@palbase/backend 17.3.0 → 18.0.0

package/dist/index-g-EzitI-.d.ts

@@ -0,0 +1,674 @@
+import { Tables, TableTypes } from './db/env.js';
+import { D as DBClient, b8 as TxPlanHandle, bh as TxTable, M as Materialized } from './endpoint-B0LpZixz.js';
+
+/** On delete action for foreign key references. */
+type OnDeleteAction = 'cascade' | 'set null' | 'restrict' | 'no action';
+/**
+ * The ON DELETE actions permitted on a foreign key to the built-in auth users
+ * (`auth.users`). Both let a user's rows be removed (`cascade`) or detached
+ * (`set null`) when the account is erased; `restrict` / `no action` would BLOCK
+ * erasure and are therefore excluded. This is the CLIENT-SIDE mirror of the
+ * server's auth-FK deletion policy — the server (validateAuthUserFK) is the real
+ * boundary, this narrows the type so the common mistake is caught at compile time.
+ */
+type AuthUserOnDelete = Extract<OnDeleteAction, 'cascade' | 'set null'>;
+/** Column type identifiers. */
+type ColumnType = 'uuid' | 'text' | 'integer' | 'bigint' | 'numeric' | 'boolean' | 'timestamp' | 'jsonb' | 'enum';
+/** Base column definition shared by all column types. */
+interface ColumnDef {
+    type: ColumnType;
+    nullable: boolean;
+    primaryKey: boolean;
+    defaultValue?: unknown;
+    defaultRandom?: boolean;
+    defaultNow?: boolean;
+    references?: {
+        table: string;
+        column: string;
+    };
+    /**
+     * The name this column used to have. A diff cannot tell a rename from a drop and
+     * an add — both leave one name gone and another present — so the intent has to be
+     * declared. Without it, renaming a column loses its data.
+     */
+    renamedFrom?: string;
+    onDeleteAction?: OnDeleteAction;
+    enumName?: string;
+    enumValues?: string[];
+    unique?: boolean;
+}
+declare const __colKind: unique symbol;
+declare const __colNullable: unique symbol;
+declare const __colHasDefault: unique symbol;
+declare const __colEnumValues: unique symbol;
+declare const __colPayload: unique symbol;
+/**
+ * Fluent column builder with phantom type params:
+ *  K — ColumnType literal (e.g. "text", "integer")
+ *  N — boolean: true when nullable() has been called last (false = NOT NULL)
+ *  D — boolean: true when a default has been set
+ *  E — enum value union (never for non-enum columns)
+ *  P — jsonb payload shape (unknown unless jsonb<T>() supplied one)
+ *
+ * All five params have defaults so bare `ColumnBuilder` (no args) still
+ * satisfies `Record<string, ColumnBuilder>` in schema.ts without modification.
+ *
+ * The five `declare readonly` brand fields carry the phantom types into the
+ * structural shape so that conditional types like ColValue<C> can discriminate
+ * on K without requiring runtime values on those fields.
+ */
+declare class ColumnBuilder<K extends ColumnType = ColumnType, N extends boolean = boolean, D extends boolean = boolean, E = unknown, P = unknown> {
+    readonly [__colKind]: K;
+    readonly [__colNullable]: N;
+    readonly [__colHasDefault]: D;
+    readonly [__colEnumValues]: E;
+    readonly [__colPayload]: P;
+    readonly _def: ColumnDef;
+    constructor(type: K, existingDef?: ColumnDef);
+    /** Mark this column as the primary key. */
+    primaryKey(): ColumnBuilder<K, N, D, E, P>;
+    /** Mark this column as NOT NULL (default). */
+    notNull(): ColumnBuilder<K, false, D, E, P>;
+    /** Allow NULL values. */
+    nullable(): ColumnBuilder<K, true, D, E, P>;
+    /** Set a default value. */
+    default(value: unknown): ColumnBuilder<K, N, true, E, P>;
+    /** UUID: generate a random default (gen_random_uuid()). */
+    defaultRandom(): ColumnBuilder<K, N, true, E, P>;
+    /** Timestamp: default to now(). */
+    defaultNow(): ColumnBuilder<K, N, true, E, P>;
+    /** Add a foreign key reference. */
+    /**
+     * Declares that this column used to be called `previous`.
+     *
+     * A schema diff sees one name gone and another present; it cannot know whether
+     * you renamed a column or dropped one and added another, and the two are very
+     * different — the second loses every value. Saying so here turns the plan into
+     * `ALTER TABLE … RENAME COLUMN` instead.
