnalyticsQueryNamespace as v, type PalbaseAttestAndroidParams as w, type PalbaseAttestAndroidResult as x, type PalbaseAttestiOSParams as y, type PalbaseAttestiOSResult as z };
+/** On delete action for foreign key references. */
+type OnDeleteAction = 'cascade' | 'set null' | 'restrict' | 'no action';
+/**
+ * The ON DELETE actions permitted on a foreign key to the built-in auth users
+ * (`auth.users`). Both let a user's rows be removed (`cascade`) or detached
+ * (`set null`) when the account is erased; `restrict` / `no action` would BLOCK
+ * erasure and are therefore excluded. This is the CLIENT-SIDE mirror of the
+ * server's auth-FK deletion policy — the server (validateAuthUserFK) is the real
+ * boundary, this narrows the type so the common mistake is caught at compile time.
+ */
+type AuthUserOnDelete = Extract<OnDeleteAction, 'cascade' | 'set null'>;
+/** Column type identifiers. */
+type ColumnType = 'uuid' | 'text' | 'integer' | 'bigint' | 'numeric' | 'boolean' | 'timestamp' | 'jsonb' | 'enum';
+/** Base column definition shared by all column types. */
+interface ColumnDef {
+    type: ColumnType;
+    nullable: boolean;
+    primaryKey: boolean;
+    defaultValue?: unknown;
+    defaultRandom?: boolean;
+    defaultNow?: boolean;
+    references?: {
+        table: string;
+        column: string;
+    };
+    onDeleteAction?: OnDeleteAction;
+    enumName?: string;
+    enumValues?: string[];
+    unique?: boolean;
+}
+declare const __colKind: unique symbol;
+declare const __colNullable: unique symbol;
+declare const __colHasDefault: unique symbol;
+declare const __colEnumValues: unique symbol;
+declare const __colPayload: unique symbol;
+/**
+ * Fluent column builder with phantom type params:
+ *  K — ColumnType literal (e.g. "text", "integer")
+ *  N — boolean: true when nullable() has been called last (false = NOT NULL)
+ *  D — boolean: true when a default has been set
+ *  E — enum value union (never for non-enum columns)
+ *  P — jsonb payload shape (unknown unless jsonb<T>() supplied one)
+ *
+ * All five params have defaults so bare `ColumnBuilder` (no args) still
+ * satisfies `Record<string, ColumnBuilder>` in schema.ts without modification.
+ *
+ * The five `declare readonly` brand fields carry the phantom types into the
+ * structural shape so that conditional types like ColValue<C> can discriminate
+ * on K without requiring runtime values on those fields.
+ */
+declare class ColumnBuilder<K extends ColumnType = ColumnType, N extends boolean = boolean, D extends boolean = boolean, E = unknown, P = unknown> {
+    readonly [__colKind]: K;
+    readonly [__colNullable]: N;
+    readonly [__colHasDefault]: D;
+    readonly [__colEnumValues]: E;
+    readonly [__colPayload]: P;
+    readonly _def: ColumnDef;
+    constructor(type: K, existingDef?: ColumnDef);
+    /** Mark this column as the primary key. */
+    primaryKey(): ColumnBuilder<K, N, D, E, P>;
+    /** Mark this column as NOT NULL (default). */
+    notNull(): ColumnBuilder<K, false, D, E, P>;
+    /** Allow NULL values. */
+    nullable(): ColumnBuilder<K, true, D, E, P>;
+    /** Set a default value. */
+    default(value: unknown): ColumnBuilder<K, N, true, E, P>;
+    /** UUID: generate a random default (gen_random_uuid()). */
+    defaultRandom(): ColumnBuilder<K, N, true, E, P>;
+    /** Timestamp: default to now(). */
+    defaultNow(): ColumnBuilder<K, N, true, E, P>;
+    /** Add a foreign key reference. */
+    references(table: string, column: string): ColumnBuilder<K, N, D, E, P>;
+    /**
+     * Add a real DB-level foreign key to the built-in auth users
+     * (`REFERENCES auth.users(id)`), so a column like `user_id` gets true
+     * database cascade/integrity instead of app-layer-only. Sugar for
+     * `.references("auth.users", "id")`.
+     *
+     * `auth.users` lives in the SAME tenant database (palauth-owned), so this is
+     * a genuine cross-schema integrity constraint scoped to THIS tenant's users.
+     * The referenced `auth.users.id` is `text` (palauth ids are `usr_<uuid>`), so
+     * the referencing column must be `text()` too.
+     *
+     * ON DELETE is REQUIRED here and may only be `cascade` or `set null`: an
+     * account-erasure request must never be blocked by a lingering FK, so
+     * `restrict` / `no action` are not accepted (they don't type-check). Example:
+     * `text().notNull().referencesAuthUser("cascade")`, or
+     * `text().nullable().referencesAuthUser("set null")`. The server
+     * (validateAuthUserFK) enforces this — and the remaining rules the type can't
+     * express (referencing column is text, `set null` needs a nullable column) —
+     * as the real boundary; this signature is the compile-time DX mirror.
