export declare const STARTER_DATABASE_CONFIG: {
    version: number;
    schema: string[];
    functions: string;
    migrations: string;
    contracts: string;
    audit: string;
    consumers: string[];
    auditConsumers: never[];
    role: string;
};
export declare const STARTER_DATABASE_SCHEMA = "import { sql } from \"drizzle-orm\";\nimport { boolean, check, integer, jsonb, pgTable, primaryKey, text, uuid } from \"drizzle-orm/pg-core\";\n\n// Structure for the reviewed starter migrations. Grants/policies stay in those migrations.\nexport const application = pgTable.withRLS(\"starter_application\", {\n  singleton: boolean().default(true).primaryKey(),\n  projectId: text(\"project_id\").notNull(),\n  tenantId: text(\"tenant_id\").notNull(),\n}, table => [\n  check(\"starter_application_singleton_check\", sql`${table.singleton}`),\n  check(\"starter_application_project_id_check\", sql`length(${table.projectId}) > 0`),\n  check(\"starter_application_tenant_id_check\", sql`length(${table.tenantId}) > 0`),\n]);\n\nexport const reviews = pgTable.withRLS(\"starter_reviews\", {\n  id: text().primaryKey(),\n  ownerId: text(\"owner_id\").notNull(),\n  state: text({ enum: [\"draft\", \"approved\"] }).notNull(),\n  version: integer().notNull(),\n}, table => [\n  check(\"starter_reviews_state_check\", sql`${table.state} IN ('draft', 'approved')`),\n  check(\"starter_reviews_version_check\", sql`${table.version} > 0`),\n]);\n\nexport const members = pgTable.withRLS(\"starter_members\", {\n  subject: text().primaryKey(),\n  enabled: boolean().default(true).notNull(),\n  canApprove: boolean(\"can_approve\").default(false).notNull(),\n  storageSubject: uuid(\"storage_subject\").unique(),\n});\n\nexport const attachments = pgTable.withRLS(\"starter_attachments\", {\n  reviewId: text(\"review_id\").primaryKey().references(() => reviews.id),\n  artifactId: uuid(\"artifact_id\").notNull().unique(),\n  ownerId: text(\"owner_id\").notNull(),\n  runId: uuid(\"run_id\").notNull().unique(),\n  objectPath: text(\"object_path\").notNull().unique(),\n});\n\nexport const attachmentResults = pgTable.withRLS(\"starter_attachment_results\", {\n  reviewId: text(\"review_id\").notNull().references(() => reviews.id),\n  version: integer().notNull(),\n  artifactId: uuid(\"artifact_id\").notNull(),\n  result: jsonb().$type<unknown>().notNull(),\n}, table => [\n  primaryKey({ columns: [table.reviewId, table.version, table.artifactId] }),\n  check(\"starter_attachment_results_version_check\", sql`${table.version} >= 2`),\n]);\n\nexport type ReviewRow = typeof reviews.$inferSelect;\nexport type NewReview = typeof reviews.$inferInsert;\n";
export declare const STARTER_DATABASE_MODULES = "import { defineDatabaseModule } from \"@supacloud/db\";\nimport { getTableConfig } from \"drizzle-orm/pg-core\";\nimport { application, reviews, members, attachments, attachmentResults } from \"./schema\";\n\nconst backendPolicies = [\n  [\"starter_backend_binding_read\", \"public.starter_application\", \"select\", [\"starter_review_http\", \"starter_review_worker\"]],\n  [\"starter_backend_binding_lock\", \"public.starter_application\", \"update\", [\"starter_review_http\", \"starter_review_worker\"]],\n  [\"starter_backend_binding_immutable\", \"public.starter_application\", \"update\", [\"starter_review_http\", \"starter_review_worker\"]],\n  [\"starter_backend_member_read\", \"public.starter_members\", \"select\", [\"starter_review_http\", \"starter_review_worker\"]],\n  [\"starter_backend_member_lock\", \"public.starter_members\", \"update\", [\"starter_review_http\", \"starter_review_worker\"]],\n  [\"starter_backend_member_immutable\", \"public.starter_members\", \"update\", [\"starter_review_http\", \"starter_review_worker\"]],\n  [\"starter_backend_review_read\", \"public.starter_reviews\", \"select\", [\"starter_review_http\", \"starter_review_worker\"]],\n  [\"starter_backend_review_update\", \"public.starter_reviews\", \"update\", [\"starter_review_http\"]],\n  [\"starter_worker_review_immutable\", \"public.starter_reviews\", \"update\", [\"starter_review_worker\"]],\n  [\"starter_backend_attachment_read\", \"public.starter_attachments\", \"select\", [\"starter_review_http\", \"starter_review_worker\"]],\n  [\"starter_backend_attachment_lock\", \"public.starter_attachments\", \"update\", [\"starter_review_http\", \"starter_review_worker\"]],\n  [\"starter_backend_attachment_immutable\", \"public.starter_attachments\", \"update\", [\"starter_review_http\", \"starter_review_worker\"]],\n  [\"starter_http_attachment_insert\", \"public.starter_attachments\", \"insert\", [\"starter_review_http\"]],\n  [\"starter_worker_result_read\", \"public.starter_attachment_results\", \"select\", [\"starter_review_worker\"]],\n  [\"starter_worker_result_insert\", \"public.starter_attachment_results\", \"insert\", [\"starter_review_worker\"]],\n] as const;\n\n// The module is the single live-Catalog ownership contract for starter tables.