@dbsp/adapter-pgsql 4.0.0 → 6.0.0

package/dist/outcome-protocol-CACJDzli.d.ts

@@ -1,1088 +0,0 @@
-import { TransitionRunPersister, ValidatedManagedStepManifest } from '@dbsp/core';
-import { AdmittedDestructiveOutcomeClaim, DurablyLoadedRun } from '@dbsp/core/internal';
-import * as _dbsp_types from '@dbsp/types';
-import { DbCasing, DialectCapabilities, ModelIR, NormalizedManagedStep, ResourceAddress, LedgerAddress, DurableIntentRecord, TransitionRunAuthorization, TransitionRunJournal, ProvenPlanShape, LedgerHome, LedgerReservationRow, LedgerIdentity, LedgerChainMember, LedgerMarkerState, DeclarationSet, ReinitializePreflightReport, OutcomeClaimPlan, DestructiveDecision, LedgerEventKind, LedgerPayload, OutcomeVacancy, OutcomeProtocolRefusal, ClaimBundleStatement, ControllerIdentity, AdmittedOutcomeClaim, ClaimToken, OutcomeIndeterminateRecoveryEvidence, OutcomeRecoveryEffect, OutcomeRecoveryClassification, ScopedApprovalSet, OutcomeRecoveryReadBack, OutcomeClaimAdmission } from '@dbsp/types';
-
-/**
- * Schema Comparison Engine (DDL-PROV Block 1)
- *
- * Compares two ModelIRs (schema definition vs database state)
- * and produces a structured diff of changes needed.
- *
- * @module schema-diff
- */
-
-type ChangeKind = 'create_table' | 'drop_table' | 'readdress_table' | 'add_column' | 'drop_column' | 'alter_column_type' | 'alter_column_nullable' | 'alter_column_default' | 'alter_column_unique' | 'add_primary_key' | 'drop_primary_key' | 'add_foreign_key' | 'drop_foreign_key' | 'alter_foreign_key' | 'validate_constraint' | 'create_index' | 'drop_index' | 'add_check_constraint' | 'drop_check_constraint' | 'create_enum' | 'alter_enum_add_value' | 'drop_enum' | 'alter_column_collation' | 'alter_column_identity' | 'add_comment' | 'drop_comment' | 'create_extension' | 'drop_extension' | 'create_sequence' | 'alter_sequence' | 'drop_sequence' | 'enable_rls' | 'disable_rls' | 'create_policy' | 'drop_policy';
-interface SchemaChange {
-    readonly kind: ChangeKind;
-    readonly table: string;
-    readonly column?: string;
-    readonly destructive: boolean;
-    readonly details: string;
-    /** Additional metadata for SQL generation */
-    readonly meta?: Readonly<Record<string, unknown>>;
-}
-interface DiffSummary {
-    readonly tables: {
-        readonly added: number;
-        readonly dropped: number;
-    };
-    readonly columns: {
-        readonly added: number;
-        readonly dropped: number;
-        readonly altered: number;
-    };
-    readonly indexes: {
-        readonly added: number;
-        readonly dropped: number;
-    };
-    readonly constraints: {
-        readonly added: number;
-        readonly dropped: number;
-        readonly altered: number;
-    };
-}
-interface SchemaDiff {
-    readonly changes: readonly SchemaChange[];
-    readonly hasDestructive: boolean;
-    readonly summary: DiffSummary;
-}
-interface CompareSchemataOptions {
-    /**
-     * Database naming convention.
-     * When set, schema model names (camelCase) are converted to DB format
-     * (e.g. snake_case) before comparison with the introspected model.
-     */
-    dbCasing?: DbCasing;
-    /** Dialect capabilities — comparisons for unsupported features will be skipped */
-    readonly dialectCapabilities?: DialectCapabilities;
-    /**
-     * When `true`, extensions present in the live DB but absent from the model
-     * schema are silently ignored — no `drop_extension` change is emitted for them.
-     * Only extensions explicitly declared in the model are managed (created if missing).
-     *
-     * Use this when the database image pre-installs extensions that the application
-     * schema does not own (e.g. pgvector, pg_search bundled in a custom Postgres image).
-     * Default: `false` (full-sync behaviour — unmanaged DB extensions produce a
-     * `drop_extension` entry).
-     */
-    readonly ignoreUnmanagedExtensions?: boolean;
-    /**
-     * Strict compile-only mode for callers that require convergence guarantees.
-     *
-     * `compareSchemata()` is intentionally pure and cannot ask PostgreSQL to
-     * canonicalise raw-SQL expression surfaces. By default it keeps the historic
-     * best-effort verbatim comparison for column defaults, CHECK expressions,
-     * partial-index predicates, and index expressions. Set this flag to throw when either model
-     * contains one of those surfaces so a caller cannot accidentally rely on a
-     * compile-only diff for a convergence-sensitive check.
-     *
-     * Live PostgreSQL callers should use `comparePgsqlDatabaseSchema()`, which
-     * canonicalises CHECK constraint expressions, column defaults, and partial-index predicates before calling this function.
-     * Under that live mode, each side is canonicalised independently; rejected
-     * predicates refuse the migration and infrastructure fallback uses both raw
-     * models. This does not prove
-     * that the resulting migration is executable.
-     * Index expressions are not canonicalised by the live helper and are rejected
-     * there when this strict flag is set.
-     */
-    readonly requireExpressionCanonicalization?: boolean;
-}
-declare class ExpressionCanonicalizationUnavailableError extends Error {
-    readonly surfaces: readonly string[];
-    constructor(surfaces: readonly string[]);
-}
-/**
- * Compare two ModelIRs and produce a structured diff.
- *
- * @param schema - The desired schema (from definition)
- * @param db - The current database state (from introspection)
- * @param options - Optional comparison settings (e.g. dbCasing)
- * @returns SchemaDiff with all changes needed to bring DB in sync with schema
- */
-declare function compareSchemata(schema: ModelIR, db: ModelIR, options?: CompareSchemataOptions): SchemaDiff;
-
-type GeneratedConstraintPostcondition = {
-    readonly type: 'p' | 'u';
-    readonly columns: readonly string[];
-    readonly deferrable: boolean;
-    readonly initiallyDeferred: boolean;
-    readonly enforced: boolean;
-} | {
-    readonly type: 'f';
-    readonly columns: readonly string[];
-    readonly references: {
-        readonly schema: string;
-        readonly table: string;
-        readonly columns: readonly string[];
-    };
-    readonly onDelete: GeneratedForeignKeyAction;
-    readonly onUpdate: GeneratedForeignKeyAction;
-    readonly deferrable: boolean;
-    readonly initiallyDeferred: boolean;
-    readonly enforced: boolean;
-    readonly notValid: boolean;
-} | {
-    readonly type: 'c';
-    /** The ModelIR CHECK expression, never a rendered constraint definition. */
-    readonly expression: string;
-    readonly notValid: boolean;
-};
-/** The semantic FK actions PostgreSQL can represent in pg_constraint. */
-type GeneratedForeignKeyAction = 'NO ACTION' | 'RESTRICT' | 'CASCADE' | 'SET NULL' | 'SET DEFAULT';
-type GeneratedIndexPostcondition = {
-    /** The identity is persisted separately from the rendered CREATE INDEX SQL. */
-    readonly schema: string;
-    readonly table: string;
-    readonly name: string;
-    /** PostgreSQL exposes an omitted method as btree; make that expectation explicit. */
-    readonly method: string;
-    readonly unique: boolean;
-    readonly valid: true;
-    readonly ready: true;
-    readonly live: true;
-    readonly columns: readonly string[];
-    readonly expressions?: readonly string[];
-    readonly include?: readonly string[];
-    readonly nullsNotDistinct: boolean;
-    readonly opclass?: Readonly<Record<string, string>>;
-    readonly with?: Readonly<Record<string, string>>;
-    readonly where?: string;
-};
-/** A canonical SQL fact, never an unversioned deparse string. */
-type CanonicalSqlFact = {
-    readonly canonicalFormVersion: 1;
-    readonly sql: string;
-};
-/**
- * The default, identity, and expression facts are one discriminated state.
