@dbsp/types 3.4.0 → 4.0.0

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { bV as RecursiveTraversal, e as AdjacencyTraversal, c_ as WindowFunction, l as AggregateWindowFunction, bb as OffsetWindowFunction, ak as ExpressionIntent, F as CoalesceExpressionIntent, G as ColumnAliasIntent, a0 as CustomTraversal, bB as QueryIntent, bP as RecursiveIntent, aW as MutationIntent, a7 as DeleteIntent, ag as EdgeTableTraversal, aB as InsertIntent, bF as RankingWindowFunction, bI as RawExpressionIntent, bX as RelationColumnIntent, c8 as SelectIntent, c5 as SelectAggregateIntent, c6 as SelectAllIntent, c7 as SelectFieldsIntent, c9 as SelectWithExpressionsIntent, cm as SubqueryRefIntent, cz as UpdateIntent, cD as UpsertIntent, cN as WhereIntent, cF as WhereAndIntent, cG as WhereAnyIntent, cH as WhereComparisonIntent, cI as WhereExistsIntent, cK as WhereInIntent, cQ as WhereLikeIntent, cU as WhereOrIntent, cS as WhereNotIntent, cR as WhereNotExistsIntent, cT as WhereNullIntent, cV as WhereRangeIntent, cY as WhereRelationFilterIntent, cZ as WhereSubqueryIntent, c$ as WindowIntent, J as ColumnJsReadType, cp as TableIR, aV as ModelIR, K as ColumnListInput, bY as RelationIR, aq as ForeignKeyIR, cb as SemanticArtifactRef, cv as TrustRoot, be as OperationKindRef } from './adapter-CjwnHeg4.js';
-export { A as Adapter, b as AdapterCapabilities, c as AdapterLogger, d as AdapterStreamOptions, f as AggOrderByArg, g as AggregateCountIntent, h as AggregateExpressionIntent, i as AggregateFieldIntent, j as AggregateFunction, k as AggregateIntent, m as AggregateWindowIntent, n as AliasIncludedColumnsMode, o as AlterColumnOptions, p as AmbiguityCheckResult, q as ArithmeticExpressionIntent, r as ArrayExpressionIntent, s as ArrayOperator, t as AuthorAttestedNativeDefault, u as AuthorAttester, B as BaseAdapter, v as BatchUpdateIntent, w as BatchValuesJoinPayload, x as CTEDefinition, y as Cardinality, z as CaseExpressionIntent, D as CastExpressionIntent, E as CheckConstraintIR, H as ColumnExpressionIntent, I as ColumnIR, L as ColumnType, M as CommonColumnType, O as ComparisonExpressionIntent, Q as ComparisonOperator, R as CompileOnlyAdapter, S as CompileOptions, T as CompileOptionsBase, U as CompileResultWithIncludes, a as CompiledColumnMetadata, V as CompiledNqlQuery, C as CompiledQuery, W as CompilingAdapter, X as ConnectionAvailability, Y as CreateIndexOptions, Z as CteQueryIntent, _ as CustomFnExpressionIntent, $ as CustomOpExpressionIntent, a1 as DDLFeature, a2 as DDLFeatureElementMap, a3 as DDLFeatureVersionRange, a4 as DDLGeneratingAdapter, a5 as DbCasing, a6 as DecisionType, a8 as DialectCapabilities, a9 as DialectName, aa as DiffSummary, ab as DropIndexOptions, ac as DuckDBColumnType, ad as Dump, ae as DumpMeta, af as DumpSequenceStep, ah as EmitJoinClause, ai as EnumIR, aj as ExecutingAdapter, al as FeatureBehaviorConfig, am as FeatureTranslator, an as FeatureWarning, ao as FieldRef, ap as FilterStrategy, ar as FunctionExpressionIntent, as as HierarchyIR, at as IncludeIntent, au as IncludeRecursiveOptions, av as IncludeStrategy, aw as IndexColumnDef, ax as IndexIR, ay as IndexInfo, az as IndexMethod, aA as InsertFromIntent, aC as IntrospectingAdapter, aD as IntrospectionOptions, aE as IntrospectionResult, aF as IsTypeSupported, aG as JoinDefault, aH as JoinIntent, aI as JsonAggOrderByEntry, aJ as JsonContainsIntent, aK as JsonExistsIntent, aL as JsonExtractIntent, aM as JsonPathExtractIntent, aN as LiteralExpressionIntent, aO as LockIntent, aP as LockStrength, aQ as LockWaitPolicy, aR as LogicalIdentity, aS as LogicalIdentityCarrier, aT as LogicalOperator, aU as MSSQLColumnType, aX as MutationReturningItem, aY as MySQLColumnType, aZ as NamedArgExpressionIntent, a_ as NestedOutputReadHandling, a$ as NqlBindingColumnLineage, b0 as NqlBindingColumnTypeInfo, b1 as NqlBindingColumnUntypeableReason, b2 as NqlBindingOutputSchema, b3 as NqlBindingRelationFilterMetadata, N as NqlBindingRelationType, b4 as NqlBindingVirtualRelation, b5 as NqlBindingVirtualRelationHop, b6 as NqlBindingVirtualRelationRecursive, b7 as NqlProgramSequenceStep, b8 as NqlRuntimeBinding, b9 as NullOperator, ba as NullsPosition, bc as OffsetWindowIntent, bd as OnDeleteAction, bf as Optionality, bg as OrderByExpressionIntent, bh as OrderByFieldIntent, bi as OrderByIntent, bj as OutputDescriptor, bk as OutputReadHandling, bl as OutputSource, bm as OutputValueShape, bn as ParamExpressionIntent, bo as ParamIntent, bp as PartitionIR, bq as PinnedConnectionOptions, br as PlanDecision, bs as PlanOptions, P as PlanReport, bt as PlanWarning, bu as PlanWarningCode, bv as PolicyIR, bw as PostgresColumnType, bx as PostgresOnlyColumnType, by as PseudoColumnExpressionIntent, bz as PseudoColumnMetadata, bA as PseudoColumnTraversal, bC as RangeOperand, bD as RangeOperator, bE as RangeValue, bG as RankingWindowIntent, bH as RawCteIntent, bJ as RawSqlAdapter, bK as RecursiveAdvancedOptions, bL as RecursiveDedupe, bM as RecursiveDirection, bN as RecursiveEmitOptions, bO as RecursiveExistsOptions, bQ as RecursiveMetadata, bR as RecursiveNodeIdExpr, bS as RecursivePlanOptions, bT as RecursivePlanReport, bU as RecursiveTrackOptions, bW as RefExpressionIntent, bZ as RelationKind, b_ as RelationOperator, b$ as RelationType, c0 as RequiredEnumLabelIR, c1 as ResolvedIncludeStrategy, c2 as SQLiteColumnType, c3 as SchemaChange, c4 as SchemaDiff, ca as SemanticArtifactId, cc as SequenceIR, cd as SetOperationIntent, ce as SetOperationType, cf as SimpleCteIntent, cg as SortDirection, ch as StarExpressionIntent, ci as StreamingAdapter, cj as StringOperator, ck as SubqueryExpressionIntent, cl as SubqueryIncludeInfo, cn as SupportedColumnTypes, co as TableDDLGeneratorAdapter, cq as TransactionBeginOptions, cr as TransactionOptions, cs as TransactionalAdapter, ct as TranslationContext, cu as TruncateOptions, cw as UnaryExpressionIntent, cx as UnnestCteIntent, cy as UnsupportedFeatureBehavior, cA as UpsertConflictAction, cB as UpsertConflictTarget, cC as UpsertFromIntent, cE as VacuumOptions, cJ as WhereExpressionIntent, cL as WhereInSubqueryIntent, cM as WhereInValueIntent, cO as WhereJsonContainsIntent, cP as WhereJsonExistsIntent, cW as WhereRawExistsIntent, cX as WhereRawNotExistsIntent, d0 as WindowOrderBy, d1 as getNodeIdAlias, d2 as isFieldRef, d3 as isParamIntent, d4 as resolveOutputReadHandling, d5 as toColumnList } from './adapter-CjwnHeg4.js';
