@dbsp/core 3.3.0 → 4.0.0

package/dist/index.d.ts

@@ -1,6 +1,8 @@
 import * as _dbsp_types from '@dbsp/types';
-import { PseudoColumnMetadata, RecursiveMetadata, RelationIR, RelationKind, AdapterCapabilities, Adapter, BaseAdapter, DDLGeneratingAdapter, ExecutingAdapter, IntrospectingAdapter, RawSqlAdapter, StreamingAdapter, TransactionalAdapter, ColumnType, ColumnJsReadType as ColumnJsReadType$1, WhereIntent, OnDeleteAction, ModelIR, DbCasing, QueryIntent, PlanOptions, PlanReport, RecursiveIntent, RecursivePlanOptions, RecursivePlanReport, ObservationContext, TransitionSessionClient, IssuedObservation, RecoveryArtefact, FingerprintManifest, OperationSemantics, OperationKindRef, PhysicalOperation, EvidenceObservation, DurableIntentRecord, OperationEffectAssessment, ObservationIssuer, ApplyGuard, OperationExecutionOutcome, TransactionalCompletionRecord, StepJournal, TransitionRule, EquivalenceCapability, CapabilityDescriptor, TransitionCompositionFact, RuleRef, SemanticArtifactRef, CheckConstraintIR, Comparator, EnumIR, ObservationRequest, EvidenceView, AdvisoryObservationId, AssumptionId, ClaimId, EvidenceId, SemanticArtifactId, IndexIR, ResourceAddress, ResourceSelector, TransitionLessor, ApplyPolicy, ApplyResult, TransitionCandidate, TransitionFragmentComposition, PlanAssessment, CompareOutcome, TransitionQueryClient, TransitionFragment, ProofClaim, Assumption, ProvenPlanShape, ApplicableAssessment, TransitionRunJournal, InapplicableAssessment, TableIR, SequenceIR, AmbiguityCheckResult, DialectCapabilities, DDLFeature, DDLFeatureVersionRange, SelectIntent, IncludeIntent, AggregateIntent, OrderByIntent, SortDirection, InsertIntent, InsertFromIntent, UpdateIntent, BatchUpdateIntent, DeleteIntent, UpsertIntent, UpsertFromIntent, TransactionBeginOptions, Dump, SetOperationIntent, LockStrength, LockWaitPolicy, DumpMeta, JoinIntent, UnnestCteIntent, CteQueryIntent, CompileOptions, CompiledQuery, MutationIntent as MutationIntent$1, DumpSequenceStep, UpsertConflictTarget, UpsertConflictAction, RawCteIntent, TruncateOptions, VacuumOptions, AlterColumnOptions, CreateIndexOptions, DropIndexOptions, IndexInfo, TransactionOptions, PinnedConnectionOptions, ExpressionIntent, ComparisonOperator, WhereSubqueryIntent, SubqueryRefIntent, WhereAndIntent, WhereAnyIntent, WhereComparisonIntent, WhereRelationFilterIntent, RecursiveExistsOptions, WhereExistsIntent, WhereInIntent, WhereNullIntent, WhereLikeIntent, WhereNotIntent, WhereNotExistsIntent, WhereOrIntent, WhereRawExistsIntent, WhereRawNotExistsIntent, WhereExpressionIntent, AggOrderByArg, RelationType as RelationType$1, Cardinality, FeatureWarning, UnsupportedFeatureBehavior, FeatureBehaviorConfig, RangeValue, WhereRangeIntent, SubqueryIncludeInfo } from '@dbsp/types';
-export { Adapter, AdapterCapabilities, AdapterLogger, AdapterStreamOptions, AdjacencyTraversal, AggregateExpressionIntent, AggregateFunction, AggregateIntent, AggregateWindowFunction, AliasIncludedColumnsMode, AlterColumnOptions, AmbiguityCheckResult, ApplicableAssessment, ApplicableEvaluation, ApplyPolicy, ArrayOperator, Assumption, BaseAdapter, CTEDefinition, CapabilityDescriptor, Cardinality, CaseExpressionIntent, CoalesceExpressionIntent, ColumnAliasIntent, ColumnExpressionIntent, ColumnIR, ColumnJsReadType, ColumnType, CommonColumnType, Comparator, CompareOutcome, ComparisonExpressionIntent, ComparisonOperator, CompileOnlyAdapter, CompileOptions, CompileResultWithIncludes, CompiledQuery, CompilingAdapter, CreateIndexOptions, CustomTraversal, DDLGeneratingAdapter, DbCasing, DecisionType, DeleteIntent, DialectCapabilities, DialectName, DropIndexOptions, DuckDBColumnType, Dump, DumpMeta, DurableIntentRecord, EdgeTableTraversal, EmitJoinClause, ExecutingAdapter, ExpressionIntent, FilterStrategy, FingerprintManifest, ForeignKeyIR, InapplicableAssessment, IncludeIntent, IncludeStrategy, IndexColumnDef, IndexIR, IndexInfo, IndexMethod, InsertFromIntent, InsertIntent, IntrospectingAdapter, IsTypeSupported, JoinDefault, JoinIntent, LiteralExpressionIntent, LogicalIdentity, LogicalIdentityCarrier, LogicalOperator, MSSQLColumnType, ModelIR, MutationIntent, MySQLColumnType, NullOperator, NullsPosition, ObservationContext, ObservationIssuer, ObservationRequest, OffsetWindowFunction, OnDeleteAction, OperationEffectAssessment, OperationSemantics, Optionality, OrderByIntent, PartitionIR, PhysicalOperation, PlanDecision, PlanOptions, PlanReport, PlanWarning, PlanWarningCode, PostgresColumnType, PostgresOnlyColumnType, ProvenApplyGuard, ProvenGuardProtocol, ProvenPlanShape, ProvenPlanStep, PseudoColumnExpressionIntent, PseudoColumnMetadata, PseudoColumnTraversal, QueryIntent, RangeOperator, RangeValue, RankingWindowFunction, RawExpressionIntent, RawSqlAdapter, RecognitionResult, RecursiveAdvancedOptions, RecursiveDedupe, RecursiveDirection, RecursiveEmitOptions, RecursiveExistsOptions, RecursiveIntent, RecursiveMetadata, RecursiveNodeIdExpr, RecursivePlanOptions, RecursivePlanReport, RecursiveTrackOptions, RecursiveTraversal, RelationColumnIntent, RelationIR, RelationKind, RelationOperator, RelationType, RequiredEnumLabelIR, ResolvedIncludeStrategy, ResourceAddress, RuleEvaluation, RuleSupport, SQLiteColumnType, SelectAggregateIntent, SelectAllIntent, SelectFieldsIntent, SelectIntent, SelectWithExpressionsIntent, SerializedProvenPlan, SortDirection, StepJournal, StreamingAdapter, StringOperator, SubqueryIncludeInfo, SubqueryRefIntent, SupportedColumnTypes, TableIR, TransactionOptions, TransactionalAdapter, TransactionalCompletionRecord, TransitionCandidate, TransitionLessor, TransitionQueryClient, TransitionRule, TransitionRunMetadata, TransitionSessionClient, TruncateOptions, UpdateIntent, UpsertConflictAction, UpsertConflictTarget, UpsertFromIntent, UpsertIntent, VacuumOptions, WhereAndIntent, WhereAnyIntent, WhereComparisonIntent, WhereExistsIntent, WhereInIntent, WhereIntent, WhereLikeIntent, WhereNotExistsIntent, WhereNotIntent, WhereNullIntent, WhereOrIntent, WhereRangeIntent, WhereRelationFilterIntent, WhereSubqueryIntent, WindowFunction, WindowIntent, WindowOrderBy, getNodeIdAlias, isAdjacencyTraversal, isAggregateWindowFunction, isCoalesceExpression, isColumnAliasExpression, isCustomTraversal, isDeleteIntent, isEdgeTableTraversal, isInsertIntent, isMutationIntent, isRankingWindowFunction, isRawExpression, isRecursiveIntent, isRelationColumnExpression, isSelectAggregate, isSelectAll, isSelectFields, isSelectWithExpressions, isSubqueryRef, isUpdateIntent, isUpsertIntent, isWhereAnd, isWhereAny, isWhereComparison, isWhereExists, isWhereIn, isWhereLike, isWhereLogical, isWhereNot, isWhereNotExists, isWhereNull, isWhereOr, isWhereRange, isWhereRelationBased, isWhereRelationFilter, isWhereSubquery, isWindowIntent } from '@dbsp/types';
+import { PseudoColumnMetadata, RecursiveMetadata, RelationIR, RelationKind, AdapterCapabilities, Adapter, BaseAdapter, DDLGeneratingAdapter, ExecutingAdapter, IntrospectingAdapter, RawSqlAdapter, StreamingAdapter, TransactionalAdapter, ColumnType, ColumnJsReadType as ColumnJsReadType$1, WhereIntent, OnDeleteAction, TableReaddressDeclaration, ModelIR, DbCasing, QueryIntent, PlanOptions, PlanReport, RecursiveIntent, RecursivePlanOptions, RecursivePlanReport, ObservationContext, TransitionSessionClient, TransitionRunMetadata, IssuedObservation, RecoveryArtefact, ManagedStepClaimMaterial, LedgerPayload, FingerprintManifest, OperationSemantics, OperationKindRef, PhysicalOperation, EvidenceObservation, DurableIntentRecord, OperationEffectAssessment, ObservationIssuer, ApplyGuard, OperationExecutionOutcome, TransactionalCompletionRecord, StepJournal, TransitionRule, EquivalenceCapability, CapabilityDescriptor, TransitionCompositionFact, RuleRef, SemanticArtifactRef, TransitionRunJournal, ProvenPlanShape, ApplyPolicy, CheckConstraintIR, Comparator, ResourceAddress, JsonValue as JsonValue$1, DeclarationSet, EnumIR, ObservationRequest, EvidenceView, ProofObligation, ExecutionContract, ExecutionRequirement, AdvisoryObservationId, AssumptionId, ClaimId, EvidenceId, SemanticArtifactId, IndexIR, LedgerClaimKind, LedgerLifecycleGrammarColumn, LedgerHome, LedgerAddress, LedgerChainMember, LedgerStableState, LedgerOpenClaim, LedgerChainProjection, Assumption, ResourceSelector, TransitionLessor, ApplyResult, TransitionCandidate, TransitionFragmentComposition, PlanAssessment, CompareOutcome, TransitionFragment, ProofClaim, NormalizedManagedStep, ApplicableAssessment, ExclusiveTransitionTarget, DurableApplyOutcome, InapplicableAssessment, TableIR, SequenceIR, AmbiguityCheckResult, DialectCapabilities, DDLFeature, DDLFeatureVersionRange, SelectIntent, IncludeIntent, AggregateIntent, OrderByIntent, SortDirection, InsertIntent, InsertFromIntent, UpdateIntent, BatchUpdateIntent, DeleteIntent, UpsertIntent, UpsertFromIntent, TransactionBeginOptions, Dump, SetOperationIntent, LockStrength, LockWaitPolicy, DumpMeta, JoinIntent, UnnestCteIntent, CteQueryIntent, CompileOptions, CompiledQuery, MutationIntent as MutationIntent$1, DumpSequenceStep, UpsertConflictTarget, UpsertConflictAction, RawCteIntent, TruncateOptions, VacuumOptions, AlterColumnOptions, CreateIndexOptions, DropIndexOptions, IndexInfo, TransactionOptions, PinnedConnectionOptions, ExpressionIntent, ComparisonOperator, WhereSubqueryIntent, SubqueryRefIntent, WhereAndIntent, WhereAnyIntent, WhereComparisonIntent, WhereRelationFilterIntent, RecursiveExistsOptions, WhereExistsIntent, WhereInIntent, WhereNullIntent, WhereLikeIntent, WhereNotIntent, WhereNotExistsIntent, WhereOrIntent, WhereRawExistsIntent, WhereRawNotExistsIntent, WhereExpressionIntent, StandaloneWhereExpressionIntent, AggOrderByArg, PredicateOperator, RelationType as RelationType$1, Cardinality, FeatureWarning, UnsupportedFeatureBehavior, FeatureBehaviorConfig, RangeValue, WhereRangeIntent, RangeOperand, SubqueryIncludeInfo } from '@dbsp/types';