+     */
+    referencesAuthUser(onDelete: AuthUserOnDelete): ColumnBuilder<K, N, D, E, P>;
+    /**
+     * Add a real DB-level foreign key to the canonical, server-minted installation
+     * anchor (`REFERENCES auth.installations(id)`) — the app-scoped verified-device
+     * root (`ins_...`). Sugar for `.references("auth.installations", "id")`.
+     *
+     * An installation is an APP INSTALL, not a user: this FK is NOT user ownership.
+     * A user-owned row STILL needs its own `.referencesAuthUser(...)` FK so account
+     * erasure removes it — an installation reference alone does not tie a row to a
+     * user's deletion. Use this only for install-scoped state (device prefs, push
+     * routing, …), alongside a separate auth-user FK where the row is user-owned.
+     *
+     * `auth.installations` lives in the SAME tenant DB (palauth-owned); its `id` is
+     * `text` (`ins_<uuid>`), so the referencing column must be `text()` too. ON
+     * DELETE is REQUIRED and may only be `cascade` or `set null` (same allowed set
+     * as an auth-user FK): an installation revoke / orphan cleanup must never be
+     * blocked by a lingering FK. The server (validateAuthAnchorFK) is the real
+     * boundary; this signature is the compile-time DX mirror.
+     */
+    referencesInstallation(onDelete: AuthUserOnDelete): ColumnBuilder<K, N, D, E, P>;
+    /** Set the ON DELETE action for a foreign key reference. */
+    onDelete(action: OnDeleteAction): ColumnBuilder<K, N, D, E, P>;
+    /** Add a single-column UNIQUE constraint. */
+    unique(): ColumnBuilder<K, N, D, E, P>;
+}
+/**
+ * Extracts the TypeScript value type for a column, respecting nullability.
+ * - "uuid" | "text" | "timestamp" | "bigint" | "numeric" → string (or string | null when N = true)
+ *   Note: bigint/numeric surface as string — JS number loses precision past 2^53,
+ *   and pgx/PostgREST serialize int8/numeric as strings. App code uses
+ *   BigInt(row.amount) for bigint, or a decimal lib for numeric.
+ * - "integer" → number
+ * - "boolean" → boolean
+ * - "jsonb" → P (the dev-supplied payload shape from jsonb<T>(), else unknown)
+ * - "enum" → E (the union of literal values)
+ */
+type ColValue<C> = C extends ColumnBuilder<'uuid' | 'text' | 'timestamp' | 'bigint' | 'numeric', infer N, infer _D, infer _E, infer _P> ? N extends true ? string | null : string : C extends ColumnBuilder<'integer', infer N, infer _D, infer _E, infer _P> ? N extends true ? number | null : number : C extends ColumnBuilder<'boolean', infer N, infer _D, infer _E, infer _P> ? N extends true ? boolean | null : boolean : C extends ColumnBuilder<'jsonb', infer N, infer _D, infer _E, infer P> ? N extends true ? P | null : P : C extends ColumnBuilder<'enum', infer N, infer _D, infer E, infer _P> ? N extends true ? E | null : E : never;
+/**
+ * True when a column is optional on INSERT:
+ *  - nullable columns (N = true) — the DB allows NULL so the field may be omitted
+ *  - columns with a default (D = true) — the DB fills in the value when absent
+ */
+type ColIsOptionalOnInsert<C> = C extends ColumnBuilder<infer _K, true, infer _D, infer _E> ? true : C extends ColumnBuilder<infer _K, infer _N, true, infer _E> ? true : false;
+/** Create a UUID column. */
+declare function uuid(): ColumnBuilder<'uuid', false, false, never>;
+/** Create a TEXT column. */
+declare function text(): ColumnBuilder<'text', false, false, never>;
+/** Create an INTEGER column. Emits int4 (max ~2.1B). */
+declare function integer(): ColumnBuilder<'integer', false, false, never>;
+/**
+ * Create a BIGINT column (Postgres int8, max ~9.2×10^18).
+ * Surfaces as `string` in row/insert types — JS number loses precision past 2^53
+ * and pgx/PostgREST serialize int8 as a JSON string. Use BigInt(row.column) in app code.
+ */
+declare function bigint(): ColumnBuilder<'bigint', false, false, never>;
+/**
+ * Create a NUMERIC column (Postgres `numeric`/`decimal`, arbitrary precision).
+ * For exact fractional values (money with cents as a decimal, rates, weights)
+ * where int4/int8 don't fit. Surfaces as `string` in row/insert types — JS
+ * number can't hold arbitrary-precision decimals without rounding, and
+ * pgx/PostgREST serialize numeric as a JSON string. Parse with a decimal lib
+ * (or BigInt for scaled integers) in app code.