+import { bW as RecursiveTraversal, e as AdjacencyTraversal, d2 as WindowFunction, l as AggregateWindowFunction, bb as OffsetWindowFunction, ak as ExpressionIntent, F as CoalesceExpressionIntent, G as ColumnAliasIntent, a0 as CustomTraversal, bC as QueryIntent, bQ as RecursiveIntent, aW as MutationIntent, a7 as DeleteIntent, ag as EdgeTableTraversal, aB as InsertIntent, bG as RankingWindowFunction, bJ as RawExpressionIntent, bY as RelationColumnIntent, c9 as SelectIntent, c6 as SelectAggregateIntent, c7 as SelectAllIntent, c8 as SelectFieldsIntent, ca as SelectWithExpressionsIntent, co as SubqueryRefIntent, cD as UpdateIntent, cH as UpsertIntent, cR as WhereIntent, cJ as WhereAndIntent, cK as WhereAnyIntent, cL as WhereComparisonIntent, cM as WhereExistsIntent, cO as WhereInIntent, cU as WhereLikeIntent, cY as WhereOrIntent, cW as WhereNotIntent, cV as WhereNotExistsIntent, cX as WhereNullIntent, cZ as WhereRangeIntent, d0 as WhereRelationFilterIntent, d1 as WhereSubqueryIntent, d3 as WindowIntent, J as ColumnJsReadType, cr as TableIR, aV as ModelIR, K as ColumnListInput, bZ as RelationIR, aq as ForeignKeyIR, cc as SemanticArtifactRef, cz as TrustRoot, be as OperationKindRef, ct as TableReaddressDeclaration } from './adapter-B057_WKR.js';
+export { A as Adapter, b as AdapterCapabilities, c as AdapterLogger, d as AdapterStreamOptions, f as AggOrderByArg, g as AggregateCountIntent, h as AggregateExpressionIntent, i as AggregateFieldIntent, j as AggregateFunction, k as AggregateIntent, m as AggregateWindowIntent, n as AliasIncludedColumnsMode, o as AlterColumnOptions, p as AmbiguityCheckResult, q as ArithmeticExpressionIntent, r as ArrayExpressionIntent, s as ArrayOperator, t as AuthorAttestedNativeDefault, u as AuthorAttester, B as BaseAdapter, v as BatchUpdateIntent, w as BatchValuesJoinPayload, x as CTEDefinition, y as Cardinality, z as CaseExpressionIntent, D as CastExpressionIntent, E as CheckConstraintIR, H as ColumnExpressionIntent, I as ColumnIR, L as ColumnType, M as CommonColumnType, O as ComparisonExpressionIntent, Q as ComparisonOperator, R as CompileOnlyAdapter, S as CompileOptions, T as CompileOptionsBase, U as CompileResultWithIncludes, a as CompiledColumnMetadata, V as CompiledNqlQuery, C as CompiledQuery, W as CompilingAdapter, X as ConnectionAvailability, Y as CreateIndexOptions, Z as CteQueryIntent, _ as CustomFnExpressionIntent, $ as CustomOpExpressionIntent, a1 as DDLFeature, a2 as DDLFeatureElementMap, a3 as DDLFeatureVersionRange, a4 as DDLGeneratingAdapter, a5 as DbCasing, a6 as DecisionType, a8 as DialectCapabilities, a9 as DialectName, aa as DiffSummary, ab as DropIndexOptions, ac as DuckDBColumnType, ad as Dump, ae as DumpMeta, af as DumpSequenceStep, ah as EmitJoinClause, ai as EnumIR, aj as ExecutingAdapter, al as FeatureBehaviorConfig, am as FeatureTranslator, an as FeatureWarning, ao as FieldRef, ap as FilterStrategy, ar as FunctionExpressionIntent, as as HierarchyIR, at as IncludeIntent, au as IncludeRecursiveOptions, av as IncludeStrategy, aw as IndexColumnDef, ax as IndexIR, ay as IndexInfo, az as IndexMethod, aA as InsertFromIntent, aC as IntrospectingAdapter, aD as IntrospectionOptions, aE as IntrospectionResult, aF as IsTypeSupported, aG as JoinDefault, aH as JoinIntent, aI as JsonAggOrderByEntry, aJ as JsonContainsIntent, aK as JsonExistsIntent, aL as JsonExtractIntent, aM as JsonPathExtractIntent, aN as LiteralExpressionIntent, aO as LockIntent, aP as LockStrength, aQ as LockWaitPolicy, aR as LogicalIdentity, aS as LogicalIdentityCarrier, aT as LogicalOperator, aU as MSSQLColumnType, aX as MutationReturningItem, aY as MySQLColumnType, aZ as NamedArgExpressionIntent, a_ as NestedOutputReadHandling, a$ as NqlBindingColumnLineage, b0 as NqlBindingColumnTypeInfo, b1 as NqlBindingColumnUntypeableReason, b2 as NqlBindingOutputSchema, b3 as NqlBindingRelationFilterMetadata, N as NqlBindingRelationType, b4 as NqlBindingVirtualRelation, b5 as NqlBindingVirtualRelationHop, b6 as NqlBindingVirtualRelationRecursive, b7 as NqlProgramSequenceStep, b8 as NqlRuntimeBinding, b9 as NullOperator, ba as NullsPosition, bc as OffsetWindowIntent, bd as OnDeleteAction, bf as Optionality, bg as OrderByExpressionIntent, bh as OrderByFieldIntent, bi as OrderByIntent, bj as OutputDescriptor, bk as OutputReadHandling, bl as OutputSource, bm as OutputValueShape, bn as ParamExpressionIntent, bo as ParamIntent, bp as PartitionIR, bq as PinnedConnectionOptions, br as PlanDecision, bs as PlanOptions, P as PlanReport, bt as PlanWarning, bu as PlanWarningCode, bv as PolicyIR, bw as PostgresColumnType, bx as PostgresOnlyColumnType, by as PredicateOperator, bz as PseudoColumnExpressionIntent, bA as PseudoColumnMetadata, bB as PseudoColumnTraversal, bD as RangeOperand, bE as RangeOperator, bF as RangeValue, bH as RankingWindowIntent, bI as RawCteIntent, bK as