@voltro/database 0.83.1 → 0.85.0

package/dist/index.d.ts

@@ -1,15 +1,17 @@
-import { ConfigError } from 'effect';
+import { Config } from 'effect';
 import { Context } from 'effect';
+import { Duration } from 'effect/Duration';
 import { Effect } from 'effect';
 import { Exit } from 'effect';
 import { Layer } from 'effect';
 import { Schedule } from 'effect';
 import { Schema } from 'effect';
-import { SqlClient } from '@effect/sql';
-import { SqlError } from '@effect/sql';
-import { Statement } from '@effect/sql';
+import { SqlClient } from 'effect/sql';
+import { SqlError } from 'effect/sql/SqlError';
+import { SqlError as SqlError_2 } from 'effect/sql';
+import { Statement } from 'effect/sql';
 import { Stream } from 'effect';
-import { TransactionConnection } from '@effect/sql/SqlClient';
+import { TransactionConnection } from 'effect/sql/SqlClient';
 import { VoidIfEmpty } from 'effect/Types';
 import { YieldableError } from 'effect/Cause';
 
@@ -271,7 +273,7 @@ export declare const authoredError: (sentence: string, options?: {
  * error carries none — which is the case for everything a driver threw.
  *
  * Walks the same two structures `storeRefusalOf` does: every branch of an
- * Effect `Cause` (a `FiberFailure` hides its tree behind a symbol, so `.cause`
+ * Effect `Cause` (an `Exit` keeps its reasons in a list, so `.cause`
  * alone sees nothing), and then each branch's own `.cause` chain, because a
  * driver layer may have wrapped the refusal before Effect saw it. The FIRST
  * marked error wins — the outermost is the one that describes the operation
@@ -458,6 +460,11 @@ export declare interface BranchIndexName {
      *  re-derived name is exactly what we do not know. */
     readonly columns: ReadonlyArray<string>;
     readonly unique: boolean;
+    /** A partial index's predicate as the parent's catalog prints it
+     *  (`pg_get_expr`). Two indexes on the same columns — one plain, one
+     *  `WHERE "readAt" IS NULL` — are told apart only by it; without it the
+     *  restore can give each the other's name. */
+    readonly where?: string;
     /** The name the PARENT's index carries, and the one to restore. */
     readonly name: string;
 }
@@ -638,13 +645,13 @@ export declare type CaughtUpVerdict = 'caught-up' | 'behind';
 /**
  * Expand an error into the concrete failures behind it.
  *
- * A `FiberFailure` carries an Effect `Cause`, which is a TREE — a failure and a
- * defect and an interrupt can all be present at once — so following `.cause`
- * from the outside reaches none of them. Exported because anything that wants to
- * find something INSIDE a thrown Effect error needs this same expansion, and a
- * second copy of it is a second definition that nothing keeps in step. (Learned
- * the direct way: a framework refusal marked on an error was invisible to a
- * plain `.cause` walk the moment it came back through `runPromise`.)
+ * A `Cause` holds a flat list of reasons — a failure and a defect and an
+ * interrupt can all be present at once — so following `.cause` from the outside
+ * reaches none of them. Exported because anything that wants to find something
+ * INSIDE a failed Effect needs this same expansion, and a second copy of it is a
+ * second definition that nothing keeps in step. (Learned the direct way: a
+ * framework refusal marked on an error was invisible to a plain `.cause` walk
+ * the moment it came back through a promise boundary.)
  */
 export declare const causeBranches: (err: unknown, depth?: number) => ReadonlyArray<unknown>;
 
