@voltro/database 0.63.0 → 0.64.0

package/dist/index.d.ts

@@ -30,6 +30,32 @@ export declare const actorsTable: Table<'actors', Record<string, ColumnDefinitio
  */
 export declare const admitBranch: (branches: ReadonlyArray<BranchRecord>, policy: BranchPolicy, nowMs: number) => BranchLimitDecision;
 
+export declare interface AgedSoftDropSnapshot {
+    /** `table` or `table.column`. */
+    readonly name: string;
+    readonly droppedAt: Date;
+    readonly ageDays: number;
+}
+
+/**
+ * The soft-drop snapshots older than the review window — the ones nobody
+ * restored and nobody reclaimed. A snapshot is a full copy of the dropped data,
+ * PII included, and `gc-snapshots` is a manual step an operator has to
+ * remember; this is the reminder, computed from the stamp in the name so it
+ * costs no query beyond the introspection that already ran.
+ */
+export declare const agedSoftDropSnapshots: (live: {
+    readonly tables: ReadonlyArray<{
+        readonly name: string;
+        readonly columns?: ReadonlyArray<{
+            readonly name: string;
+        }>;
+    }>;
+}, options?: {
+    readonly now?: Date;
+    readonly retentionDays?: number;
+}) => ReadonlyArray<AgedSoftDropSnapshot>;
+
 export declare interface AggregateColumn<TResult = number | Date | null> {
     readonly op: 'count' | 'sum' | 'avg' | 'min' | 'max' | 'count-distinct' | 'window-row-number' | 'window-rank' | 'window-dense-rank' | 'window-lag' | 'window-lead' | 'window-sum-over' | 'window-avg-over' | 'column';
     readonly column?: string;
@@ -303,6 +329,9 @@ export declare const bindResidentStore: <S>(subject: ResidencySubject, config: R
 
 export declare const boolean: () => ColumnBuilder<boolean, "boolean", boolean>;
 
+/** The BOUND envelope: `enc:v2:<r|c>:<iv>:<tag>:<ct>` — see {@link FieldBinding}. */
+export declare const BOUND_ENCRYPTED_PREFIX = "enc:v2:";
+
 export declare type BranchEvent = 'provision' | 'provisioned' | 'fail' | 'destroy' | 'destroyed';
 
 /**
@@ -1380,6 +1409,14 @@ export declare interface ColumnDefinition<TsType, Type extends ColumnType = Colu
      * has nothing to do with FK semantics.
      */
     readonly refOnUpdate?: 'cascade' | 'restrict' | 'setNull' | 'noAction';
+    /**
+     * What the RUNTIME does to this column's rows when the referenced row is
+     * SOFT-deleted (`deletedAt` set) — set by `reference(…, { onSoftDelete })`.
+     * A foreign key never sees a soft delete (it is an UPDATE), so `onDelete`
+     * cannot express it; the store's post-commit change channel enforces this
+     * one instead, the way `pluginRef` orphan rules are enforced.
+     */
+    readonly refOnSoftDelete?: 'cascade' | 'setNull';
     /**
      * Auto-create a B-tree index on this FK column. Default `true` — FK
      * columns are nearly always read-by, and the lookup cost of a missing
@@ -1483,12 +1520,16 @@ export declare interface ColumnDefinition<TsType, Type extends ColumnType = Colu
     /**
      * Field-level encryption flag, set by `.encrypted()`. When `true`
      * the runtime's store middleware encrypts the value on write and
-     * decrypts on read via the registered field cipher (AES-256-GCM,
-     * keyed from the Secrets-Resolver — see `@voltro/plugin-governance`).
-     * The stored column is an opaque `enc:v1:…` string, so the DB type
-     * stays `text`. A row written while encryption is active can't be
+     * decrypts on read via the registered field cipher (AES-256-GCM, keyed
+     * from `VOLTRO_FIELD_ENCRYPTION_KEY` through the Secrets-Resolver — the
+     * framework registers it on both boot paths; `voltro dev` mints the key).
+     * The stored column is an opaque `enc:v2:…` string — bound by GCM's
+     * additional authenticated data to its table, column and row
+     * (`FieldBinding`), so a ciphertext copied into another row or column
+     * does not decrypt there — and the DB type stays `text`. A row written
+     * while encryption is active can't be
      * read back without the key — losing the key loses the data, by
-     * design. Boot fails loud if an `.encrypted()` column is present but
+     * design. Boot refuses if an `.encrypted()` column is declared but
      * no cipher is registered.
      */
     readonly encrypted?: boolean;
@@ -2757,7 +2798,7 @@ export declare const declareEnumRename: (enumName: string, rename: EnumValueRena
  * it is written here so the next reader does not go looking for the branch that
  * handles it.
  */
-export declare const decodeFieldValue: (cipher: FieldCipher, ciphertext: string, expected?: string) => unknown;
+export declare const decodeFieldValue: (cipher: FieldCipher, ciphertext: string, expected?: string, binding?: FieldBinding) => unknown;
 