+     *
+     * Once the rename has been applied the annotation is inert (the old name is no
+     * longer there to rename), so it can be deleted at your leisure.
+     */
+    renamedFrom(previous: string): ColumnBuilder<K, N, D, E, P>;
+    references(table: string, column: string): ColumnBuilder<K, N, D, E, P>;
+    /**
+     * Add a real DB-level foreign key to the built-in auth users
+     * (`REFERENCES auth.users(id)`), so a column like `user_id` gets true
+     * database cascade/integrity instead of app-layer-only. Sugar for
+     * `.references("auth.users", "id")`.
+     *
+     * `auth.users` lives in the SAME tenant database (palauth-owned), so this is
+     * a genuine cross-schema integrity constraint scoped to THIS tenant's users.
+     * The referenced `auth.users.id` is `text` (palauth ids are `usr_<uuid>`), so
+     * the referencing column must be `text()` too.
+     *
+     * ON DELETE is REQUIRED here and may only be `cascade` or `set null`: an
+     * account-erasure request must never be blocked by a lingering FK, so
+     * `restrict` / `no action` are not accepted (they don't type-check). Example:
+     * `text().notNull().referencesAuthUser("cascade")`, or
+     * `text().nullable().referencesAuthUser("set null")`. The server
+     * (validateAuthUserFK) enforces this — and the remaining rules the type can't
+     * express (referencing column is text, `set null` needs a nullable column) —
+     * as the real boundary; this signature is the compile-time DX mirror.
+     */
+    referencesAuthUser(onDelete: AuthUserOnDelete): ColumnBuilder<K, N, D, E, P>;
+    /**
+     * Add a real DB-level foreign key to the canonical, server-minted installation
+     * anchor (`REFERENCES auth.installations(id)`) — the app-scoped verified-device
+     * root (`ins_...`). Sugar for `.references("auth.installations", "id")`.
+     *
+     * An installation is an APP INSTALL, not a user: this FK is NOT user ownership.
+     * A user-owned row STILL needs its own `.referencesAuthUser(...)` FK so account
+     * erasure removes it — an installation reference alone does not tie a row to a
+     * user's deletion. Use this only for install-scoped state (device prefs, push
+     * routing, …), alongside a separate auth-user FK where the row is user-owned.
+     *
+     * `auth.installations` lives in the SAME tenant DB (palauth-owned); its `id` is
+     * `text` (`ins_<uuid>`), so the referencing column must be `text()` too. ON
+     * DELETE is REQUIRED and may only be `cascade` or `set null` (same allowed set
+     * as an auth-user FK): an installation revoke / orphan cleanup must never be
+     * blocked by a lingering FK. The server (validateAuthAnchorFK) is the real
+     * boundary; this signature is the compile-time DX mirror.
+     */
+    referencesInstallation(onDelete: AuthUserOnDelete): ColumnBuilder<K, N, D, E, P>;
+    /** Set the ON DELETE action for a foreign key reference. */
+    onDelete(action: OnDeleteAction): ColumnBuilder<K, N, D, E, P>;
+    /** Add a single-column UNIQUE constraint. */
+    unique(): ColumnBuilder<K, N, D, E, P>;
+}
+/**
+ * Extracts the TypeScript value type for a column, respecting nullability.
+ * - "uuid" | "text" | "timestamp" | "bigint" | "numeric" → string (or string | null when N = true)
+ *   Note: bigint/numeric surface as string — JS number loses precision past 2^53,
+ *   and pgx/PostgREST serialize int8/numeric as strings. App code uses
+ *   BigInt(row.amount) for bigint, or a decimal lib for numeric.
+ * - "integer" → number
+ * - "boolean" → boolean
+ * - "jsonb" → P (the dev-supplied payload shape from jsonb<T>(), else unknown)
+ * - "enum" → E (the union of literal values)
+ */
+type ColValue<C> = C extends ColumnBuilder<'uuid' | 'text' | 'timestamp' | 'bigint' | 'numeric', infer N, infer _D, infer _E, infer _P> ? N extends true ? string | null : string : C extends ColumnBuilder<'integer', infer N, infer _D, infer _E, infer _P> ? N extends true ? number | null : number : C extends ColumnBuilder<'boolean', infer N, infer _D, infer _E, infer _P> ? N extends true ? boolean | null : boolean : C extends ColumnBuilder<'jsonb', infer N, infer _D, infer _E, infer P> ? N extends true ? P | null : P : C extends ColumnBuilder<'enum', infer N, infer _D, infer E, infer _P> ? N extends true ? E | null : E : never;
+/**
+ * True when a column is optional on INSERT:
+ *  - nullable columns (N = true) — the DB allows NULL so the field may be omitted
+ *  - columns with a default (D = true) — the DB fills in the value when absent
+ */
+type ColIsOptionalOnInsert<C> = C extends ColumnBuilder<infer _K, true, infer _D, infer _E> ? true : C extends ColumnBuilder<infer _K, infer _N, true, infer _E> ? true : false;
+/** Create a UUID column. */
+declare function uuid(): ColumnBuilder<'uuid', false, false, never>;
+/** Create a TEXT column. */
+declare function text(): ColumnBuilder<'text', false, false, never>;
+/** Create an INTEGER column. Emits int4 (max ~2.1B). */
+declare function integer(): ColumnBuilder<'integer', false, false, never>;
+/**
+ * Create a BIGINT column (Postgres int8, max ~9.2×10^18).