+export { Adapter, AdapterCapabilities, AdapterLogger, AdapterStreamOptions, AdjacencyTraversal, AggregateExpressionIntent, AggregateFunction, AggregateIntent, AggregateWindowFunction, AliasIncludedColumnsMode, AlterColumnOptions, AmbiguityCheckResult, ApplicableAssessment, ApplicableEvaluation, ApplyPolicy, ArrayOperator, Assumption, BaseAdapter, CTEDefinition, CapabilityDescriptor, Cardinality, CaseExpressionIntent, CoalesceExpressionIntent, ColumnAliasIntent, ColumnExpressionIntent, ColumnIR, ColumnJsReadType, ColumnType, CommonColumnType, Comparator, CompareOutcome, ComparisonExpressionIntent, ComparisonOperator, CompileOnlyAdapter, CompileOptions, CompileResultWithIncludes, CompiledQuery, CompilingAdapter, ConnectionAvailability, CreateIndexOptions, CustomTraversal, DDLGeneratingAdapter, DbCasing, DecisionType, DeleteIntent, DialectCapabilities, DialectName, DropIndexOptions, DuckDBColumnType, Dump, DumpMeta, DurableIntentRecord, EdgeTableTraversal, EmitJoinClause, ExclusiveTransitionTarget, ExecutingAdapter, ExpressionIntent, FilterStrategy, FingerprintManifest, ForeignKeyIR, InapplicableAssessment, IncludeIntent, IncludeStrategy, IndexColumnDef, IndexIR, IndexInfo, IndexMethod, InsertFromIntent, InsertIntent, IntrospectingAdapter, IsTypeSupported, JoinDefault, JoinIntent, LiteralExpressionIntent, LogicalIdentity, LogicalIdentityCarrier, LogicalOperator, MSSQLColumnType, ModelIR, MutationIntent, MySQLColumnType, NullOperator, NullsPosition, ObservationContext, ObservationIssuer, ObservationRequest, OffsetWindowFunction, OnDeleteAction, OperationEffectAssessment, OperationSemantics, Optionality, OrderByIntent, PartitionIR, PhysicalOperation, PlanDecision, PlanOptions, PlanReport, PlanWarning, PlanWarningCode, PostgresColumnType, PostgresOnlyColumnType, PredicateOperator, ProvenApplyGuard, ProvenGuardProtocol, ProvenPlanShape, ProvenPlanStep, PseudoColumnExpressionIntent, PseudoColumnMetadata, PseudoColumnTraversal, QueryIntent, RangeOperator, RangeValue, RankingWindowFunction, RawExpressionIntent, RawSqlAdapter, RecognitionResult, RecursiveAdvancedOptions, RecursiveDedupe, RecursiveDirection, RecursiveEmitOptions, RecursiveExistsOptions, RecursiveIntent, RecursiveMetadata, RecursiveNodeIdExpr, RecursivePlanOptions, RecursivePlanReport, RecursiveTrackOptions, RecursiveTraversal, RelationColumnIntent, RelationIR, RelationKind, RelationOperator, RelationType, RequiredEnumLabelIR, ResolvedIncludeStrategy, ResourceAddress, RuleEvaluation, RuleSupport, SQLiteColumnType, SelectAggregateIntent, SelectAllIntent, SelectFieldsIntent, SelectIntent, SelectWithExpressionsIntent, SerializedProvenPlan, SortDirection, StepJournal, StreamingAdapter, StringOperator, SubqueryIncludeInfo, SubqueryRefIntent, SupportedColumnTypes, TableIR, TableReaddressAddress, TableReaddressDeclaration, TransactionOptions, TransactionalAdapter, TransactionalCompletionRecord, TransitionCandidate, TransitionLessor, TransitionQueryClient, TransitionRule, TransitionRunMetadata, TransitionSessionClient, TruncateOptions, UpdateIntent, UpsertConflictAction, UpsertConflictTarget, UpsertFromIntent, UpsertIntent, VacuumOptions, WhereAndIntent, WhereAnyIntent, WhereComparisonIntent, WhereExistsIntent, WhereInIntent, WhereIntent, WhereLikeIntent, WhereNotExistsIntent, WhereNotIntent, WhereNullIntent, WhereOrIntent, WhereRangeIntent, WhereRelationFilterIntent, WhereSubqueryIntent, WindowFunction, WindowIntent, WindowOrderBy, getNodeIdAlias, isAdjacencyTraversal, isAggregateWindowFunction, isCoalesceExpression, isColumnAliasExpression, isCustomTraversal, isDeleteIntent, isEdgeTableTraversal, isInsertIntent, isMutationIntent, isRankingWindowFunction, isRawExpression, isRecursiveIntent, isRelationColumnExpression, isSelectAggregate, isSelectAll, isSelectFields, isSelectWithExpressions, isSubqueryRef, isUpdateIntent, isUpsertIntent, isWhereAnd, isWhereAny, isWhereComparison, isWhereExists, isWhereIn, isWhereLike, isWhereLogical, isWhereNot, isWhereNotExists, isWhereNull, isWhereOr, isWhereRange, isWhereRelationBased, isWhereRelationFilter, isWhereSubquery, isWindowIntent } from '@dbsp/types';
+import { D as DurablyLoadedRun, T as TransitionReadTarget } from './internal-CNjWzMNe.js';
+export { A as AdmittedDestructiveOutcomeClaim, a as TRANSITION_LESSOR_REJECTION, b as TransitionLeaseFailure, c as acquireExclusiveTransitionLease, d as acquireTransitionLease, e as acquireTransitionTargetLease, f as classifyOutcomeRecovery, g as createExclusiveTransitionTarget, h as createTransitionLessor, i as findUniqueLedgerTerminal, j as isExclusiveTransitionTarget, k as isTransitionLessor, o as outcomeClaimEventId, l as outcomeClaimId, p as planOperationSession } from './internal-CNjWzMNe.js';
 import { NqlCompilerOptions } from '@dbsp/nql';
 
 /**
@@ -51,6 +53,13 @@ declare function createRecursiveMetadata(direction: 'up' | 'down', throughRelati
  * Check if adapter supports execution.
  */
 declare function supportsExecution(adapter: BaseAdapter): adapter is ExecutingAdapter;
+/**
+ * Refuse execution for adapters that explicitly report no connection.
+ *
+ * The availability declaration is optional so existing third-party adapters
+ * continue through the established capability checks unchanged.
+ */
+declare function assertConnectionAvailable(adapter: BaseAdapter, operation: string): void;
 /**
  * Check if adapter supports streaming.
  */
@@ -480,7 +489,7 @@ type InferColumnTypes<TColumns extends Record<string, ColumnRef<string, string,
  * // { id: number; name: string; email: string }
  * ```
  */
-type InferTableRow<T> = T extends TableRef<string, infer TColumns, infer _TRelations> ? InferColumnTypes<TColumns> : never;
+type InferTableRow<T> = T extends TableRef<infer _TName, infer TColumns> ? InferColumnTypes<TColumns> : never;
 /**
  * Type guard to check if a value is a TableRef.
  *
@@ -920,6 +929,12 @@ interface SchemaTableOptions {
     }>;
     /** Composite foreign keys for this table (use ref() with columns/references) */
     foreignKeys?: RefDefinition[];
+    /** Explicit rename or schema move for this desired table. */
+    readdress?: TableReaddressDeclaration;
+    /** Explicitly bring this existing table under managed state. */
+    adopt?: true;
+    /** Request a reviewed retire-and-create replacement of this table. */
+    replace?: true;
 }
 /**
  * Per-table constraint options, keyed by table name.
@@ -933,10 +948,10 @@ interface SchemaExtras {
     extensions?: string[];
     /** Sequences to create (CREATE SEQUENCE). Key = sequence name */
     sequences?: Record<string, {
-        startWith?: number;
-        incrementBy?: number;
-        minValue?: number;
-        maxValue?: number;
+        startWith?: number | string;
+        incrementBy?: number | string;
+        minValue?: number | string;
+        maxValue?: number | string;
         cycle?: boolean;
     }>;
 }
@@ -1012,6 +1027,10 @@ interface Schema<T extends SchemaDefinition> {
     readonly definition: T;
     /** Table-level constraints supplied to schema() or reconstructed from introspection */
     readonly constraints?: SchemaConstraints;
+    /** Schema-wide objects supplied to schema(); retained for durable declarations. */
+    readonly extras?: SchemaExtras;
+    /** Planning inputs supplied to schema(); retained without changing model semantics. */
+    readonly options?: SchemaOptions;
     /** Converted ModelIR for use with ORM */
     readonly model: ModelIR;
     /** Table names */
@@ -1410,7 +1429,33 @@ interface OperationFingerprints {
 }
 interface RegisteredOperationSemantics extends OperationSemantics {
     readonly operationKind?: OperationKindRef;
+    /**
+     * Execution-contract-aware packs declare whether reviewed requirements can be
+     * derived for this operation. Contract-construction consumers may use the
+     * declaration; proving remains available to callers that do not require a
+     * contract.
+     */
+    readonly executionContractEligibility?: {
+        readonly eligible: true;
+    } | {
+        readonly eligible: false;
+        readonly detail: string;
+    };
+    /**
+     * Session settings that this operation's SQL renderer requires. Execution
+     * contract construction reads these from the resolved operation runtime, so
+     * the durable contract cannot drift from renderer prerequisites.
+     */
+    readonly rendererSessionRequirements?: readonly {
+        readonly setting: 'standard_conforming_strings';
+        readonly value: 'on';
+    }[];
     supportsOperation?(operation: PhysicalOperation): boolean;
+    /**
+     * Optional non-executable SQL view for a proven operation. Packs opt in per
+     * operation; consumers must refuse to render operations without this view.
+     */
+    renderPlanSql?(operation: PhysicalOperation, context: ObservationContext): string;
     buildFingerprints(operation: PhysicalOperation, evidence: readonly EvidenceObservation[], context: ObservationContext): OperationFingerprints;
 }
 interface OperationObservation {
@@ -1440,12 +1485,47 @@ interface GuardExecutionResult {
 }
 interface TransitionExecutionClient {
     readonly opaqueClient: TransitionSessionClient;
+    /** Mark the checked-out client unsafe to return to its pool. */
+    markClientCompromised(): void;
 }
 interface NonRollbackableExecutionTracker {
     markNonRollbackableOperationExecuted(): void;
 }
+/**
+ * Adapter boundary for a plan-carried managed statement bundle.  Core owns the
+ * immutable material and the run link; the adapter owns claim admission,
+ * token-gated SQL, and the INV-07 transaction composition.
+ */
+interface ManagedOutcomeExecutionRequest {
+    readonly claim: ManagedStepClaimMaterial;
+    readonly run: TransitionRunMetadata;
+    /** Core-minted proof that this run crossed a verified execution boundary. */
+    readonly durablyLoadedRun: DurablyLoadedRun;
+    /** Minted once by apply(), never reused when a recorded run is applied again. */
+    readonly executionId: string;
+    readonly transactional: boolean;
+    readonly lockTimeoutMs: number;
+    /** The operation's own live postcondition observation, never a generic identity probe. */
+    readBack(): Promise<LedgerPayload>;
+}
+/** The plan and session facts an adapter may inspect before the step intent. */
+type ManagedOutcomePreflightRequest = Pick<ManagedOutcomeExecutionRequest, 'claim' | 'run' | 'transactional' | 'lockTimeoutMs'>;
 interface ExecutionCoordinator {
     readonly transactionDomain: string;
+    /**
+     * When supplied, core calls this after `begin` and before application locks
+     * for transactional segments. It may reserve the durable run journal on the
+     * same session so later intent writes keep journal-then-application lock
+     * order. Generic runtimes without an operation/journal reservation protocol
+     * leave this absent; in particular a non-transactional segment cannot retain
+     * a transaction-scoped journal row lock across application locking.