@@ -1018,9 +1025,11 @@ export declare class ColumnBuilder<TsType, Type extends ColumnType, HasDefault e
     private rejectIfRaw;
     nullable(): ColumnBuilder<TsType | null, Type, HasDefault>;
     /**
-     * Declare that this scalar id points outside the app's local database graph.
+     * Declare that this scalar id has no single database foreign key target.
      * Use it for provider, gateway, hardware, polymorphic, or cross-installation
      * identifiers that intentionally must not become `reference()` columns.
+     * A polymorphic target may live in this same database. The application
+     * validates the target and cleans up orphans.
      * This is schema metadata only and does not change the SQL column.
      */
     externalId(): this;
@@ -1265,7 +1274,7 @@ export declare class ColumnBuilder<TsType, Type extends ColumnType, HasDefault e
      *
      * Two flavors:
      *
-     * - **SQL** (preferred, 95% case): pass an `@effect/sql` `Statement.Fragment`
+     * - **SQL** (preferred, 95% case): pass an `effect/sql` `Statement.Fragment`
      *   (a sql`...` template built with `Statement.make`), evaluated
      *   server-side. Single round-trip, transactional, scales linearly.
      *
@@ -1478,7 +1487,8 @@ export declare interface ColumnDefinition<TsType, Type extends ColumnType = Colu
      */
     readonly fkAutoIndex?: boolean;
     /**
-     * This id-shaped scalar names something outside the local relational graph.
+     * This id-shaped scalar deliberately has no single foreign key target,
+     * including external-system ids and local polymorphic targets.
      * Set by `.externalId()` so schema audits do not guess a local FK from the
      * column name. Metadata only; it emits no constraint or DDL.
      */
@@ -1637,6 +1647,14 @@ export declare interface ColumnDefinition<TsType, Type extends ColumnType = Colu
      * column is just `bytes` with server-merge semantics.
      */
     readonly crdtManaged?: boolean;
+    /**
+     * End-to-end-sealed CRDT marker, set by `crdtSealed()`. The column holds an
+     * append-only LOG of encrypted CRDT updates the server cannot read: the
+     * write path appends an incoming frame (or applies a client's snapshot
+     * frame) and never decodes or merges — clients holding the key do. Same
+     * `bytes` storage and zero DDL churn as `crdtManaged`.
+     */
+    readonly crdtSealed?: boolean;
     /**
      * Optimistic-concurrency marker, set by `.version()`.
      *
@@ -1694,6 +1712,7 @@ export declare interface ColumnDefinition<TsType, Type extends ColumnType = Colu
      * MUST be `<= precision`. See {@link ColumnDefinition.precision}.
      */
     readonly scale?: number;
+    /* Excluded from this release type: sqliteDecimalEncoding */
     /**
      * Vector dimensionality. Populated only when `type === 'vector'`.
      * The migration emitter uses it to size the column DDL —
@@ -1861,7 +1880,7 @@ export declare interface ColumnReference {
  * value through unchanged, so the mapping looked right in any test that only
  * checked a round trip. Take definitions from `table.fields`.
  */
-export declare const columnSchema: <TsType, C extends ColumnType>(def: ColumnDefinition<TsType, C>) => Schema.Schema.Any;
+export declare const columnSchema: <TsType, C extends ColumnType>(def: ColumnDefinition<TsType, C>) => Schema.Top;
 
 /**
  * A column as seen by the planner: either declared in code (extracted
@@ -1965,6 +1984,10 @@ declare interface ColumnSnapshot {
      */
     readonly precision?: number;
     readonly scale?: number;
+    /** Physical SQLite-family exact-decimal representation. Absent on ordinary
+     * NUMERIC columns. The marker is observable schema state, not a DSL hint:
+     * changing it requires data conversion, never a plain SQL type cast. */
+    readonly sqliteDecimalEncoding?: 'sortable-v1';
     /**
      * Id-generation scheme for `type: 'id'` columns. Mirrors
      * `ColumnDefinition.idScheme.kind` so the applier can tell a numeric
@@ -2122,6 +2145,9 @@ export declare const columnsPerRow: (rows: ReadonlyArray<Record<string, unknown>
 
 export declare type ColumnType = 'id' | 'text' | 'integer' | 'real' | 'decimal' | 'bigint' | 'boolean' | 'timestamp' | 'date' | 'json' | 'bytes' | 'reference' | 'vector' | 'enum' | 'array' | 'interval' | 'raw';
 
+/** The explicit committed-buffer identity, absent for ordinary/CDC events. */
+export declare const committedChangeBatchOf: (event: ChangeEvent) => object | undefined;
+
 /** Exact comparison of fixed-point decimal strings, without a floating-point conversion. */
 export declare const compareDecimal: (left: unknown, right: unknown) => number | null;
 
@@ -2157,24 +2183,8 @@ export declare const compileEagerJson: (descriptor: QueryDescriptor, sql: SqlCon
  */
 export declare const compileJsonPatch: (sql: SqlConstructor, dialect: DialectId, path: string, value: unknown, source?: Statement.Fragment) => Statement.Fragment;
 
-/**
- * Lower a `Predicate` AST to a SQL `Fragment` suitable for use inside a
- * WHERE clause. Identifiers are quoted via `sql(col)`; values flow through
- * `sql\`${v}\`` as parameters — no string concatenation, no injection.
- */
-export declare const compilePredicate: (predicate: Predicate, sql: SqlConstructor, namespace?: QueryNamespace, 
-/**
- * The table this predicate filters, when the caller knows it. Supplied so a
- * leaf's VALUE can be coerced to the column's shape — `eq('capturedAt',
- * epochMs)` against a `timestamp()` column otherwise compiles to
- * `WHERE capturedAt = 1767916800000` and matches nothing, silently. The write
- * path has always encoded; this closes the asymmetry.
- *
- * Optional because `compilePredicate` is also called for JOIN conditions and
- * by callers that hold only the AST. Absent → no coercion, i.e. exactly the
- * previous behaviour.
- */
-table?: string) => Statement.Fragment;
+/** Compile a standalone predicate; SELECT supplies its own lexical CTE scope. */
+export declare const compilePredicate: (predicate: Predicate, sql: SqlConstructor, namespace?: QueryNamespace, table?: string) => Statement.Fragment;
 