+ * Surfaces as `string` in row/insert types — JS number loses precision past 2^53
+ * and pgx/PostgREST serialize int8 as a JSON string. Use BigInt(row.column) in app code.
+ */
+declare function bigint(): ColumnBuilder<'bigint', false, false, never>;
+/**
+ * Create a NUMERIC column (Postgres `numeric`/`decimal`, arbitrary precision).
+ * For exact fractional values (money with cents as a decimal, rates, weights)
+ * where int4/int8 don't fit. Surfaces as `string` in row/insert types — JS
+ * number can't hold arbitrary-precision decimals without rounding, and
+ * pgx/PostgREST serialize numeric as a JSON string. Parse with a decimal lib
+ * (or BigInt for scaled integers) in app code.
+ */
+declare function numeric(): ColumnBuilder<'numeric', false, false, never>;
+/** Create a BOOLEAN column. */
+declare function boolean(): ColumnBuilder<'boolean', false, false, never>;
+/** Create a TIMESTAMP column. */
+declare function timestamp(): ColumnBuilder<'timestamp', false, false, never>;
+/**
+ * Create a JSONB column. Pass a payload type to make the generated row/insert
+ * type concrete instead of `unknown`:
+ *
+ *   tags: jsonb<string[]>()           // row.tags: string[]
+ *   meta: jsonb<{ tier: string }>()   // row.meta: { tier: string }
+ *   raw:  jsonb()                      // row.raw: unknown (back-compat)
+ *
+ * The runtime accepts a plain JS object/array directly (no JSON.stringify); the
+ * generic only refines the TYPE the env codegen emits.
+ */
+declare function jsonb<T = unknown>(): ColumnBuilder<'jsonb', false, false, never, T>;
+/**
+ * Create an ENUM column.
+ * @param name   The PostgreSQL enum type name (used in DDL).
+ * @param values A readonly tuple of valid string values — kept `const` so the
+ *               union `V[number]` is as narrow as possible.
+ */
+declare function enumType<const V extends readonly string[]>(name: string, values: V): ColumnBuilder<'enum', false, false, V[number]>;
+
+/**
+ * policy.ts — the RLS policy authoring DSL.
+ *
+ * `policy(name)` returns a fluent builder that mirrors the `ColumnBuilder`
+ * style in columns.ts: each chainable method mutates the underlying
+ * definition and returns the builder so calls compose. The terminal value is
+ * a plain {@link PolicyDef} — the exact JSON shape the runtime's
+ * `schema_extract.js` reads off the bundled module and the Go side parses into
+ * `PolicyJSON` (CONTRACT-POLICY).
+ *
+ * @example
+ * import { policy } from "@palbase/backend";
+ *
+ * policy("owner_select")
+ *   .for("select")
+ *   .to("authenticated")
+ *   .using("owner = (select auth.uid())");
+ */
+/** The SQL command a policy applies to. `"all"` covers SELECT/INSERT/UPDATE/DELETE. */
+type PolicyCommand = "all" | "select" | "insert" | "update" | "delete";
+/** Whether a policy is permissive (OR-combined, the default) or restrictive
+ * (AND-combined). Mirrors Postgres `CREATE POLICY ... AS PERMISSIVE|RESTRICTIVE`. */
+type PolicyMode = "permissive" | "restrictive";
+/**
+ * The compiled, serializable policy definition — the EXACT shape consumed by
+ * `schema_extract.js` → Go `PolicyJSON` (CONTRACT-POLICY).
+ *
+ * - `roles`: the DB roles this policy applies to (`TO` clause). An empty array
+ *   means the policy applies to PUBLIC (all roles) — the Postgres default.
