import { PgDatabase, PgQueryResultHKT } from "drizzle-orm/pg-core";
//#region src/db/driver.d.ts
interface DatabaseDriver<TSchema extends Record<string, unknown>> {
  readonly db: PgDatabase<PgQueryResultHKT, TSchema>;
  close(): Promise<void>;
}
/**
 * Resolve a plugin id to its data-schema name on a shared database.
 *
 * Schema names are unconditional `plugin_<slug>` for every workspace on the
 * shared API database. The `pluginId === "api" ? undefined` special case found
 * in older plugin copies is dead code (a plugin is never `api`); api's own
 * tables already live in `plugin_api`.
 */
declare function pluginSchemaName(pluginId: string): string;
/**
 * Railway's public proxy (`*.rlwy.net`) fronts the same Postgres as the
 * internal hostname and presents the same self-signed certificate chain no
 * client CA bundle can verify — but unlike `*.railway.internal` it crosses
 * the public internet, so TLS must stay on (encrypted, unverified) rather
 * than being dropped entirely.
 */
declare function isRailwayPublicProxyUrl(url: string): boolean;
/**
 * TLS behavior for a non-local Postgres URL, following libpq `sslmode`
 * semantics from the connection string itself:
 *
 * - `disable`            → no TLS
 * - `prefer`/`allow`/`require` → TLS, but the server's certificate is NOT
 *   verified (libpq: `require` encrypts, it does not trust). Managed
 *   providers (Railway, Neon, Supabase poolers…) hand out `sslmode=require`
 *   URLs backed by certificates no client CA bundle can verify.
 * - `verify-ca`/`verify-full` → TLS + certificate verification.
 * - absent → verification ON (secure default for bare URLs), EXCEPT Railway's
 *   public proxy (`*.rlwy.net`), which fronts the same self-signed Postgres
 *   as `*.railway.internal` — those URLs default to encrypted-unverified
 *   TLS. `DB_SSL_REJECT_UNAUTHORIZED` still overrides.
 *
 * `DB_SSL_REJECT_UNAUTHORIZED` stays as an explicit operator override: it
 * wins over whatever the URL says (`"false"` disables verification, `"true"`
 * forces it).
 */
declare function resolvePoolSsl(url: string): false | {
  rejectUnauthorized: boolean;
};
/**
 * Create a drizzle database driver for a plugin, choosing the engine by URL
 * scheme: `pglite:` / `:memory:` → embedded PGlite, anything else → postgres
 * (`pg.Pool`).
 *
 * Drivers stay externalized (never statically imported, never in the Module
 * Federation singleton share set) — they are loaded here via dynamic `import()`
 * only, and `drizzle-orm` appears as a runtime import for the `drizzle` entry
 * points. The `namespace` option expresses every topology the platform needs:
 * `plugin_<slug>` on a shared database, undefined for public-schema (api) or
 * dedicated-database (auth) workloads.
 */
declare function createDatabaseDriver<TSchema extends Record<string, unknown>>(url: string, schema: TSchema, namespace?: string): Promise<DatabaseDriver<TSchema>>;
//#endregion
export { DatabaseDriver, createDatabaseDriver, isRailwayPublicProxyUrl, pluginSchemaName, resolvePoolSsl };
//# sourceMappingURL=driver.d.mts.map