- * In particular, an identity cannot also claim an authored/default sequence
- * expression, and a missing default cannot carry an expression.
- */
-type GeneratedColumnDefaultState = {
-    readonly defaultKind: 'none';
-    readonly hasDefault: false;
-    readonly identity: null;
-    readonly defaultExpression?: never;
-} | {
-    readonly defaultKind: 'authored';
-    readonly hasDefault: true;
-    readonly identity: null;
-    readonly defaultExpression: CanonicalSqlFact;
-} | {
-    readonly defaultKind: 'generated-sequence';
-    readonly hasDefault: true;
-    readonly identity: null;
-    readonly defaultExpression?: never;
-} | {
-    readonly defaultKind: 'identity';
-    readonly hasDefault: false;
-    readonly identity: 'always' | 'byDefault';
-    readonly defaultExpression?: never;
-};
-type GeneratedColumnDeclaration = {
-    readonly type?: string;
-    readonly nullable?: boolean;
-    /** null means no COLLATE clause was authored; it is not an effective default. */
-    readonly authoredCollation?: string | null;
-    readonly default?: GeneratedColumnDefaultState;
-};
-type GeneratedTableColumnDeclaration = GeneratedColumnDeclaration & {
-    /** A table-shape member name, not the table target binding. */
-    readonly name: string;
-};
-type GeneratedIndexDeclaration = Omit<GeneratedIndexPostcondition, 'schema' | 'table' | 'name' | 'expressions' | 'where'> & {
-    readonly expressions?: readonly CanonicalSqlFact[];
-    readonly where?: CanonicalSqlFact;
-};
-type GeneratedConstraintDeclaration = Extract<GeneratedConstraintPostcondition, {
-    readonly type: 'p' | 'u';
-}> | Extract<GeneratedConstraintPostcondition, {
-    readonly type: 'f';
-}>;
-/** Table names live only in TargetBinding; columns describe table structure. */
-type V3TableDeclaration = {
-    readonly kind: 'table';
-    readonly columns: readonly GeneratedTableColumnDeclaration[];
-};
-/** Column names live only in TargetBinding; this is the column's shape. */
-type V3ColumnDeclaration = {
-    readonly kind: 'column';
-    readonly column: GeneratedColumnDeclaration;
-};
-/** Constraint names live only in TargetBinding; this is a non-CHECK constraint fact. */
-type V3ConstraintDeclaration = {
-    readonly kind: 'constraint';
-    readonly constraint: GeneratedConstraintDeclaration;
-};
-/** CHECK names live only in TargetBinding; expression is canonical and versioned. */
-type V3CheckDeclaration = {
-    readonly kind: 'check';
-    readonly check: {
-        readonly expression: CanonicalSqlFact;
-        readonly notValid: boolean;
-    };
-};
-/** Index schema, table, and name live only in TargetBinding; options are structured facts. */
-type V3IndexDeclaration = {
-    readonly kind: 'index';
-    readonly index: GeneratedIndexDeclaration;
-};
-/** Enum names live only in TargetBinding; labels are the declaration. */
-type V3EnumDeclaration = {
-    readonly kind: 'enum';
-    readonly labels: readonly string[];
-};
-/** Sequence names live only in TargetBinding; options are the declaration. */
-type V3SequenceDeclaration = {
-    readonly kind: 'sequence';
-    readonly startValue?: string;
-    readonly incrementBy?: string;
-    readonly minValue?: string;
-    readonly maxValue?: string;
-    readonly cycle?: boolean;
-};
-/** Extension names live only in TargetBinding; requested version is the declaration. */
-type V3ExtensionDeclaration = {
-    readonly kind: 'extension';
-    readonly version?: string;
-};
-/** Address-free v3 declaration variants. */
-type GeneratedPostconditionDeclarationV3 = {
-    readonly canonicalFormVersion: 1;
-} & (V3TableDeclaration | V3ColumnDeclaration | V3ConstraintDeclaration | V3CheckDeclaration | V3IndexDeclaration | V3EnumDeclaration | V3SequenceDeclaration | V3ExtensionDeclaration | {
-    readonly kind: 'absent';
-});
-/**
- * The separate binding selects the surrounding managed step's canonical
- * address.  It is versioned independently so later verifiers can resolve it
- * without teaching any declaration variant about physical addresses.
- */
-type TargetBinding = {
-    readonly bindingVersion: 1;
-    readonly bindingKind: 'managed-step-address';
-};
-/** Version 3 carries an address-free declaration and a separately decoded binding. */
-type GeneratedPostconditionV3 = {
-    readonly postconditionVersion: 3;
-    /** v3 kind lives only in the address-free declaration, never beside the binding. */
-    readonly kind?: never;
-    readonly declaration: GeneratedPostconditionDeclarationV3;
-    readonly targetBinding: TargetBinding;
-};
-/** Only v3 is a decodable generated postcondition. Older values replan. */
-type GeneratedPostcondition = GeneratedPostconditionV3;
-/** The version tag is part of the digest domain, never an implicit convention. */
-declare function generatedPostconditionDigest(value: {
-    readonly postconditionVersion: number;
-}): string;
-declare function generatedPostconditionForChange(input: {
-    readonly change: SchemaChange;
-    readonly schema: string;
-}): _dbsp_types.LedgerPayload | undefined;
-/**
- * The only change-kind boundary between diagnostic schema diffing and managed
- * execution.  Keep it at manifest construction: diagnostic-only controls must
- * never acquire an address, claim, reservation, or DDL bundle.
- */
-declare function assertDeclarableChangeKind(kind: ChangeKind): asserts kind is Exclude<ChangeKind, 'enable_rls' | 'disable_rls' | 'create_policy' | 'drop_policy' | 'add_comment' | 'drop_comment'>;
-/**
- * PostgreSQL's total ChangeKind-to-address producer.  The mapping is run at
- * plan time, so no executable generator step can later fall through to a
- * permissive "no managed address" branch.
- */
-declare function createPgsqlGeneratedManagedStep(input: {
-    readonly change: SchemaChange;
-    readonly database: string;
-    readonly schema: string;
-    readonly stepKey: string;
-    readonly order: number;
-    readonly dependencyOrder?: readonly string[];
-    readonly statements: readonly string[];
-}): NormalizedManagedStep;
-
-type GeneratedPostconditionQuery = {
-    query(sql: string, params?: readonly unknown[]): Promise<{
-        readonly rows: readonly Record<string, unknown>[];
-    }>;
-};
-declare const generatedPostconditionSessionBrand: unique symbol;
-/** An adapter-minted, exclusive PostgreSQL session for rollback-only proof. */
-type GeneratedPostconditionSession = GeneratedPostconditionQuery & {
-    readonly [generatedPostconditionSessionBrand]: true;
-};
-/** A retained session capability was used after its owning bracket ended. */
-declare class GeneratedPostconditionSessionDeactivatedError extends Error {
-    constructor();
-}
-/** A caller attempted to overlap rollback-only proofs on one capability. */
-declare class GeneratedPostconditionProofInFlightError extends Error {
-    constructor();
-}
-/** A session bracket completed while rollback-only proof work was still running. */
-declare class GeneratedPostconditionWorkInFlightError extends Error {
-    constructor();
-}
-/**
- * Public verifier checkout bracket.  Scratch-backed proofs require the active
- * role to hold database TEMP privilege; callers must preflight that capability
- * before applying managed DDL whose postcondition needs scratch staging.