 export declare type DecoderDialectId = 'postgres' | 'mysql' | 'mariadb' | 'sqlite' | 'mssql' | 'turso';
 
@@ -2789,6 +2830,9 @@ export declare const decryptFieldsOnRead: (rows: ReadonlyArray<Row>, table: Tabl
         readonly column: string;
         readonly reason: string;
     }) => void;
+    /** The row's id when the rows themselves do not carry it — the row a KEYED
+     *  write returns is addressed by the `pk` the caller passed. */
+    readonly rowId?: unknown;
 }) => ReadonlyArray<Row>;
 
 /**
@@ -2821,6 +2865,10 @@ export declare const DEFAULT_CHANGE_CLAIM_TTL_HOURS = 1;
  */
 export declare const DEFAULT_EAGER_FALLBACK_WARN_INTERVAL_MS = 300000;
 
+/** Default review window for a soft-drop snapshot, in days — the "~7d" the
+ *  soft-drop advice promises. Past it, a boot and a `db plan` say so. */
+export declare const DEFAULT_SOFT_DROP_RETENTION_DAYS = 7;
+
 export declare const DEFAULT_SUBJECT_GRAPH_DEPTH = 4;
 
 export declare const defineMigration: (input: MigrationDefinitionInput) => MigrationDefinition;
@@ -2921,6 +2969,9 @@ export declare interface DeriveSubjectGraphInput {
  */
 export declare const deriveTypeIdPrefix: (tableName: string) => string;
 
+/** The one line both the boot and `db plan` print for an aged snapshot set. */
+export declare const describeAgedSoftDropSnapshots: (aged: ReadonlyArray<AgedSoftDropSnapshot>, retentionDays: number) => string;
+
 /**
  * A one-line driver summary for an error, or `undefined` when the chain carries
  * nothing driver-shaped.
@@ -3268,7 +3319,7 @@ declare type EmptyMerge = unknown;
  * remedies, and collapsing them is what cost the consumer a day. `decodeFieldValue`
  * therefore decrypts and decodes as two separate steps and says which one failed.
  */
-export declare const encodeFieldValue: (cipher: FieldCipher, value: unknown) => string;
+export declare const encodeFieldValue: (cipher: FieldCipher, value: unknown, binding?: FieldBinding) => string;
 
 /**
  * Serialize a row's json()/array() cells to JSON strings so they can be
@@ -3278,7 +3329,7 @@ export declare const encodeFieldValue: (cipher: FieldCipher, value: unknown) =>
  */
 export declare const encodeRowForSchema: <T extends Record<string, unknown>>(row: T, tableName: string, types?: ReadonlyArray<ColumnType>) => T;
 
-/** A ciphertext produced by the framework cipher carries this prefix. */
+/** The UNBOUND envelope: `enc:v1:<iv>:<tag>:<ct>`. */
 export declare const ENCRYPTED_PREFIX = "enc:v1:";
 
 /** Column names on a table flagged `.encrypted()`. */
@@ -3290,10 +3341,14 @@ export declare const encryptedColumnsOf: (table: TableLike) => ReadonlyArray<str
  * `null` / `undefined` pass through. An already-encrypted value is left
  * as-is (idempotent — a re-passed ciphertext isn't double-wrapped).
  *
+ * Each value is BOUND to its address (`FieldBinding`): to the row when its id
+ * is known — the row's own `id`, or `rowId` for a keyed write whose patch does
+ * not carry it — and to the column otherwise.
+ *
  * Throws if an encrypted column carries a value but no cipher is
  * registered — losing the key silently would be worse than a loud boot.
  */
-export declare const encryptFieldsForWrite: (row: Row, table: TableLike | undefined, cipher: FieldCipher | undefined) => Row;
+export declare const encryptFieldsForWrite: (row: Row, table: TableLike | undefined, cipher: FieldCipher | undefined, rowId?: unknown) => Row;
 