+ * - `using`: the `USING (...)` row-visibility expression, or `null` when none.
+ * - `withCheck`: the `WITH CHECK (...)` write-validation expression, or `null`.
+ * - `permissive`: `true` for `AS PERMISSIVE` (default), `false` for restrictive.
+ */
+interface PolicyDef {
+    name: string;
+    command: PolicyCommand;
+    roles: string[];
+    using: string | null;
+    withCheck: string | null;
+    permissive: boolean;
+}
+/**
+ * Fluent RLS policy builder.
+ *
+ * Defaults (documented, applied at construction):
+ *  - `command`: `"all"` — applies to every SQL command unless `.for(...)` narrows it.
+ *  - `roles`: `["authenticated"]` — the common case is "rule applies to signed-in
+ *    users". Call `.to(...)` to override; pass `.to()` with no roles (or never
+ *    call it after a reset) to target PUBLIC.
+ *  - `using` / `withCheck`: `null` — no row filter / write check until set.
+ *  - `permissive`: `true` — `AS PERMISSIVE` (policies OR together).
+ *
+ * Each method mutates `_def` in place and returns `this`, so the chain is a
+ * single builder instance (no per-call allocation, like a tagged-template
+ * compile target). The terminal `PolicyDef` is read directly off `_def` by
+ * `schema_extract.js`.
+ */
+declare class PolicyBuilder {
+    readonly _def: PolicyDef;
+    constructor(name: string);
+    /** Restrict the policy to a single SQL command (default `"all"`). */
+    for(command: PolicyCommand): this;
+    /**
+     * Set the DB roles the policy applies to (the `TO` clause), replacing any
+     * previously-set roles. Call with no arguments to target PUBLIC (all roles).
+     *
+     * @example
+     * policy("p").to("authenticated")
+     * policy("p").to("authenticated", "service_role")
+     * policy("p").to() // PUBLIC
+     */
+    to(...roles: string[]): this;
+    /** Set the `USING (...)` row-visibility expression (raw SQL). */
+    using(sqlExpr: string): this;
+    /** Set the `WITH CHECK (...)` write-validation expression (raw SQL). */
+    withCheck(sqlExpr: string): this;
+    /** Set the policy mode: `"permissive"` (default, OR-combined) or
+     * `"restrictive"` (AND-combined). */
+    as(mode: PolicyMode): this;
+}
+/**
+ * Start authoring an RLS policy. Returns a {@link PolicyBuilder}; the resulting
+ * `PolicyBuilder` is accepted directly in a table's `policies: [...]` array
+ * (its `_def` is read at schema-extract time).
+ *
+ * @param name The policy name. Palbase reconciliation keys policies by
+ *             `(table, name)`, so names must be unique per table.
+ */
+declare function policy(name: string): PolicyBuilder;
+
+/**
+ * Postgres extensions a Palbase project can enable from its schema.
+ *
+ * Extensions are config-as-code: declare them in `defineSchema({ extensions })`
+ * and the deploy installs them (CREATE EXTENSION … SCHEMA extensions) using the
+ * deploy path's privileged connection. They are NOT toggled live from Studio —
+ * CREATE EXTENSION requires a superuser role that only the deploy path holds.
+ *
+ * The list is an allowlist (a string-literal union) so editors autocomplete the
+ * supported names and a typo fails typecheck. It is intentionally extensible:
+ * add a name here (+ confirm the base image ships it) to support more.
+ */
+declare const PALBASE_EXTENSIONS: readonly ["vector", "pg_trgm", "unaccent", "citext", "postgis", "cube", "earthdistance", "hstore", "ltree", "btree_gist", "pg_cron", "pgcrypto", "uuid-ossp"];
+/** A Postgres extension supported by Palbase (allowlist union). */
+type PalbaseExtension = (typeof PALBASE_EXTENSIONS)[number];
+/**
+ * Extensions that depend on another extension. The deploy installs
+ * dependencies first; declaring `earthdistance` without `cube` still works
+ * because the deploy resolves the order, but listing both is clearer.
+ */
+declare const EXTENSION_DEPENDENCIES: Partial<Record<PalbaseExtension, PalbaseExtension[]>>;
+/** Runtime guard: is `name` a supported Palbase extension? */
+declare function isPalbaseExtension(name: string): name is PalbaseExtension;
+
+/**
+ * A named raw-SQL DDL object declared in db/schema.ts for anything the typed DSL
+ * cannot express (EXCLUDE, CHECK, partial/expression indexes, triggers, views).