- */
-declare function withGeneratedPostconditionSession<T>(executor: {
-    connect(): Promise<GeneratedPostconditionQuery & {
-        release(error?: unknown): void | Promise<void>;
-    }>;
-}, work: (session: GeneratedPostconditionSession) => Promise<T>, lockTimeoutMs?: number): Promise<T>;
-type ResolvableGeneratedPostconditionKind = 'table' | 'column' | 'constraint';
-type GeneratedPostconditionBindingKind = ResolvableGeneratedPostconditionKind | 'index' | 'enum' | 'sequence' | 'extension';
-type GeneratedPostconditionSchemaBindingKind = Exclude<GeneratedPostconditionBindingKind, 'extension'>;
-type GeneratedPostconditionTableChildKind = 'column' | 'index' | 'constraint';
-/** The canonical schema-scoped table parent of a managed table child. */
-type GeneratedPostconditionTableParent = {
-    readonly scope: 'schema';
-    readonly engine: string;
-    readonly database: string;
-    readonly schema: string;
-    readonly kind: 'table';
-    readonly name: string;
-    readonly parent?: never;
-    readonly catalogueIdentity?: never;
-    readonly qualifiedBy?: never;
-};
-type GeneratedPostconditionSchemaRootAddress<K extends Exclude<GeneratedPostconditionSchemaBindingKind, GeneratedPostconditionTableChildKind>> = Omit<ResourceAddress, 'engine' | 'schema' | 'parent' | 'kind'> & {
-    readonly engine: string;
-    readonly scope: 'schema';
-    readonly schema: string;
-    readonly parent?: never;
-    readonly kind: K;
-};
-type GeneratedPostconditionTableChildAddress<K extends GeneratedPostconditionTableChildKind> = Omit<ResourceAddress, 'engine' | 'schema' | 'parent' | 'kind'> & {
-    readonly engine: string;
-    readonly scope: 'schema';
-    readonly schema: string;
-    readonly parent: GeneratedPostconditionTableParent;
-    readonly kind: K;
-};
-type GeneratedPostconditionExtensionAddress = Omit<ResourceAddress, 'engine' | 'schema' | 'parent' | 'kind'> & {
-    readonly engine: string;
-    readonly scope: 'database';
-    readonly schema?: never;
-    readonly parent?: never;
-    readonly kind: 'extension';
-};
-/** The complete topology selected by a v3 managed-step binding. */
-type GeneratedPostconditionBindingAddress = GeneratedPostconditionSchemaRootAddress<'table' | 'enum' | 'sequence'> | GeneratedPostconditionTableChildAddress<GeneratedPostconditionTableChildKind> | GeneratedPostconditionExtensionAddress;
-declare class GeneratedPostconditionBindingResolutionError extends Error {
-    readonly sought: string;
-    readonly found: string;
-    constructor(input: {
-        readonly sought: string;
-        readonly found: string;
-    }, options?: ErrorOptions);
-}
-/**
- * Narrows a ledger address into the complete topology that a v3 verifier can
- * bind.  Ledger addresses are intentionally broader, so this boundary must
- * reject malformed persisted input before it reaches any verifier dispatch.
- */
-declare function toGeneratedPostconditionBindingAddress(address: LedgerAddress): GeneratedPostconditionBindingAddress;
-type IndexProjection = {
-    readonly schema: string;
-    readonly table: string;
-    readonly name: string;
-    readonly method: string;
-    readonly unique: boolean;
-    readonly valid: boolean;
-    readonly ready: boolean;
-    readonly live: boolean;
-    readonly nullsNotDistinct: boolean;
-    readonly primary: boolean;
-    readonly exclusion: boolean;
-    readonly immediate: boolean;
-    readonly constraintOwned: boolean;
-    readonly keyColumns: readonly (string | null)[];
-    readonly keyDefinitions: readonly string[];
-    readonly includeColumns: readonly string[];
-    readonly opclasses: readonly string[];
-    readonly keyOptions: readonly string[];
-    readonly reloptions: readonly string[];
-    readonly predicate: string | null;
-};
-type CheckProjection = {
-    readonly expression: string;
-    readonly validated: boolean;
-    readonly noInherit: boolean;
-    readonly enforced: boolean;
-    readonly isLocal: boolean;
-    readonly inheritanceCount: number;
-    readonly parentId: number;
-};
-type TableColumnProjection = {
-    readonly name: string;
-    readonly type: string;
-    readonly nullable: boolean;
-    readonly default: string | undefined;
-    /** Ownership and canonical nextval shape read in the same catalogue snapshot. */
-    readonly generatedSequenceDefault: boolean;
-    readonly collation: string | null;
-    readonly identity: 'always' | 'byDefault' | null;
-};
-type TableProjection = {
-    readonly columns: readonly TableColumnProjection[];
-};
-type GeneratedColumnProjection = Omit<TableColumnProjection, 'name'>;
-declare class GeneratedPostconditionReplanRequiredError extends Error {
-    readonly code = "REPLAN_REQUIRED";
-    readonly diagnostic: Readonly<{
-        versionSeen: unknown;
-        stepIdentity: string | undefined;
-        structuralPath: string | undefined;
-    }>;
-    readonly structuralPath: string | undefined;
-    constructor(message: string, versionSeen?: unknown, stepIdentity?: string | undefined, options?: ErrorOptions, structuralPath?: string | undefined);
-}
-/**
- * Decode exactly one postcondition interpretation per version: only v3 is
- * accepted. v1/v2 and every other value are named REPLAN_REQUIRED outcomes.
- */
-declare function decodeGeneratedPostcondition(value: unknown, stepIdentity?: string): GeneratedPostcondition;
-/**
- * The persisted digest is bound to the versioned wire value before decoding.
- * A digest minted for one version cannot authenticate another version body.
- */
-declare function decodeGeneratedPostconditionPayload(payload: {
-    readonly value: unknown;
-    readonly digest: string;
-}, stepIdentity?: string): GeneratedPostcondition;
-/** Refuse structural lookalikes before any proof or catalogue read. */
-declare function assertGeneratedPostconditionSession(value: unknown): GeneratedPostconditionSession;
-type GeneratedPostconditionCatalogueIdentity = NonNullable<ResourceAddress['catalogueIdentity']>;
-/** Resolves the v3 table binding, then delegates its shared structural proof. */
-declare function verifyGeneratedTablePostcondition(input: {
-    readonly session: GeneratedPostconditionSession;
-    readonly postcondition: unknown;
-    readonly address: GeneratedPostconditionBindingAddress;
-}): Promise<{
-    readonly kind: 'table';
-    readonly projection: TableProjection;
-    readonly catalogueIdentity: GeneratedPostconditionCatalogueIdentity;
-}>;
-/** Resolves the v3 column binding, then delegates its shared structural proof. */
-declare function verifyGeneratedColumnPostcondition(input: {
-    readonly session: GeneratedPostconditionSession;
-    readonly postcondition: unknown;
-    readonly address: GeneratedPostconditionBindingAddress;
-}): Promise<{
-    readonly kind: 'column';
-    readonly projection: GeneratedColumnProjection;
-    readonly catalogueIdentity: GeneratedPostconditionCatalogueIdentity;
-}>;
-/** Resolves the v3 index binding, then delegates its shared structural proof. */
-declare function verifyGeneratedIndexPostcondition(input: {
-    readonly session: GeneratedPostconditionSession;
-    readonly postcondition: unknown;
-    readonly address: GeneratedPostconditionBindingAddress;
-}): Promise<{
-    readonly kind: 'index';
-    readonly projection: IndexProjection;
-    readonly catalogueIdentity: GeneratedPostconditionCatalogueIdentity;
-}>;
-/** Resolves the v3 CHECK binding, then delegates its shared structural proof. */
-declare function verifyGeneratedCheckPostcondition(input: {
-    readonly session: GeneratedPostconditionSession;
-    readonly postcondition: unknown;
-    readonly address: GeneratedPostconditionBindingAddress;
-}): Promise<{
-    readonly kind: 'constraint';
-    readonly projection: CheckProjection;
-    readonly catalogueIdentity: GeneratedPostconditionCatalogueIdentity;
-}>;
-/**
- * Binds the deliberately non-structural v3 kinds under the same rollback-only
- * proof bracket as structural verifiers.  The declaration kind is the binding
- * expectation, so a sequence slot can never observe an enum declaration (or
- * vice versa) merely because the address happens to resolve.