 /** Mark it finished — AFTER its `routeEvent` has registered, not after the
  *  statement. That is the whole point: the window being closed is exactly the
@@ -3374,9 +3429,10 @@ export declare interface ExistsPredicate {
  * expiry on every existing row".
  *
  * Reads filter it out on EVERY dialect from the moment it passes; the physical
- * delete is a postgres-only sweep. Read the header before relying on the second
- * half — an expired row is INVISIBLE everywhere and still PRESENT on four of
- * five dialects, which is the right trade and a surprising one.
+ * delete is the retention sweep, on every dialect, after a grace of
+ * `VOLTRO_EXPIRED_ROWS_TTL_HOURS` (default 24). Read the header before relying
+ * on the second half — an expired row is INVISIBLE everywhere and still
+ * PRESENT for up to that grace, which is the right trade and a surprising one.
  *
  * Opt out for a deliberate read of expired rows the same way soft-delete does:
  * `ctx.store.select('inviteLinks').includeExpired()`.
@@ -3427,10 +3483,54 @@ export declare interface FallbackLogger {
     readonly debug: (message: string, fields?: Record<string, unknown>) => void;
 }
 
+/**
+ * Where a ciphertext BELONGS — the table, the column and, when the row's
+ * identity is known at write time, the row. Fed to AES-GCM as additional
+ * authenticated data, so the tag covers the address as well as the bytes.
+ *
+ * ── The attack this closes ─────────────────────────────────────────────────
+ *
+ * Without it, a ciphertext is a bearer value: anyone who can WRITE the database
+ * — a leaked migration credential, a compromised replica, an operator with too
+ * much access — copies user A's encrypted token into user B's row, and the app,
+ * acting for B, decrypts and USES A's credential. No key is needed; the app is
+ * the confused deputy that holds it. The same copy across columns turns a
+ * refresh token into an access token. Bound to `table:column:rowId`, the copied
+ * value fails GCM authentication in its new home: the attacker needs the key to
+ * re-bind it, which is the thing they did not have.
+ *
+ * `row` is the strong binding and `column` the fallback: a set-based write has
+ * no row identity, and a table whose id the DATABASE assigns has none at insert.
+ * The envelope records which one was used (`enc:v2:r:` / `enc:v2:c:`), so the
+ * reader never guesses.
+ */
+export declare interface FieldBinding {
+    /** `table:column`. */
+    readonly column: string;
+    /** `table:column:rowId` — present iff the row's id is known. */
+    readonly row?: string;
+}
+
+/** The binding for one column of one row. `rowId` is the id as the row carries
+ *  it; a number is spelled the way `String()` spells it so a keyed update by
+ *  its string form and a read of the numeric column agree. */
+export declare const fieldBinding: (table: string, column: string, rowId?: unknown) => FieldBinding;
+
 /** The cipher the store middleware injects. Operates on opaque strings. */
 export declare interface FieldCipher {
-    readonly encrypt: (plaintext: string) => string;
-    readonly decrypt: (ciphertext: string) => string;
+    /**
+     * With a binding: an `enc:v2:r:` (row-bound, when `binding.row` is set) or
+     * `enc:v2:c:` (column-bound) envelope whose GCM tag covers the binding.
+     * Without one: the unbound `enc:v1:` envelope — the raw-SQL escape hatch's
+     * form, and what every row written before 0.64 carries.
+     */
+    readonly encrypt: (plaintext: string, binding?: FieldBinding) => string;
+    /**
+     * Reads every envelope. A bound one is verified against the matching member
+     * of `binding` and fails when it is absent or differs — that failure IS the
+     * feature, and the reader must not fall back to an unbound read.
+     */
+    readonly decrypt: (ciphertext: string, binding?: FieldBinding) => string;
 }
 
 /**
@@ -3977,6 +4077,10 @@ export declare const intersect: (...queries: ReadonlyArray<QueryWithDescriptorAn
  */
 export declare const interval: () => ColumnBuilder<string, "interval", boolean>;
 