+     *
+     * Before an intent exists, core can invoke `begin`, `setLockTimeout`, this
+     * optional reservation, `rollback`, and `isLockTimeout`. They must
+     * not perform operation DDL or any external effect. `executeOperation` is
+     * the first callback allowed to do so.
+     */
+    reserveJournalRun?(client: TransitionExecutionClient, run: TransitionRunMetadata): Promise<void>;
     begin(client: TransitionExecutionClient): Promise<void>;
     setLockTimeout(client: TransitionExecutionClient, maxWaitMs: number): Promise<void>;
     commit(client: TransitionExecutionClient): Promise<void>;
@@ -1457,6 +1537,19 @@ interface TransactionCoordinatorBinding {
     readonly transactionDomain: string;
 }
 interface OperationRuntime extends RegisteredOperationSemantics {
+    /**
+     * Before `writeIntentJournal`, core can invoke `effectsOf`, `begin`,
+     * `setLockTimeout`, optional `reserveJournalRun`, `acquireLocks`,
+     * `observeContext`,
+     * `observeOperation`, `buildFingerprints`, `rollback`, and `isLockTimeout`.
+     * All must perform no operation DDL or external effect. The only
+     * pre-intent diagnostic exception is `writeObservedJournal` after a
+     * fingerprint-construction failure: it may append that immutable failure
+     * event, but may not perform operation DDL or an external effect. This lets a
+     * refusal before the intent leave the run pristine; `executeOperation` is the
+     * first callback allowed to perform the operation's DDL or external effect.
+     */
+    reserveJournalRun?(client: TransitionExecutionClient, run: TransitionRunMetadata): Promise<void>;
     writeIntentJournal(client: TransitionExecutionClient, record: DurableIntentRecord): Promise<void>;
     begin(client: TransitionExecutionClient): Promise<void>;
     setLockTimeout(client: TransitionExecutionClient, maxWaitMs: number): Promise<void>;
@@ -1465,6 +1558,17 @@ interface OperationRuntime extends RegisteredOperationSemantics {
     observeOperation(client: TransitionExecutionClient, operation: PhysicalOperation, context: ObservationContext, phase: 'before' | 'after', issuer: ObservationIssuer): Promise<OperationObservation>;
     checkGuard(client: TransitionExecutionClient, operation: PhysicalOperation, guard: ApplyGuard, context: ObservationContext): Promise<GuardExecutionResult>;
     executeOperation(client: TransitionExecutionClient, operation: PhysicalOperation, context: ObservationContext, duringGuards?: readonly ApplyGuard[], executionTracker?: NonRollbackableExecutionTracker): Promise<OperationExecutionOutcome>;
+    /**
+     * Required when a plan step carries managed claim material.  The applier
+     * never falls back to `executeOperation` for such a step.
+     */
+    executeManagedOutcome?(client: TransitionExecutionClient, request: ManagedOutcomeExecutionRequest): Promise<OperationExecutionOutcome>;
+    /**
+     * Refuses a managed outcome before its durable step intent is recorded.
+     * This boundary is for adapter-owned prerequisites such as an incompatible
+     * ledger marker; it must not execute DDL or append ledger members.
+     */
+    preflightManagedOutcome?(client: TransitionExecutionClient, request: ManagedOutcomePreflightRequest): Promise<string | undefined>;
     writeCompletionJournal(client: TransitionExecutionClient, operation: PhysicalOperation, record: TransactionalCompletionRecord): Promise<void>;
     commit(client: TransitionExecutionClient): Promise<void>;
     rollback(client: TransitionExecutionClient): Promise<void>;
@@ -1530,7 +1634,47 @@ declare class PackRegistry {
 }
 declare function createPackRegistry(packs: readonly TransitionPack[]): PackRegistry;
 
-declare function createApplier(registry: PackRegistry): Applier;
+interface ResumeTransitionInput {
+    readonly journal: VerifiedRecoveryJournal;
+    readonly readContext: (target: TransitionReadTarget, run: TransitionRunJournal['run']) => Promise<ObservationContext>;
+    readonly policy?: ApplyPolicy;
+    readonly target: TransitionReadTarget;
+    readonly admitRecovery?: TransitionRecoveryAdmission;
+}
+/**
+ * A frozen journal whose run identity, durable digest, external review digest,
+ * and plan structure were verified together. The WeakSet is the runtime brand:
+ * callers may cast a lookalike, but recovery will not accept it.
+ */
+type VerifiedRecoveryJournal = TransitionRunJournal & {
+    readonly plan: ProvenPlanShape;
+};
+type RecoveryJournalLoadResult = {
+    readonly ok: true;
+    readonly journal: VerifiedRecoveryJournal;
+} | {
+    readonly ok: false;
+    readonly code: 'load-failed' | 'run-id-mismatch' | 'plan-digest-mismatch' | 'plan-invalid' | 'event-invalid';
+    readonly detail: string;
+};
+/** Load exactly once, snapshot and freeze the complete durable evidence set. */
+declare function loadVerifiedRecoveryJournal(runId: string, expectedPlanDigest: string, loadCurrent: (runId: string) => Promise<TransitionRunJournal & {
+    readonly plan: ProvenPlanShape;
+}>): Promise<RecoveryJournalLoadResult>;
+
+declare function createApplier(registry: PackRegistry, persister: TransitionRunPersister): Applier;
+
+/** Raised when a value cannot cross the durable JSON payload boundary. */
+declare class CanonicalJsonError extends TypeError {
+    constructor(path: string, detail: string, options?: ErrorOptions);
+}
+/**
+ * Encodes a JSON value with lexically sorted object keys and preserved array
+ * order. Unlike JSON.stringify, this refuses values it would omit or coerce.
+ */
+declare function canonicalJson(value: unknown): string;
+/** Hashes the canonical durable representation of a JSON payload. */
+declare function canonicalJsonDigest(value: unknown): string;
 
 type CheckSetEntry = Pick<CheckConstraintIR, 'name' | 'expression' | 'notValid'>;
 type CheckDelta = {
@@ -1553,6 +1697,45 @@ declare function checkDelta(desiredChecks: readonly CheckConstraintIR[] | undefi
 
 declare function createComparator(registry: PackRegistry): Comparator;
 
+declare function observationContextDigest(context: ObservationContext): string;
+
+interface DeclarationAddressContext {
+    readonly engine: string;
+    readonly database: string;
+    readonly schema: string;
+}
+/**
+ * The declaration layer deliberately depends on this small structural naming
+ * boundary rather than an adapter package. Callers pass the same strategy that
+ * comparison and proof use for the target database.
+ */
+interface DeclarationNamingStrategy {
+    toDatabase(identifier: string): string;
+}
+/**
+ * Reject every JavaScript value whose JSON representation is lossy or
+ * host-dependent. JSON.stringify alone is unsuitable because it silently drops
+ * functions and undefined object members, exactly the ColumnDef.default case.
+ */
+declare function assertCanonicalizableJson(value: unknown, path?: string, seen?: WeakSet<object>): asserts value is JsonValue$1;
+/**
+ * Slice only the declarable part of ModelIR. Deliberately absent are
+ * logicalIdentity, pseudoColumns, comment, partition, rlsEnabled and policies;
+ * their omission is encoded here once, rather than re-checked at every caller.
+ */
+declare function declarationSetFromModel(model: ModelIR, context: DeclarationAddressContext, naming?: DeclarationNamingStrategy): DeclarationSet;
+/** Validate the complete declarable surface before comparison can short-circuit plan time. */
+declare function validateDeclarationModel(model: ModelIR): void;
+/** Compare only the recorded/live identity and retain the precise mismatch reason. */
+declare function admitRecordedIdentity(recorded: ResourceAddress, live: ResourceAddress): {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly detail: string;
+};
+/** Attach the canonical declaration artifact before metadata/digest minting. */
+declare function bindDeclarationSet(plan: InProcessProvenPlan, declarations: DeclarationSet): InProcessProvenPlan;
+
 type EnumAddDelta = {
     readonly kind: 'none';
 } | {
@@ -1574,6 +1757,31 @@ declare function createEvidenceView(params: {
     readonly requests?: readonly ObservationRequest[];
 }): EvidenceView;
 
+type EvidenceConclusion = 'established' | 'undischarged' | 'refuted' | 'conflicted';
+type EvidenceEntailmentResult = {
+    readonly conclusion: EvidenceConclusion;
+    readonly supportedBy: readonly EvidenceObservation[];
+};
+declare function concludeEvidenceForObligation(params: {
+    readonly obligation: ProofObligation;
+    readonly evidence: readonly EvidenceObservation[];
+    readonly expectedContext?: ObservationContext;
+}): EvidenceEntailmentResult;
+
+type ExecutionContractValidation = {
+    readonly ok: true;
+    readonly contract: ExecutionContract;
+} | {
+    readonly ok: false;
+    readonly detail: string;
+};
+/** Construct a fresh versioned contract whose requirements are canonical. */
+declare function createExecutionContract(requirements: readonly ExecutionRequirement[]): ExecutionContract;
+/** Fail closed for malformed, future, or non-canonical persisted contracts. */
+declare function validateExecutionContract(value: unknown): ExecutionContractValidation;
+/** Attach a planning-time-only contract to a fresh immutable durable plan. */
+declare function bindExecutionContract(plan: InProcessProvenPlan, contract: ExecutionContract): InProcessProvenPlan;
+
 declare function semanticArtifactId(value: string): SemanticArtifactId;
 declare function assumptionId(value: string): AssumptionId;
 declare function claimId(value: string): ClaimId;
@@ -1609,11 +1817,59 @@ type IndexPerspective = 'desired' | 'current';
 declare function normalizedIndex(tableName: string, index: IndexIR, perspective?: IndexPerspective): IndexSetEntry;
 declare function indexDelta(tableName: string, desiredIndexes: readonly IndexIR[], currentIndexes: readonly IndexIR[]): IndexDelta;
 
+/** Bump whenever the malformed-chain vocabulary or interpretation changes. */
+declare const LEDGER_PROJECTION_CODE_VERSION: 1;
+/**
+ * The one closed grammar matrix. Later claim and token producers consume this
+ * interpreter; they do not reconstruct lifecycle state from ledger spellings.
+ */
+declare const LEDGER_LIFECYCLE_GRAMMAR: Readonly<Record<LedgerClaimKind, LedgerLifecycleGrammarColumn>>;
+interface LifecycleFrame {
+    readonly stableState: LedgerStableState;
+    readonly openClaim?: LedgerOpenClaim;
+}
+type LifecycleStep = {
+    readonly kind: 'ok';
+    readonly frame: LifecycleFrame;
+} | {
+    readonly kind: 'invalid';
+    readonly detail: string;
+};
+interface LedgerChainProjectionInput {
+    readonly ledger: LedgerHome;
+    readonly address: LedgerAddress;
+    readonly events: readonly LedgerChainMember[];
+}
+/** Interprets exactly one terminal-to-next lifecycle edge. */
+declare function interpretLedgerLifecycle(frame: LifecycleFrame, event: LedgerChainMember): LifecycleStep;
+/**
+ * Projects a whole address chain without using insertion order. Malformed
+ * chains deliberately return a structured value so mutation callers fail
+ * closed while readers retain the evidence needed to diagnose it.
+ */
+declare function projectLedgerChain(input: LedgerChainProjectionInput): LedgerChainProjection;
+
+/**
+ * Canonical digest used to bind a durable transition run to its proven plan.
+ */
+declare function transitionPlanDigest(plan: ProvenPlanShape): string;
+
 declare function createProver(registry: PackRegistry): Prover;
 
 declare function resourceIsWithin(resource: ResourceAddress, parent: ResourceAddress): boolean;
 declare function selectorMatchesResource(selector: ResourceSelector, resource: ResourceAddress): boolean;
 declare function resourceScopeCovers(scope: readonly ResourceAddress[], required: readonly ResourceAddress[]): boolean;
+declare function assumptionAccepted(assumption: Assumption, policy: ApplyPolicy): boolean;
+
+/**
+ * Mint metadata for a proven transition before making it durable.
+ *
+ * The target digest is deliberately derived from the plan's evidence, not a
+ * caller-supplied snapshot.  That is the exact context resume verifies.