 /**
  * Rebind a captured {@link RawSqlFragment} onto a live `sql`
@@ -2193,6 +2203,7 @@ export declare const compileRawFragment: <Row extends object = Record<string, un
  * Shared by SELECT and DML RETURNING; other dialects retain native projection. */
 export declare const compileRowProjection: (table: string, sql: SqlConstructor, projection?: ReadonlyArray<string>) => Statement.Fragment;
 
+/** Compile a public query descriptor; recursive CTE terms use their SQL scope. */
 export declare const compileSelect: <Row extends object>(descriptor: QueryDescriptor, sql: SqlConstructor, namespace?: QueryNamespace) => Statement.Statement<Row>;
 
 /** Compose the durable identity written to `_voltro_cdcout_claims.changeKey`. */
@@ -2259,7 +2270,7 @@ export declare interface ConnectionConfig {
      *     timer). The waiting half is UNBOUNDED by default and deliberately so —
      *     see {@link ConnectionConfig.acquireQueueLimit} for the length bound
      *     that exists, why it is opt-in, and what it costs.
-     *   - **mssql** — establishment only. Maps to `@effect/sql-mssql`'s
+     *   - **mssql** — establishment only. Maps to `effect/sql-mssql`'s
      *     `connectTimeout` (tedious connect + the boot `SELECT 1` probe); its
      *     pool is an Effect `Pool` whose `get` has no timeout knob.
      *   - **sqlite** — ignored. One in-process connection, no pool to exhaust.
@@ -2287,7 +2298,7 @@ export declare interface ConnectionConfig {
      *   The event loop is never reached again: no timer fires, nothing drains the
      *   queue that caused the rejection, and nothing is logged.
      *
-     * That caller is not hypothetical and not ours to fix: `@effect/cluster`
+     * That caller is not hypothetical and not ours to fix: `effect/cluster`
      * releases shards one statement per shard (300 by default) and wraps each in
      * `Effect.eventually` — retry until success, no schedule, no delay, logged at
      * debug. On a `shardLockDisableAdvisory` (Galera / PXC) runner those releases
@@ -2316,7 +2327,7 @@ export declare interface ConnectionConfig {
      * node-postgres' `statement_timeout` pool option — a runaway query is cancelled
      * with SQLSTATE 57014, not merely disconnected. Every OTHER dialect currently
      * ACCEPTS the field but IGNORES it, and the honest reasons differ:
-     *   - **mssql** — `@effect/sql-mssql` exposes only `connectTimeout` (connection
+     *   - **mssql** — `effect/sql-mssql` exposes only `connectTimeout` (connection
      *     establishment), not tedious's per-request `requestTimeout`; mapping this
      *     onto `connectTimeout` would bound the wrong phase, so it is left unwired
      *     rather than wrong.
@@ -2413,6 +2424,22 @@ export declare const count: (alias?: string) => AggregateColumn<number>;
 
 export declare const countDistinct: (column: string, alias?: string) => AggregateColumn<number>;
 
+/**
+ * A CONVERGING COUNTER column — likes, stock reservations, votes, a running
+ * total — that any number of clients increment and decrement concurrently,
+ * offline too, without losing a single step. A plain `integer()` column read,
+ * incremented and written back by two clients at once keeps one of the two
+ * increments; this keeps both.
+ *
+ * Each writer (one client session) accumulates its own increments and
+ * decrements under its own key, and the value is the sum over all writers, so
+ * concurrent steps commute. Storage, nullability and the authoritative server
+ * merge are those of `crdtText()` — the column stores the encoded CRDT state
+ * as `bytes`. Read the number with `@voltro/local-first`'s
+ * `crdtCounterValue(state)`; bind it in React with `useCrdtCounter`.
+ */
+export declare const crdtCounter: () => ColumnBuilder<Uint8Array | null, "bytes">;
+
 /**
  * A whole collaborative DOCUMENT as a column — rich text, nested maps/arrays,
  * whatever the CRDT backend's document model holds. `crdtText()` is the
@@ -2450,6 +2477,22 @@ export declare const crdtManagedColumns: (table: TableLike) => ReadonlyArray<str
  *  folds and the capture paths (undo, row history) exclude. */
 export declare const crdtManagedColumnsOf: (table: TableLike) => ReadonlyArray<string>;
 