- */
-declare function verifyGeneratedIdentityPostcondition(input: {
-    readonly session: GeneratedPostconditionSession;
-    readonly postcondition: unknown;
-    readonly address: GeneratedPostconditionBindingAddress;
-    readonly kind: 'constraint' | 'enum' | 'sequence' | 'extension';
-}): Promise<{
-    readonly kind: 'constraint' | 'enum' | 'sequence' | 'extension';
-    readonly identity: Readonly<{
-        readonly relationOid: string;
-        readonly objectOid?: string;
-    }>;
-    readonly catalogueIdentity: GeneratedPostconditionCatalogueIdentity;
-}>;
-
-type QueryResultLike = {
-    readonly rows: readonly Record<string, unknown>[];
-};
-type TransitionJournalQueryable = {
-    query(sql: string, params?: readonly unknown[]): Promise<QueryResultLike>;
-};
-/** A copied plan row is not authority for a differently named run. */
-declare class TransitionRunIdentityMismatchError extends Error {
-    constructor();
-}
-declare function renderCreateDbspMetaSchemaSql(): string;
-declare function renderCreateTransitionRunTableSql(): string;
-declare function renderCreateTransitionJournalTableSql(): string;
-declare function renderCreateTransitionRunPlanTableSql(): string;
-declare function renderCreateTransitionAuthorizationTableSql(): string;
-declare function ensureTransitionJournal(executor: TransitionJournalQueryable): Promise<void>;
-declare function createPgTransitionRunPersister(executor: TransitionJournalQueryable): TransitionRunPersister;
-declare function appendIntentJournal(executor: TransitionJournalQueryable, record: DurableIntentRecord): Promise<void>;
-/** Append-only run approval, intentionally separate from step attempts. */
-declare function appendTransitionAuthorization(executor: TransitionJournalQueryable, record: TransitionRunAuthorization): Promise<void>;
-declare function readTransitionJournal(executor: TransitionJournalQueryable, runId: string, options?: {
-    readonly ensure?: boolean;
-}): Promise<TransitionRunJournal & {
-    readonly plan: ProvenPlanShape;
-}>;
-
-interface PgCatalogueIdentityQueryable {
-    query(sql: string, params?: readonly unknown[]): Promise<{
-        readonly rows: readonly Record<string, unknown>[];
-    }>;
-}
-/**
- * Re-read the PostgreSQL catalogue identity for one managed address. The
- * adapter deliberately returns absence as undefined; callers decide whether an
- * absent object is legal for the lifecycle state they are admitting.
- */
-declare function readPgCatalogueIdentity(executor: PgCatalogueIdentityQueryable, address: ResourceAddress): Promise<ResourceAddress | undefined>;
-
-declare const PG_LEDGER_SHAPE_VERSION = 1;
-declare const ledgerShapeAllowanceBrand: unique symbol;
-/**
- * An in-process allowance for one non-ledger trigger observed immediately
- * after trusted harness setup. Its contents are deliberately not structural:
- * only the internal factory can register a value in the WeakSet below.
- */
-interface PgLedgerShapeAllowance {
-    readonly [ledgerShapeAllowanceBrand]: 'dbsp-ledger-shape-allowance';
-}
-type PgLedgerPhysicalShapeOutcome = {
-    readonly kind: 'verified';
-} | {
-    readonly kind: 'shape-wrong';
-    readonly artefact: string;
-} | {
-    readonly kind: 'unverifiable';
-    readonly cause: string;
-} | {
-    readonly kind: 'unsupported-major';
-    readonly major: number | undefined;
-} | {
-    readonly kind: 'validator-abi-failure';
-    readonly sqlstate: string;
-};
-/**
- * Read-only admission of an existing ledger.  A fixture is deliberately a
- * prerequisite: deparse text is not portable across PostgreSQL majors.
- */
-declare function classifyPgLedgerPhysicalShape(executor: TransitionJournalQueryable, target: PgLedgerTarget, allowance?: PgLedgerShapeAllowance): Promise<PgLedgerPhysicalShapeOutcome>;
-/**
- * Throwing compatibility façade. Existing mutating callers intentionally keep
- * their historical contract; outcome-aware consumers use `classify…`.
- */
-declare function validatePgLedgerPhysicalShape(executor: TransitionJournalQueryable, target: PgLedgerTarget, allowance?: PgLedgerShapeAllowance): Promise<void>;
-/**
- * Mint a one-request allowance for one exact live trigger. This is exported
- * only from the adapter's `/internal` surface: consumers cannot forge the
- * WeakMap registration or serialize it into an ordinary recovery request.
- */
-declare function createPgLedgerShapeAllowance(executor: TransitionJournalQueryable, target: PgLedgerTarget, triggerName: string): Promise<PgLedgerShapeAllowance>;
-declare class PgLedgerStorageUnsupportedError extends Error {
-    constructor(observed: unknown);
-}
-declare const pgOrderedLedgerLocksBrand: unique symbol;
-/** Proof returned only after this transaction acquired every home in order. */
-interface PgOrderedLedgerLocks {
-    readonly homes: readonly PgLedgerTarget[];
-    readonly [pgOrderedLedgerLocksBrand]: 'dbsp-pg-ordered-ledger-locks';
-}
-type PgLedgerLockResult = {
-    readonly kind: 'acquired';
-    readonly proof: PgOrderedLedgerLocks;
-} | {
-    readonly kind: 'busy';
-    readonly ledger: LedgerHome;
-} | {
-    readonly kind: 'refused';
-    readonly ledger: LedgerHome;
-    readonly error: unknown;
-};
-type PgLedgerTarget = LedgerHome;
-/** Read only reservations explicitly linked to one durable execution/run. */
-declare function readPgLedgerReservationsForExecution(executor: TransitionJournalQueryable, target: PgLedgerTarget, executionId: string): Promise<readonly LedgerReservationRow[]>;
-/**
- * A re-address pair can cross ledger homes. Discover every existing reservation
- * table before reading the pair so recovery cannot accidentally treat one side
- * of a cross-schema closure as the entire operation.