+/** Is this value a BOUND ciphertext (`enc:v2:`)? An unbound `enc:v1:` value
+ *  reads fine and is what `voltro db encrypt-column` re-binds. */
+export declare const isBoundCiphertext: (value: unknown) => value is string;
+
 /** Is this namespace one of ours? (so a teardown sweep never touches a real
  *  tenant namespace). */
 export declare const isBranchNamespace: (namespace: string) => boolean;
@@ -4069,7 +4173,7 @@ export declare const isQueryTimeout: (dbCause: Record<string, unknown>) => boole
  *  to normalise a column without touching rows that are already current. Answers
  *  `undefined` when the two forms coincide (a numeric column, or a value that
  *  parses to itself) — nothing to do either way. */
-export declare const isRawEncoding: (cipher: FieldCipher, ciphertext: string, expected?: string) => boolean | undefined;
+export declare const isRawEncoding: (cipher: FieldCipher, ciphertext: string, expected?: string, binding?: FieldBinding) => boolean | undefined;
 
 /** Can THIS deployment serve the region? */
 export declare const isRegionServable: (region: string, config: ResidencyConfig) => boolean;
@@ -4078,6 +4182,11 @@ export declare const isRelationsSpec: (value: unknown) => value is RelationsSpec
 
 export declare const isSeedDefinition: (value: unknown) => value is SeedDefinition;
 
+/** True when `name` is a soft-drop snapshot (`<original>__dropped_<ts>`) left
+ *  behind by `VOLTRO_SOFT_DROP=1`. Applies to tables AND columns — the applier
+ *  uses one suffix for both. */
+export declare const isSoftDropSnapshotName: (name: string) => boolean;
+
 /**
  * `turso` (the Rust rewrite of SQLite, `@voltro/sql-turso`) is
  * SQL-semantically identical to `sqlite` — it differs only in the connection
@@ -4144,6 +4253,13 @@ export declare const isStagingTableName: (name: string) => boolean;
  */
 export declare const isTableReactive: (tableName: string) => boolean;
 
+/**
+ * Dialect-agnostic: does this error, anywhere down its `cause` chain, carry a
+ * contention signal any supported engine emits? The mutation runner replays
+ * the whole transaction on a `true`.
+ */
+export declare const isTransientContention: (err: unknown) => boolean;
+
 /** Type guard: is this descriptor a read-only view (vs a base table)? */
 export declare const isView: (t: TableLike) => t is View<string, Record<string, ColumnDefinition<unknown>>>;
 
@@ -4608,6 +4724,12 @@ export declare interface MixinOptions<Input extends FieldsInput> {
     readonly policies?: MixinDefinition<FieldDefinitions<Input>>['policies'];
 }
 
+/** SQL Server error numbers, as decimal strings. */
+export declare const MSSQL_TRANSIENT_NUMBERS: ReadonlySet<string>;
+
+/** MySQL / MariaDB — `errno` as a decimal string, or the symbolic `code`. */
+export declare const MYSQL_TRANSIENT_CODES: ReadonlySet<string>;
+
 /**
  * Type-narrowing migration marker. Tells the planner that this column
  * previously had type `from` and is now being narrowed/converted to its
@@ -4997,6 +5119,9 @@ export declare interface PluginRefSpec {
 /** The declared spec for a column builder, when it is a `pluginRef`. */
 export declare const pluginRefSpecOf: (column: unknown) => PluginRefSpec | undefined;
 
+/** Postgres SQLSTATEs. */
+export declare const POSTGRES_TRANSIENT_STATES: ReadonlySet<string>;
+
 export declare type Predicate = PredicateLeaf | AndPredicate | OrPredicate | NotPredicate | SubqueryInPredicate | ExistsPredicate;
 