+/**
+ * An END-TO-END ENCRYPTED collaborative column: clients encrypt every CRDT
+ * update with a key the server never sees (AES-GCM, `@voltro/local-first`'s
+ * `seal` option on `useCrdtText` / `useCrdtDoc` / `useCrdtCounter`), and the
+ * server stores an append-only log of the sealed frames. It cannot read,
+ * validate or merge the content — clients decrypt and merge locally, which is
+ * why the convergence still holds — and a client's snapshot frame compacts the
+ * log without losing a frame appended concurrently.
+ *
+ * Trade-offs, by construction: `crdt.validate` and server-side restore cannot
+ * see the content, and the downstream lane ships the log, not an increment.
+ * The size limits still apply. Choose it for content the operator must not be
+ * able to read.
+ */
+export declare const crdtSealed: () => ColumnBuilder<Uint8Array | null, "bytes">;
+
 /**
  * CRDT-managed text column — a field whose value is a CONFLICT-FREE replicated
  * text document rather than a plain string. Two clients editing it at the same
@@ -3122,19 +3165,20 @@ export declare interface DbOpSample {
 }
 
 /**
- * Fixed-point exact-decimal column — money, tax rates, anything where
- * floating-point rounding is unacceptable. Emits `NUMERIC(precision, scale)`
- * on postgres and `DECIMAL(precision, scale)` on mysql / mariadb / mssql;
- * sqlite / turso have no fixed-point type, so it's `NUMERIC` affinity storing
- * the value as text.
+ * Fixed-point exact-decimal column for money, tax rates and other values
+ * that must not pass through floating-point arithmetic. Emits
+ * `NUMERIC(precision, scale)` on postgres and `DECIMAL(precision, scale)`
+ * on mysql / mariadb / mssql. SQLite, native Turso and libSQL use exact,
+ * order-preserving encoded TEXT storage, including declared defaults.
+ * Existing NUMERIC columns require a reviewed offline conversion.
  *
- * The row type is **`string`**, NOT `number`, on purpose: a JS `number` is an
- * IEEE-754 double and silently loses precision past ~15-17 significant digits
- * (`0.1 + 0.2 !== 0.3`), so a `DECIMAL(38,9)` value round-tripped through a JS
- * number would corrupt. The drivers already hand these back as strings
- * (node-postgres, mysql2), and the row decoder coerces the mssql numeric back
- * to a string, so the value is lossless end-to-end. Do arithmetic with a
- * decimal library (or in SQL), not JS `+`.
+ * The row type is **`string`**, NOT `number`: JavaScript numbers lose
+ * precision beyond roughly 15–17 significant digits. SQLite-family stores
+ * encode writes and decode reads at the declared scale. MSSQL's driver
+ * can already have rounded large values before string decoding; use a
+ * text projection for values beyond the driver's numeric precision.
+ * Use a decimal library or supported typed query-builder operations for
+ * arithmetic. Raw SQL must not treat encoded TEXT as a decimal number.
  *
  * ```ts
  * price:   decimal(12, 2),   // up to 9_999_999_999.99
@@ -3226,8 +3270,11 @@ export declare const decodeRowsForTable: <T extends Record<string, unknown>>(row
  * Unknown tables (not registered) pass through unchanged — this is
  * the case for the framework's internal cluster-runtime tables and
  * for ad-hoc raw-SQL paths that bypass the typed-table mechanism.
+ * Pass the SELECT descriptor when decoding a compileSelect result: explicitly
+ * encoded SQLite queries return logical projections, not physical table rows.
+ * Omit it for DML RETURNING, whose cells retain their storage representation.
  */
-export declare const decodeRowsFromSchema: <T extends Record<string, unknown>>(rows: ReadonlyArray<T>, tableName: string, dialect: DecoderDialectId) => ReadonlyArray<T>;
+export declare const decodeRowsFromSchema: <T extends Record<string, unknown>>(rows: ReadonlyArray<T>, tableName: string, dialect: DecoderDialectId, query?: QueryDescriptor) => ReadonlyArray<T>;
 
 /**
  * Decrypt every `.encrypted()` column's value on read. A value that
@@ -3496,6 +3543,9 @@ export declare interface DialectTransactionSpec {
     /** The store's `sql.withTransaction` — issues BEGIN/COMMIT/ROLLBACK and
      *  provides `TransactionConnection`. */
     readonly withTransaction: <A>(effect: Effect.Effect<A, unknown, never>) => Effect.Effect<A, unknown, never>;
+    /** The store's `sql.transactionService` — the key under which `withTransaction`
+     *  provides this client's `[Connection, depth]` (per-client in Effect 4). */