- */
-type PgLedgerReservationCandidateOutcome = {
-    readonly target: PgLedgerTarget;
-    readonly kind: 'verified';
-} | {
-    readonly target: PgLedgerTarget;
-    readonly kind: 'not-ledger-shape';
-} | {
-    readonly target: PgLedgerTarget;
-    readonly kind: 'unverifiable';
-    readonly cause: string;
-};
-type PgLedgerReservationsForPair = readonly LedgerReservationRow[] & {
-    readonly candidates: readonly PgLedgerReservationCandidateOutcome[];
-};
-declare function readPgLedgerReservationsForPair(executor: TransitionJournalQueryable, pairId: string): Promise<PgLedgerReservationsForPair>;
-type LedgerWriteMember = Omit<LedgerChainMember, 'controller' | 'recordedAt'>;
-declare function renderCreateLedgerEventTableSql(target: PgLedgerTarget): string;
-declare function renderCreateLedgerTerminalMemberIndexSql(target: PgLedgerTarget): string;
-declare function renderCreateLedgerReservationTableSql(target: PgLedgerTarget): string;
-declare function renderCreateLedgerIdentityTableSql(target: PgLedgerTarget): string;
-declare function renderCreateLedgerMarkerTableSql(target: PgLedgerTarget): string;
-declare function renderCreateLedgerImmutabilityFunctionSql(target: PgLedgerTarget): string;
-declare function renderCreateLedgerImmutabilityTriggerSql(target: PgLedgerTarget): string;
-/** Proves the PG 15 requirement before emitting a NULLS NOT DISTINCT table. */
-declare function ensurePgLedgerStorageVersion(executor: TransitionJournalQueryable): Promise<void>;
-declare function ensurePgLedger(executor: TransitionJournalQueryable, target: PgLedgerTarget, options?: {
-    readonly writeMarker?: boolean;
-}): Promise<void>;
-declare function ensureDbspMetaLedger(executor: TransitionJournalQueryable, options?: {
-    readonly writeMarker?: boolean;
-}): Promise<void>;
-/** Records lineage once; a mismatching identity is an admission concern of unit 5. */
-declare function recordPgLedgerIdentity(executor: TransitionJournalQueryable, target: PgLedgerTarget, identity: LedgerIdentity): Promise<void>;
-declare function appendPgLedgerProgress(executor: TransitionJournalQueryable, target: PgLedgerTarget, member: LedgerWriteMember): Promise<void>;
-/**
- * Appends the root claim and every reservation in one PostgreSQL statement.
- * Callers can include this statement in a larger DDL transaction, but cannot
- * accidentally split this claim's append from its durable reservation rows.
- */
-declare function appendPgLedgerClaim(executor: TransitionJournalQueryable, target: PgLedgerTarget, member: LedgerWriteMember, reservations: readonly LedgerReservationRow[], reservationRootClaimId?: string): Promise<void>;
-/**
- * Appends an entire destructive closure as one ledger group.  The caller owns
- * the surrounding locked transaction; consequently a failed member insert
- * rolls back the root, every member and every reservation together.
- */
-declare function appendPgLedgerClaimGroup(executor: TransitionJournalQueryable, root: LedgerWriteMember, members: readonly LedgerWriteMember[], reservations: readonly LedgerReservationRow[]): Promise<void>;
-/** Resolves every closure terminal in the caller's one locked transaction. */
-declare function appendPgLedgerResolutionGroup(executor: TransitionJournalQueryable, rootClaimId: string, members: readonly LedgerWriteMember[], reservations: readonly Pick<LedgerReservationRow, 'address'>[]): Promise<void>;
-/**
- * Appends a terminal member and releases the reservations owned by this
- * append atomically. A group-owned contained member has an intentionally
- * empty closure because its group's root append already released it.
- */
-declare function appendPgLedgerResolution(executor: TransitionJournalQueryable, target: PgLedgerTarget, member: LedgerWriteMember, rootClaimId: string, reservations: readonly Pick<LedgerReservationRow, 'address'>[]): Promise<void>;
-/**
- * `released` has no claim spelling in the closed event grammar. It is the
- * deliberate atomic managed-to-unknown transition, so it must not invent an
- * empty reservation closure merely to reuse ordinary claim resolution.
- */
-declare function appendPgLedgerRelease(executor: TransitionJournalQueryable, target: PgLedgerTarget, member: LedgerWriteMember): Promise<void>;
-/**
- * Transaction-scoped, non-waiting locks for one effects closure. The ordering
- * is dbsp_meta first and then schema name, so opposing closures cannot deadlock.
- */
-declare function acquirePgLedgerLocks(executor: TransitionJournalQueryable, homes: readonly LedgerHome[]): Promise<PgLedgerLockResult>;
-
-type ReinitializePreflightCheckpoint = 'archive' | 'create' | 'grants' | 'marker' | 'output';
-/** Test-only callers can observe real engine progress without changing production flow. */
-type ReinitializePreflightObserver = (checkpoint: ReinitializePreflightCheckpoint, ledger?: LedgerHome) => Promise<void>;
-interface PgReinitializePreflightClient extends TransitionJournalQueryable {
-    release?(error?: unknown): void;
-}
-interface PgReinitializePreflightPool {
-    connect(): Promise<PgReinitializePreflightClient>;
-}
-interface PgReinitializePreflightOptions {
-    readonly pool: PgReinitializePreflightPool;
-    /** Schema names only. `dbsp_meta` is always added as the database ledger. */
-    readonly schemas: readonly string[];
-    readonly declarations: DeclarationSet;
-    readonly writeAdoptionFile: (report: ReinitializePreflightReport) => Promise<void>;
-    readonly observer?: ReinitializePreflightObserver;
-}
-/**
- * Read exactly one ledger shape marker without creating or repairing anything.
- * Ordinary command surfaces use this to refuse a non-current mutating scope;
- * inspect deliberately reports the returned value instead.
- */
-declare function readPgLedgerMarker(executor: TransitionJournalQueryable, home: LedgerHome): Promise<LedgerMarkerState>;
-/**
- * Ordinary mutating commands consume this read-only admission result.  It
- * intentionally delegates equality to the preflight's recorded-vs-live
- * comparison, keeping that pair as the only ledger lineage comparison.
- */
-type PgLedgerScopeCurrency = {
-    readonly kind: 'absent';
-    readonly marker: LedgerMarkerState;
-} | {
-    readonly kind: 'current';
-    readonly marker: LedgerMarkerState;
-} | {
-    readonly kind: 'not-current';
-    readonly marker: LedgerMarkerState;
-    readonly reason: 'marker' | 'lineage';
-};
-declare function readPgLedgerScopeCurrency(executor: TransitionJournalQueryable, home: LedgerHome): Promise<PgLedgerScopeCurrency>;
-/**
- * Pair recovery reads only homes already selected by the durable run.  A
- * same-named user table in another schema is never discovery evidence for a
- * pair; callers must first establish the finite candidate homes from reviewed
- * material and then each home is admitted here.
- */
-declare function readVerifiedPgLedgerReservationsForPair(executor: TransitionJournalQueryable, pairId: string, homes: readonly LedgerHome[]): Promise<readonly _dbsp_types.LedgerReservationRow[]>;
-/**
- * Runs the separately privileged reinitialize-preflight. It never invokes a
- * ledger append primitive: the only durable writes are additive structure,
- * archived structure, identity, grants, marker, and the caller-owned output.
- */
-declare function runPgReinitializePreflight(options: PgReinitializePreflightOptions): Promise<ReinitializePreflightReport>;
-
-declare const pgLockedRunBrand: unique symbol;
-/**
- * A run identity that was loaded while the caller owns its run lock.  This is
- * deliberately not a structural `{ runId, planDigest }`: callers cannot bind
- * the digest check to two independently supplied strings.
- */
-interface PgLockedRun {
-    readonly runId: string;
-    readonly planDigest: string;
-    readonly [pgLockedRunBrand]: 'dbsp-pg-locked-journal-run';
-}
-/**
- * Adapter-only bridge from the journal-load/run-lock boundary.  Keep this
- * beside the admitted facade; ordinary callers receive a `PgLockedRun`, never
- * manufacture one from string fields.
