/** 02-store §1 */
export interface StoreConfig {
    url?: string;
    dataDir?: string;
    encryption?: {
        key: string;
    };
    /** 02-store §4 — dev-mode escape hatch: store secrets unencrypted when no
        encryption key is configured. Never enable in production; secret writes
        without a key fail closed there. */
    allowUnencryptedSecrets?: boolean;
}
export type Query = Db["query"];
/** A data directory the next redeploy deletes, and why: a container platform
    that wipes its filesystem (named), or a path under the OS temp dir (no
    platform). Composed state, not a message — whoever holds the store decides
    how to say it; `createVendo` renders it as the boot block's ⚠ store row. */
export interface EphemeralDataDir {
    /** The directory as configured — what the operator wrote, or the default. */
    readonly dataDir: string;
    /** The platform whose filesystem is wiped, when a marker named one. */
    readonly platform?: string;
}
/** 02-store §4 */
export interface Db {
    kind: "pg" | "pglite";
    /** Set only when this engine writes to storage a redeploy wipes — the PGlite
        default on a container platform or under the OS temp dir. Absent for a
        Postgres url, for `memory://`, and for a real disk. */
    readonly ephemeral?: EphemeralDataDir;
    /** `rowCount` is what the statement returned or AFFECTED — the only way an
        UPDATE or a DELETE can say it did anything. Absent where the engine does
        not report one; callers fall back to `rows.length`. */
    query(text: string, params?: unknown[]): Promise<{
        rows: Record<string, unknown>[];
        rowCount?: number;
    }>;
    close(): Promise<void>;
    raw(): unknown;
    /** 02-store §4 — serialize schema migration against concurrent migrators.
        Lives on the handle (not as a free function) so schema.ts needs no
        driver import: the pg implementation must open a dedicated session for
        the advisory lock, and pulling `pg` into the shared modules would drag
        it into every entry's bundle graph. */
    withSchemaLock<T>(work: (query: Query) => Promise<T>): Promise<T>;
    /** Run work inside a database transaction. The callback receives a
     *  transaction-scoped query function; commit on success, rollback on throw.
     *  Accepts an optional `beforeWork` hook that runs AFTER BEGIN but BEFORE the
     *  callback — designed for SET LOCAL statements (RLS tenant context in task 12). */
    transaction<T>(work: (query: Query) => Promise<T>, opts?: {
        beforeWork?: (query: Query) => Promise<void>;
    }): Promise<T>;
}
/** The pg engine: a lazy Pool for queries, a dedicated Client per schema
 *  lock (advisory locks are session-scoped). */
export declare function createPostgresDb(url: string): Db;
//# sourceMappingURL=db-postgres.d.ts.map