RawSqlAdapter, bL as RecursiveAdvancedOptions, bM as RecursiveDedupe, bN as RecursiveDirection, bO as RecursiveEmitOptions, bP as RecursiveExistsOptions, bR as RecursiveMetadata, bS as RecursiveNodeIdExpr, bT as RecursivePlanOptions, bU as RecursivePlanReport, bV as RecursiveTrackOptions, bX as RefExpressionIntent, b_ as RelationKind, b$ as RelationOperator, c0 as RelationType, c1 as RequiredEnumLabelIR, c2 as ResolvedIncludeStrategy, c3 as SQLiteColumnType, c4 as SchemaChange, c5 as SchemaDiff, cb as SemanticArtifactId, cd as SequenceIR, ce as SetOperationIntent, cf as SetOperationType, cg as SimpleCteIntent, ch as SortDirection, ci as StandaloneWhereExpressionIntent, cj as StarExpressionIntent, ck as StreamingAdapter, cl as StringOperator, cm as SubqueryExpressionIntent, cn as SubqueryIncludeInfo, cp as SupportedColumnTypes, cq as TableDDLGeneratorAdapter, cs as TableReaddressAddress, cu as TransactionBeginOptions, cv as TransactionOptions, cw as TransactionalAdapter, cx as TranslationContext, cy as TruncateOptions, cA as UnaryExpressionIntent, cB as UnnestCteIntent, cC as UnsupportedFeatureBehavior, cE as UpsertConflictAction, cF as UpsertConflictTarget, cG as UpsertFromIntent, cI as VacuumOptions, cN as WhereExpressionIntent, cP as WhereInSubqueryIntent, cQ as WhereInValueIntent, cS as WhereJsonContainsIntent, cT as WhereJsonExistsIntent, c_ as WhereRawExistsIntent, c$ as WhereRawNotExistsIntent, d4 as WindowOrderBy, d5 as getNodeIdAlias, d6 as isFieldRef, d7 as isParamIntent, d8 as resolveOutputReadHandling, d9 as toColumnList } from './adapter-B057_WKR.js';
 
 /**
  * NQL-origin SELECT function allowlist.
@@ -203,6 +203,10 @@ declare function resolveJsonAggOrderKey(table: TableIR): JsonAggOrderKey;
  */
 interface LoadedSchema {
     readonly definition: Record<string, unknown>;
+    /** Retained schema() inputs used when per-object declarations are sliced. */
+    readonly constraints?: unknown;
+    readonly extras?: unknown;
+    readonly options?: unknown;
     readonly model: ModelIR;
     readonly tableNames: readonly string[];
 }
@@ -252,18 +256,46 @@ interface FingerprintManifest {
     readonly digest: string;
 }
 
-type JsonValue = null | boolean | number | string | readonly JsonValue[] | {
+type JsonObject = {
     readonly [k: string]: JsonValue;
 };
+type JsonValue = null | boolean | number | string | readonly JsonValue[] | JsonObject;
 
+/** The managed catalogue kinds. This union is intentionally closed. */
+type DeclarableKind = 'table' | 'column' | 'index' | 'constraint' | 'enum' | 'sequence' | 'extension';
+/** Adapter-owned, versioned durable catalogue identity. */
+interface CatalogueIdentity {
+    readonly engine: string;
+    readonly format: number;
+    readonly value: JsonObject;
+}
+/**
+ * The durable PostgreSQL role identity which controls a managed ledger entry.
+ * A role name alone is reusable after DROP/CREATE; the OID binds the record to
+ * the role that was actually present when the event was written.
+ */
+interface ControllerIdentity {
+    readonly name: string;
+    readonly oid: string;
+}
+/** Compare the complete durable controller identity in one place. */
+declare function sameControllerIdentity(recorded: ControllerIdentity, current: ControllerIdentity): boolean;
 interface ResourceAddress {
     readonly engine: string;
     readonly database: string;
     readonly schema?: string;
+    /** The containing object, for example an index or column's table. */
+    readonly parent?: ResourceAddress;
     readonly kind: string;
     readonly name: string;
+    /** Recorded catalogue identity. It is absent only for legacy/non-managed scope. */
+    readonly catalogueIdentity?: CatalogueIdentity;
     readonly qualifiedBy?: readonly string[];
 }
+/** A managed declaration cannot spell a kind outside the declarable set. */
+type DeclarableResourceAddress<K extends DeclarableKind = DeclarableKind> = Omit<ResourceAddress, 'kind'> & {
+    readonly kind: K;
+};
 interface ResourceSelector {
     readonly kind?: string;
     readonly schema?: string;
@@ -369,7 +401,7 @@ interface ProofObligation {
 }
 interface Assumption {
     readonly id: AssumptionId;
-    readonly class: 'rule-effect-declaration' | 'user-blast-radius' | 'external-ddl-exclusion' | 'operation-pack-semantics' | 'baseline-identity-attachment' | (string & {});
+    readonly class: 'rule-effect-declaration' | 'user-blast-radius' | 'external-ddl-exclusion' | 'operation-pack-semantics' | 'baseline-identity-attachment' | 'non-transactional-segment' | (string & {});
     readonly asserter: TrustRoot;
     readonly statement: string;
     readonly scope: readonly ResourceAddress[];
@@ -491,6 +523,13 @@ interface ExternalEffectCoverage {
 }
 type OperationExecutionOutcome = {
     readonly kind: 'completed';
+} | {
+    readonly kind: 'recovery-required';
+    readonly claimId: string;
+    readonly detail: string;
+} | {
+    readonly kind: 'transport-ambiguous';
+    readonly detail: string;
 } | {
     readonly kind: 'guard-failed';
     readonly guard: ApplyGuard;
@@ -655,6 +694,43 @@ type InapplicableAssessment = PlanAssessment & {
     readonly decision: 'inapplicable';
 };
 
+interface AssumptionAcceptance {
+    readonly class: string;
+    readonly fromTrustRoot?: TrustRoot;
+    readonly withinScope?: readonly ResourceSelector[];
+}
+interface ApplyPolicy {
+    readonly accepts: readonly AssumptionAcceptance[];
+}
+/**
+ * The scoped approvals carried into admitted execution.  This distinct input
+ * prevents execution boundaries from silently degrading reviewed scope to a
+ * bare list of approval-class strings.