+    readonly transactionService: Context.Service<TransactionConnection, TransactionConnection.Service>;
     /** The store's managed runtime, ALWAYS as `runPromiseExit` — `runPromise` is
      *  the bug this file exists to prevent, so the shared bracket never sees one. */
     readonly runPromiseExit: <A>(effect: Effect.Effect<A, unknown, never>) => Promise<Exit.Exit<A, unknown>>;
@@ -3720,6 +3770,13 @@ export declare interface EagerRootPlan {
     readonly children: ReadonlyArray<EagerRelationNode>;
 }
 
+/**
+ * Emit an explicitly committed buffer synchronously, preserving every row
+ * event and its order. Batch identity is process-local metadata, never wire
+ * payload or attribution. Never use for rows still being written.
+ */
+export declare const emitCommittedChanges: (events: readonly ChangeEvent[], emit: (event: ChangeEvent) => void) => void;
+
 declare type EmptyMerge = unknown;
 
 /**
@@ -3752,8 +3809,8 @@ declare type EmptyMerge = unknown;
 export declare const encodeFieldValue: (cipher: FieldCipher, value: unknown, binding?: FieldBinding) => string;
 
 /**
- * Serialize selected json()/array()/vector() cells to JSON strings so they can be
- * bound as scalar SQL parameters. Symmetric to `decodeRowsFromSchema`.
+ * Serialize selected JSON-like cells and explicitly marked decimal storage
+ * values so they can be bound as scalar SQL parameters. Symmetric to `decodeRowsFromSchema`.
  * No-op for tables with no json/array columns (cost: one map build +
  * a per-cell type lookup). Unknown tables pass through unchanged.
  */
@@ -3780,6 +3837,9 @@ export declare const encryptedColumnsOf: (table: TableLike) => ReadonlyArray<str
  */
 export declare const encryptFieldsForWrite: (row: Row, table: TableLike | undefined, cipher: FieldCipher | undefined, rowId?: unknown) => Row;
 
+/** Encrypt a bulk write with one metadata snapshot, retaining per-row AAD. */
+export declare const encryptFieldsForWriteBatch: (rows: ReadonlyArray<Row>, table: TableLike | undefined, cipher: FieldCipher | undefined) => ReadonlyArray<Row>;
+
 /** Mark it finished — AFTER its `routeEvent` has registered, not after the
  *  statement. That is the whole point: the window being closed is exactly the
  *  gap between the committing statement and the registration. */
@@ -4097,7 +4157,7 @@ export declare interface FileMigration {
 export declare interface FileMigrationContext {
     /**
      * The escape hatch, and it asks for a reason. `raw('why')` returns the
-     * `@effect/sql` client — `sql.unsafe(...)`, `sql\`...\``,
+     * `effect/sql` client — `sql.unsafe(...)`, `sql\`...\``,
      * `sql.onDialectOrElse({...})` — for the one thing neither `store` nor
      * `schema` expresses. The reason is required (an empty one throws), it is
      * what `voltro doctor` lists beside every migration that reaches for raw
@@ -5144,7 +5204,7 @@ export declare const makeNamespaceBranchExecutor: (sql: BranchSqlRunner) => Bran
  * every `Effect.withSpan` inside `transactional()` emits real spans.
  */
 export declare interface MakeStoreOptions {
-    readonly sqlLayer: Layer.Layer<SqlClient.SqlClient, ConfigError.ConfigError | SqlError.SqlError, never>;
+    readonly sqlLayer: Layer.Layer<SqlClient.SqlClient, Config.ConfigError | SqlError_2.SqlError, never>;
     readonly tracerLayer?: Layer.Layer<never, never, never>;
     readonly changeStrategy?: ChangeStrategy;
     /** Postgres NOTIFY channel name when changeStrategy is 'cdc'. */
@@ -5304,7 +5364,7 @@ export declare class MigrationExpectationFailed extends Error {
  * `log` and the two probes the store can answer about its own shape
  * (`tableExists`, `columnExists`) work without one; each refusal names what to
  * do instead. Also raised at construction when what was handed in as `sql` is not
- * an `@effect/sql` client, or when a SQL-backed store arrives without the
+ * an `effect/sql` client, or when a SQL-backed store arrives without the
  * client it executes on — both are refused before a body can run rather
  * than surfacing as a TypeError from inside the first helper that touches
  * the client.
@@ -5752,6 +5812,15 @@ export declare interface OneRelation {
     readonly sourceKey?: string;
 }
 
+/**
+ * Run `effect` ON a transaction captured by `runRetryingTransaction`: the
+ * whole context the transaction's fiber had — `TransactionConnection` plus
+ * the sql client's transaction semaphore a nested `withTransaction`