+ */
+declare function createTransitionRunMetadata(plan: InProcessProvenPlan): TransitionRunMetadata;
+/** Label a generator removal before persistence; it can never become replayable. */
+declare function markGeneratorRemovalNonReplayable(run: TransitionRunMetadata): TransitionRunMetadata;
 
 interface StagedTransitionInput {
     readonly desired: ModelIR;
@@ -1626,7 +1882,7 @@ interface StagedTransitionInput {
 interface StagedTransitionOrchestrator {
     applyStagedTransition(input: StagedTransitionInput): Promise<ApplyResult>;
 }
-declare function createStagedTransitionOrchestrator(registry: PackRegistry): StagedTransitionOrchestrator;
+declare function createStagedTransitionOrchestrator(registry: PackRegistry, persister: TransitionRunPersister): StagedTransitionOrchestrator;
 
 type TransitionCompare = Extract<CompareOutcome, {
     readonly kind: 'transitions';
@@ -1657,48 +1913,6 @@ declare function chooseReadyCandidate(preflight: Extract<StagedCompositionPrefli
 }>): StagedCompositionCandidate;
 declare function projectCompareToSingleCandidate(compare: TransitionCompare, entry: StagedCompositionCandidate): TransitionCompare;
 
-declare const TRANSITION_LESSOR_REJECTION = "transition target must be a core-minted lessor";
-/** A core-owned lease: packs receive its session, while core retains release. */
-type TransitionLease = {
-    readonly session: TransitionSessionClient;
-    readonly release: (failure?: TransitionLeaseFailure) => Promise<void>;
-};
-/**
- * Cross the engine's acquisition boundary.
- *
- * A lessor brand is a declaration, not a security boundary, so every
- * acquisition is checked here even when a caller forged that declaration.
- */
-declare function acquireTransitionLease(target: TransitionLessor): Promise<TransitionLease>;
-/**
- * Mint a declared source of transition leases.
- *
- * This declares a source of leases; it does not inspect individual
- * acquisitions. Every acquisition crosses `acquireTransitionLease`, the
- * runtime boundary that validates and captures it exactly once.
- *
- * The wrapper is allocated and frozen by core. Its non-writable,
- * non-configurable `Symbol.for('dbsp.transition.lessor')` brand carries this
- * protocol version, so independently installed incompatible core versions do
- * not accept one another's lessors. The global symbol is intentionally not a
- * security boundary: code already running in this realm can forge it. This
- * protects callers from passing the wrong connection object by accident.
- */
-declare function createTransitionLessor(acquire: () => Promise<TransitionQueryClient>): TransitionLessor;
-/**
- * Recognize a core-minted transition lessor. The shape check only rejects a
- * contradictory declaration (a branded object without acquire()); the brand
- * and protocol version are the declaration.
- */
-declare function isTransitionLessor(value: unknown): value is TransitionLessor;
-/**
- * Carries the error that ended a lease's use. Its presence — not the value it
- * holds — is what says the lease is being returned after a failure.
- */
-type TransitionLeaseFailure = {
-    readonly error: unknown;
-};
-
 type TransitionRelationalValidationInput = {
     readonly kind: 'fragment';
     readonly fragment: TransitionFragment;
@@ -1715,6 +1929,25 @@ type TransitionRelationalValidationResult = {
     readonly ok: false;
     readonly detail: string;
 };
+declare const validatedManagedStepManifestBrand: unique symbol;
+/** A manifest normalized and accepted by the managed lifecycle boundary. */
+interface ValidatedManagedStepManifest {
+    readonly steps: readonly NormalizedManagedStep[];
+    readonly [validatedManagedStepManifestBrand]: 'dbsp-validated-managed-step-manifest';
+}
+type ValidatedManagedStepManifestResult = {
+    readonly ok: true;
+    readonly manifest: ValidatedManagedStepManifest;
+} | {
+    readonly ok: false;
+    readonly detail: string;
+};
+/**
+ * Generic lifecycle invariants for adapter-produced normalized managed steps.
+ * Mapping a concrete DDL kind remains adapter work; core only validates the
+ * durable protocol shape before it becomes digest-covered plan material.
+ */
+declare function validateNormalizedManagedStepManifest(steps: readonly NormalizedManagedStep[]): ValidatedManagedStepManifestResult;
 /**
  * Diagnostic consistency check for transition fragments and already-trusted,
  * in-process plans. For plan inputs this is not an untrusted serialized-plan
@@ -1726,6 +1959,14 @@ declare function validateTransitionRelationalInvariants(input: TransitionRelatio
 type InProcessProvenPlan = ProvenPlanShape & {
     readonly __inProcessProvenPlan: unique symbol;
 };
+/**
+ * Makes a transition run and its proven plan durable before execution begins.
+ * Implementations must persist both rows atomically and accept retries only
+ * when the metadata and plan are identical.
+ */
+type TransitionRunPersister = {
+    persist(run: TransitionRunMetadata, plan: ProvenPlanShape): Promise<void>;
+};
 type EstablishedProofClaim = ProofClaim & {
     readonly assumes: readonly [];
     readonly derivedBy: {
@@ -1758,12 +1999,65 @@ interface Applier {
         readonly plan: InProcessProvenPlan;
         readonly assessment: ApplicableAssessment;
     }, policy: ApplyPolicy, target: TransitionLessor): Promise<ApplyResult>;
-    resume(runId: string, loadCurrent: TransitionResumeJournalLoader, readContext: TransitionResumeContextReader, policy: ApplyPolicy, target: TransitionLessor): Promise<ApplyResult>;
+    applyDurable(input: DurableApplyInput): Promise<DurableApplyResult>;
+    resume(journal: VerifiedRecoveryJournal, readContext: ResumeTransitionInput['readContext'], policy: ApplyPolicy | undefined, target: TransitionReadTarget, admitRecovery?: TransitionRecoveryAdmission): Promise<ApplyResult>;
 }
+/** Durable-run entry point; it snapshots and verifies serialized evidence. */
+interface DurableApplyInput {
+    readonly runId: string;
+    /**
+     * Content hash the operator reviewed outside the target database. Durable
+     * apply refuses unless it is the hash of the loaded plan itself.
+     */
+    readonly expectedPlanDigest: string;
+    readonly loadCurrent: TransitionResumeJournalLoader;
+    readonly policy: ApplyPolicy;
+    readonly target: ExclusiveTransitionTarget;
+    /** Runs on the held execution lease before authorization, a transaction, intent, or DDL. */
+    readonly prepareExecutionSession: (target: TransitionSessionClient, contract: ExecutionContract, plan: ProvenPlanShape) => Promise<{
+        readonly ok: true;
+        readonly context: ObservationContext;
+    } | {
+        readonly ok: false;
+        /** Omitted by legacy adapters; treated as a contract refusal. */
+        readonly kind?: 'refused' | 'failed' | 'read-only';
+        readonly detail: string;
+    }>;
+    /** Called on that same preflight lease, after admission and before any step attempt. */
+    readonly authorize: (run: TransitionRunJournal['run'], plan: ProvenPlanShape, target: TransitionSessionClient) => Promise<void>;
+}
+type DurableApplyResult = (ApplyResult & {
+    readonly unresolvedOutcome: {
+        readonly kind: 'recovery-required';
+        readonly claimId: string;
+        readonly detail: string;
+    };
+    readonly durableOutcome: 'recovery-required';
+}) | (ApplyResult & {
+    readonly unresolvedOutcome: {
+        readonly kind: 'transport-ambiguous';
+        readonly detail: string;
+    };
+    readonly durableOutcome: 'transport-ambiguous';
+}) | (Omit<ApplyResult, 'unresolvedOutcome' | 'durableOutcome'> & {
+    readonly unresolvedOutcome?: never;
+    readonly durableOutcome: Exclude<DurableApplyOutcome, 'recovery-required' | 'transport-ambiguous'>;
+});
 type TransitionResumeJournalLoader = (runId: string) => Promise<TransitionRunJournal & {
     readonly plan: ProvenPlanShape;
 }>;
-type TransitionResumeContextReader = (target: TransitionLessor, run: TransitionRunJournal['run']) => Promise<ObservationContext>;
+/**
+ * Recovery admission identifies the physical PostgreSQL target before any
+ * classification journal can be written. It deliberately does not re-check
+ * apply authority or the historic observation-context digest.
+ */
+type TransitionRecoveryAdmission = (target: TransitionReadTarget, contract: ExecutionContract) => Promise<{
+    readonly ok: true;
+    readonly context: ObservationContext;
+} | {
+    readonly ok: false;
+    readonly detail: string;
+}>;
 
 /**
  * @module model-impl
@@ -2330,7 +2624,7 @@ declare class IntentBuilder<TResult = unknown> {
  */
 
 /** Query execution result types for afterQuery generics */
-type QueryResultType = 'all' | 'first' | 'count' | 'exists' | 'aggregate';
+type QueryResultType = 'all' | 'first' | 'exists';
 /**
  * Context passed to query hooks (beforeQuery/afterQuery).
  * Frozen via Object.freeze — hooks must return new objects to modify.
@@ -2389,11 +2683,16 @@ type ErrorHookContext = {
 };
 /** Hook invoked before query execution. Can modify intent via return. */
 type BeforeQueryHook = (ctx: QueryHookContext) => QueryHookContext | Promise<QueryHookContext> | undefined;
-/** Hook invoked after query execution. Can transform results via return. */
+/** Observer invoked after query execution. Its return value is ignored. */
+type AfterQueryObserver = (ctx: QueryHookContext, result: unknown) => void | Promise<void>;
+/** Hook invoked after query execution. Can transform results without changing their shape. */
 type AfterQueryHook = <R>(ctx: QueryHookContext, result: R) => R | Promise<R> | undefined;
 /** Hook invoked before mutation execution. Can modify context via return. */
 type BeforeMutationHook = <T>(ctx: MutationHookContext<T>) => MutationHookContext<T> | Promise<MutationHookContext<T>> | undefined;
-/** Hook invoked after mutation execution. Can transform RETURNING results. */
+/** Observer invoked after mutation execution. Its return value is ignored. */
+type AfterMutationObserver = (ctx: MutationHookContext, result: unknown) => void | Promise<void>;
+type ObserverRegistration<T extends (...args: never[]) => unknown, TObserver extends (...args: never[]) => unknown> = ReturnType<T> extends ReturnType<TObserver> ? unknown : never;
+/** Hook invoked after mutation execution. Can transform RETURNING results without changing their shape. */
 type AfterMutationHook = <T>(ctx: MutationHookContext<T>, result: T[]) => T[] | Promise<T[]> | undefined;
 /** Hook invoked on query/mutation errors. Can transform the error. */
 type OnErrorHook = (ctx: ErrorHookContext) => undefined | Error | Promise<undefined | Error>;
@@ -2402,11 +2701,21 @@ type OnErrorHook = (ctx: ErrorHookContext) => undefined | Error | Promise<undefi
  * Returns 'continue' to skip failed hook, 'abort' to propagate error.
  */
 type HookErrorHandler = (error: Error, hookName: string, ctx: QueryHookContext | MutationHookContext, phase: string) => 'continue' | 'abort';
+/**
+ * Diagnostic sink for observer failures and snapshot skips.
+ *
+ * Unlike {@link HookErrorHandler}, this handler has no control-flow return:
+ * observer diagnostics always go to a void sink and can never abort work that
+ * has already executed.