- */
-declare function lockPgJournalRun(run: DurablyLoadedRun): PgLockedRun;
-/** A COMMIT write may have reached PostgreSQL even when its acknowledgement did not. */
-declare class PgCommitAcknowledgementAmbiguousError extends Error {
-    constructor(cause: unknown);
-}
-/**
- * Test-only observation points on the admitted path.  Production callers do
- * not supply an observer, so the helper is inert: it performs no IPC, I/O, or
- * scheduling work in an ordinary run.
- */
-type PgOutcomeCheckpoint = 'post-lock-integrity-before-append' | 'commit-acknowledged' | 'ddl-completed-before-read-back';
-type PgOutcomeCheckpointObserver = (checkpoint: PgOutcomeCheckpoint) => Promise<void> | void;
-interface PgOutcomeClaimRequest {
-    readonly plan: OutcomeClaimPlan;
-    readonly reservations: readonly LedgerReservationRow[];
-    readonly lockTimeoutMs?: number;
-    /** Destructive authority is evaluated under these same ledger locks. */
-    readonly destructiveDecision?: (executor: TransitionJournalQueryable, plan: OutcomeClaimPlan) => Promise<DestructiveDecision>;
-    /** Optional E2E observer; absent in all production command paths. */
-    readonly observer?: PgOutcomeCheckpointObserver;
-}
-/** One root claim plus its token-free destructive-closure members. */
-interface PgOutcomeClaimGroupRequest extends PgOutcomeClaimRequest {
-    readonly members: readonly Omit<PgOutcomeClaimRequest, 'destructiveDecision'>[];
-}
-interface PgOutcomeClaimGroupAdmission {
-    readonly root: OutcomeClaimAdmission;
-    readonly members: readonly OutcomeClaimAdmission[];
-}
-interface PgOutcomeClaimGroupResolution {
-    readonly rootClaimId: string;
-    readonly members: readonly {
-        readonly target: PgLedgerTarget;
-        readonly member: Omit<LedgerChainMember, 'controller' | 'recordedAt'>;
-    }[];
-    readonly reservations: readonly Pick<LedgerReservationRow, 'address'>[];
-    readonly lockTimeoutMs?: number;
-    /** Durable run witness carried from destructive admission to its terminal. */
-    readonly runtimeIntegrityRun?: PgLockedRun;
-    /** Optional E2E observer for this terminal-appending transaction. */
-    readonly observer?: PgOutcomeCheckpointObserver;
-}
-interface PgOutcomeResolution {
-    readonly eventId: string;
-    readonly eventKind: Exclude<LedgerEventKind, 'intent' | 'retire-intent' | 'readdress-intent' | 'adopt-intent' | 'executing'>;
-    readonly observed?: LedgerChainMember['observed'];
-    /** Required by the ledger writer when this resolution is `refused`. */
-    readonly refusal?: LedgerChainMember['refusal'];
-}
-interface PgOutcomeExecutionRequest {
-    readonly token: ClaimToken;
-    readonly claim: AdmittedOutcomeClaim;
-    readonly statements: readonly ClaimBundleStatement[];
-}
-/**
- * The first admitted-operation shape. Later waves add single and paired
- * operation variants without reopening the facade's authority boundary.
- */
-interface PgSingleAdmittedOperation {
-    readonly kind: 'single-outcome';
-    readonly request: PgOutcomeTransactionalRequest | PgOutcomeNonTransactionalRequest;
-}
-/**
- * The three generated payload roles are intentionally disjoint at the type
- * boundary. Their runtime serialization remains the ledger's `{ value,
- * digest }` pair; the discriminant prevents a generic identity observation
- * from being wired into a declaration or a structural-proof slot.
- */
-type GeneratedDeclarationPayload = LedgerPayload & {
-    readonly payloadKind: 'generated-declaration';
-};
-type GeneratedIdentityObservation = LedgerPayload & {
-    readonly payloadKind: 'generated-identity-observation';
-};
-type GeneratedStructuralObservation = LedgerPayload & {
-    readonly payloadKind: 'generated-structural-observation';
-};
-/**
- * Readdress keeps its catalogue closure discovery in readdress.ts, while this
- * facade owns the only claim/permit/DDL/terminal path for the resulting pair.
- */
-interface PgPairedReaddressOperation {
-    readonly kind: 'paired-readdress';
-    readonly request: {
-        readonly pairId: string;
-        readonly executionId: string;
-        readonly members: readonly {
-            readonly source: LedgerAddress;
-            readonly target: LedgerAddress;
-            readonly sourceClaimId: string;
-            readonly targetClaimId: string;
-            readonly sourceDeclared?: LedgerPayload;
-            readonly targetDeclared: GeneratedDeclarationPayload;
-            readonly targetObserved: GeneratedIdentityObservation;
-            /**
-             * Optional structural proof for a typed table declaration. The paired
-             * protocol invokes it after DDL on its pinned transaction session, so
-             * the observed ledger fact is the catalogue projection it just read.
-             */
-            readonly postDdlReadBack?: (executor: GeneratedPostconditionSession) => Promise<GeneratedStructuralObservation>;
-            /** Verifies a physical relationship that identity alone cannot prove. */
-            readonly postDdlVerify?: (executor: TransitionJournalQueryable) => Promise<void>;
-        }[];
-        readonly reservations: readonly LedgerReservationRow[];
-        readonly statements: readonly ClaimBundleStatement[];
-        /** Digest-covered root material for this paired request; it is never empty. */
-        readonly manifestPlan: OutcomeClaimPlan;
-        /** Re-read closure, source controller/identity and target vacancy under lock. */
-        readonly verifyLiveAdmission: (executor: TransitionJournalQueryable, currentController: ControllerIdentity) => Promise<OutcomeProtocolRefusal | readonly {
-            readonly source: LedgerAddress;
-            readonly target: LedgerAddress;
-            readonly catalogueIdentity: NonNullable<NonNullable<Awaited<ReturnType<typeof readPgCatalogueIdentity>>>['catalogueIdentity']>;
-        }[]>;
-        readonly lockTimeoutMs?: number;
-        /** Optional E2E observer; absent in normal execution. */
-        readonly observer?: PgOutcomeCheckpointObserver;
-    };
-}
-interface PgDestructiveAdmittedOperation {
-    readonly kind: 'destructive-outcome';
-    readonly request: PgOutcomeClaimGroupRequest;
-    readonly readBackAndResolve: (executor: TransitionJournalQueryable, claim: AdmittedDestructiveOutcomeClaim) => Promise<PgOutcomeClaimGroupResolution>;
-}
-type PgAdmittedOperation = PgSingleAdmittedOperation | PgPairedReaddressOperation | PgDestructiveAdmittedOperation;
-type PgAdmittedOperationResult = PgOutcomeResult | PgDestructiveOutcomeResult | {
-    readonly kind: 'executed-paired-readdress';
-    readonly pairId: string;
-} | {
-    readonly kind: 'outcome-transport-ambiguous';
-    readonly reason: string;
-} | {
-    readonly kind: 'outcome-recovery-required';
-    readonly claimId: string;
-    readonly reason: string;
-};
-type PgDestructiveOutcomeResult = {
-    readonly kind: 'executed-destructive-outcome';
-}
-/**
- * SQL was admitted and may have run, but its operation-owned read-back could
- * not establish a terminal fact.  Keep the durable claim open for reconcile;
- * in particular, never turn this post-executing state into `refused`.