+ * (savepoint) takes a permit from. A connection this module never saw is
+ * provided on its own, which is all a plain statement needs.
+ */
+export declare const onTransaction: <A, E, R>(effect: Effect.Effect<A, E, R>, transactionService: Context.Service<TransactionConnection, TransactionConnection.Service>, txn: TransactionConnectionContext) => Effect.Effect<A, E, Exclude<R, TransactionConnection>>;
+
 export declare const or: (...predicates: ReadonlyArray<Predicate>) => OrPredicate;
 
 export declare interface OrderClause {
@@ -5969,7 +6038,7 @@ export declare interface PluginRefSpec {
     readonly onSoftDelete: boolean;
 }
 
-/** The declared spec for a column builder, when it is a `pluginRef`. */
+/** The declared spec on a builder or its materialized column definition. */
 export declare const pluginRefSpecOf: (column: unknown) => PluginRefSpec | undefined;
 
 /** Postgres SQLSTATEs. */
@@ -5996,6 +6065,12 @@ export declare interface PredicateLeafWithContext extends PredicateLeaf {
     readonly conjunctive: boolean;
 }
 
+/** Prepare one synchronous evaluation pass. Recreate after mutating the AST or
+ * its value arrays; no process-wide cache retains descriptors or row values. */
+export declare const preparePredicate: (predicate: Predicate, subqueries?: SubqueryResults | null, columns?: Readonly<Record<string, {
+    readonly type: string;
+}>>) => ((row: Row | null) => boolean);
+
 export declare interface PrimaryKeyConflictError {
     readonly _tag: 'PrimaryKeyConflictError';
     readonly table: string;
@@ -7434,7 +7509,7 @@ export declare const rowNumber: (alias?: string) => WindowBuilder;
  */
 export declare const rowSchema: <T extends TableLike>(table: T, options?: {
     readonly omit?: ReadonlyArray<string>;
-}) => Schema.Schema.Any;
+}) => Schema.Top;
 
 /** The context a rule predicate is evaluated with. */
 export declare interface RuleContext {
@@ -7487,7 +7562,7 @@ export declare interface RuleViolationDetail {
  *   1. the connection handshake — `withTransaction` + `TransactionConnection`,
  *      with a loud failure rather than a silent non-transactional run when the
  *      service is somehow absent;
- *   2. **commit-defect promotion** — `@effect/sql` runs COMMIT as `Effect.orDie`,
+ *   2. **commit-defect promotion** — `effect/sql` runs COMMIT as `Effect.orDie`,
  *      so a serialization/deadlock error raised AT COMMIT arrives as a defect and
  *      `Effect.retry` never sees it. A retryable defect is promoted back to a
  *      typed failure so the schedule can replay it; anything else re-dies, so
@@ -7639,10 +7714,9 @@ export declare interface SchemaTable extends TableLike {
     /**
      * The plugin references DECLARED on this table, surviving `table()`.
      *
-     * `pluginRefSpecOf` reads a column BUILDER, and materialisation replaces it
-     * with a plain field descriptor — so without this the declaration is
-     * unreadable the moment the table exists, and any tool deriving structure
-     * from the schema sees an ordinary `text()` column.
+     * Derived from column metadata on every table rebuild, including columns
+     * contributed by mixins. Consumers can inspect these rules without knowing
+     * the private metadata on each materialized scalar definition.
      */
     readonly appliedPluginRefs?: ReadonlyArray<{
         readonly column: string;
@@ -7859,7 +7933,7 @@ export declare const setTenantCreateSeedHook: (hook: TenantCreateSeedHook | null
 
 /**
  * Unwrap a transaction program's `Exit`: return the value, or throw the
- * ORIGINAL error rather than Effect's `FiberFailure` wrapper.
+ * ORIGINAL error rather than a squashed or wrapped one.
  *
  * Use with `runtime.runPromiseExit`, never `runPromise` — the wrapper is
  * created by `runPromise` itself, so there is nothing left to unwrap by the
@@ -7868,7 +7942,7 @@ export declare const setTenantCreateSeedHook: (hook: TenantCreateSeedHook | null
  * `Cause.squash` is what preserves the typing: for a `Fail` it yields the value
  * that was thrown (the app's `TaggedError`, so the rpc encoder can still match
  * it against the descriptor's `error:` schema); for a `Die` the defect; for an
- * interrupt an `InterruptedException`. Retry filtering has already run inside
+ * interrupt an `Error` ("All fibers interrupted without error"). Retry filtering has already run inside
  * the program, so an Exit reaching here is final.
  */