+ */
+interface ScopedApprovalSet {
+    readonly approvals: readonly AssumptionAcceptance[];
+    /** The authority root declared for this admitted policy evaluation. */
+    readonly declaredTrustRoot?: TrustRoot;
+}
+
+/**
+ * The closed set of durable declarative fragments.  Consumers receive this
+ * type rather than a stringly kind so an undeclarable surface is impossible to
+ * express without extending the one union above.
+ */
+interface ManagedDeclaration<K extends DeclarableKind = DeclarableKind> {
+    readonly address: DeclarableResourceAddress<K>;
+    readonly fragment: JsonValue;
+    /** SHA-256 of the canonical parsed fragment, never of storage bytes. */
+    readonly digest: string;
+}
+interface DeclarationSet {
+    readonly version: 1;
+    readonly declarations: readonly ManagedDeclaration[];
+    /** SHA-256 of the canonical parsed declaration set. */
+    readonly digest: string;
+}
+
 /**
  * Durable, reviewed conditions for executing a serialized transition plan.
  *
@@ -704,24 +780,566 @@ interface ExecutionContract {
     readonly requirements: readonly ExecutionRequirement[];
 }
 
+/** The unit-9/SC-64 vocabulary is the one source for durable refusal prose. */
+declare const REFUSAL_VOCABULARY: {
+    readonly 'ERR-01': {
+        readonly cause: "unaccepted non-transactional segment";
+        readonly withheldAuthority: "non-transactional execution authority";
+        readonly resolvingCommand: "dbsp apply";
+    };
+    readonly 'ERR-02': {
+        readonly cause: "pre-existing object has no admitted adoption";
+        readonly withheldAuthority: "creation authority over an occupied address";
+        readonly resolvingCommand: "dbsp apply";
+    };
+    readonly 'ERR-03': {
+        readonly cause: "managed-ledger preflight is not current";
+        readonly withheldAuthority: "managed-ledger mutation authority";
+        readonly resolvingCommand: "dbsp preflight --reinitialize";
+    };
+    readonly 'ERR-04': {
+        readonly cause: "removal containment cannot be proven";
+        readonly withheldAuthority: "destructive removal authority";
+        readonly resolvingCommand: "dbsp apply";
+    };
+    readonly 'ERR-05': {
+        readonly cause: "recorded identity differs from the live object";
+        readonly withheldAuthority: "managed mutation authority";
+        readonly resolvingCommand: "dbsp apply";
+    };
+    readonly 'ERR-06': {
+        readonly cause: "managed-ledger lineage does not match this target";
+        readonly withheldAuthority: "managed-ledger mutation authority";
+        readonly resolvingCommand: "dbsp preflight --reinitialize";
+    };
+    readonly 'ERR-07': {
+        readonly cause: "target database is read-only";
+        readonly withheldAuthority: "database write authority";
+        readonly resolvingCommand: "dbsp apply";
+    };
+    readonly 'ERR-08': {
+        readonly cause: "ledger chain is malformed";
+        readonly withheldAuthority: "managed mutation authority";
+        readonly resolvingCommand: "dbsp inspect";
+    };
+    readonly 'ERR-09': {
+        readonly cause: "catalogue read is unavailable";
+        readonly withheldAuthority: "outcome classification authority";
+        readonly resolvingCommand: "dbsp reconcile";
+    };
+    readonly 'ERR-10': {
+        readonly cause: "recorded-plan path cannot execute a removal";
+        readonly withheldAuthority: "recorded-plan removal execution";
+        readonly resolvingCommand: "dbsp apply";
+    };
+    readonly 'ERR-11': {
+        readonly cause: "recovery proved the interrupted operation had no effect";
+        readonly withheldAuthority: "recovery execution authority";
+        readonly resolvingCommand: "dbsp reconcile";
+    };
+};
+type RefusalCode = keyof typeof REFUSAL_VOCABULARY;
+/** Bind a catalogue entry to the address state that existed at refusal time. */
+declare function refusalFor(code: RefusalCode, input: Pick<LedgerRefusal, 'state'> & {
+    readonly address?: LedgerAddress;
+}): LedgerRefusal;
+
+/** The outcome protocol is closed at the fourteen ADR 0006 event kinds. */
+declare const LEDGER_EVENT_KINDS: readonly ["adopt-intent", "adopt", "intent", "retire-intent", "readdress-intent", "refused", "executing", "observed", "absent", "indeterminate", "resolved", "readdressed-to", "readdressed-from", "released"];
+type LedgerEventKind = (typeof LEDGER_EVENT_KINDS)[number];
+type LedgerClaimKind = Extract<LedgerEventKind, 'adopt-intent' | 'intent' | 'retire-intent' | 'readdress-intent'>;
 /**
- * ProvenPlanShape is the serializable audit/dump shape of a plan the prover can
- * derive. It is not an apply credential: runtime safety comes from @dbsp/core
- * apply() accepting only an InProcessProvenPlan minted by this module instance's
- * prove() through a module-private WeakSet identity capability plus deep-freeze.
- *
- * A serialized, cloned, or hand-forged shape is not authorized for apply(). A
- * separate future adoptSerializedPlan(serialized, observationContext) API
- * (stage: identity & adoption) will re-derive an in-process plan from fresh
- * observations; apply() must not be overloaded to accept serialized data.
+ * A canonical address is recorded as columns by PostgreSQL and as this shape at
+ * the adapter boundary.  `scope` selects exactly one physical ledger.
+ */
+interface LedgerAddress extends ResourceAddress {
+    readonly scope: 'schema' | 'database';
+}
+/**
+ * Construct the one parent shape used by ledger-bearing child addresses.
  *
- * The derived plan shape is expected to satisfy these relational invariants,
- * which are beyond structural typing:
- * - Every ApplyGuard.appliesTo and ProofObligation.appliesTo matches exactly one PhysicalOperation.ref in the same step/fragment (no dangling or duplicate ref).
- * - Every external-ddl-exclusion binding's AssumptionId is present in the step's restsOnAssumptions closure and in GuardedPlan.assumptions.
- * - Journal record stepIds are consistent with intent.stepId; ApplyResult.observations is a superset of every ObservedOutcomeRecord.observations.
+ * A parent identifies containment only. Ledger scope belongs to the child
+ * address, while a catalogue identity is an observed, non-address fact. Keep
+ * both out of this recursive serialization so every producer names a physical
+ * child the same way.