+ */
+declare function numeric(): ColumnBuilder<'numeric', false, false, never>;
+/** Create a BOOLEAN column. */
+declare function boolean(): ColumnBuilder<'boolean', false, false, never>;
+/** Create a TIMESTAMP column. */
+declare function timestamp(): ColumnBuilder<'timestamp', false, false, never>;
+/**
+ * Create a JSONB column. Pass a payload type to make the generated row/insert
+ * type concrete instead of `unknown`:
+ *
+ *   tags: jsonb<string[]>()           // row.tags: string[]
+ *   meta: jsonb<{ tier: string }>()   // row.meta: { tier: string }
+ *   raw:  jsonb()                      // row.raw: unknown (back-compat)
+ *
+ * The runtime accepts a plain JS object/array directly (no JSON.stringify); the
+ * generic only refines the TYPE the env codegen emits.
+ */
+declare function jsonb<T = unknown>(): ColumnBuilder<'jsonb', false, false, never, T>;
+/**
+ * Create an ENUM column.
+ * @param name   The PostgreSQL enum type name (used in DDL).
+ * @param values A readonly tuple of valid string values — kept `const` so the
+ *               union `V[number]` is as narrow as possible.
+ */
+declare function enumType<const V extends readonly string[]>(name: string, values: V): ColumnBuilder<'enum', false, false, V[number]>;
+
+/**
+ * policy.ts — the RLS policy authoring DSL.
+ *
+ * `policy(name)` returns a fluent builder that mirrors the `ColumnBuilder`
+ * style in columns.ts: each chainable method mutates the underlying
+ * definition and returns the builder so calls compose. The terminal value is
+ * a plain {@link PolicyDef} — the exact JSON shape the runtime's
+ * `schema_extract.js` reads off the bundled module and the Go side parses into
+ * `PolicyJSON` (CONTRACT-POLICY).
+ *
+ * @example
+ * import { policy } from "@palbase/backend";
+ *
+ * policy("owner_select")
+ *   .for("select")
+ *   .to("authenticated")
+ *   .using("owner = (select auth.uid())");
+ */
+/** The SQL command a policy applies to. `"all"` covers SELECT/INSERT/UPDATE/DELETE. */
+type PolicyCommand = "all" | "select" | "insert" | "update" | "delete";
+/** Whether a policy is permissive (OR-combined, the default) or restrictive
+ * (AND-combined). Mirrors Postgres `CREATE POLICY ... AS PERMISSIVE|RESTRICTIVE`. */
+type PolicyMode = "permissive" | "restrictive";
+/**
+ * The compiled, serializable policy definition — the EXACT shape consumed by
+ * `schema_extract.js` → Go `PolicyJSON` (CONTRACT-POLICY).
+ *
+ * - `roles`: the DB roles this policy applies to (`TO` clause). An empty array
+ *   means the policy applies to PUBLIC (all roles) — the Postgres default.
+ * - `using`: the `USING (...)` row-visibility expression, or `null` when none.
+ * - `withCheck`: the `WITH CHECK (...)` write-validation expression, or `null`.
+ * - `permissive`: `true` for `AS PERMISSIVE` (default), `false` for restrictive.
+ */
+interface PolicyDef {
+    name: string;
+    command: PolicyCommand;
+    roles: string[];
+    using: string | null;
+    withCheck: string | null;
+    permissive: boolean;
+}
+/**
+ * Fluent RLS policy builder.
+ *
+ * Defaults (documented, applied at construction):
+ *  - `command`: `"all"` — applies to every SQL command unless `.for(...)` narrows it.
+ *  - `roles`: `["authenticated"]` — the common case is "rule applies to signed-in
+ *    users". Call `.to(...)` to override; pass `.to()` with no roles (or never
+ *    call it after a reset) to target PUBLIC.
+ *  - `using` / `withCheck`: `null` — no row filter / write check until set.
+ *  - `permissive`: `true` — `AS PERMISSIVE` (policies OR together).
+ *
+ * Each method mutates `_def` in place and returns `this`, so the chain is a
+ * single builder instance (no per-call allocation, like a tagged-template
+ * compile target). The terminal `PolicyDef` is read directly off `_def` by
+ * `schema_extract.js`.
+ */
+declare class PolicyBuilder {
+    readonly _def: PolicyDef;
+    constructor(name: string);
+    /** Restrict the policy to a single SQL command (default `"all"`). */
+    for(command: PolicyCommand): this;
+    /**
+     * Set the DB roles the policy applies to (the `TO` clause), replacing any
+     * previously-set roles. Call with no arguments to target PUBLIC (all roles).
+     *
+     * @example
+     * policy("p").to("authenticated")
+     * policy("p").to("authenticated", "service_role")
+     * policy("p").to() // PUBLIC
+     */
+    to(...roles: string[]): this;
+    /** Set the `USING (...)` row-visibility expression (raw SQL). */
+    using(sqlExpr: string): this;
+    /** Set the `WITH CHECK (...)` write-validation expression (raw SQL). */
+    withCheck(sqlExpr: string): this;
+    /** Set the policy mode: `"permissive"` (default, OR-combined) or
+     * `"restrictive"` (AND-combined). */
+    as(mode: PolicyMode): this;
+}
+/**
+ * Start authoring an RLS policy. Returns a {@link PolicyBuilder}; the resulting
+ * `PolicyBuilder` is accepted directly in a table's `policies: [...]` array
+ * (its `_def` is read at schema-extract time).