+ */
+type ObserverErrorHandler = (error: Error, observerName: string, phase: 'afterQuery' | 'afterMutation') => void | Promise<void>;
 /** Immutable builder interface for registering hooks */
 interface HookManager {
     beforeQuery(hook: BeforeQueryHook): HookManager;
+    observeAfterQuery<T extends AfterQueryObserver>(observer: T & ObserverRegistration<T, AfterQueryObserver>): HookManager;
     afterQuery(hook: AfterQueryHook): HookManager;
     beforeMutation(hook: BeforeMutationHook): HookManager;
+    observeAfterMutation<T extends AfterMutationObserver>(observer: T & ObserverRegistration<T, AfterMutationObserver>): HookManager;
     afterMutation(hook: AfterMutationHook): HookManager;
     onError(hook: OnErrorHook): HookManager;
     freeze(): HookManager;
@@ -2414,8 +2723,10 @@ interface HookManager {
 /** @internal Hook storage — exposed for runner access */
 type HookStore = {
     readonly beforeQuery: readonly BeforeQueryHook[];
+    readonly afterQueryObservers: readonly AfterQueryObserver[];
     readonly afterQuery: readonly AfterQueryHook[];
     readonly beforeMutation: readonly BeforeMutationHook[];
+    readonly afterMutationObservers: readonly AfterMutationObserver[];
     readonly afterMutation: readonly AfterMutationHook[];
     readonly onError: readonly OnErrorHook[];
     readonly frozen: boolean;
@@ -2447,6 +2758,7 @@ interface QueryBuilderContext {
     readonly defaultFilters?: DefaultFilters | undefined;
     readonly hookStore?: HookStore | undefined;
     readonly onHookError?: HookErrorHandler | undefined;
+    readonly onObserverError?: ObserverErrorHandler | undefined;
     readonly inTransaction?: boolean | undefined;
 }
 
@@ -3052,7 +3364,7 @@ interface QueryBuilder<TResult = unknown> {
      * orm.select('users').where({ active: true, role: 'admin' })
      * ```
      */
-    where(condition: WhereIntent | WhereFilter<TResult>): QueryBuilder<TResult>;
+    where(condition: WhereIntent | PredicateRef | WhereFilter<TResult>): QueryBuilder<TResult>;
     /**
      * Add an explicit SQL JOIN clause to the query (non-hydrating, flat result).
      *
@@ -3594,7 +3906,7 @@ declare class QueryBuilderImpl<TResult = unknown> implements QueryBuilder<TResul
     }): QueryBuilder<TResult>;
     limit(count: number): QueryBuilder<TResult>;
     offset(count: number): QueryBuilder<TResult>;
-    where(condition: WhereIntent | WhereFilter<TResult>): QueryBuilder<TResult>;
+    where(condition: WhereIntent | PredicateRef | WhereFilter<TResult>): QueryBuilder<TResult>;
     join(relationOrTableOrBatch: string | BatchValuesRef, opts?: {
         type?: 'inner' | 'left';
         on?: WhereIntent;
@@ -3833,6 +4145,39 @@ declare class CteQueryBuilder<TResult = unknown> {
  * Part of DX-010: Mutations.
  */
 
+/**
+ * A row shape accepted by INSERT and UPSERT values().
+ *
+ * The public ORM type carries row types, but not the per-column default or
+ * serial metadata needed to make only generated columns optional. Until that
+ * schema metadata is threaded through the mutation builders (#449), every row
+ * column is optional here. Keys and value types remain constrained to the row
+ * type; the database enforces required columns.
+ */
+type Insertable<T> = T extends object ? Partial<T> : Record<string, unknown>;
+/** A partial row shape accepted by UPDATE and UPSERT update operations. */
+type Updateable<T> = T extends object ? {
+    [K in keyof T]?: T[K] | SqlRawExpression;
+} : Record<string, unknown>;
+/** A scalar-only partial row shape accepted by batchSet(). */
+type BatchUpdateable<T> = T extends object ? Partial<T> : Record<string, unknown>;
+/**
+ * Reject keys outside a mutation payload's row shape, including when callers
+ * pass an object through a variable rather than an object literal.
+ */
+type ExactMutationPayload<TInput, TShape> = TInput & Record<Exclude<keyof TInput, keyof TShape>, never>;
+type ExactMutationRows<TInput extends readonly unknown[], TShape> = TInput & {
+    readonly [K in keyof TInput]: ExactMutationPayload<TInput[K], TShape>;
+};
+/**
+ * Column names accepted by a mutation on a row shape.
+ *
+ * The tuple prevents conditional-type distribution: a mutation whose table is
+ * a union may only name columns shared by every possible target table.
+ */
+type MutationKey<T> = [T] extends [object] ? Extract<keyof T, string> : string;
+type MutationReturningRow<T, K extends MutationKey<T>> = T extends object ? Pick<T, Extract<K, keyof T>> : Record<string, unknown>;
+type MutationWhereCondition = WhereIntent | PredicateRef;
 /**
  * Dump output for mutations.
  * Similar to query Dump but without plan (mutations don't use the planner).
@@ -3857,6 +4202,7 @@ type MutationBaseOpts = {
     schemaName?: string | undefined;
     hookStore?: HookStore | undefined;
     onHookError?: HookErrorHandler | undefined;
+    onObserverError?: ObserverErrorHandler | undefined;
     inTransaction?: boolean | undefined;
 };
 /**
@@ -3876,6 +4222,7 @@ declare abstract class MutationBuilderBase<T, TIntent extends InsertIntent | Upd
     protected readonly returningColumns: readonly string[] | undefined;
     protected readonly hookStore: HookStore | undefined;
     protected readonly onHookError: HookErrorHandler | undefined;
+    protected readonly onObserverError: ObserverErrorHandler | undefined;
     protected readonly inTransaction: boolean | undefined;
     protected constructor(opts: MutationBaseOpts & {
         returning?: readonly string[] | undefined;
@@ -3898,7 +4245,7 @@ declare abstract class MutationBuilderBase<T, TIntent extends InsertIntent | Upd
  * Builder for INSERT operations.
  * Immutable - each method returns a new builder instance.
  */
-declare class InsertBuilder<T = void> extends MutationBuilderBase<T, InsertIntent> {
+declare class InsertBuilder<TRow = unknown, TResult = void> extends MutationBuilderBase<TResult, InsertIntent> {
     private readonly valuesData;
     protected readonly operationName = "insert";
     constructor(opts: MutationBaseOpts & {
@@ -3909,7 +4256,7 @@ declare class InsertBuilder<T = void> extends MutationBuilderBase<T, InsertInten
      * Set values to insert.
      * Accepts a single object or an array for bulk insert.
      */
-    values(data: Record<string, unknown> | readonly Record<string, unknown>[]): InsertBuilder<T>;
+    values<TInput extends Insertable<TRow> | readonly Insertable<TRow>[]>(data: TInput & (TInput extends readonly Insertable<TRow>[] ? ExactMutationRows<TInput, Insertable<TRow>> : ExactMutationPayload<TInput, Insertable<TRow>>)): InsertBuilder<TRow, TResult>;
     /**
      * Specify columns to return after insert (DX-026).
      * Requires adapter support for RETURNING clause.
@@ -3923,7 +4270,7 @@ declare class InsertBuilder<T = void> extends MutationBuilderBase<T, InsertInten
      * // inserted = [{ id: 1, created_at: '2024-01-01T00:00:00Z' }]
      * ```
      */
-    returning<R = Record<string, unknown>>(columns: readonly (keyof R & string)[]): InsertBuilder<R[]>;
+    returning<K extends MutationKey<TRow>>(columns: readonly K[]): InsertBuilder<TRow, MutationReturningRow<TRow, K>[]>;
     protected buildIntent(): InsertIntent;
     protected compileIntent(adapter: Adapter, intent: InsertIntent, options?: CompileOptions): CompiledQuery;
 }
@@ -3931,7 +4278,7 @@ declare class InsertBuilder<T = void> extends MutationBuilderBase<T, InsertInten
  * Builder for UPDATE operations.
  * Immutable - each method returns a new builder instance.
  */
-declare class UpdateBuilder<T = void> extends MutationBuilderBase<T, UpdateIntent | BatchUpdateIntent> {
+declare class UpdateBuilder<TRow = unknown, TResult = void> extends MutationBuilderBase<TResult, UpdateIntent | BatchUpdateIntent> {
     private readonly setData;
     private readonly whereIntent;
     private readonly allowAllFlag;
@@ -3951,11 +4298,11 @@ declare class UpdateBuilder<T = void> extends MutationBuilderBase<T, UpdateInten
      * Multiple calls merge fields (last value wins).
      * When combined with batchSet(), these become scalar SET assignments applied to all rows.
      */
-    set(data: Record<string, unknown>): UpdateBuilder<T>;
+    set<TInput extends Updateable<TRow>>(data: ExactMutationPayload<TInput, Updateable<TRow>>): UpdateBuilder<TRow, TResult>;
     /**
      * Add WHERE condition.
      */
-    where(condition: WhereIntent): UpdateBuilder<T>;
+    where(condition: MutationWhereCondition): UpdateBuilder<TRow, TResult>;
     /**
      * Specify columns to return after update (DX-026).
      * Requires adapter support for RETURNING clause.
@@ -3969,7 +4316,7 @@ declare class UpdateBuilder<T = void> extends MutationBuilderBase<T, UpdateInten
      *   .execute();
      * ```
      */
-    returning<R = Record<string, unknown>>(columns: readonly (keyof R & string)[]): UpdateBuilder<R[]>;
+    returning<K extends MutationKey<TRow>>(columns: readonly K[]): UpdateBuilder<TRow, MutationReturningRow<TRow, K>[]>;
     /**
      * Batch update multiple rows using unnest FROM strategy (BATCH-001).
      *
@@ -3990,7 +4337,7 @@ declare class UpdateBuilder<T = void> extends MutationBuilderBase<T, UpdateInten
      *   .execute();
      * ```
      */
-    batchSet(matchColumn: string | string[], data: Record<string, unknown>[]): UpdateBuilder<T>;
+    batchSet<TInput extends BatchUpdateable<TRow>>(matchColumn: MutationKey<TRow> | MutationKey<TRow>[], data: readonly ExactMutationPayload<TInput, BatchUpdateable<TRow>>[]): UpdateBuilder<TRow, TResult>;
     protected buildIntent(): UpdateIntent | BatchUpdateIntent;
     protected compileIntent(adapter: Adapter, intent: UpdateIntent | BatchUpdateIntent, options?: CompileOptions): CompiledQuery;
 }
@@ -3998,7 +4345,7 @@ declare class UpdateBuilder<T = void> extends MutationBuilderBase<T, UpdateInten
  * Builder for DELETE operations.
  * Immutable - each method returns a new builder instance.
  */
-declare class DeleteBuilder<T = void> extends MutationBuilderBase<T, DeleteIntent> {
+declare class DeleteBuilder<TRow = unknown, TResult = void> extends MutationBuilderBase<TResult, DeleteIntent> {
     private readonly whereIntent;
     private readonly allowAllFlag;
     private readonly cascadeRelations;
@@ -4012,13 +4359,13 @@ declare class DeleteBuilder<T = void> extends MutationBuilderBase<T, DeleteInten
     /**
      * Add WHERE condition.
      */
-    where(condition: WhereIntent): DeleteBuilder<T>;
+    where(condition: MutationWhereCondition): DeleteBuilder<TRow, TResult>;
     /**
      * Enable cascade delete.
      * Without arguments: deletes ALL related records.
      * With array: deletes only specified relations.
      */
-    cascade(relations?: readonly string[]): DeleteBuilder<T>;
+    cascade(relations?: readonly string[]): DeleteBuilder<TRow, TResult>;
     /**
      * Specify columns to return after delete (DX-026).
      * Requires adapter support for RETURNING clause.
@@ -4031,7 +4378,7 @@ declare class DeleteBuilder<T = void> extends MutationBuilderBase<T, DeleteInten
      *   .execute();
      * ```
      */
-    returning<R = Record<string, unknown>>(columns: readonly (keyof R & string)[]): DeleteBuilder<R[]>;
+    returning<K extends MutationKey<TRow>>(columns: readonly K[]): DeleteBuilder<TRow, MutationReturningRow<TRow, K>[]>;
     protected buildIntent(): DeleteIntent;
     protected compileIntent(adapter: Adapter, intent: DeleteIntent, options?: CompileOptions): CompiledQuery;
 }
@@ -4064,7 +4411,7 @@ declare class DeleteBuilder<T = void> extends MutationBuilderBase<T, DeleteInten
  *   .execute();
  * ```
  */
-declare class UpsertBuilder<T = void> extends MutationBuilderBase<T, UpsertIntent> {
+declare class UpsertBuilder<TRow = unknown, TResult = void> extends MutationBuilderBase<TResult, UpsertIntent> {
     private readonly valuesData;
     private readonly conflictTarget;
     private readonly conflictAction;
@@ -4079,17 +4426,17 @@ declare class UpsertBuilder<T = void> extends MutationBuilderBase<T, UpsertInten
      * Set values to insert.