+ */
+declare function canonicalResourceParent(address: ResourceAddress): ResourceAddress;
+/**
+ * The sole structural equality for a ledger address.  Parent absence is
+ * canonicalized so `undefined` and `null` mean the same root address.
+ */
+declare function sameLedgerAddress(left: LedgerAddress, right: LedgerAddress): boolean;
+/** A canonical map key with the same key-order-insensitive parent semantics. */
+declare function ledgerAddressKey(address: LedgerAddress): string;
+/**
+ * Canonical parent representation for PostgreSQL's `address_parent` column.
+ * Catalogue observations never create another physical ledger address.
+ */
+declare function ledgerAddressParentJson(address: LedgerAddress): string;
+interface LedgerPayload {
+    readonly value: JsonValue;
+    readonly digest: string;
+}
+/**
+ * The durable, operator-facing explanation attached to a `refused` terminal.
+ * The address itself remains in the event's canonical address columns; these
+ * values preserve the other facts needed to explain a historic refusal.
+ */
+interface LedgerRefusal {
+    /** Closed durable vocabulary; stored strings are validated at the reader. */
+    readonly code: RefusalCode;
+    readonly cause: string;
+    readonly state: 'unknown' | 'managed' | 'absent';
+    readonly withheldAuthority: string;
+    readonly resolvingCommand: string;
+}
+interface LedgerChainMember {
+    readonly eventId: string;
+    readonly executionId?: string;
+    readonly plannedClaimKey?: string;
+    readonly claimGroupId?: string;
+    readonly rootClaimId?: string;
+    readonly address: LedgerAddress;
+    readonly catalogueIdentity?: CatalogueIdentity;
+    readonly eventKind: LedgerEventKind;
+    readonly predecessor?: string;
+    readonly pairId?: string;
+    readonly declared?: LedgerPayload;
+    readonly observed?: LedgerPayload;
+    /** Present exactly on a durable `refused` terminal. */
+    readonly refusal?: LedgerRefusal;
+    readonly controller: string;
+    /** The durable OID paired with `controller` when the event was recorded. */
+    readonly controllerOid?: string;
+    readonly recordedAt?: string;
+}
+/** A durable effects-closure reservation, anchored in its root claim's ledger. */
+interface LedgerReservationRow {
+    readonly address: LedgerAddress;
+    readonly claimKind: LedgerClaimKind;
+    readonly executionId: string;
+    readonly pairId?: string;
+    readonly rootClaimId: string;
+    readonly homeLedger: LedgerHome;
+}
+interface LedgerHome {
+    readonly scope: 'schema' | 'database';
+    /** Present exactly for a schema ledger. */
+    readonly schema?: string;
+}
+/** The lineage facts stored beside every ledger; their admission rules ship later. */
+interface LedgerIdentity {
+    readonly clusterSystemIdentifier: string;
+    readonly databaseOid: string;
+    readonly namespaceOid?: string;
+}
+interface LedgerShapeMarker {
+    readonly version: number;
+}
+/**
+ * The only marker vocabulary understood by the reinitialize-preflight path.
+ * `absent` is deliberately distinct from a malformed or old marker: a
+ * missing marker is how a new scope enters the cutover.
+ */
+type LedgerMarkerState = {
+    readonly kind: 'current';
+} | {
+    readonly kind: 'absent';
+} | {
+    readonly kind: 'older';
+    readonly version: number;
+} | {
+    readonly kind: 'future';
+    readonly version: number;
+} | {
+    readonly kind: 'mixed';
+    readonly versions: readonly number[];
+} | {
+    readonly kind: 'unreadable';
+    readonly reason: string;
+};
+/** The closed result set for one explicit reinitialize-preflight scope. */
+type ReinitializePreflightScopeOutcome = 'current' | 'unchanged' | 'failed' | 'not-attempted';
+type ReinitializePreflightRefusalCode = 'database-read-only' | 'reinitialize-preflight-marker-not-current' | 'reinitialize-preflight-advisory-lock' | 'reinitialize-preflight-ownership' | 'reinitialize-preflight-grants' | 'reinitialize-preflight-lineage' | 'reinitialize-preflight-failed';
+/** The exact operation that produced a reported preflight failure. */
+type ReinitializePreflightFailureStep = 'advisory-lock' | 'marker' | 'identity' | 'ownership-grants' | 'archive' | 'create' | 'record-identity' | 'creation-grants' | 'write-marker' | 'output';
+/** PostgreSQL's unmodified message, paired with the engine step that failed. */
+interface ReinitializePreflightFailureReason {
+    readonly step: ReinitializePreflightFailureStep;
+    readonly message: string;
+}
+interface ReinitializePreflightScopeReportBase {
+    readonly ledger: LedgerHome;
+    readonly marker: LedgerMarkerState;
+    readonly refusal?: {
+        readonly code: ReinitializePreflightRefusalCode;
+        readonly detail: string;
+    };
+}
+/** A failed scope is structurally required to retain its diagnostic. */
+type ReinitializePreflightScopeReport = (ReinitializePreflightScopeReportBase & {
+    readonly outcome: 'failed';
+    readonly reason: ReinitializePreflightFailureReason;
+}) | (ReinitializePreflightScopeReportBase & {
+    readonly outcome: Exclude<ReinitializePreflightScopeOutcome, 'failed'>;
+    readonly reason?: never;
+});
+/** A current DSL declaration for which no chain exists in its home ledger. */
+interface ReinitializePreflightAdoptionCandidate {
+    readonly address: LedgerAddress;
+    readonly declaration: LedgerPayload;
+}
+interface ReinitializePreflightReport {
+    readonly scopes: readonly ReinitializePreflightScopeReport[];
+    readonly adoptionCandidates: readonly ReinitializePreflightAdoptionCandidate[];
+}
+
+/** The only durable management states an address can have. */
+type LedgerStableState = 'unknown' | 'managed' | 'absent';
+/** A claim is open until its own grammar column closes it. */
+interface LedgerOpenClaim {
+    readonly event: LedgerChainMember;
+    readonly kind: LedgerClaimKind;
+    readonly stableStateBeforeClaim: LedgerStableState;
+    readonly phase: 'claimed' | 'executing' | 'indeterminate';
+}
+/** What readers present: stable state plus any still-open claim. */
+type LedgerReportedState = {
+    readonly kind: LedgerStableState;
+} | {
+    readonly kind: 'pending';
+    readonly stableState: LedgerStableState;
+    readonly claim: LedgerOpenClaim;
+} | {
+    readonly kind: 'blocked';
+    readonly stableState: LedgerStableState;
+    readonly claim: LedgerOpenClaim;
+};
+/** The legal lifecycle grammar is deliberately a closed, per-claim matrix. */
+interface LedgerLifecycleGrammarColumn {
+    readonly claimKind: LedgerClaimKind;
+    readonly opensFrom: readonly LedgerStableState[];
+    readonly resolvesThrough: readonly LedgerEventKind[];
+}
+interface ProjectedLedgerChain {
+    readonly kind: 'projected-ledger-chain';
+    readonly ledger: LedgerHome;
+    readonly address: LedgerAddress;
+    readonly events: readonly LedgerChainMember[];
+    readonly stableState: LedgerStableState;
+    readonly openClaim?: LedgerOpenClaim;
+    readonly reportedState: LedgerReportedState;
+    /** The last declaration fact recorded by a claim chain, if any. */
+    readonly declaration?: LedgerPayload;
+    /** The last read-back recorded by a claim chain, if any. */
+    readonly observation?: LedgerPayload;
+}
+type UnprojectableChainReason = {
+    readonly code: 'cycle';
+    readonly eventIds: readonly string[];
+} | {
+    readonly code: 'missing-predecessor';
+    readonly eventId: string;
+    readonly predecessor: string;
+} | {
+    readonly code: 'fork';
+    readonly predecessor?: string;
+    readonly eventIds: readonly string[];
+} | {
+    readonly code: 'unknown-event-kind';
+    readonly eventId: string;
+    readonly eventKind: string;
+} | {
+    readonly code: 'address-mismatch';
+    readonly eventId: string;
+} | {
+    readonly code: 'duplicate-event-id';
+    readonly eventId: string;
+} | {
+    readonly code: 'invalid-lifecycle-edge';
+    readonly eventId: string;
+    readonly detail: string;
+};
+/**
+ * A degraded read is data, not an exception. Its required reason lets every
+ * mutation fail closed while inspect-like readers can still display the chain.