+ * The deploy emits `up` verbatim on the privileged DDL connection — same trust
+ * posture as policy().using(). Tracked by NAME (not by diffing the body), so a
+ * changed body needs a new name or an explicit drop+add.
+ */
+interface RawConstraintDef {
+    name: string;
+    up: string;
+    down?: string;
+}
+declare function raw(name: string, up: string, opts?: {
+    down?: string;
+}): RawConstraintDef;
+
+/**
+ * A map of column builders keyed by column name — the value you write under
+ * the `columns` key of `defineSchema({ tables: { <name>: { columns } } })`.
+ *
+ * The default `Record<string, ColumnBuilder>` keeps bare references compiling
+ * without a type argument.
+ */
+type ColumnMap = Record<string, ColumnBuilder>;
+/**
+ * The author-facing value written under each table key:
+ * `{ columns, rls?, policies? }`.
+ *
+ * - `columns`: the column map (required).
+ * - `rls`: enable + FORCE row-level security on this table. **Defaults to
+ *   `true`**, and is forced on when `policies` is non-empty. A table with RLS
+ *   and no policies is deny-all, which is the starting state: nothing reads it
+ *   until a policy says who may. Set `rls: false` only for a genuinely public
+ *   table — it is an explicit opt-out that a reviewer can grep for, not
+ *   something you get by forgetting.
+ * - `policies`: the RLS policies for this table, authored with `policy(name)`.
+ *   Each entry may be a {@link PolicyBuilder} (the normal `policy(...)` chain)
+ *   or a raw {@link PolicyDef} object.
+ *
+ * The `C` type parameter preserves the precise per-column phantom types so the
+ * typed `Database.tables.*` surface keeps inferring insert/row shapes.
+ */
+interface TableInput<C extends ColumnMap = ColumnMap> {
+    columns: C;
+    rls?: boolean;
+    policies?: (PolicyBuilder | PolicyDef)[];
+    /** Composite/named primary key (ordered column names). Omit for single-column inline .primaryKey(). */
+    primaryKey?: string[];
+    /** Named multi-column UNIQUE constraints. */
+    unique?: {
+        name: string;
+        columns: string[];
+    }[];
+    /** Named raw-SQL DDL objects (EXCLUDE, triggers, views) that the typed DSL cannot express. */
+    raw?: RawConstraintDef[];
+    /**
+     * Named first-class CHECK constraints. Diffed by NAME with a BODY compare:
+     * a changed `expr` (after pg normalization) recreates the constraint
+     * (DROP + ADD). `expr` is trusted SQL emitted verbatim (like policy USING),
+     * `name` is identifier-validated.
+     */
+    checks?: {
+        name: string;
+        expr: string;
+    }[];
+    /**
+     * Plain (non-unique) btree indexes over an ordered column list, emitted as
+     * standalone `CREATE INDEX [IF NOT EXISTS] name ON table (col1, col2)`
+     * statements (NOT a table clause — a separate migration statement category).
+     * Structural compare by NAME (no expression normalization). `name` and each
+     * column are identifier-validated by the Go differ.
+     *
+     * Scope: columns-only plain btree. Partial (`where`) and expression indexes
+     * are a deliberate follow-up — modelling them needs the same raw-SQL
+     * normalization round-trip CHECK uses (Task 10), so they are NOT in this
+     * type yet to avoid a half-working partial-index path.
+     */
+    indexes?: {
+        name: string;
+        columns: string[];
+    }[];
+}
+/**
+ * A table definition — the runtime value the Go runtime's `schema_extract.js`
+ * reads. It keys tables by `tableDef.name`, reads `tableDef.columns` for the
+ * column DDL, and `tableDef.rls` + `tableDef.policies` for RLS.
+ *
+ * `defineSchema` derives `name` from the object key, so authors never repeat
+ * the table name. `rls`/`policies` are always present after normalization
+ * (defaulted to `true`/`[]`).
+ *
+ * The `C` type parameter preserves the precise per-column phantom types so that
+ * downstream mapped types (InsertShape, RowShape) can discriminate on them.
+ */
+interface TableDef<C extends ColumnMap = ColumnMap> {
+    name: string;
+    columns: C;
+    rls: boolean;
+    policies: PolicyDef[];
+    primaryKey?: string[];
+    unique?: {
+        name: string;
+        columns: string[];
+    }[];
+    /** Named raw-SQL DDL objects emitted verbatim on deploy. Tracked by name. */
+    raw?: RawConstraintDef[];
+    /** Named first-class CHECK constraints. Diffed by name + (normalized) body. */
+    checks?: {
+        name: string;
+        expr: string;
+    }[];
+    /** Plain btree indexes (columns-only), emitted as standalone CREATE INDEX. Diffed by name. */
+    indexes?: {
+        name: string;
+        columns: string[];
+    }[];
+}
+/**
+ * A schema definition containing multiple tables, keyed by table name.