 export declare interface PredicateLeaf {
@@ -5112,6 +5237,16 @@ Joins extends JoinsMap = {}> {
      * SEE tombstoned rows. No-op on tables without `softDelete()`.
      */
     withDeleted: () => Query<RowOf, IxNames, Joins>;
+    /**
+     * Lock the matched rows until the enclosing transaction commits — the
+     * read half of a read-modify-write that must not lose an update to a
+     * concurrent writer. A json array appended by two requests at once keeps
+     * one append without it; with it the second reader waits for the first
+     * transaction and reads the row it wrote. Per dialect: `FOR UPDATE`
+     * (postgres / mysql / mariadb), `WITH (UPDLOCK, ROWLOCK)` (mssql), nothing
+     * on sqlite (its writers are serialised already).
+     */
+    forUpdate: () => Query<RowOf, IxNames, Joins>;
     /**
      * Cross-tenant: opt OUT of the runtime's automatic
      * `tenantId = <subject.tenantId>` scope on `tenant()` tables. Use for
@@ -5477,6 +5612,15 @@ export declare interface QueryDescriptor<R = Row> {
      *  rows (an admin view, a grace-period check). Same shape and same posture as
      *  `includeDeleted`. */
     readonly includeExpired?: boolean;
+    /**
+     * Lock the matched rows for the rest of the enclosing transaction — set by
+     * `.forUpdate()`. `SELECT … FOR UPDATE` on postgres / mysql / mariadb,
+     * `WITH (UPDLOCK, ROWLOCK)` on mssql; sqlite serialises writers already and
+     * emits nothing. Outside a transaction the lock is released as the statement
+     * ends, which is harmless and useless — the point is a read-modify-write
+     * whose read and write share one transaction.
+     */
+    readonly lock?: 'update';
     /**
      * Opt OUT of the runtime's automatic tenant scope on `tenant()` tables.
      * Set by `.unscoped()`. Honored by the runtime, same as `includeDeleted`.
@@ -5907,25 +6051,26 @@ export declare interface RecordedWrite {
 
 export declare const recordsTable: (table: string) => boolean;
 
-/**
- * Foreign-key reference to another table's id column.
- *
- * Default cascade semantics: `onDelete: 'restrict'`,
- * `onUpdate: 'noAction'`, `index: true`. Override per call when the
- * relationship genuinely is owned-lifecycle (junction tables typically
- * want `onDelete: 'cascade'`).
- *
- * ```ts
- * userId: reference(() => users, { onDelete: 'cascade' })
- * tenantId: reference(() => tenants)                          // restrict default
- * cacheBucketId: reference(() => cacheBuckets, { index: false })  // rare opt-out
- * ```
- */
 export declare const reference: (target: () => TableLike, options?: ReferenceOptions) => ColumnBuilder<string, "reference">;
 
 export declare interface ReferenceOptions {
     readonly onDelete?: 'cascade' | 'restrict' | 'setNull' | 'noAction';
     readonly onUpdate?: 'cascade' | 'restrict' | 'setNull' | 'noAction';
+    /**
+     * The soft-delete counterpart of `onDelete`. A soft delete is an UPDATE that
+     * sets `deletedAt`, so `ON DELETE CASCADE` never fires for it and the
+     * children of a soft-deleted parent stay visible — a team's members outlive
+     * the team. This is enforced by the runtime on the store's change channel:
+     *
+     *   'cascade' → soft-delete the referencing rows (their table must carry
+     *               `softDelete()` too — a hard delete of a child cannot be
+     *               undone when the parent is restored, so it is refused at boot)
+     *   'setNull' → null the reference (the column must be `.nullable()`)
+     *
+     * Restoring the parent does NOT restore the children; a restore is a
+     * deliberate act on one row, and the children carry their own `deletedAt`.
+     */
+    readonly onSoftDelete?: 'cascade' | 'setNull';
     /**
      * Auto-build a B-tree index on this column. Default `true` because
      * FK columns are almost always read-by. Set `false` only for tiny
@@ -6529,6 +6674,19 @@ export declare interface SchemaTable extends TableLike {
     readonly appliedFullText: ReadonlyArray<TableFullTextIndex>;
 }
 
+/** The longest scope key stored. A scope is an address, not a document; a
+ *  value longer than this is truncated, deterministically, so equal scopes
+ *  keep equal keys. */
+export declare const SCOPE_KEY_MAX_LENGTH = 255;
+
+/**
+ * The scope's key. A string scope is its own key (`'team:frontend'`); anything
+ * else is canonical JSON — object keys sorted, `undefined` fields dropped — so
+ * `{ team: 'a', org: 'b' }` and `{ org: 'b', team: 'a' }` address the same rows.
+ * `null` / `undefined` have no key.
+ */
+export declare const scopeKeyOf: (scope: unknown) => string | null;
+
 export declare interface SeedDefinition {
     readonly __seed: true;
     readonly id: string;
@@ -6655,6 +6813,26 @@ export declare interface SeedStore {
     delete(table: string, primaryKey: string): Promise<boolean>;
 }
 