 export declare const settleTransactionExit: <A>(exit: Exit.Exit<A, unknown>) => A;
@@ -7887,6 +7961,14 @@ export declare const settleVersionedUpdate: (input: {
     readonly current: number | null;
 }) => VersionConflict | undefined;
 
+/** ONE transaction context key for every SQL client a process builds, whatever
+ *  the dialect: v4 keys `TransactionConnection` per client, so a statement issued
+ *  through a second client (another layer build, a plugin's own runtime) inside a
+ *  store transaction would otherwise take a fresh pool connection — outside the
+ *  transaction, and a deadlock when the pool is small. node-postgres shared one
+ *  tag; every dialect layer passes this key to its client. */
+export declare const SHARED_TRANSACTION_SERVICE: Context.Service<SqlClient.TransactionConnection, TransactionConnection.Service>;
+
 /** When a `<name>__dropped_<YYYYMMDDHHMMSS>` snapshot was taken (UTC), or
  *  `undefined` for a name that is not one. */
 export declare const softDropSnapshotStamp: (name: string) => Date | undefined;
@@ -7968,7 +8050,7 @@ export declare type SqlConstructor = Statement.Constructor;
  * `id` is the canonical name surfaced in logs, boot banners, error
  * messages, and the `DB_DIALECT` env value.
  *
- * `makeSqlLayer` constructs the `@effect/sql` connection Layer from a
+ * `makeSqlLayer` constructs the `effect/sql` connection Layer from a
  * generic `ConnectionConfig`. Each dialect maps the config to its own
  * driver's expected shape.
  *
@@ -7994,12 +8076,14 @@ export declare interface SqlDialect {
      */
     readonly workflowRunnerStorage?: (connection: ConnectionConfig) => 'memory' | 'sql';
     readonly id: DialectId;
-    readonly makeSqlLayer: (conn: ConnectionConfig) => Layer.Layer<SqlClient.SqlClient, ConfigError.ConfigError | SqlError.SqlError, never>;
+    readonly makeSqlLayer: (conn: ConnectionConfig) => Layer.Layer<SqlClient.SqlClient, Config.ConfigError | SqlError_2.SqlError, never>;
     readonly makeStore: (options: MakeStoreOptions) => Promise<DataStore>;
     readonly compileContains: (col: Statement.Identifier, value: string, sql: Statement.Constructor) => Statement.Fragment;
     readonly retryFilter: (error: unknown) => RetryDecision;
 }
 
+export declare const sqlError: (message: string, cause?: unknown) => SqlError;
+
 /** SQLite / turso result codes — symbolic and numeric spellings. */
 export declare const SQLITE_TRANSIENT_CODES: ReadonlySet<string>;
 
@@ -8329,10 +8413,9 @@ export declare interface Table<Name extends string, Fields extends Record<string
     /**
      * The plugin references DECLARED on this table, surviving `table()`.
      *
-     * `pluginRefSpecOf` reads a column BUILDER, and materialisation replaces it
-     * with a plain field descriptor — so without this the declaration is
-     * unreadable the moment the table exists, and any tool deriving structure
-     * from the schema sees an ordinary `text()` column.
+     * Derived from column metadata on every table rebuild, including columns
+     * contributed by mixins. Consumers can inspect these rules without knowing
+     * the private metadata on each materialized scalar definition.
      */
     readonly appliedPluginRefs?: ReadonlyArray<{
         readonly column: string;
@@ -8379,7 +8462,7 @@ export declare interface Table<Name extends string, Fields extends Record<string
      * BEFORE every INSERT. Populated by `.validate(schema)`. Set
      * per-table at table-construction time; immutable thereafter.
      */
-    readonly insertSchema?: Schema.Schema.Any;
+    readonly insertSchema?: Schema.Top;
     /**
      * Optional `effect/Schema` the framework decodes a patch against
      * BEFORE every UPDATE. Populated by `.validatePatch(schema)`. The
@@ -8388,7 +8471,7 @@ export declare interface Table<Name extends string, Fields extends Record<string
      * are checked. Set per-table at table-construction time; immutable
      * thereafter.
      */
-    readonly validatePatchSchema?: Schema.Schema.Any;
+    readonly validatePatchSchema?: Schema.Top;
     with: <const Mixins extends ReadonlyArray<AnyMixin>>(...mixins: Mixins) => Table<Name, Fields & MergeMixinFields<Mixins>, Reactive, IxNames>;
     /**
      * Attach an effect/Schema that validates EVERY insert against the
@@ -8416,7 +8499,7 @@ export declare interface Table<Name extends string, Fields extends Record<string
      * `id` and `createdAt` are already filled in by the time the
      * decoder sees the row.