+ */
+interface UnprojectableLedgerChain {
+    readonly kind: 'unprojectable-ledger-chain';
+    readonly ledger: LedgerHome;
+    readonly address: LedgerAddress;
+    readonly events: readonly LedgerChainMember[];
+    readonly reason: UnprojectableChainReason;
+    readonly codeVersion: 1;
+}
+type LedgerChainProjection = ProjectedLedgerChain | UnprojectableLedgerChain;
+
+/** A planned managed statement has a stable position inside its claim bundle. */
+interface ClaimBundleStatement {
+    readonly ordinal: number;
+    readonly sql: string;
+}
+/**
+ * The complete ordered set of statements a claim may execute.  It is supplied
+ * by planning and never extended by the execution path.
+ */
+interface ClaimStatementBundle {
+    readonly statements: readonly ClaimBundleStatement[];
+}
+/** A cascade-covered claim records a member fact but never executes SQL. */
+interface EmptyClaimStatementBundle {
+    readonly statements: readonly [];
+}
+/**
+ * Opaque capability minted only by the core claim-admission boundary.
+ * Its members are intentionally not public: adapters present it to core rather
+ * than reconstructing a claim identity from data controlled by a caller.
+ */
+declare const claimTokenBrand: unique symbol;
+interface ClaimToken {
+    readonly [claimTokenBrand]: 'dbsp-outcome-claim-token';
+}
+/**
+ * Opaque execution authority minted only after an adapter has admitted a live
+ * operation.  It deliberately has no structural fields a caller can supply.
+ */
+declare const admittedPermitBrand: unique symbol;
+interface AdmittedPermit {
+    readonly [admittedPermitBrand]: 'dbsp-admitted-permit';
+}
+/** Fields shared by every fixed plan-time outcome claim. */
+interface OutcomeClaimPlanBase {
+    readonly claimId: string;
+    /** One actual apply attempt; deliberately distinct from the persisted run id. */
+    readonly executionId?: string;
+    /** Digest-covered logical position of this claim in the reviewed plan. */
+    readonly plannedClaimKey?: string;
+    /** The atomic closure identity; a single-address claim uses its root claim id. */
+    readonly claimGroupId?: string;
+    readonly address: LedgerAddress;
+    readonly claimKind: LedgerClaimKind;
+    /**
+     * A creation verifies that its target address remains vacant before DDL.
+     * Absent only on plans written before this material was introduced.
+     */
+    readonly requiresVacancy?: boolean;
+    readonly declared?: LedgerPayload;
+    readonly pairId?: string;
+}
+/** A claim that owns a manifest-bound SQL bundle. */
+interface SqlBearingOutcomeClaimPlan extends OutcomeClaimPlanBase {
+    readonly claimSpecies: 'sql-bearing';
+    readonly rootClaimId?: string;
+    readonly statementBundle: ClaimStatementBundle;
+}
+/** Adoption records a present live object but deliberately sends no SQL. */
+interface AdoptionOutcomeClaimPlan extends OutcomeClaimPlanBase {
+    readonly claimSpecies: 'adoption';
+    readonly rootClaimId?: string;
+    readonly claimKind: 'adopt-intent';
+    readonly statementBundle: EmptyClaimStatementBundle;
+}
+/** A closure member whose terminal fact is covered by its root claim's SQL. */
+interface CascadeCoveredOutcomeClaimPlan extends OutcomeClaimPlanBase {
+    readonly claimSpecies: 'cascade-covered';
+    /** The SQL-bearing destructive root that covers this member. */
+    readonly rootClaimId: string;
+    readonly statementBundle: EmptyClaimStatementBundle;
+}
+/** The fixed plan-time material that becomes one ledger claim. */
+type OutcomeClaimPlan = SqlBearingOutcomeClaimPlan | AdoptionOutcomeClaimPlan | CascadeCoveredOutcomeClaimPlan;
+/** The only successful result of admission, including its single-use token. */
+interface AdmittedOutcomeClaim {
+    readonly kind: 'admitted-outcome-claim';
+    readonly plan: OutcomeClaimPlan;
+    readonly stableStateBeforeClaim: LedgerStableState;
+    readonly token: ClaimToken;
+}
+/** Every refusal retains the subject's server or admission words. */
+interface OutcomeProtocolRefusal {
+    readonly kind: 'outcome-protocol-refused';
+    readonly reason: string;
+}
+type OutcomeClaimAdmission = AdmittedOutcomeClaim | OutcomeProtocolRefusal;
+/** A typed live-vacancy result supplied by the catalogue-specific reader. */
+type OutcomeVacancy = {
+    readonly kind: 'vacant';
+} | {
+    readonly kind: 'occupied';
+    readonly reason: string;
+};
+/** A projected chain is always supplied to core admission as one unit. */
+interface OutcomeClaimAdmissionInput {
+    readonly plan: OutcomeClaimPlan;
+    readonly projection: LedgerChainProjection;
+    /** Current role read by the adapter on the locked claiming session. */
+    readonly currentController?: ControllerIdentity;
+    /** Fresh locked catalogue identity for an existing managed address. */
+    readonly liveAddress?: LedgerAddress;
+}
+/** Typed catalogue evidence used by outcome-protocol recovery. */
+type OutcomeRecoveryEffect = 'applied' | 'no-effect' | 'unverifiable';
+type OutcomeRecoveryReadBack = {
+    readonly kind: 'absent';
+    readonly effect?: OutcomeRecoveryEffect;
+} | {
+    readonly kind: 'present';
+    readonly catalogueIdentity: CatalogueIdentity;
+    /** The canonical shape read from the live catalogue. */
+    readonly observed: LedgerPayload;
+    /** Operation-specific read-back when the catalogue presence is insufficient. */
+    readonly effect?: OutcomeRecoveryEffect;
+};
+/** A failed read is evidence of nothing, and therefore permits no append. */
+interface OutcomeCatalogueUnavailable {
+    readonly kind: 'catalogue-unavailable';
+    readonly reason: string;
+}
+type OutcomeRecoveryCatalogueRead = OutcomeRecoveryReadBack | OutcomeCatalogueUnavailable;