- */
- | {
-    readonly kind: 'outcome-protocol-pending';
-    readonly reason: string;
-} | OutcomeProtocolRefusal | {
-    readonly kind: 'outcome-transport-ambiguous';
-    readonly reason: string;
-} | {
-    readonly kind: 'outcome-recovery-required';
-    readonly claimId: string;
-    readonly reason: string;
-};
-/**
- * Internal compatibility bridge. Callers must bring the durable run and scoped
- * approvals that the façade consumes; this bridge never invents either.
- */
-declare function executePgDestructiveOutcome(executor: TransitionJournalQueryable, input: {
-    readonly run: PgLockedRun;
-    readonly approval: ScopedApprovalSet;
-    readonly request: PgOutcomeClaimGroupRequest;
-    readonly readBackAndResolve: (executor: TransitionJournalQueryable, claim: AdmittedDestructiveOutcomeClaim) => Promise<PgOutcomeClaimGroupResolution>;
-}): Promise<PgDestructiveOutcomeResult>;
-/** Keeps terminal appends and reservation release behind the managed facade. */
-declare function resolvePgDestructiveOutcome(executor: TransitionJournalQueryable, request: PgOutcomeClaimGroupResolution): Promise<undefined | OutcomeProtocolRefusal>;
-interface PgOutcomeTransactionalRequest extends PgOutcomeClaimRequest {
-    readonly resolution: PgOutcomeResolution;
-    /** Core has already opened the segment transaction; never nest BEGIN. */
-    readonly transactionOpen?: boolean;
-    /**
-     * Operation-owned terminal read-back; generic catalogue identity is not
-     * evidence. It receives the admitted session so transactional DDL is read
-     * before its terminal ledger fact commits.
-     */
-    readonly readBack?: (executor: GeneratedPostconditionSession) => Promise<LedgerPayload>;
-    /** Required for creations; the reader runs after the claim and before SQL. */
-    readonly vacancy?: (executor: TransitionJournalQueryable, plan: OutcomeClaimPlan) => Promise<OutcomeVacancy>;
-    /** Re-check operation-specific live facts after the claim/reservation opens. */
-    readonly verifyLiveAdmission?: (executor: TransitionJournalQueryable, plan: OutcomeClaimPlan) => Promise<OutcomeProtocolRefusal | undefined>;
-    /** Record the post-DDL catalogue identity on a present terminal member. */
-    readonly recordCatalogueIdentity?: boolean;
-}
-interface PgOutcomeNonTransactionalRequest extends PgOutcomeTransactionalRequest {
-    readonly executingEventId: string;
-    /** Observable acknowledgement point after executing has committed, before SQL. */
-    readonly onExecutingCommitted?: () => Promise<void> | void;
-}
-/** Builds the canonical read-back payload once catalogue presence is proven. */
-type PgOutcomeReadBackFactory = (executor: GeneratedPostconditionSession, address: LedgerAddress, catalogueIdentity: NonNullable<Awaited<ReturnType<typeof readPgCatalogueIdentity>>>['catalogueIdentity']) => Promise<LedgerPayload>;
-/**
- * A postcondition read owned by the operation itself.  Catalogue identity is
- * still retained when present for the ledger, but effect classification comes
- * from the operation's value-level observation rather than object presence.
- */
-type PgOutcomeOperationReadBackFactory = (executor: TransitionJournalQueryable, address: LedgerAddress, catalogueIdentity: NonNullable<Awaited<ReturnType<typeof readPgCatalogueIdentity>>>['catalogueIdentity'] | undefined) => Promise<{
-    readonly observed: LedgerPayload;
-    readonly effect: OutcomeRecoveryEffect;
-}>;
-interface PgOutcomeRecoveryRequest {
-    readonly address: LedgerAddress;
-    readonly reservations: readonly Pick<LedgerReservationRow, 'address'>[];
-    readonly resolutionEventId: string;
-    readonly acceptedExternalDdlExclusion: boolean;
-    /** Durable claim-bound evidence re-matched by reconcile under the run lock. */
-    readonly indeterminateEvidence?: OutcomeIndeterminateRecoveryEvidence;
-    readonly resolveIndeterminate?: boolean;
-    readonly readBack: PgOutcomeReadBackFactory;
-    readonly operationReadBack?: PgOutcomeOperationReadBackFactory;
-    readonly lockTimeoutMs?: number;
-    /** Internal-only, in-memory allowance for one harness-installed trigger. */
-    readonly ledgerShapeAllowance?: PgLedgerShapeAllowance;
-    /** Optional E2E observer for recovery's committing transaction. */
-    readonly observer?: PgOutcomeCheckpointObserver;
-}
-type PgOutcomeResolutionAppendResult = {
-    readonly kind: 'appended-outcome-resolution';
-} | {
-    readonly kind: 'already-appended-outcome-resolution';
-} | {
-    readonly kind: 'malformed-outcome-resolution';
-    readonly reason: string;
-};
-type PgOutcomeRecoveryResult = Exclude<OutcomeRecoveryClassification, {
-    readonly kind: 'outcome-recovery-append';
-}> | {
-    readonly kind: 'outcome-recovery-appended';
-    readonly classification: Extract<OutcomeRecoveryClassification, {
-        readonly kind: 'outcome-recovery-append';
-    }>;
-    readonly append: Exclude<PgOutcomeResolutionAppendResult, {
-        readonly kind: 'malformed-outcome-resolution';
-    }>;
-} | {
-    readonly kind: 'outcome-transport-ambiguous';
-    readonly reason: string;
-} | OutcomeProtocolRefusal;
-type PgOutcomeResult = {
-    readonly kind: 'executed-outcome-claim';
-    readonly claim: AdmittedOutcomeClaim;
-} | OutcomeProtocolRefusal | {
-    readonly kind: 'outcome-transport-ambiguous';
-    readonly reason: string;
-} | {
-    readonly kind: 'outcome-recovery-required';
-    readonly claimId: string;
-    readonly reason: string;
-};
-type PgPairedReaddressRecoveryDecision = {
-    readonly kind: 'refused';
-    readonly reason: string;
-} | {
-    readonly kind: 'pending';
-    readonly reason: string;
-} | {
-    readonly kind: 'indeterminate';
-    readonly reason: string;
-} | {
-    readonly kind: 'outcome-transport-ambiguous';
-    readonly reason: string;
-};
-/**
- * Recovery owns its reservation set: it re-reads every durable pair row,
- * checks currency under the same locks, and appends only under a minted paired
- * permit. A caller's selected rows are evidence to compare, never authority.
- */
-declare function recoverPgAdmittedReaddressPair(executor: TransitionJournalQueryable, request: {
-    readonly pairId: string;
-    readonly executionId: string;
-    readonly reservations: readonly LedgerReservationRow[];
-    readonly assess: (executor: TransitionJournalQueryable, reservations: readonly LedgerReservationRow[]) => Promise<PgPairedReaddressRecoveryDecision>;
-    readonly observer?: PgOutcomeCheckpointObserver;
-}): Promise<PgPairedReaddressRecoveryDecision>;
-type RuntimeIntegritySeams = {
-    readonly validateShape: typeof validatePgLedgerPhysicalShape;
-    readonly readCurrency: typeof readPgLedgerScopeCurrency;
-};
-/**
- * The façade's runtime gate: validate the physical ledger and its marker /
- * lineage currency on the same pinned execution session before it admits DDL.
- * Callers must still take the ledger locks before claiming; this check avoids a
- * preflight-only trust decision without widening the ledger DDL grammar.
- */
-declare function validatePgLedgerRuntimeIntegrity(executor: TransitionJournalQueryable, homes: readonly PgLedgerTarget[], run?: PgLockedRun, seams?: RuntimeIntegritySeams): Promise<OutcomeProtocolRefusal | undefined>;
-/**
- * Appends a resolution once, or treats an already-written equal payload as a
- * successful retry. A different child cannot be written by PostgreSQL's
- * one-child constraint and is reported as a fail-closed malformed outcome.