      * Accepts a single object or an array for bulk upsert.
      */
-    values(data: Record<string, unknown> | readonly Record<string, unknown>[]): UpsertBuilder<T>;
+    values<TInput extends Insertable<TRow> | readonly Insertable<TRow>[]>(data: TInput & (TInput extends readonly Insertable<TRow>[] ? ExactMutationRows<TInput, Insertable<TRow>> : ExactMutationPayload<TInput, Insertable<TRow>>)): UpsertBuilder<TRow, TResult>;
     /**
      * Specify conflict target by column names.
      * These columns determine conflict detection.
      */
-    onConflict(columns: readonly string[]): UpsertBuilder<T>;
+    onConflict(columns: readonly MutationKey<TRow>[]): UpsertBuilder<TRow, TResult>;
     /**
      * Specify conflict target by constraint name.
      * Alternative to onConflict() for named constraints.
      */
-    onConflictConstraint(constraintName: string): UpsertBuilder<T>;
+    onConflictConstraint(constraintName: string): UpsertBuilder<TRow, TResult>;
     /**
      * On conflict, update the specified fields.
      * If no fields specified, auto-updates all non-conflict columns.
@@ -4097,16 +4444,16 @@ declare class UpsertBuilder<T = void> extends MutationBuilderBase<T, UpsertInten
      * @param set - Optional fields to update on conflict
      * @param where - Optional condition for the update
      */
-    doUpdate(set?: Record<string, unknown>, where?: WhereIntent): UpsertBuilder<T>;
+    doUpdate<TInput extends Updateable<TRow>>(set?: ExactMutationPayload<TInput, Updateable<TRow>>, where?: MutationWhereCondition): UpsertBuilder<TRow, TResult>;
     /**
      * On conflict, do nothing (skip the insert).
      */
-    doNothing(): UpsertBuilder<T>;
+    doNothing(): UpsertBuilder<TRow, TResult>;
     /**
      * Specify columns to return after upsert (DX-026).
      * Requires adapter support for RETURNING clause.
      */
-    returning<R = Record<string, unknown>>(columns: readonly (keyof R & string)[]): UpsertBuilder<R[]>;
+    returning<K extends MutationKey<TRow>>(columns: readonly K[]): UpsertBuilder<TRow, MutationReturningRow<TRow, K>[]>;
     protected buildIntent(): UpsertIntent;
     protected compileIntent(adapter: Adapter, intent: UpsertIntent, options?: CompileOptions): CompiledQuery;
 }
@@ -4188,9 +4535,13 @@ declare function nqlRaw(fragment: string): NqlRawFragment;
  * @param model - ModelIR for plan execution
  * @param adapter - Optional adapter for query execution
  * @param schemaName - Optional schema name for multi-tenant queries
+ * @param hookStore - Optional hook storage for query and mutation hooks
+ * @param onHookError - Optional control-flow handler for hook failures
+ * @param inTransaction - Whether execution is already within a transaction
+ * @param onObserverError - Optional non-fatal diagnostic sink for observer failures
  * @returns NQL template tag function
  */
-declare function createNqlTag(_schemaDefinition: unknown, model: ModelIR, adapter?: Adapter<unknown>, schemaName?: string, hookStore?: HookStore, onHookError?: HookErrorHandler, inTransaction?: boolean): NqlTag;
+declare function createNqlTag(_schemaDefinition: unknown, model: ModelIR, adapter?: Adapter<unknown>, schemaName?: string, hookStore?: HookStore, onHookError?: HookErrorHandler, inTransaction?: boolean, onObserverError?: ObserverErrorHandler): NqlTag;
 /**
  * Extract pseudo-column keywords from model configuration.
  * Collects all configured roles and recursive keywords from all tables'
@@ -4454,11 +4805,12 @@ interface OrmOptionsWithAdapter<DB = unknown> extends OrmOptionsBase<DB> {
  *   - `orm.select(name)` - concise table-name form
  *   - `orm.from(table)` - TableRef form with column-level types
  *
- * Mutations use the typed TableRef-based methods:
- *   - `orm.into(table)` - INSERT
- *   - `orm.modify(table)` - UPDATE
- *   - `orm.removeFrom(table)` - DELETE
- *   - `orm.upsertInto(table)` - UPSERT (INSERT ... ON CONFLICT)
+ * Mutations have two schema-keyed surfaces:
+ *   - `orm.insert(name)`, `orm.update(name)`, `orm.delete(name)`, and
+ *     `orm.upsert(name)` are concise when the table name is already available.
+ *   - `orm.into(table)`, `orm.modify(table)`, `orm.removeFrom(table)`, and
+ *     `orm.upsertInto(table)` take a TableRef and fit flows that also use its
+ *     column references for typed filters and queries.
  *
  * @typeParam DB - Database row map type.
  *   Keys are table names, values are row types.
@@ -4561,6 +4913,14 @@ interface OrmInstance<DB = Record<string, unknown>> {
      * @returns A QueryBuilder for constructing the select
      */
     select<K extends keyof DB & string, TResult = DB[K]>(from: K): QueryBuilder<TResult>;
+    /** Start a type-safe INSERT operation from a schema table name. */
+    insert<K extends keyof DB & string>(table: K): InsertBuilder<DB[K]>;
+    /** Start a type-safe UPDATE operation from a schema table name. */
+    update<K extends keyof DB & string>(table: K): UpdateBuilder<DB[K]>;
+    /** Start a type-safe DELETE operation from a schema table name. */
+    delete<K extends keyof DB & string>(table: K): DeleteBuilder<DB[K]>;
+    /** Start a type-safe UPSERT operation from a schema table name. */
+    upsert<K extends keyof DB & string>(table: K): UpsertBuilder<DB[K]>;
     /**
      * Start building a SELECT query from a typed TableRef.
      *
@@ -4767,7 +5127,7 @@ interface OrmInstance<DB = Record<string, unknown>> {
      *   .execute();
      * ```
      */
-    updateAll(table: string): UpdateBuilder;
+    updateAll<K extends keyof DB & string>(table: K): UpdateBuilder<DB[K]>;
     /**
      * Start building a DELETE operation that affects all rows.
      * Use with caution - this explicitly allows deletes without WHERE.
@@ -4780,7 +5140,7 @@ interface OrmInstance<DB = Record<string, unknown>> {
      * await orm.deleteAll('tempData').execute();
      * ```
      */
-    deleteAll(table: string): DeleteBuilder;
+    deleteAll<K extends keyof DB & string>(table: K): DeleteBuilder<DB[K]>;
     /**
      * Execute a callback within a database transaction.
      * Auto-commits on success, auto-rolls back on exception.
@@ -6070,7 +6430,7 @@ interface SqlRawExpression {
  * ```typescript
  * orm.upsert('files')
  *   .values({ id: 1, name: 'test' })
- *   .onConflict({ columns: ['id'] })
+ *   .onConflict(['id'])
  *   .doUpdate({ last_parsed: sql('now()'), count: sql('excluded.count + 1') })
  *   .execute();
  *
@@ -6134,6 +6494,9 @@ declare function isSqlRaw(value: unknown): value is SqlRawExpression;
  * not a column name → use `literal()` instead).
  */
 type ExprInput = ExpressionRef | ExpressionSpec | AggOrderByArg | string | number | boolean | readonly unknown[];
+
+type BinaryPredicateOperator = Exclude<PredicateOperator, 'AND' | 'OR' | 'NOT'>;
+type NonPredicateOperator<TOperator extends string> = TOperator extends PredicateOperator ? never : TOperator;
 /**
  * A chainable wrapper around an ExpressionIntent.
  *
@@ -6187,6 +6550,47 @@ declare class ExpressionRef {
      */
     filter(condition: WhereIntent): ExpressionRef;
 }
+/** Marker used to identify an invalid predicate from a different core copy. */
+declare const PREDICATE_REF_DISCRIMINATOR: "dbsp.predicate.v1";
+/**
+ * A predicate that is also a scalar expression.
+ *
+ * Its one canonical representation is the expression intent inherited from
+ * `ExpressionRef`; the WHERE form is derived when a builder consumes it.
+ */
+declare class ExpressionPredicateRef extends ExpressionRef {
+    readonly __predicateRef: "dbsp.predicate.v1";
+    readonly intent: StandaloneWhereExpressionIntent;
+    constructor(intent: StandaloneWhereExpressionIntent);
+    as(alias: string): PredicateExpressionRef;
+}
+/** A scalar predicate created by `op()`, `boolFn()`, or `unsafeAsPredicate()`. */
+type PredicateExpressionRef = ExpressionPredicateRef;
+/**
+ * A composed predicate has no scalar-expression representation in this API.
+ * Its canonical representation is the complete WHERE intent.
+ */
+declare class WhereOnlyPredicateRef {
+    readonly intent: WhereIntent;
+    readonly __predicateRef: "dbsp.predicate.v1";
+    constructor(intent: WhereIntent);
+}
+/** A composed predicate that is accepted only in `.where()`. */
+type WhereOnlyPredicate = WhereOnlyPredicateRef;
+/**
+ * A value accepted by `.where()` as a predicate.
+ *
+ * The constructors are intentionally module-private. Use `op()`, predicate
+ * helpers, or `unsafeAsPredicate()` instead.
+ */
+type PredicateRef = PredicateExpressionRef | WhereOnlyPredicate;
+/**
+ * Recognize only predicate instances constructed by this installed core copy.
+ *
+ * A predicate from another installed copy is unsupported: reconstruct it with
+ * this module's predicate factories before passing it to a builder.
+ */
+declare function isPredicateRef(value: unknown): value is PredicateRef;
 /**
  * Column reference — refers to a named column (or table.column).
  *
@@ -6216,7 +6620,21 @@ declare function cast(expr: ExpressionRef, typeName: string): ExpressionRef;
  * @example op('<=>', 'embedding', [0.1, 0.2])  // implicit conversions
  * @throws Error if operator fails validation (injection guard)
  */
-declare function op(operator: string, left: ExprInput, right: ExprInput): ExpressionRef;
+/** Logical AND / OR — both operands must be predicates. */
+declare function op(operator: 'AND' | 'OR', left: PredicateRef, right: PredicateRef): WhereOnlyPredicate;
+/** Logical NOT — its sole operand must be a predicate. */
+declare function op(operator: 'NOT', operand: PredicateRef): WhereOnlyPredicate;
+/** Predicate binary operators accept expression operands. */
+declare function op(operator: BinaryPredicateOperator, left: ExprInput, right: ExprInput): ExpressionPredicateRef;
+/** Any non-predicate operator remains an ordinary expression. */
+declare function op<TOperator extends string>(operator: NonPredicateOperator<TOperator>, left: ExprInput, right: ExprInput): ExpressionRef;
+/**
+ * Assert that an arbitrary expression is boolean for use in WHERE.
+ *
+ * Use this only for a user-defined operator whose boolean result cannot be
+ * represented by the closed PredicateOperator union.
+ */
+declare function unsafeAsPredicate(expr: ExpressionRef): PredicateExpressionRef;
 /**
  * Custom function call — name(args...).
  * Supports schema-qualified names (e.g., 'paradedb.score', 'ST_Distance').
@@ -6242,6 +6660,18 @@ declare function op(operator: string, left: ExprInput, right: ExprInput): Expres
  * @throws Error if name fails validation (injection guard)
  */
 declare function fn(name: string, ...args: (ExprInput | DistinctField)[]): ExpressionRef;
+/**
+ * Declare that a custom function call is boolean-valued for use in WHERE.
+ *
+ * This has the same trust boundary as the SQL function name and arguments the
+ * caller writes: use it only when the declared function returns boolean.
+ * Unlike `fn()`, which builds a scalar expression, `boolFn()` builds a
+ * predicate that can be passed directly to `.where()`.