      */
-    validate: <S extends Schema.Schema.Any>(schema: S) => Table<Name, Fields, Reactive, IxNames>;
+    validate: <S extends Schema.Top>(schema: S) => Table<Name, Fields, Reactive, IxNames>;
     /**
      * Attach an effect/Schema that validates UPDATE patches against the
      * table. The framework wraps the schema in `Schema.partial`, so a
@@ -8447,7 +8530,7 @@ export declare interface Table<Name extends string, Fields extends Record<string
      * wrapping is applied for you, so don't pre-wrap fields in
      * `Schema.optional`.
      */
-    validatePatch: <S extends Schema.Schema.Any>(schema: S) => Table<Name, Fields, Reactive, IxNames>;
+    validatePatch: <S extends Schema.Struct<Schema.Struct.Fields>>(schema: S) => Table<Name, Fields, Reactive, IxNames>;
     /**
      * Declare a (possibly composite) secondary index on the table.
      *
@@ -9041,7 +9124,7 @@ export declare const timestamp: () => ColumnBuilder<Date, "timestamp", boolean>;
  * There is deliberately no `timestampMsOptional`: an absent field is
  * `Schema.optional(timestampMs)`, which composes without a third export.
  */
-export declare const timestampMs: Schema.Schema<Date, number>;
+export declare const timestampMs: Schema.Codec<Date, number>;
 
 /**
  * `timestampMs` for a NULLABLE timestamp column — `Date | null` in the
@@ -9053,7 +9136,7 @@ export declare const timestampMs: Schema.Schema<Date, number>;
  * instead of as nothing. Mirrors what `columnSchema` does for a
  * `.nullable()` timestamp.
  */
-export declare const timestampMsOrNull: Schema.Schema<Date | null, number | null>;
+export declare const timestampMsOrNull: Schema.Codec<Date | null, number | null>;
 
 /**
  * `transactional()`'s work caught a statement failure the engine had already
@@ -9139,14 +9222,14 @@ export declare class TransactionBrokenByBodyError extends Error {
 }
 
 /**
- * The `[Connection, depth]` tuple `@effect/sql` provides inside
+ * The `[Connection, depth]` tuple `effect/sql` provides inside
  * `withTransaction`. Every statement that must run on the transaction's OWN
  * connection (rather than a fresh one from the pool) is given this explicitly.
  */
-export declare type TransactionConnectionContext = Context.Tag.Service<typeof TransactionConnection>;
+export declare type TransactionConnectionContext = TransactionConnection.Service;
 
 /** Shared bounded contention policy, including stores without a SQL connection. */
-export declare const transactionRetrySchedule: (isRetryable: (error: unknown) => boolean) => Schedule.Schedule<number, unknown, never>;
+export declare const transactionRetrySchedule: (isRetryable: (error: unknown) => boolean) => Schedule.Schedule< Duration, unknown, never, never>;
 
 /** Turso's MVCC conflicts arrive as messages, not codes. */
 export declare const TURSO_TRANSIENT_MESSAGE: RegExp;
@@ -9539,16 +9622,14 @@ export declare const versionColumnOf: (columns: Readonly<Record<string, {
 export declare class VersionConflict extends VersionConflict_base {
 }
 
-declare const VersionConflict_base: Schema.TaggedErrorClass<VersionConflict, "VersionConflict", {
-    readonly _tag: Schema.tag<"VersionConflict">;
-} & {
-    table: typeof Schema.String;
-    id: typeof Schema.String;
+declare const VersionConflict_base: Schema.Class<VersionConflict, Schema.TaggedStruct<"VersionConflict", {
+    readonly table: Schema.String;
+    readonly id: Schema.String;
     /** What the caller believed the row was at. */
-    expected: typeof Schema.Number;
+    readonly expected: Schema.Number;
     /** What it is actually at. `null` when the row is gone entirely. */
-    actual: Schema.NullOr<typeof Schema.Number>;
-}>;
+    readonly actual: Schema.NullOr<Schema.Number>;
+}>, YieldableError>;
 
 /**
  * A read-only SQL view descriptor. Structurally a `TableLike` (carries
@@ -9816,8 +9897,8 @@ export declare interface WindowSpec {
  * echoes the duplicate value, mssql echoes the truncated one. A cause that
  * forwards the sentence ships row contents to whoever provoked the failure.
  *
- * `StoreOperationFailed.cause` did exactly that: `String(error)` on a
- * `FiberFailure`, which is the message AND the stack, so an absolute server
+ * `StoreOperationFailed.cause` did exactly that: `String(error)` on the
+ * rejection, which is the message AND the stack, so an absolute server
  * path reached any caller that declared the error and every subscriber on a
  * stream carrying it.
  *