+ *
+ * @param name The policy name. Palbase reconciliation keys policies by
+ *             `(table, name)`, so names must be unique per table.
+ */
+declare function policy(name: string): PolicyBuilder;
+
+/**
+ * Postgres extensions a Palbase project can enable from its schema.
+ *
+ * Extensions are config-as-code: declare them in `defineSchema({ extensions })`
+ * and the deploy installs them (CREATE EXTENSION … SCHEMA extensions) using the
+ * deploy path's privileged connection. They are NOT toggled live from Studio —
+ * CREATE EXTENSION requires a superuser role that only the deploy path holds.
+ *
+ * The list is an allowlist (a string-literal union) so editors autocomplete the
+ * supported names and a typo fails typecheck. It is intentionally extensible:
+ * add a name here (+ confirm the base image ships it) to support more.
+ */
+declare const PALBASE_EXTENSIONS: readonly ["vector", "pg_trgm", "unaccent", "citext", "postgis", "cube", "earthdistance", "hstore", "ltree", "btree_gist", "pg_cron", "pgcrypto", "uuid-ossp"];
+/** A Postgres extension supported by Palbase (allowlist union). */
+type PalbaseExtension = (typeof PALBASE_EXTENSIONS)[number];
+/**
+ * Extensions that depend on another extension. The deploy installs
+ * dependencies first; declaring `earthdistance` without `cube` still works
+ * because the deploy resolves the order, but listing both is clearer.
+ */
+declare const EXTENSION_DEPENDENCIES: Partial<Record<PalbaseExtension, PalbaseExtension[]>>;
+/** Runtime guard: is `name` a supported Palbase extension? */
+declare function isPalbaseExtension(name: string): name is PalbaseExtension;
+
+/**
+ * A named raw-SQL DDL object declared in db/schema.ts for anything the typed DSL
+ * cannot express (EXCLUDE, CHECK, partial/expression indexes, triggers, views).
+ * The deploy emits `up` verbatim on the privileged DDL connection — same trust
+ * posture as policy().using(). Tracked by NAME (not by diffing the body), so a
+ * changed body needs a new name or an explicit drop+add.
+ */
+interface RawConstraintDef {
+    name: string;
+    up: string;
+    down?: string;
+}
+declare function raw(name: string, up: string, opts?: {
+    down?: string;
+}): RawConstraintDef;
+
+/**
+ * A map of column builders keyed by column name — the value you write under
+ * the `columns` key of `defineSchema({ tables: { <name>: { columns } } })`.
+ *
+ * The default `Record<string, ColumnBuilder>` keeps bare references compiling
+ * without a type argument.
+ */
+type ColumnMap = Record<string, ColumnBuilder>;
+/**
+ * The author-facing value written under each table key:
+ * `{ columns, rls?, policies? }`.
+ *
+ * - `columns`: the column map (required).
+ * - `rls`: enable + FORCE row-level security on this table. **Defaults to
+ *   `true`**, and is forced on when `policies` is non-empty. A table with RLS
+ *   and no policies is deny-all, which is the starting state: nothing reads it
+ *   until a policy says who may. Set `rls: false` only for a genuinely public
+ *   table — it is an explicit opt-out that a reviewer can grep for, not
+ *   something you get by forgetting.
+ * - `policies`: the RLS policies for this table, authored with `policy(name)`.
+ *   Each entry may be a {@link PolicyBuilder} (the normal `policy(...)` chain)
+ *   or a raw {@link PolicyDef} object.
+ *
+ * The `C` type parameter preserves the precise per-column phantom types so the
+ * typed `Database.tables.*` surface keeps inferring insert/row shapes.
+ */
+interface TableInput<C extends ColumnMap = ColumnMap> {
+    columns: C;
+    rls?: boolean;
+    policies?: (PolicyBuilder | PolicyDef)[];
+    /** Composite/named primary key (ordered column names). Omit for single-column inline .primaryKey(). */
+    primaryKey?: string[];
+    /** Named multi-column UNIQUE constraints. */
+    unique?: {
+        name: string;
+        columns: string[];
+    }[];
+    /** Named raw-SQL DDL objects (EXCLUDE, triggers, views) that the typed DSL cannot express. */
+    raw?: RawConstraintDef[];
+    /**
+     * Named first-class CHECK constraints. Diffed by NAME with a BODY compare:
+     * a changed `expr` (after pg normalization) recreates the constraint
+     * (DROP + ADD). `expr` is trusted SQL emitted verbatim (like policy USING),
+     * `name` is identifier-validated.
+     */
+    checks?: {
+        name: string;
+        expr: string;
+    }[];
+    /**
+     * Plain (non-unique) btree indexes over an ordered column list, emitted as
+     * standalone `CREATE INDEX [IF NOT EXISTS] name ON table (col1, col2)`
+     * statements (NOT a table clause — a separate migration statement category).
+     * Structural compare by NAME (no expression normalization). `name` and each
+     * column are identifier-validated by the Go differ.
+     *
+     * Scope: columns-only plain btree. Partial (`where`) and expression indexes
+     * are a deliberate follow-up — modelling them needs the same raw-SQL
+     * normalization round-trip CHECK uses (Task 10), so they are NOT in this
+     * type yet to avoid a half-working partial-index path.