+ *
+ * The `T` type parameter preserves the exact `TableDef<...>` type for each
+ * table so that `SchemaDef["tables"]["rooms"]` resolves to the precise
+ * `TableDef<{ id: ColumnBuilder<'uuid', false, true, never>; ... }>`.
+ */
+interface SchemaDef<T extends Record<string, TableDef> = Record<string, TableDef>> {
+    tables: T;
+    /** Postgres extensions to install on deploy. Normalized to `[]` when absent. */
+    extensions: PalbaseExtension[];
+}
+/** The author-facing input to `defineSchema` — a `tables` map whose keys are
+ * the table names and whose values are `{ columns, rls?, policies? }`, plus an
+ * optional `extensions` allowlist. */
+interface SchemaInput<T extends Record<string, TableInput> = Record<string, TableInput>> {
+    tables: T;
+    /**
+     * Postgres extensions to enable for this project, e.g. `["vector"]`.
+     * Config-as-code: installed by the deploy (CREATE EXTENSION … SCHEMA
+     * extensions) with the privileged deploy connection. The type is an
+     * allowlist union, so unsupported names fail typecheck.
+     */
+    extensions?: PalbaseExtension[];
+}
+/** Map the author's `{ tables: { <name>: { columns } } }` input to the
+ * `{ tables: { <name>: TableDef<columns> } }` runtime/type shape, threading the
+ * per-table column map `T[K]["columns"]` so column-level inference survives. */
+type TablesFromInput<T extends Record<string, TableInput>> = {
+    [K in keyof T]: TableDef<T[K]["columns"]>;
+};
+/**
+ * Define a schema. The table NAME comes from the object key. Each table value
+ * is `{ columns, rls?, policies? }`:
+ *
+ *   export default defineSchema({
+ *     tables: {
+ *       todos: {
+ *         columns: {
+ *           id:    uuid().primaryKey().defaultRandom(),
+ *           owner: text().notNull(),
+ *           title: text().notNull(),
+ *         },
+ *         rls: true,
+ *         policies: [
+ *           policy("owner_all").for("all").to("authenticated")
+ *             .using("owner = (select auth.uid())")
+ *             .withCheck("owner = (select auth.uid())"),
+ *         ],
+ *       },
+ *     },
+ *   });
+ *
+ * The returned value is
+ * `{ tables: { todos: { name, columns, rls, policies } } }` — the exact shape
+ * the runtime schema extractor parses. Per-column phantom types are preserved
+ * so `Database.tables.todos.insert({...})` stays typed.
+ *
+ * RLS normalization: `rls` defaults to **`true`**, `policies` to `[]`. A table
+ * that declares neither is therefore deny-all — nothing reads it until a policy
+ * says who may, which is the safe starting point rather than a bug. Declare
+ * `rls: false` for a genuinely public table; that is an explicit, greppable
+ * statement of intent instead of an omission. When `policies` is non-empty,
+ * `rls` is forced on (ENABLE + FORCE) regardless of the declared flag — a table
+ * with policies must have RLS enabled or the policies would be inert.
+ */
+declare function defineSchema<T extends Record<string, TableInput>>(input: SchemaInput<T>): SchemaDef<TablesFromInput<T>>;
+
+/**
+ * typed-db.ts — Task 2: TypedDB schema-derived insert/row shapes.
+ *
+ * Derives INSERT and full-row TypeScript types from a `defineSchema()` result
+ * and wraps the untyped runtime `DBClient` with a typed facade.
+ *
+ * No value-any. No `as unknown as X`. The two narrow `as` casts in
+ * `makeTypedTable` are safe because:
+ *  - `data as Record<string, unknown>`: InsertShape<T> maps string keys to
+ *    typed values; all value types are subsets of `unknown`, so the cast is
+ *    structurally sound.
+ *  - `result as RowShape<T>`: The runtime DBClient returns `Record<string,
+ *    unknown>` which is the erased form of the typed row; we're narrowing back
+ *    to the precise shape that the schema declared.
+ * Both casts are narrowing only (not widening) and correctness is guaranteed
+ * by the schema the caller provides.