+/** The catalogue boundary is injected so core has no database dependency. */
+type OutcomeRecoveryCatalogueReader = (address: LedgerAddress) => Promise<OutcomeRecoveryCatalogueRead>;
+/** A recovery append has one canonical predecessor/payload comparison shape. */
+interface OutcomeRecoveryResolution {
+    readonly eventKind: 'refused' | 'observed' | 'absent' | 'indeterminate' | 'resolved';
+    readonly predecessor: string;
+    readonly rootClaimId: string;
+    readonly reason: string;
+    readonly readBack: OutcomeRecoveryReadBack;
+    /** Present exactly when recovery closes the open claim as refused. */
+    readonly refusal?: LedgerRefusal;
+}
+type OutcomeRecoveryClassification = {
+    readonly kind: 'outcome-recovery-append';
+    readonly address: LedgerAddress;
+    readonly resolution: OutcomeRecoveryResolution;
+} | {
+    readonly kind: 'outcome-recovery-pending';
+    readonly address: LedgerAddress;
+    readonly reason: string;
+    /** A catalogue failure is a named pre-append refusal, not a retry hint. */
+    readonly reasonCode?: 'catalogue-unavailable';
+} | {
+    readonly kind: 'outcome-recovery-blocked';
+    readonly address: LedgerAddress;
+    readonly reason: string;
+} | {
+    readonly kind: 'outcome-recovery-no-open-claim';
+    readonly address: LedgerAddress;
+} | {
+    readonly kind: 'outcome-recovery-malformed-chain';
+    readonly address: LedgerAddress;
+    readonly reason: string;
+};
+/**
+ * Claim-bound evidence required before an interrupted creation or modification
+ * can be attributed to DBSP. The adapter reconstructs these values from the
+ * durable run, admitted operation and scoped authorization while holding its
+ * run and ledger locks; a same-name catalogue object is never this evidence.
  */
+interface OutcomeIndeterminateRecoveryEvidence {
+    readonly runId: string;
+    readonly planDigest: string;
+    readonly executionId: string;
+    readonly claimId: string;
+    readonly plannedClaimKey?: string;
+    /** Digest recorded when the exact admitted statement bundle was minted. */
+    readonly admittedBundleDigest: string;
+    /** Digest re-read from the persisted operation at resolution time. */
+    readonly persistedBundleDigest: string;
+    readonly recordedPreState: 'unknown' | 'managed' | 'absent';
+    readonly externalDdlExclusion: {
+        readonly planDigest: string;
+        readonly address: LedgerAddress;
+        readonly trustRoot: string;
+    };
+}
+interface OutcomeRecoveryInput {
+    readonly projection: LedgerChainProjection;
+    readonly catalogue: OutcomeRecoveryCatalogueReader;
+    /** Accepted with the interrupted run, never inferred from a current policy. */
+    readonly acceptedExternalDdlExclusion: boolean;
+    /** Required for resolving an indeterminate creation or modification. */
+    readonly indeterminateEvidence?: OutcomeIndeterminateRecoveryEvidence;
+    /** Only an explicit reconciliation path may close an indeterminate claim. */
+    readonly resolveIndeterminate?: boolean;
+}
 
+/**
+ * The generator and recorded transition planner share this immutable execution
+ * vocabulary.  It intentionally does not reuse GuardedPlanStep: generated DDL
+ * has no transition-operation graph or fingerprint protocol, but it must carry
+ * the complete claim, SQL, selection, and replay contract before it is shown.
+ */
+type ManagedStepClassification = 'non-destructive' | 'removal' | 'data-destructive' | 'paired-readdress';
+type ManagedStepReplayPolicy = 'recorded' | 'fresh-live-only';
+interface ManagedStepClosureMember {
+    readonly plannedClaimKey: string;
+    readonly address: DeclarableResourceAddress & {
+        readonly scope: 'schema' | 'database';
+    };
+}
+interface ManagedStepSelectionRequirement {
+    readonly kind: 'replacement' | 'adoption' | 'readdress' | 'optional-action';
+    readonly selector: string;
+}
+/**
+ * Reviewed lifecycle material.  It lives beside the claim and SQL in the
+ * normalized manifest; generator provenance is never an execution source.
+ */
+type ManagedStepLifecycle = {
+    readonly kind: 'adoption';
+    readonly shape: TableIR;
+} | {
+    readonly kind: 'adoption-refused';
+} | {
+    readonly kind: 'readdress';
+    readonly declaration: TableReaddressDeclaration;
+};
+/** A digest-covered, ordered unit of managed DDL. */
+interface NormalizedManagedStep {
+    readonly stepKey: string;
+    readonly order: number;
+    readonly segmentId: string;
+    readonly dependencyOrder: readonly string[];
+    /** Root address, unless the operation declares a destructive closure root. */
+    readonly address?: DeclarableResourceAddress & {
+        readonly scope: 'schema' | 'database';
+    };
+    readonly closure?: {
+        readonly root: DeclarableResourceAddress & {
+            readonly scope: 'schema' | 'database';
+        };
+        readonly members: readonly ManagedStepClosureMember[];
+    };
+    readonly claimKind: LedgerClaimKind;
+    readonly plannedClaimKeys: readonly string[];
+    readonly statementBundle: ClaimStatementBundle;
+    readonly classification: ManagedStepClassification;
+    readonly requiresVacancy: boolean;
+    readonly expectedDeclaration?: LedgerPayload;
+    readonly expectedCatalogueIdentity?: CatalogueIdentity;
+    readonly selection?: ManagedStepSelectionRequirement;
+    readonly lifecycle?: ManagedStepLifecycle;
+    readonly replayPolicy: ManagedStepReplayPolicy;
+}
+/**
+ * Immutable managed-outcome material carried by a plan step.  It is produced
+ * while proving, covered by the plan digest, and is the only source an
+ * executor may use for the address or statement bundle of a managed claim.