+     */
+    indexes?: {
+        name: string;
+        columns: string[];
+    }[];
+}
+/**
+ * A table definition — the runtime value the Go runtime's `schema_extract.js`
+ * reads. It keys tables by `tableDef.name`, reads `tableDef.columns` for the
+ * column DDL, and `tableDef.rls` + `tableDef.policies` for RLS.
+ *
+ * `defineSchema` derives `name` from the object key, so authors never repeat
+ * the table name. `rls`/`policies` are always present after normalization
+ * (defaulted to `true`/`[]`).
+ *
+ * The `C` type parameter preserves the precise per-column phantom types so that
+ * downstream mapped types (InsertShape, RowShape) can discriminate on them.
+ */
+interface TableDef<C extends ColumnMap = ColumnMap> {
+    name: string;
+    columns: C;
+    rls: boolean;
+    policies: PolicyDef[];
+    primaryKey?: string[];
+    unique?: {
+        name: string;
+        columns: string[];
+    }[];
+    /** Named raw-SQL DDL objects emitted verbatim on deploy. Tracked by name. */
+    raw?: RawConstraintDef[];
+    /** Named first-class CHECK constraints. Diffed by name + (normalized) body. */
+    checks?: {
+        name: string;
+        expr: string;
+    }[];
+    /** Plain btree indexes (columns-only), emitted as standalone CREATE INDEX. Diffed by name. */
+    indexes?: {
+        name: string;
+        columns: string[];
+    }[];
+}
+/**
+ * A schema definition containing multiple tables, keyed by table name.
+ *
+ * The `T` type parameter preserves the exact `TableDef<...>` type for each
+ * table so that `SchemaDef["tables"]["rooms"]` resolves to the precise
+ * `TableDef<{ id: ColumnBuilder<'uuid', false, true, never>; ... }>`.
+ */
+interface SchemaDef<T extends Record<string, TableDef> = Record<string, TableDef>> {
+    tables: T;
+    /** Postgres extensions to install on deploy. Normalized to `[]` when absent. */
+    extensions: PalbaseExtension[];
+}
+/** The author-facing input to `defineSchema` — a `tables` map whose keys are
+ * the table names and whose values are `{ columns, rls?, policies? }`, plus an
+ * optional `extensions` allowlist. */
+interface SchemaInput<T extends Record<string, TableInput> = Record<string, TableInput>> {
+    tables: T;
+    /**
+     * Postgres extensions to enable for this project, e.g. `["vector"]`.
+     * Config-as-code: installed by the deploy (CREATE EXTENSION … SCHEMA
+     * extensions) with the privileged deploy connection. The type is an
+     * allowlist union, so unsupported names fail typecheck.
+     */
+    extensions?: PalbaseExtension[];
+}
+/** Map the author's `{ tables: { <name>: { columns } } }` input to the
+ * `{ tables: { <name>: TableDef<columns> } }` runtime/type shape, threading the
+ * per-table column map `T[K]["columns"]` so column-level inference survives. */
+type TablesFromInput<T extends Record<string, TableInput>> = {
+    [K in keyof T]: TableDef<T[K]["columns"]>;
+};
+/**
+ * Define a schema. The table NAME comes from the object key. Each table value
+ * is `{ columns, rls?, policies? }`:
+ *
+ *   export default defineSchema({
+ *     tables: {
+ *       todos: {
+ *         columns: {
+ *           id:    uuid().primaryKey().defaultRandom(),
+ *           owner: text().notNull(),
+ *           title: text().notNull(),
+ *         },
+ *         rls: true,
+ *         policies: [
+ *           policy("owner_all").for("all").to("authenticated")
+ *             .using("owner = (select auth.uid())")
+ *             .withCheck("owner = (select auth.uid())"),
+ *         ],
+ *       },
+ *     },
+ *   });
+ *
+ * The returned value is
+ * `{ tables: { todos: { name, columns, rls, policies } } }` — the exact shape
+ * the runtime schema extractor parses. Per-column phantom types are preserved
+ * so `Database.tables.todos.insert({...})` stays typed.
+ *
+ * RLS normalization: `rls` defaults to **`true`**, `policies` to `[]`. A table
+ * that declares neither is therefore deny-all — nothing reads it until a policy
+ * says who may, which is the safe starting point rather than a bug. Declare
+ * `rls: false` for a genuinely public table; that is an explicit, greppable
+ * statement of intent instead of an omission. When `policies` is non-empty,
+ * `rls` is forced on (ENABLE + FORCE) regardless of the declared flag — a table
+ * with policies must have RLS enabled or the policies would be inert.
+ */
+declare function defineSchema<T extends Record<string, TableInput>>(input: SchemaInput<T>): SchemaDef<TablesFromInput<T>>;
+
+/**
+ * typed-db.ts — Task 2: TypedDB schema-derived insert/row shapes.
+ *
+ * Derives INSERT and full-row TypeScript types from a `defineSchema()` result
+ * and wraps the untyped runtime `DBClient` with a typed facade.