+ */
+
+/** Keys of C whose columns are required on INSERT (not nullable, no default). */
+type RequiredKeys<C> = {
+    [K in keyof C]: ColIsOptionalOnInsert<C[K]> extends true ? never : K;
+}[keyof C];
+/** Keys of C whose columns are optional on INSERT (nullable or has a default). */
+type OptionalKeys<C> = {
+    [K in keyof C]: ColIsOptionalOnInsert<C[K]> extends true ? K : never;
+}[keyof C];
+/**
+ * The TypeScript type for an INSERT payload for table `T`.
+ * - Required: columns that are NOT NULL and have no DB-level default.
+ * - Optional: columns that are nullable or carry a default.
+ *
+ * When all columns are optional, `RequiredKeys<C>` resolves to `never` and
+ * the first part becomes `{}`, which is a neutral element for `&`.
+ */
+type InsertShape<T extends TableDef> = {
+    [K in RequiredKeys<T["columns"]>]: ColValue<T["columns"][K]>;
+} & {
+    [K in OptionalKeys<T["columns"]>]?: ColValue<T["columns"][K]>;
+};
+/**
+ * The TypeScript type for a full row returned by the DB for table `T`.
+ * Every column is present; nullable columns resolve to `T | null`.
+ */
+type RowShape<T extends TableDef> = {
+    [K in keyof T["columns"]]: ColValue<T["columns"][K]>;
+};
+/** A typed table accessor that mirrors the runtime DBClient surface. */
+interface TypedTable<T extends TableDef> {
+    insert(data: InsertShape<T>): Promise<RowShape<T>>;
+    /** Update the row by id; resolves to the updated row, or `null` if no row
+     * matched (absent or RLS-hidden) — an idempotent outcome, mirroring
+     * `findById`. The runtime returns a null row rather than throwing. */
+    update(id: string, data: Partial<InsertShape<T>>): Promise<RowShape<T> | null>;
+    delete(id: string): Promise<void>;
+    findById(id: string): Promise<RowShape<T> | null>;
+    findMany(query?: Partial<RowShape<T>>): Promise<RowShape<T>[]>;
+}
+/** A typed DB facade covering all tables declared in schema `S`. */
+interface TypedDB<S extends SchemaDef> {
+    tables: {
+        [K in keyof S["tables"]]: TypedTable<S["tables"][K]>;
+    };
+    /** Run a transaction plan. See {@link EnvTypedDatabase.transaction}. */
+    transaction<T>(fn: (tx: TypedTx<S>) => T extends Promise<unknown> ? never : T): Promise<Materialized<T>>;
+}
+/** The plan-building handle a `TypedDB<S>` transaction callback receives: the
+ * schema's tables, expressed as plan operations rather than awaited calls. */
+type TypedTx<S extends SchemaDef> = TxPlanHandle<{
+    [K in keyof S["tables"]]: TxTable<RowShape<S["tables"][K]>, InsertShape<S["tables"][K]>>;
+}>;
+/**
+ * Wraps a raw `DBClient` with the type-safe `TypedDB<S>` facade derived from
+ * the provided schema. No behavior change for the direct ops — all calls
+ * delegate to `raw` with the table name as a plain string.
+ *
+ * `transaction` does NOT delegate to a per-op client: the callback describes a
+ * plan against a fresh {@link TxPlanBuilder}, and the whole plan travels in one
+ * `raw.txPlan` call. The schema is used only for its table NAMES; the values
+ * are typed by `S` at compile time and are plain strings at run time.
+ *
+ * The `as` casts are single structural narrowings from a dynamically-built
+ * object to the precise mapped type (TS cannot infer the mapped-type result
+ * through `Object.keys` iteration) — see the module-level doc comment.
+ */
+declare function makeTypedDB<S extends SchemaDef>(schema: S, raw: DBClient): TypedDB<S>;
+/** A typed table accessor derived from one env `Tables` entry's flat shapes. */
+interface EnvTypedTable<T extends TableTypes> {
+    insert(data: T["insert"]): Promise<T["row"]>;
+    /** Update the row by id; resolves to the updated row, or `null` if no row
+     * matched (absent or RLS-hidden) — an idempotent outcome, mirroring
+     * `findById`. The runtime returns a null row rather than throwing. */
+    update(id: string, data: Partial<T["insert"]>): Promise<T["row"] | null>;
+    delete(id: string): Promise<void>;
+    findById(id: string): Promise<T["row"] | null>;
+    findMany(query?: Partial<T["row"]>): Promise<T["row"][]>;
+}
+/** The `tables` map exposed on `Database`/`tx`, keyed by the env `Tables`
+ * interface. When no schema is declared `Tables` is empty, so `tables` is an
+ * empty object — accessing `.tables.foo` is then a compile error (no member). */
+type EnvTables = {
+    [K in keyof Tables]: EnvTypedTable<Tables[K]>;
+};
+/** The project's tables as PLAN operations, keyed by the env `Tables`
+ * interface. The transaction twin of {@link EnvTables}. */
+type TxTables = {
+    [K in keyof Tables]: TxTable<Tables[K]["row"], Tables[K]["insert"]>;
+};
+/**
+ * The handle a `Database.transaction(…)` callback receives.