+/**
+ * The target thunk `selfReference()` plants — `table()` swaps it for the table
+ * being built. Calling it before then is a declaration error, said out loud
+ * rather than returned as `undefined`.
+ */
+export declare const SELF_REFERENCE_TARGET: () => TableLike;
+
+/**
+ * A reference to the table this column is declared IN — `parentId` on
+ * `teams`, `replyToId` on `comments`.
+ *
+ * `reference(() => teams)` inside `teams`' own declaration is a TypeScript
+ * cycle (TS7022 — the table's type depends on the column, whose type mentions
+ * the table), so the honest workaround was `text()` and a foreign key the
+ * schema no longer knew about. This column carries no target type, only the
+ * thunk `table()` resolves to itself, so the FK, the eager loader and the
+ * subject graph see it as the reference it is.
+ */
+export declare const selfReference: (options?: ReferenceOptions) => ColumnBuilder<string, "reference">;
+
 /**
  * Data-sensitivity classes for `.sensitive(class)`. The class picks the
  * format-preserving fake the export masker applies (an `'email'` becomes a
@@ -6720,6 +6898,10 @@ export declare const settleVersionedUpdate: (input: {
     readonly current: number | null;
 }) => VersionConflict | undefined;
 
+/** When a `<name>__dropped_<YYYYMMDDHHMMSS>` snapshot was taken (UTC), or
+ *  `undefined` for a name that is not one. */
+export declare const softDropSnapshotStamp: (name: string) => Date | undefined;
+
 /**
  * PostGIS spatial-distance clause carried on a {@link QueryDescriptor}.
  * Drives a `ST_Distance` projected column (distance-as-a-value) and/or a
@@ -6824,6 +7006,9 @@ export declare interface SqlDialect {
     readonly retryFilter: (error: unknown) => RetryDecision;
 }
 
+/** SQLite / turso result codes — symbolic and numeric spellings. */
+export declare const SQLITE_TRANSIENT_CODES: ReadonlySet<string>;
+
 /**
  * How long a staged run's silence has to last before its scratch tables are
  * treated as abandoned.
@@ -7387,10 +7572,11 @@ export declare interface Table<Name extends string, Fields extends Record<string
      * row with the same key is allowed — no hand-written
      * `generatedAs("CASE WHEN …")` column, no resurrection footgun.
      *
-     * **mysql / mariadb:** these engines have no partial-index support, so
-     * `.uniqueActive()` FAILS LOUDLY at migrate time (a full unique index would
-     * silently forbid re-creating a soft-deleted row). Use a generated STORED
-     * column + `.unique()` there until the framework lowers it for you.
+     * **mysql / mariadb:** these engines have no partial-index support, so the
+     * migrator LOWERS `.uniqueActive()` to a generated STORED column holding the
+     * key while the predicate holds (NULL otherwise, and NULLs never collide) plus
+     * a UNIQUE index on it — the same guarantee, on the dialects that cannot
+     * spell it directly. See `lowerUniqueActive` in `migrate.ts`.
      */
     uniqueActive: {
         <const F extends readonly [keyof Fields & string, ...Array<keyof Fields & string>]>(fields: F, options?: {
@@ -7655,8 +7841,9 @@ export declare interface TableIndex {
      * declarative planner is predicate-blind, these are emitted by the
      * fresh-schema DDL path (like every partial predicate) and kept OUT of the
      * declarative index snapshot. mysql/mariadb have no partial-index support —
-     * `.uniqueActive()` fails loudly there (use a generated column) rather than
-     * silently dropping the predicate into a full unique index.
+     * `.uniqueActive()` is lowered there to a generated STORED column + UNIQUE
+     * (`migrate.ts`) rather than silently dropping the predicate into a full
+     * unique index.
      */
     readonly unique?: boolean;
 }
@@ -7835,6 +8022,9 @@ export declare interface TransactionalViewHandle {
  */
 export declare type TransactionConnectionContext = Context.Tag.Service<typeof TransactionConnection>;
 
+/** Turso's MVCC conflicts arrive as messages, not codes. */
+export declare const TURSO_TRANSIENT_MESSAGE: RegExp;
+
 /** Append one row inside the caller's transaction. Insert-only by design. */
 export declare type TxnAppend = (table: string, row: Row) => Promise<void>;