[andrewzolotukhin]

Typed contracts currently require consumers to reconstruct asset paths, PostgreSQL transaction locks require repeated raw SQL, and open object schemas can throw a descriptor exception for primitive values nested in arrays. This adds reusable path and transaction APIs and fixes the schema boundary.

Original request

Provide the missing Framework APIs in a separate PR against development, with regression tests and documentation. Leave review and beta publication to the maintainer.

What changed

• Export browser-safe endpointPath and matchEndpointPath from server contracts. Client URL construction and server routing share the implementation, encode/decode each parameter once, preserve route precedence and multi-segment captures, and validate parameters through their declared schemas.
• Add optional db.transaction(callback, { advisoryLocks }) for PostgreSQL. Locks use bound, namespaced keys, are deduplicated/sorted, and remain owned by the transaction on commit or rollback. Both tracked and untracked contexts support the option.
• Return proper validation errors for primitive/array inputs to open object schemas, including nested arrays. Empty object schemas now expose a root property descriptor.
• Add runtime/type tests, real PostgreSQL lock integration tests, READMEs, JSDoc and a changeset.

Reasoning

Contracts should remain the source of path names and parameter types. Transaction locking belongs on the transaction connection so callbacks cannot accidentally run outside the lock. Fixing schema validation removes the need for consumer-side primitive guards.

Advisory locks are opt-in and PostgreSQL-specific; transactions without lock options retain their existing dialect support. They do not replace authorization or relational constraints.

Validation

• npm run lint, npm run build, npm run test: pass; 5,338 tests, no type errors.
• npm run test:coverage: pass, including every published-package floor; 92.92% lines and 86.10% branches overall.
• npm run test:queries:integration: 105 tests pass against an isolated PostgreSQL 16 fixture, including same-key serialization, unrelated keys, commit and rollback lock release.
• GitHub run 38749136583: all required jobs pass on 39c02341, including lint/build/tests, packed packages, documentation, PostgreSQL, Garage and demo API/browser/telemetry E2E. The external Striff check also passes.

Screenshots / preview evidence

Not applicable to these non-visual library APIs. A real HTTP server round-trip test verifies reserved characters, slashes and percent escapes. Database tests use real PostgreSQL connections. No persistent application preview or external SigNoz deployment is configured for this library PR; the demo E2E CI job provides its isolated browser/telemetry coverage.

Blog post

Skipped: internal library primitives and a validation bug fix. Public API documentation and the changeset cover the changes.

Release

Target: development. Maintainer review and the normal beta publication workflow must precede consumer dependency pins. This PR is not auto-merged or published by this task.

PR-ready notification: skipped for this upstream library change because it has no persistent preview environment or project notification configuration.