+ *
+ * Tables only — no `query`, no `findById`, no `asService`. A read whose value
+ * the plan does not write belongs outside the transaction, where it costs one
+ * round trip and is an ordinary value you can branch on.
+ */
+type TxPlan = TxPlanHandle<TxTables>;
+/**
+ * The RLS-bypass sibling returned by `Database.asService()`. Same typed surface
+ * as {@link EnvTypedDatabase} — `tables`, the raw string ops, and a typed
+ * `transaction` — but it does NOT re-expose `asService` (no double-bypass).
+ * Every op it performs runs as the `service_role` (BYPASSRLS).
+ */
+interface EnvServiceDatabase extends Omit<DBClient, "txPlan" | "asService"> {
+    tables: EnvTables;
+    transaction<T>(fn: (tx: TxPlan) => T extends Promise<unknown> ? never : T): Promise<Materialized<T>>;
+}
+/**
+ * The typed-by-default Database surface: the raw string-keyed `DBClient` ops
+ * PLUS a `tables` map typed against the project's generated `palbase-env.d.ts`,
+ * a `transaction` that runs a whole plan in one request, and `asService()` for
+ * the explicit RLS-bypass sibling.
+ *
+ * The low-level `txPlan` op is deliberately NOT re-exposed here: `transaction`
+ * is the surface, and a hand-built plan would bypass the ref/guard machinery
+ * that makes one safe to write.
+ */
+interface EnvTypedDatabase extends Omit<DBClient, "txPlan" | "asService"> {
+    tables: EnvTables;
+    /**
+     * Run a transaction. The callback DESCRIBES the operations; the whole
+     * description travels in one request and the broker runs it inside a single
+     * transaction — committing when it finishes, rolling back on any failure.
+     *
+     * The callback is SYNCHRONOUS: nothing has run when it returns, so there is
+     * nothing to await. `async` on it and `await` inside it are compile errors.
+     * Values a later operation needs are {@link Ref}s, written straight into the
+     * next operation; values the CALLER needs are returned and substituted before
+     * this promise resolves.
+     *
+     * @example
+     * const { statementId } = await Database.transaction((tx) => {
+     *   const st = tx.tables.statements
+     *     .insert({ household_id: hid, file_sha256: sha, status: "reviewing" })
+     *     .expectOne(new Internal("statement insert failed"));
+     *
+     *   tx.tables.statement_lines.insertMany(
+     *     lines.map((l) => ({ statement_id: st.id, category: resolveCategory(l) })),
+     *   );
+     *
+     *   return { statementId: st.id };
+     * });
+     */
+    transaction<T>(fn: (tx: TxPlan) => T extends Promise<unknown> ? never : T): Promise<Materialized<T>>;
+    /**
+     * Return a sibling that bypasses RLS by running as the `service_role`. Use
+     * sparingly and explicitly — the default `Database.*` path is RLS-enforced.
+     *
+     * @example
+     * const all = await Database.asService().tables.todos.findMany({});
+     * const rows = await Database.asService().query("SELECT * FROM todos");
+     */
+    asService(): EnvServiceDatabase;
+}
+
+export { jsonb as A, makeTypedDB as B, ColumnBuilder as C, numeric as D, type EnvTypedDatabase as E, policy as F, raw as G, text as H, type InsertShape as I, timestamp as J, uuid as K, type OnDeleteAction as O, PALBASE_EXTENSIONS as P, type RawConstraintDef as R, type SchemaDef as S, type TableDef as T, type ColumnDef as a, type ColumnMap as b, type ColumnType as c, EXTENSION_DEPENDENCIES as d, type EnvServiceDatabase as e, type EnvTables as f, type EnvTypedTable as g, type PalbaseExtension as h, PolicyBuilder as i, type PolicyCommand as j, type PolicyDef as k, type PolicyMode as l, type RowShape as m, type SchemaInput as n, type TableInput as o, type TxPlan as p, type TxTables as q, type TypedDB as r, type TypedTable as s, type TypedTx as t, bigint as u, boolean as v, defineSchema as w, enumType as x, integer as y, isPalbaseExtension as z };