+ *
+ * No value-any. No `as unknown as X`. The two narrow `as` casts in
+ * `makeTypedTable` are safe because:
+ *  - `data as Record<string, unknown>`: InsertShape<T> maps string keys to
+ *    typed values; all value types are subsets of `unknown`, so the cast is
+ *    structurally sound.
+ *  - `result as RowShape<T>`: The runtime DBClient returns `Record<string,
+ *    unknown>` which is the erased form of the typed row; we're narrowing back
+ *    to the precise shape that the schema declared.
+ * Both casts are narrowing only (not widening) and correctness is guaranteed
+ * by the schema the caller provides.
+ */
+
+/** Keys of C whose columns are required on INSERT (not nullable, no default). */
+type RequiredKeys<C> = {
+    [K in keyof C]: ColIsOptionalOnInsert<C[K]> extends true ? never : K;
+}[keyof C];
+/** Keys of C whose columns are optional on INSERT (nullable or has a default). */
+type OptionalKeys<C> = {
+    [K in keyof C]: ColIsOptionalOnInsert<C[K]> extends true ? K : never;
+}[keyof C];
+/**
+ * The TypeScript type for an INSERT payload for table `T`.
+ * - Required: columns that are NOT NULL and have no DB-level default.
+ * - Optional: columns that are nullable or carry a default.
+ *
+ * When all columns are optional, `RequiredKeys<C>` resolves to `never` and
+ * the first part becomes `{}`, which is a neutral element for `&`.
+ */
+type InsertShape<T extends TableDef> = {
+    [K in RequiredKeys<T["columns"]>]: ColValue<T["columns"][K]>;
+} & {
+    [K in OptionalKeys<T["columns"]>]?: ColValue<T["columns"][K]>;
+};
+/**
+ * The TypeScript type for a full row returned by the DB for table `T`.
+ * Every column is present; nullable columns resolve to `T | null`.
+ */
+type RowShape<T extends TableDef> = {
+    [K in keyof T["columns"]]: ColValue<T["columns"][K]>;
+};
+/** A typed table accessor that mirrors the runtime DBClient surface. */
+interface TypedTable<T extends TableDef> {
+    insert(data: InsertShape<T>): Promise<RowShape<T>>;
+    /** Update the row by id; resolves to the updated row, or `null` if no row
+     * matched (absent or RLS-hidden) — an idempotent outcome, mirroring
+     * `findById`. The runtime returns a null row rather than throwing. */
+    update(id: string, data: Partial<InsertShape<T>>): Promise<RowShape<T> | null>;
+    delete(id: string): Promise<void>;
+    findById(id: string): Promise<RowShape<T> | null>;
+    findMany(query?: Partial<RowShape<T>>): Promise<RowShape<T>[]>;
+}
+/** A typed DB facade covering all tables declared in schema `S`. */
+interface TypedDB<S extends SchemaDef> {
+    tables: {
+        [K in keyof S["tables"]]: TypedTable<S["tables"][K]>;
+    };
+    /** Run a transaction plan. See {@link EnvTypedDatabase.transaction}. */
+    transaction<T>(fn: (tx: TypedTx<S>) => T extends Promise<unknown> ? never : T): Promise<Materialized<T>>;
+}
+/** The plan-building handle a `TypedDB<S>` transaction callback receives: the
+ * schema's tables, expressed as plan operations rather than awaited calls. */
+type TypedTx<S extends SchemaDef> = TxPlanHandle<{
+    [K in keyof S["tables"]]: TxTable<RowShape<S["tables"][K]>, InsertShape<S["tables"][K]>>;
+}>;
+/**
+ * Wraps a raw `DBClient` with the type-safe `TypedDB<S>` facade derived from
+ * the provided schema. No behavior change for the direct ops — all calls
+ * delegate to `raw` with the table name as a plain string.
+ *
+ * `transaction` does NOT delegate to a per-op client: the callback describes a
+ * plan against a fresh {@link TxPlanBuilder}, and the whole plan travels in one
+ * `raw.txPlan` call. The schema is used only for its table NAMES; the values
+ * are typed by `S` at compile time and are plain strings at run time.
+ *
+ * The `as` casts are single structural narrowings from a dynamically-built
+ * object to the precise mapped type (TS cannot infer the mapped-type result
+ * through `Object.keys` iteration) — see the module-level doc comment.