- */
-declare function appendPgOutcomeResolution(executor: TransitionJournalQueryable, target: PgLedgerTarget, member: Omit<LedgerChainMember, 'controller' | 'recordedAt'>, rootClaimId: string, reservations: readonly Pick<LedgerReservationRow, 'address'>[]): Promise<PgOutcomeResolutionAppendResult>;
-/**
- * Standalone PostgreSQL catalogue read-back. This intentionally does not
- * issue LOCK TABLE: callers may supply a Pool, and protocol atomicity belongs
- * to the transaction-bound recovery and observed-resolution paths.
- */
-declare function readPgOutcomeRecoveryReadBack(executor: TransitionJournalQueryable, address: LedgerAddress, readBack: PgOutcomeReadBackFactory, operationReadBack?: PgOutcomeOperationReadBackFactory, lockTimeoutMs?: number): Promise<OutcomeRecoveryReadBack>;
-/** Opens a claim on one connection when supplied a PostgreSQL pool. */
-declare function openPgOutcomeClaim(executor: TransitionJournalQueryable, request: PgOutcomeClaimRequest, run?: PgLockedRun): Promise<OutcomeClaimAdmission>;
-/**
- * Opens a root and all closure claims under globally ordered ledger locks in
- * one transaction.  No child is ever durable before its root group commits.
- */
-declare function openPgOutcomeClaimGroup(executor: TransitionJournalQueryable, request: PgOutcomeClaimGroupRequest, run?: PgLockedRun): Promise<PgOutcomeClaimGroupAdmission>;
-/** Resolves every member terminal atomically under the same ordered locks. */
-declare function resolvePgOutcomeClaimGroup(executor: TransitionJournalQueryable, request: PgOutcomeClaimGroupResolution): Promise<undefined | OutcomeProtocolRefusal>;
-/**
- * The public PostgreSQL admitted-execution boundary. It is intentionally not
- * used by legacy paths yet: later dispatches bind their persisted runs and
- * operation shapes here without changing this authority surface.
- */
-declare function executePgAdmittedOperation(session: TransitionJournalQueryable, input: {
-    readonly run: PgLockedRun;
-    readonly operation: PgAdmittedOperation;
-    readonly approval: ScopedApprovalSet;
-    /** Branded proof that the operation came from the normalized manifest. */
-    readonly manifest?: ValidatedManagedStepManifest;
-    /** Recomputed from the durable plan while the caller owns its run lock. */
-    readonly recomputedPlanDigest?: string;
-}): Promise<PgAdmittedOperationResult>;
-/**
- * Reads an address's chain and live catalogue in one locked transaction before
- * appending the core classifier's instruction. It never calls the DDL sink.
- */
-declare function recoverPgOutcomeClaim(executor: TransitionJournalQueryable, request: PgOutcomeRecoveryRequest): Promise<PgOutcomeRecoveryResult>;
-
-export { executePgAdmittedOperation as $, type PgOutcomeResult as A, type PgOutcomeTransactionalRequest as B, type ChangeKind as C, type DiffSummary as D, ExpressionCanonicalizationUnavailableError as E, type PgReinitializePreflightOptions as F, type GeneratedPostcondition as G, type PgReinitializePreflightPool as H, type SchemaChange as I, TransitionRunIdentityMismatchError as J, acquirePgLedgerLocks as K, appendIntentJournal as L, appendTransitionAuthorization as M, assertDeclarableChangeKind as N, assertGeneratedPostconditionSession as O, type PgLockedRun as P, compareSchemata as Q, createPgTransitionRunPersister as R, type SchemaDiff as S, type TransitionJournalQueryable as T, createPgsqlGeneratedManagedStep as U, decodeGeneratedPostcondition as V, decodeGeneratedPostconditionPayload as W, ensureDbspMetaLedger as X, ensurePgLedger as Y, ensurePgLedgerStorageVersion as Z, ensureTransitionJournal as _, type CompareSchemataOptions as a, generatedPostconditionDigest as a0, generatedPostconditionForChange as a1, readPgCatalogueIdentity as a2, readPgLedgerMarker as a3, readPgLedgerReservationsForExecution as a4, readPgLedgerScopeCurrency as a5, readPgOutcomeRecoveryReadBack as a6, readTransitionJournal as a7, readVerifiedPgLedgerReservationsForPair as a8, recordPgLedgerIdentity as a9, appendPgLedgerClaimGroup as aA, appendPgLedgerProgress as aB, appendPgLedgerRelease as aC, appendPgLedgerResolution as aD, appendPgLedgerResolutionGroup as aE, appendPgOutcomeResolution as aF, classifyPgLedgerPhysicalShape as aG, createPgLedgerShapeAllowance as aH, executePgDestructiveOutcome as aI, lockPgJournalRun as aJ, openPgOutcomeClaim as aK, openPgOutcomeClaimGroup as aL, readPgLedgerReservationsForPair as aM, recoverPgAdmittedReaddressPair as aN, recoverPgOutcomeClaim as aO, resolvePgDestructiveOutcome as aP, resolvePgOutcomeClaimGroup as aQ, renderCreateDbspMetaSchemaSql as aa, renderCreateLedgerEventTableSql as ab, renderCreateLedgerIdentityTableSql as ac, renderCreateLedgerImmutabilityFunctionSql as ad, renderCreateLedgerImmutabilityTriggerSql as ae, renderCreateLedgerMarkerTableSql as af, renderCreateLedgerReservationTableSql as ag, renderCreateLedgerTerminalMemberIndexSql as ah, renderCreateTransitionAuthorizationTableSql as ai, renderCreateTransitionJournalTableSql as aj, renderCreateTransitionRunPlanTableSql as ak, renderCreateTransitionRunTableSql as al, runPgReinitializePreflight as am, toGeneratedPostconditionBindingAddress as an, validatePgLedgerRuntimeIntegrity as ao, verifyGeneratedCheckPostcondition as ap, verifyGeneratedColumnPostcondition as aq, verifyGeneratedIdentityPostcondition as ar, verifyGeneratedIndexPostcondition as as, verifyGeneratedTablePostcondition as at, withGeneratedPostconditionSession as au, type PgOrderedLedgerLocks as av, type PgLedgerShapeAllowance as aw, type PgLedgerPhysicalShapeOutcome as ax, PgCommitAcknowledgementAmbiguousError as ay, appendPgLedgerClaim as az, type PgOutcomeCheckpointObserver as b, type GeneratedPostconditionBindingAddress as c, GeneratedPostconditionBindingResolutionError as d, GeneratedPostconditionProofInFlightError as e, GeneratedPostconditionReplanRequiredError as f, type GeneratedPostconditionSession as g, GeneratedPostconditionSessionDeactivatedError as h, GeneratedPostconditionWorkInFlightError as i, PG_LEDGER_SHAPE_VERSION as j, type PgAdmittedOperation as k, type PgAdmittedOperationResult as l, type PgCatalogueIdentityQueryable as m, type PgLedgerLockResult as n, type PgLedgerScopeCurrency as o, PgLedgerStorageUnsupportedError as p, type PgLedgerTarget as q, type PgOutcomeCheckpoint as r, type PgOutcomeClaimRequest as s, type PgOutcomeExecutionRequest as t, type PgOutcomeNonTransactionalRequest as u, type PgOutcomeReadBackFactory as v, type PgOutcomeRecoveryRequest as w, type PgOutcomeRecoveryResult as x, type PgOutcomeResolution as y, type PgOutcomeResolutionAppendResult as z };