\nexport default defineDatabaseModule({\n  name: \"starter\",\n  tables: [application, reviews, members, attachments, attachmentResults].map(table => {\n    const config = getTableConfig(table);\n    return (config.schema ?? \"public\") + \".\" + config.name;\n  }),\n  policies: [\n    ...backendPolicies.map(([name, table, operation, roles]) => ({\n      name, table, operation, roles: [...roles], source: \"migrations/004-review-runtime-roles.sql\",\n      tests: [\"tests/database-governance.sql\"],\n    })),\n    {\n      name: \"starter_member_read\", table: \"public.starter_members\", operation: \"select\",\n      roles: [\"authenticated\"], source: \"migrations/003-review-uploads.sql\",\n      tests: [\"tests/database-governance.sql\"],\n    },\n    {\n      name: \"starter_review_read\", table: \"public.starter_reviews\", operation: \"select\",\n      roles: [\"authenticated\"], source: \"migrations/003-review-uploads.sql\",\n      tests: [\"tests/database-governance.sql\"],\n    },\n  ],\n});\n";
export declare const STARTER_DATABASE_TEST = "-- Read-only catalog assertions; behavioral authorization tests remain separate.\nBEGIN READ ONLY;\nDO $test$\nDECLARE\n  owned text[] := ARRAY['starter_application','starter_reviews','starter_members',\n    'starter_attachments','starter_attachment_results'];\nBEGIN\n  IF (SELECT count(*) FROM pg_class c JOIN pg_namespace n ON n.oid=c.relnamespace\n      WHERE n.nspname='public' AND c.relname=ANY(owned) AND c.relrowsecurity) <> 5 THEN\n    RAISE EXCEPTION 'All starter tables must exist with RLS enabled';\n  END IF;\n  IF (SELECT count(*) FROM pg_policy p JOIN pg_class c ON c.oid=p.polrelid\n      JOIN pg_namespace n ON n.oid=c.relnamespace\n      WHERE n.nspname='public' AND c.relname=ANY(owned)) <> 17 THEN\n    RAISE EXCEPTION 'Starter policy inventory changed; reconcile db/modules.ts';\n  END IF;\n  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname IN ('starter_review_http','starter_review_worker')\n      AND (rolsuper OR rolbypassrls)) THEN\n    RAISE EXCEPTION 'Starter roles must not bypass row security';\n  END IF;\n  IF (SELECT count(*) FROM pg_roles WHERE rolname IN ('starter_review_http','starter_review_worker')) <> 2 THEN\n    RAISE EXCEPTION 'Starter runtime roles are missing';\n  END IF;\nEND\n$test$;\nROLLBACK;\n";
export declare const STARTER_DATABASE_GUIDE = "\n## Database Source Workflow\n\nDrizzle owns table declarations and inferred row types in db/schema.ts.\nUse the existing @supacloud/db/drizzle-bun adapters for typed queries and governed\ntransactions; never replace permission, idempotency or audit checks with plain CRUD.\nOpaque JSON still needs runtime decoding.\n\nAfter installing dependencies, run `bun run db:generate` once and commit db/contracts/.\nThe default `bun run check` and build fail on stale database contracts before any\ncompiler regeneration. After an intentional source change, run db:generate again,\nreview the diff, then run check.\nThe command starter registers databaseGovernance.moduleFile = \"db/modules.ts\" and\nkeeps the default `databaseGovernance.mode = \"check\"`: compile/check/build run\nthe offline source-contract gate without a database. Use `bun run dev:integration`\nwith the CLI's explicit loopback database URL, or set databaseGovernance.mode to\n\"enforce\" with an explicitly supplied `DATABASE_URL`, to run SQL lint and live\nCatalog reconciliation. Missing connections, stale source contracts and Catalog\ndrift fail closed; no contracts or migrations are silently regenerated.\n\n- Maintain one schema-qualified function with explicit grants per db/functions/*.sql.\n- Preserve migrations/ and its existing executor/ledger. Add forward migrations only.\n- `bun run db:diff` generates Drizzle drafts under db/migration-candidates/, never\n  into the deployment directory. The starter has existing SQL history, so establish\n  and review a matching Drizzle baseline before promoting any draft; the first\n  draft is not automatically an incremental production migration.\n- `bun run db:pull` requires an explicitly selected DATABASE_URL and writes only\n  output/database-audit/drizzle-candidate/. Review candidates; never overwrite source blindly.\n- Full SQL dumps belong under the ignored output/database-audit/ directory. They are\n  audit/recovery artifacts, never ordinary type, application or test inputs.\n- `bun run db:assess` explains adoption/findings without writing or connecting.\n- GraphQL/PostgREST exports remain legitimate protocol contracts. This check is not\n  proof of deployed schema, effective role permissions or complete RLS equivalence.\n\nDo not introduce any/@ts-ignore to bypass a contract. Use Drizzle-inferred types,\npreserve bigint/numeric precision and decode unknown results at the boundary.\n";
export declare function starterDatabaseFiles(): Record<string, string>;