+ */
+declare function makeTypedDB<S extends SchemaDef>(schema: S, raw: DBClient): TypedDB<S>;
+/** A typed table accessor derived from one env `Tables` entry's flat shapes. */
+interface EnvTypedTable<T extends TableTypes> {
+    insert(data: T["insert"]): Promise<T["row"]>;
+    /** Update the row by id; resolves to the updated row, or `null` if no row
+     * matched (absent or RLS-hidden) — an idempotent outcome, mirroring
+     * `findById`. The runtime returns a null row rather than throwing. */
+    update(id: string, data: Partial<T["insert"]>): Promise<T["row"] | null>;
+    delete(id: string): Promise<void>;
+    findById(id: string): Promise<T["row"] | null>;
+    findMany(query?: Partial<T["row"]>): Promise<T["row"][]>;
+}
+/** The `tables` map exposed on `Database`/`tx`, keyed by the env `Tables`
+ * interface. When no schema is declared `Tables` is empty, so `tables` is an
+ * empty object — accessing `.tables.foo` is then a compile error (no member). */
+type EnvTables = {
+    [K in keyof Tables]: EnvTypedTable<Tables[K]>;
+};
+/** The project's tables as PLAN operations, keyed by the env `Tables`
+ * interface. The transaction twin of {@link EnvTables}. */
+type TxTables = {
+    [K in keyof Tables]: TxTable<Tables[K]["row"], Tables[K]["insert"]>;
+};
+/**
+ * The handle a `Database.transaction(…)` callback receives.
+ *
+ * Tables only — no `query`, no `findById`, no `asService`. A read whose value
+ * the plan does not write belongs outside the transaction, where it costs one
+ * round trip and is an ordinary value you can branch on.
+ */
+type TxPlan = TxPlanHandle<TxTables>;
+/**
+ * The RLS-bypass sibling returned by `Database.asService()`. Same typed surface
+ * as {@link EnvTypedDatabase} — `tables`, the raw string ops, and a typed
+ * `transaction` — but it does NOT re-expose `asService` (no double-bypass).
+ * Every op it performs runs as the `service_role` (BYPASSRLS).
+ */
+interface EnvServiceDatabase extends Omit<DBClient, "txPlan" | "asService"> {
+    tables: EnvTables;
+    transaction<T>(fn: (tx: TxPlan) => T extends Promise<unknown> ? never : T): Promise<Materialized<T>>;
+}
+/**
+ * The typed-by-default Database surface: the raw string-keyed `DBClient` ops
+ * PLUS a `tables` map typed against the project's generated `palbase-env.d.ts`,
+ * a `transaction` that runs a whole plan in one request, and `asService()` for
+ * the explicit RLS-bypass sibling.
+ *
+ * The low-level `txPlan` op is deliberately NOT re-exposed here: `transaction`
+ * is the surface, and a hand-built plan would bypass the ref/guard machinery
+ * that makes one safe to write.
+ */
+interface EnvTypedDatabase extends Omit<DBClient, "txPlan" | "asService"> {
+    tables: EnvTables;
+    /**
+     * Run a transaction. The callback DESCRIBES the operations; the whole
+     * description travels in one request and the broker runs it inside a single
+     * transaction — committing when it finishes, rolling back on any failure.
+     *
+     * The callback is SYNCHRONOUS: nothing has run when it returns, so there is
+     * nothing to await. `async` on it and `await` inside it are compile errors.
+     * Values a later operation needs are {@link Ref}s, written straight into the
+     * next operation; values the CALLER needs are returned and substituted before
+     * this promise resolves.
+     *
+     * @example
+     * const { statementId } = await Database.transaction((tx) => {
+     *   const st = tx.tables.statements
+     *     .insert({ household_id: hid, file_sha256: sha, status: "reviewing" })
+     *     .expectOne(new Internal("statement insert failed"));
+     *
+     *   tx.tables.statement_lines.insertMany(
+     *     lines.map((l) => ({ statement_id: st.id, category: resolveCategory(l) })),
+     *   );
+     *
+     *   return { statementId: st.id };
+     * });
+     */
+    transaction<T>(fn: (tx: TxPlan) => T extends Promise<unknown> ? never : T): Promise<Materialized<T>>;
+    /**
+     * Return a sibling that bypasses RLS by running as the `service_role`. Use
+     * sparingly and explicitly — the default `Database.*` path is RLS-enforced.