+ *
+ * @example boolFn('jsonb_exists', ref('data'), literal('phone'))
+ * @throws Error if name fails validation (injection guard)
+ */
+declare function boolFn(name: string, ...args: (ExprInput | DistinctField)[]): PredicateExpressionRef;
 /**
  * Literal value — inlined directly in SQL (not bound as parameter).
  * Use to distinguish SQL string literals from column references.
@@ -6907,7 +7337,7 @@ type FullTextSearchOptions = {
  * }))
  * ```
  */
-declare function fullTextSearch({ query, fields, tableAlias, }: FullTextSearchOptions): ExpressionRef;
+declare function fullTextSearch({ query, fields, tableAlias, }: FullTextSearchOptions): PredicateExpressionRef;
 /**
  * BM25 relevance score expression for ParadeDB.
  *
@@ -7443,6 +7873,11 @@ interface SimplifiedOrmOptions<T extends SchemaDefinition = SchemaDefinition> {
      * or 'abort' to propagate the error.
      */
     readonly onHookError?: HookErrorHandler;
+    /**
+     * Non-fatal diagnostic sink for observer failures and snapshot skips.
+     * Its return value is ignored and it can never abort query or mutation work.
+     */
+    readonly onObserverError?: ObserverErrorHandler;
     /**
      * Behavior when schema uses features the adapter doesn't support.
      * Default: 'warning' (emit warning + skip).
@@ -7569,7 +8004,7 @@ type RangeType = 'int4range' | 'int8range' | 'numrange' | 'tsrange' | 'tstzrange
  * @example rangeOverlaps('span', [1, 100], 'int4range')
  *          → "span" && int4range($1, $2)
  */
-declare function rangeOverlaps(column: string, range: readonly [unknown, unknown], rangeType?: RangeType): ExpressionRef;
+declare function rangeOverlaps(column: string, range: readonly [unknown, unknown], rangeType?: RangeType): PredicateExpressionRef;
 /**
  * Range OVERLAPS — object API: delegates to WhereRangeIntent (planner path)
  *
@@ -7582,20 +8017,20 @@ declare function rangeOverlaps(field: string, value: RangeValue): WhereRangeInte
  * @example rangeContains('dateRange', ['2024-06-15', '2024-06-15'])
  *          → "dateRange" @> daterange($1, $2)
  */
-declare function rangeContains(column: string, range: readonly [unknown, unknown], rangeType?: RangeType): ExpressionRef;
+declare function rangeContains(column: string, range: readonly [unknown, unknown], rangeType?: RangeType): PredicateExpressionRef;
 /**
  * Range CONTAINS — object API: delegates to WhereRangeIntent (planner path)
  *
  * @example rangeContains('date_range', { lower: '2025-01-01', upper: '2025-01-05' })
  */
-declare function rangeContains(field: string, value: RangeValue): WhereRangeIntent;
+declare function rangeContains(field: string, value: RangeOperand): WhereRangeIntent;
 /**
  * Range CONTAINED BY — tuple API: `"column" <@ rangeType($1, $2)` (ExpressionRef)
  *
  * @example rangeContainedBy('dateRange', ['2024-01-01', '2024-12-31'])
  *          → "dateRange" <@ daterange($1, $2)
  */
-declare function rangeContainedBy(column: string, range: readonly [unknown, unknown], rangeType?: RangeType): ExpressionRef;
+declare function rangeContainedBy(column: string, range: readonly [unknown, unknown], rangeType?: RangeType): PredicateExpressionRef;
 /**
  * Range CONTAINED BY — object API: delegates to WhereRangeIntent (planner path)
  *
@@ -7814,6 +8249,7 @@ declare function normalizeSQL(sql: string): string;
  *
  * Pure string parser — zero external dependencies.
  */
+
 declare const ASSERTION_TYPES: readonly ["output.contains", "output.equals", "output.matches", "sql.equals", "sql.matches", "params.equals", "params.length", "plan.contains", "success", "error.contains", "sql.table", "sql.column", "sql.join", "params.type", "params.value", "db.success", "db.output.contains", "db.rows.equals", "db.rows.min", "db.rows.max", "db.output", "db.column.exists", "db.value.equals", "intent.type", "intent.table", "intent.with", "intent.hasWhere", "intent.hasGroupBy", "intent.hasOrderBy"];
 type AssertionType = (typeof ASSERTION_TYPES)[number];
 /**
@@ -7829,12 +8265,14 @@ interface TableAssertionData {
     columns: string[];
     rows: string[][];
 }
+/** Values representable in an assertion file, plus the parsed db.output table. */
+type AssertionValue = JsonValue$1 | TableAssertionData;
 /**
  * A single assertion within a block
  */
 interface Assertion {
     type: AssertionType;
-    value: string | number | boolean | unknown[] | TableAssertionData;
+    value: AssertionValue;
     line: number;
 }
 /**
@@ -8095,4 +8533,4 @@ declare const assertIntentHasOrderBy: (result: AssertionQueryResult, expected: b
  */
 declare function runAssertions(blocks: AssertionBlock[], results: AssertionQueryResult[], queries: string[], hasDb?: boolean): AssertionSummary;
 
-export { ASSERTION_TYPES, AdapterRequiredError, type AdjacencyOptions, type AfterMutationHook, type AfterQueryHook, type AggregateOptions, type AliasedColumn, type AliasedExprColumn, type AllColumns, AmbiguousPlanError, AmbiguousRelationError, type Applier, type Assertion, type AssertionBlock, type AssertionOutcome, type AssertionQueryResult, type AssertionSummary, type AssertionType, BRAND, type BatchValuesOptions, type BatchValuesRef, type BeforeMutationHook, type BeforeQueryHook, type BrandKey, COLUMN_META, type CardinalityShorthand, CaseBuilder, type CaseValue, type CheckDelta, type ColumnDef, type ColumnMetaKey, ColumnNotFoundError, type ColumnRef, type ColumnSpec, CteBuilder, type CteDump, CteQueryBuilder, type CursorPaginateOptions, type CursorPaginatedResult, DEFAULT_FEATURE_CHECKERS, DUCKDB_CAPABILITIES, type DefaultFilters, type DefineModelOptions, DeleteBuilder, type DistinctField, type DumpMetaInput, type EdgeTableOptions, type EmitWarningOptions, type EnumAddDelta, ErrorCode, type ErrorHookContext, Errors, type EstablishedProofClaim, type ExecutionCoordinator, ExecutionError, type ExprInput, ExpressionRef, type ExpressionSpec, type FeatureChecker, type FeatureUsage, type FilterOperators, type FilterValue, type FullTextSearchField, type FullTextSearchOptions, type GetSchemaFromDbOptions, type GuardExecutionResult, type HierarchyOptions, type HookErrorHandler, type HookManager, type HookPriority, type HydrateOptions, IRREGULAR_PLURALS, type InProcessProvenPlan, type IncludeOptions, type IncludeOptionsWithRecursive, type IndexDelta, type IndexSetEntry, type InferColumn, type InferColumnNonNull, type InferColumnType, type InferColumnTypes, type InferDB, type InferRefColumn, type InferRow, type InferSchemaDB, type InferTableRow, type InferTables, type InferredRangeValue, InsertBuilder, IntentBuilder, type IntentBuilderState, type IntentSummary, InvalidOperationError, InvalidRelationDefinitionError, type JoinOptions, type JsonValue, type LightweightRelationsDef, type ListHierarchyOptions, type ListIndexOptions, type Logger, MSSQL_CAPABILITIES, MYSQL_CAPABILITIES, ModelIRImpl, type MutationDump, type MutationHookContext, type MutationOperation, NamingConventionMismatchError, type NegotiationResult, type NestedInclude, type SchemaColumnType as NewSchemaColumnType, type NonRollbackableExecutionTracker, NotFoundError, type NqlBuilder, type NqlRawFragment, type NqlTag, type OnErrorHook, type OperationFingerprints, type OperationObservation, type OperationRuntime, type OrderByInput, type OrderByRecord, type OrderBySpec, type OrmInstance, type OrmOf, type OrmOptions, type OrmOptionsWithAdapter, type OrmOptionsWithModel, POSTGRESQL_CAPABILITIES, PackRegistry, type PaginateOptions, type PaginatedResult, type ParseError, type ParseResult, type ParsedRelationDef, type ParsedRelationKey, type PathOptions, type PrioritizedHook, type ProveOutcome, type Prover, type QueryAssertionResult, type QueryBuilder, type QueryHookContext, type QueryResultType, RELATION_META, type RangeType, RawCteQueryBuilder, type RecursiveDump, type RecursiveIncludeConfig, type RecursiveOptions, RecursiveShapeMismatchError, type RefDefinition, type RefOptions, type RegisteredOperationSemantics, type RelationHints, type RelationKey, type RelationMetaKey, RelationNotFoundError, type RelationObjectDef, type RelationPathIncludeNode, type RelationPathUsage, type RelationRef, type RelationShorthand, type RelationTupleDef, ResultHydrator, type RulePrecedenceFact, SQLITE_CAPABILITIES, SQL_RAW_MARKER, type Schema, type SchemaColumnType, type SchemaConstraints, type SchemaDefinition, SchemaValidationError as SchemaError, type SchemaExtras, type SchemaIndexOptions, type SchemaIndexValidationInput, type SchemaOptions, type SchemaTableOptions, SchemaValidationError, type SelectField, type SelfRefRoles, type SetOperationBuilder, type SimplifiedOrmOptions, type SqlRawExpression, type StagedCompositionCandidate, type StagedCompositionPreflight, type StagedCompositionPreflightInput, type StagedTransitionInput, type StagedTransitionOrchestrator, type StreamOptions, SubqueryBuilder, SubqueryExpression, TABLE_META, TRANSITION_LESSOR_REJECTION, type TableAssertionData, type TableDDL, type TableDef, type TableIndexes, type TableMetaKey, TableNotFoundError, type TableRef, type TransactionCoordinatorBinding, type TransitionExecutionClient, type TransitionLeaseFailure, type TransitionPack, type TransitionRelationalValidationInput, type TransitionRelationalValidationResult, type TraversalDirection, UnhandledTypeInDialect, UnknownDialectError, UnsafeOperationError, UnsupportedCapabilityError, UnsupportedFeatureError, UnsupportedStrategyError, UpdateBuilder, UpsertBuilder, type WarningCategory, type WhereFilter, WindowBuilder, acquireTransitionLease, advisoryObservationId, aggOrderBy, and, any, array, arrayAgg, assertCapability, assertContains, assertDbColumnExists, assertDbOutput, assertDbRowsEquals, assertDbRowsMax, assertDbRowsMin, assertDbValueEquals, assertEquals, assertIntentHasGroupBy, assertIntentHasOrderBy, assertIntentHasWhere, assertIntentTable, assertIntentType, assertIntentWith, assertMatches, assertParamsEquals, assertParamsLength, assertParamsType, assertParamsValue, assertSQLColumn, assertSQLEquals, assertSQLJoin, assertSQLTable, assertSuccess, assertTypeSupported, assumptionId, batchValues, capitalize, caseWhen, cast, checkDelta, chooseReadyCandidate, claimId, coalesce, col, composeAfterMutationHooks, composeAfterQueryHooks, composeBeforeMutationHooks, composeBeforeQueryHooks, composeOnErrorHooks, countDistinctRelationPathsByName, createApplier, createComparator, createDialectCapabilities, createEvidenceView, createHookManager, createNqlTag, createOrm, createPackRegistry, createProver, createPseudoColumnMetadata, createRawCteBuilder, createRecursiveMetadata, createStagedTransitionOrchestrator, createTransitionLessor, decapitalize, defaultIndexName, defaultLogger, defineModel, denseRank, deriveRelationPathFromIntentPath, distinct, emitWarning, enumAddDelta, eq, every, evidenceId, exists, ref as exprRef, extendDialect, extractPseudoColumnKeywords, findClosestMatch, fn, fullTextSearch, getAvailableDialects, getDialectCapabilities, getLogger, getRelationKind, getSchemaFromDb, gt, gte, inArray, inSubquery, indexDelta, inferForeignKey, isAliasedColumn, isAllColumns, isBatchValuesRef, isCardinalityShorthand, isColumnRef, isDistinctField, isDistinctFrom, isExpressionSpec, isKnownDialect, isNotNull, isNull, isOperationRuntime, isOverallSuccess, isRecursiveIncludeOptions, isRecursiveRelation, isRef, isRelationObjectDef, isRelationRef, isRelationTupleDef, isSelfReferential, isSqlRaw, isSubqueryExpression, isTableRef, isTransitionLessor, isWhereIntent, lag, lead, like, literal, lt, lte, namedArg, negotiateFeatures, neq, none, normalizeSQL, normalizedIndex, not, notExists, nqlRaw, objectToWhereIntent, op, or, outerRef, param, parseAssertionFile, parseRelationDef, parseRelationKey, pipeAfterMutationHooks, pipeAfterQueryHooks, pipeBeforeMutationHooks, pipeBeforeQueryHooks, pipeOnErrorHooks, plan, planRecursive, pluralize, preflightStagedComposition, projectCompareToSingleCandidate, rangeContainedBy, rangeContains, rangeOverlaps, rank, raw, rawExists, rawNotExists, ref$1 as ref, registerDialect, relationColumn, requiresDatabase, resetLogger, resolveEnumSchemaForComparison, resolveQueryIndex, resourceIsWithin, resourceScopeCovers, rowNumber, runAssertions, schema, schemaToModelIR, selectorMatchesResource, semanticArtifactId, serverVersionNum, setLogger, silentLogger, singularize, some, sortByPriority, sql, star, stringAgg, subquery, supportsDDLGeneration, supportsExecution, supportsIntrospection, supportsRawSql, supportsStreaming, supportsTransactions, textScore, unary, validateAssertionBlocks, validateRecursiveInclude, validateRecursiveShape, validateSchemaIndexOptions, validateTransitionRelationalInvariants, validateTypeName, wAvg, wCount, wMax, wMin, wSum, withPriority };
+export { ASSERTION_TYPES, AdapterRequiredError, type AdjacencyOptions, type AfterMutationHook, type AfterMutationObserver, type AfterQueryHook, type AfterQueryObserver, type AggregateOptions, type AliasedColumn, type AliasedExprColumn, type AllColumns, AmbiguousPlanError, AmbiguousRelationError, type Applier, type Assertion, type AssertionBlock, type AssertionOutcome, type AssertionQueryResult, type AssertionSummary, type AssertionType, BRAND, type BatchValuesOptions, type BatchValuesRef, type BeforeMutationHook, type BeforeQueryHook, type BrandKey, COLUMN_META, CanonicalJsonError, type CardinalityShorthand, CaseBuilder, type CaseValue, type CheckDelta, type ColumnDef, type ColumnMetaKey, ColumnNotFoundError, type ColumnRef, type ColumnSpec, CteBuilder, type CteDump, CteQueryBuilder, type CursorPaginateOptions, type CursorPaginatedResult, DEFAULT_FEATURE_CHECKERS, DUCKDB_CAPABILITIES, type DeclarationNamingStrategy, type DefaultFilters, type DefineModelOptions, DeleteBuilder, type DistinctField, type DumpMetaInput, type EdgeTableOptions, type EmitWarningOptions, type EnumAddDelta, ErrorCode, type ErrorHookContext, Errors, type EstablishedProofClaim, type ExecutionCoordinator, ExecutionError, type ExprInput, ExpressionRef, type ExpressionSpec, type FeatureChecker, type FeatureUsage, type FilterOperators, type FilterValue, type FullTextSearchField, type FullTextSearchOptions, type GetSchemaFromDbOptions, type GuardExecutionResult, type HierarchyOptions, type HookErrorHandler, type HookManager, type HookPriority, type HydrateOptions, IRREGULAR_PLURALS, type InProcessProvenPlan, type IncludeOptions, type IncludeOptionsWithRecursive, type IndexDelta, type IndexSetEntry, type InferColumn, type InferColumnNonNull, type InferColumnType, type InferColumnTypes, type InferDB, type InferRefColumn, type InferRow, type InferSchemaDB, type InferTableRow, type InferTables, type InferredRangeValue, InsertBuilder, type Insertable, IntentBuilder, type IntentBuilderState, type IntentSummary, InvalidOperationError, InvalidRelationDefinitionError, type JoinOptions, type JsonValue, LEDGER_LIFECYCLE_GRAMMAR, LEDGER_PROJECTION_CODE_VERSION, type LedgerChainProjectionInput, type LightweightRelationsDef, type ListHierarchyOptions, type ListIndexOptions, type Logger, MSSQL_CAPABILITIES, MYSQL_CAPABILITIES, type ManagedOutcomeExecutionRequest, type ManagedOutcomePreflightRequest, ModelIRImpl, type MutationDump, type MutationHookContext, type MutationOperation, NamingConventionMismatchError, type NegotiationResult, type NestedInclude, type SchemaColumnType as NewSchemaColumnType, type NonRollbackableExecutionTracker, NotFoundError, type NqlBuilder, type NqlRawFragment, type NqlTag, type ObserverErrorHandler, type OnErrorHook, type OperationFingerprints, type OperationObservation, type OperationRuntime, type OrderByInput, type OrderByRecord, type OrderBySpec, type OrmInstance, type OrmOf, type OrmOptions, type OrmOptionsWithAdapter, type OrmOptionsWithModel, POSTGRESQL_CAPABILITIES, PREDICATE_REF_DISCRIMINATOR, PackRegistry, type PaginateOptions, type PaginatedResult, type ParseError, type ParseResult, type ParsedRelationDef, type ParsedRelationKey, type PathOptions, type PredicateExpressionRef, type PredicateRef, type PrioritizedHook, type ProveOutcome, type Prover, type QueryAssertionResult, type QueryBuilder, type QueryHookContext, type QueryResultType, RELATION_META, type RangeType, RawCteQueryBuilder, type RecursiveDump, type RecursiveIncludeConfig, type RecursiveOptions, RecursiveShapeMismatchError, type RefDefinition, type RefOptions, type RegisteredOperationSemantics, type RelationHints, type RelationKey, type RelationMetaKey, RelationNotFoundError, type RelationObjectDef, type RelationPathIncludeNode, type RelationPathUsage, type RelationRef, type RelationShorthand, type RelationTupleDef, ResultHydrator, type RulePrecedenceFact, SQLITE_CAPABILITIES, SQL_RAW_MARKER, type Schema, type SchemaColumnType, type SchemaConstraints, type SchemaDefinition, SchemaValidationError as SchemaError, type SchemaExtras, type SchemaIndexOptions, type SchemaIndexValidationInput, type SchemaOptions, type SchemaTableOptions, SchemaValidationError, type SelectField, type SelfRefRoles, type SetOperationBuilder, type SimplifiedOrmOptions, type SqlRawExpression, type StagedCompositionCandidate, type StagedCompositionPreflight, type StagedCompositionPreflightInput, type StagedTransitionInput, type StagedTransitionOrchestrator, type StreamOptions, SubqueryBuilder, SubqueryExpression, TABLE_META, type TableAssertionData, type TableDDL, type TableDef, type TableIndexes, type TableMetaKey, TableNotFoundError, type TableRef, type TransactionCoordinatorBinding, type TransitionExecutionClient, type TransitionPack, TransitionReadTarget, type TransitionRelationalValidationInput, type TransitionRelationalValidationResult, type TransitionRunPersister, type TraversalDirection, UnhandledTypeInDialect, UnknownDialectError, UnsafeOperationError, UnsupportedCapabilityError, UnsupportedFeatureError, UnsupportedStrategyError, UpdateBuilder, type Updateable, UpsertBuilder, type ValidatedManagedStepManifest, type ValidatedManagedStepManifestResult, type WarningCategory, type WhereFilter, WindowBuilder, admitRecordedIdentity, advisoryObservationId, aggOrderBy, and, any, array, arrayAgg, assertCanonicalizableJson, assertCapability, assertConnectionAvailable, assertContains, assertDbColumnExists, assertDbOutput, assertDbRowsEquals, assertDbRowsMax, assertDbRowsMin, assertDbValueEquals, assertEquals, assertIntentHasGroupBy, assertIntentHasOrderBy, assertIntentHasWhere, assertIntentTable, assertIntentType, assertIntentWith, assertMatches, assertParamsEquals, assertParamsLength, assertParamsType, assertParamsValue, assertSQLColumn, assertSQLEquals, assertSQLJoin, assertSQLTable, assertSuccess, assertTypeSupported, assumptionAccepted, assumptionId, batchValues, bindDeclarationSet, bindExecutionContract, boolFn, canonicalJson, canonicalJsonDigest, capitalize, caseWhen, cast, checkDelta, chooseReadyCandidate, claimId, coalesce, col, composeAfterMutationHooks, composeAfterQueryHooks, composeBeforeMutationHooks, composeBeforeQueryHooks, composeOnErrorHooks, concludeEvidenceForObligation, countDistinctRelationPathsByName, createApplier, createComparator, createDialectCapabilities, createEvidenceView, createExecutionContract, createHookManager, createNqlTag, createOrm, createPackRegistry, createProver, createPseudoColumnMetadata, createRawCteBuilder, createRecursiveMetadata, createStagedTransitionOrchestrator, createTransitionRunMetadata, decapitalize, declarationSetFromModel, defaultIndexName, defaultLogger, defineModel, denseRank, deriveRelationPathFromIntentPath, distinct, emitWarning, enumAddDelta, eq, every, evidenceId, exists, ref as exprRef, extendDialect, extractPseudoColumnKeywords, findClosestMatch, fn, fullTextSearch, getAvailableDialects, getDialectCapabilities, getLogger, getRelationKind, getSchemaFromDb, gt, gte, inArray, inSubquery, indexDelta, inferForeignKey, interpretLedgerLifecycle, isAliasedColumn, isAllColumns, isBatchValuesRef, isCardinalityShorthand, isColumnRef, isDistinctField, isDistinctFrom, isExpressionSpec, isKnownDialect, isNotNull, isNull, isOperationRuntime, isOverallSuccess, isPredicateRef, isRecursiveIncludeOptions, isRecursiveRelation, isRef, isRelationObjectDef, isRelationRef, isRelationTupleDef, isSelfReferential, isSqlRaw, isSubqueryExpression, isTableRef, isWhereIntent, lag, lead, like, literal, loadVerifiedRecoveryJournal, lt, lte, markGeneratorRemovalNonReplayable, namedArg, negotiateFeatures, neq, none, normalizeSQL, normalizedIndex, not, notExists, nqlRaw, objectToWhereIntent, observationContextDigest, op, or, outerRef, param, parseAssertionFile, parseRelationDef, parseRelationKey, pipeAfterMutationHooks, pipeAfterQueryHooks, pipeBeforeMutationHooks, pipeBeforeQueryHooks, pipeOnErrorHooks, plan, planRecursive, pluralize, preflightStagedComposition, projectCompareToSingleCandidate, projectLedgerChain, rangeContainedBy, rangeContains, rangeOverlaps, rank, raw, rawExists, rawNotExists, ref$1 as ref, registerDialect, relationColumn, requiresDatabase, resetLogger, resolveEnumSchemaForComparison, resolveQueryIndex, resourceIsWithin, resourceScopeCovers, rowNumber, runAssertions, schema, schemaToModelIR, selectorMatchesResource, semanticArtifactId, serverVersionNum, setLogger, silentLogger, singularize, some, sortByPriority, sql, star, stringAgg, subquery, supportsDDLGeneration, supportsExecution, supportsIntrospection, supportsRawSql, supportsStreaming, supportsTransactions, textScore, transitionPlanDigest, unary, unsafeAsPredicate, validateAssertionBlocks, validateDeclarationModel, validateExecutionContract, validateNormalizedManagedStepManifest, validateRecursiveInclude, validateRecursiveShape, validateSchemaIndexOptions, validateTransitionRelationalInvariants, validateTypeName, wAvg, wCount, wMax, wMin, wSum, withPriority };