+     *
+     * @example
+     * const all = await Database.asService().tables.todos.findMany({});
+     * const rows = await Database.asService().query("SELECT * FROM todos");
+     */
+    asService(): EnvServiceDatabase;
+}
+
+export { type PalbaseBindDeviceParams as $, type AuthSpec as A, BadRequest as B, type CacheClient as C, type DBClient as D, type EnvTypedDatabase as E, type FileContext as F, PalError as G, HttpError as H, type InsertShape as I, type PalbaseAnalyticsClient as J, type PalbaseAnalyticsManagementNamespace as K, type Logger as L, type Materialized as M, NotFound as N, type OnDeleteAction as O, type PalbaseDocsClient as P, type PalbaseAnalyticsProperties as Q, type RateLimitConfig as R, type SchemaDef as S, type PalbaseAnalyticsQueryNamespace as T, type PalbaseAttestAndroidParams as U, type PalbaseAttestAndroidResult as V, type PalbaseAttestiOSParams as W, type PalbaseAttestiOSResult as X, type PalbaseAuthClient as Y, type PalbaseBatchOverrideOperation as Z, type PalbaseBatchSetOverridesResult as _, type PalbaseFlagsClient as a, type PalbaseSignedUrlResponse as a$, type PalbaseBucketClient as a0, type PalbaseClearAllOverridesResult as a1, type PalbaseClearOverrideResult as a2, type PalbaseCohortQueryInput as a3, type PalbaseCohortResult as a4, type PalbaseCollectionRef as a5, type PalbaseCountQueryInput as a6, type PalbaseCountResult as a7, type PalbaseCreateLinkParams as a8, type PalbaseDeviceInfo as a9, type PalbaseInboxSendResponse as aA, type PalbaseInitialLink as aB, type PalbaseInvokeOptions as aC, type PalbaseLink as aD, type PalbaseLinkAnalytics as aE, type PalbaseLinkDetails as aF, type PalbaseLinksClient as aG, type PalbaseListLinksOptions as aH, type PalbaseListLinksResult as aI, type PalbaseListOptions as aJ, type PalbaseMatchParams as aK, type PalbaseMultiChannelResponse as aL, type PalbaseOverviewResult as aM, type PalbasePreferences as aN, type PalbasePreferencesClient as aO, type PalbasePushClient as aP, type PalbasePushSendParams as aQ, type PalbasePushSendResponse as aR, type PalbaseQrCodeOptions as aS, type PalbaseQuerySnapshot as aT, type PalbaseRegisterDeviceParams as aU, type PalbaseResult as aV, type PalbaseRetentionQueryInput as aW, type PalbaseRetentionResult as aX, type PalbaseSession as aY, type PalbaseSetOverrideResult as aZ, type PalbaseSetOverridesResult as a_, type PalbaseDeviceTokenView as aa, type PalbaseDocumentRef as ab, type PalbaseDocumentSnapshot as ac, type PalbaseEmailClient as ad, type PalbaseEmailSendParams as ae, type PalbaseEmailSendResponse as af, type PalbaseEventNamesResult as ag, type PalbaseEventsQueryInput as ah, type PalbaseEventsResult as ai, type PalbaseExtension as aj, type PalbaseFileObject as ak, type PalbaseFlag as al, type PalbaseFlagContext as am, type PalbaseFlagSource as an, type PalbaseFlagValue as ao, type PalbaseFlagVariant as ap, type PalbaseFlagsServiceClient as aq, type PalbaseFunctionsClient as ar, type PalbaseFunnelQueryInput as as, type PalbaseFunnelResult as at, type PalbaseIdentifyTraits as au, type PalbaseInboxClient as av, type PalbaseInboxListOptions as aw, type PalbaseInboxListResult as ax, type PalbaseInboxMessage as ay, type PalbaseInboxSendParams as az, type PalbaseNotificationsClient as b, jsonb as b$, type PalbaseSmsClient as b0, type PalbaseSmsSendParams as b1, type PalbaseSmsSendResponse as b2, type PalbaseTransformOptions as b3, type PalbaseUpdateLinkParams as b4, type PalbaseUploadOptions as b5, type PalbaseUser as b6, type PalbaseUserDetailResult as b7, type PalbaseUsersQueryInput as b8, type PalbaseUsersResult as b9, type TxRows as bA, type TxSelectOptions as bB, type TxSetShape as bC, type TxSetValue as bD, type TxTable as bE, type TxTables as bF, type TxWhere as bG, type TxWireExpr as bH, type TxWireGuard as bI, type TxWireOp as bJ, type TxWireRef as bK, type TxWireValue as bL, type TypedDB as bM, type TypedTable as bN, type TypedTx as bO, Unauthorized as bP, type User as bQ, type VerifiedDevice as bR, bigint as bS, boolean as bT, dec as bU, defineMiddleware as bV, defineSchema as bW, enumType as bX, inc as bY, integer as bZ, isPalbaseExtension as b_, type PalbaseVerifyRequestSignatureParams as ba, type PalbaseWhereOperator as bb, PolicyBuilder as bc, type PolicyCommand as bd, type PolicyDef as be, type PolicyMode as bf, type RawConstraintDef as bg, type Ref as bh, type RowShape as bi, type SchemaInput as bj, type TableDef as bk, type TableInput as bl, TooManyRequests as bm, type TxColumnExpr as bn, type TxInsertShape as bo, type TxInsertValue as bp, type TxNow as bq, type TxPlan as br, type TxPlanBody as bs, TxPlanError as bt, type TxPlanHandle as bu, type TxPlanOpResult as bv, type TxPlanRejection as bw, type TxPlanResponse as bx, TxRefError as by, type TxRow as bz, type PalbaseRealtimeClient as c, makeTypedDB as c0, now as c1, numeric as c2, policy as c3, raw as c4, text as c5, timestamp as c6, uuid as c7, type PalbaseStorageClient as d, type AuthConfig as e, type ClientInfo as f, ColumnBuilder as g, type ColumnDef as h, type ColumnMap as i, type ColumnType as j, Conflict as k, type DBOps as l, EXTENSION_DEPENDENCIES as m, type EnvServiceDatabase as n, type EnvTables as o, type EnvTypedTable as p, type ErrorDef as q, type ErrorMap as r, type ErrorThrowers as s, Forbidden as t, type HttpMethod as u, type Middleware as v, type MiddlewareContext as w, type MiddlewareHandler as x, PALBASE_EXTENSIONS as y, type PBRequest as z };