+ */
+interface ManagedStepClaimMaterial {
+    /** Legacy plan-local label retained for serialized-plan compatibility; never a ledger event id. */
+    readonly claimId: string;
+    /** Stable only inside this persisted plan; execution mints the claim id. */
+    readonly plannedClaimKey: string;
+    readonly address: DeclarableResourceAddress & {
+        readonly scope: 'schema' | 'database';
+    };
+    readonly claimKind: LedgerClaimKind;
+    readonly statementBundle: ClaimStatementBundle;
+    /** True only when the plan writes an address it did not read. */
+    readonly requiresVacancy: boolean;
+}
 interface ExecutableAssertion {
     readonly proposition: Proposition;
     readonly scope: readonly ResourceAddress[];
@@ -729,6 +1347,8 @@ interface ExecutableAssertion {
 interface DurableIntentRecord {
     readonly runId?: string;
     readonly run?: TransitionRunMetadata;
+    /** One apply attempt, deliberately distinct from the durable reviewed run. */
+    readonly executionId?: string;
     readonly stepId: string;
     readonly operation: PhysicalOperation;
     readonly recordedAt: string;
@@ -751,6 +1371,8 @@ interface TransitionRunMetadata {
     readonly databaseId: string;
     readonly coreVersion: string;
     readonly startedAt: string;
+    /** Generator removal runs are inspectable but must be freshly re-planned. */
+    readonly replayability?: 'replayable' | 'non-replayable-generator-removal';
 }
 type TransitionJournalEventName = 'intent' | 'completion' | 'observed';
 type TransitionJournalEventRecord = DurableIntentRecord | TransactionalCompletionRecord | StepJournal;
@@ -767,6 +1389,24 @@ interface TransitionJournalEvent {
 interface TransitionRunJournal {
     readonly run: TransitionRunMetadata;
     readonly events: readonly TransitionJournalEvent[];
+    /** Run-level approval records are deliberately not step attempts. */
+    readonly authorizations?: readonly TransitionRunAuthorization[];
+}
+/**
+ * The audit record made before a durable plan may begin execution.  Keeping it
+ * outside the step event stream means a crash after authorization is retryable:
+ * pristine means no intent, completion, or observed step event.
+ */
+interface TransitionRunAuthorization {
+    readonly runId: string;
+    readonly policy: readonly AssumptionAcceptance[];
+    readonly grants: readonly {
+        readonly assumptionId: string;
+        readonly grant: number;
+    }[];
+    readonly digest: string;
+    readonly actor: string;
+    readonly authorizedAt: string;
 }
 type StepOutcome = 'completed' | 'guard-failed' | 'guard-timeout' | 'context-mismatch' | 'operation-failed-not-applied' | 'partially-applied' | 'unknown-step-result';
 interface StepJournalBase {
@@ -806,6 +1446,8 @@ interface GuardedPlanStep {
     readonly guards: readonly ApplyGuard[];
     readonly restsOnAssumptions: readonly AssumptionId[];
     readonly selectionRationale: RuleSelectionRationale;
+    /** Present exactly for a managed DDL operation with a fixed plan-time sink. */
+    readonly managedClaim?: ManagedStepClaimMaterial;
 }
 interface GuardedPlanSegment {
     readonly segmentId: string;
@@ -822,7 +1464,11 @@ interface GuardedPlan {
     readonly segments: readonly GuardedPlanSegment[];
     readonly steps: readonly GuardedPlanStep[];
     readonly postconditions: readonly ExecutableAssertion[];
-    /** Present on plans emitted by current `dbsp plan` and covered by its digest. */
+    /**
+     * Present on plans emitted by current `dbsp plan`.  It remains optional in
+     * the TypeScript shape solely so recovery can read historic documents; new
+     * execution rejects an absent contract before taking intent.
+     */
     readonly executionContract?: ExecutionContract;
 }
 type ProvenGuardProtocol = Exclude<GuardProtocol, {
@@ -836,6 +1482,11 @@ interface ProvenPlanStep extends Omit<GuardedPlanStep, 'guards'> {
 }
 interface ProvenPlanShape extends Omit<GuardedPlan, 'steps'> {
     readonly steps: readonly ProvenPlanStep[];
+    /**
+     * Present on newly persisted declarative runs. It is inside the plan document
+     * deliberately: the plan digest therefore covers the declaration set.
+     */
+    readonly declarations?: DeclarationSet;
 }
 /**
  * Plain serializable audit/dump format. A future
@@ -844,6 +1495,10 @@ interface ProvenPlanShape extends Omit<GuardedPlan, 'steps'> {
  */
 type SerializedProvenPlan = ProvenPlanShape;
 
+/** Stable phase-owned result of a durable apply attempt. */
+type DurableApplyOutcome = 'completed' | 'operation-failed-not-applied' | 'partially-applied' | 'unknown-step-result' | 'outcome-unknown' | 'guard-failed' | 'guard-timeout' | 'context-mismatch' | 'transactional-only-refusal' | 'digest-mismatch' | 'prior-step-events-refusal' | 'compatibility-refusal' | 'assumption-not-accepted' | 'authorization-write-failed' | 'execution-contract-refused' | 'execution-preflight-failed' | 'execution-failed' | 'operation-unavailable' | 'plan-validation-failed' | 'run-id-mismatch' | 'load-failed' | 'plan-digest-mismatch' | 'database-read-only' | 'recovery-required' | 'transport-ambiguous';
+/** Stable phase-owned result of recovery classification. */
+type RecoveryOutcome = 'completed' | 'recovery-resume-required' | 'recovery-partially-applied' | 'recovery-unknown-step-result' | 'recovery-guard-failed' | 'recovery-guard-timeout' | 'recovery-operation-failed-not-applied' | 'recovery-context-mismatch' | 'recovery-read-failed';
 interface ApplyResult {
     readonly assessment: PlanAssessment;
     readonly journals: readonly StepJournal[];
@@ -853,6 +1508,19 @@ interface ApplyResult {
         readonly protocol: ProvenGuardProtocol['kind'];
         readonly artefact: RecoveryArtefact;
     }[];
+    /** Present only on the durable-apply entry point. */
+    readonly durableOutcome?: DurableApplyOutcome;
+    /** Present only on the recovery entry point. */
+    readonly recoveryOutcome?: RecoveryOutcome;
+    /** An admitted managed claim remains unresolved and must not be retried. */
+    readonly unresolvedOutcome?: {
+        readonly kind: 'recovery-required';
+        readonly claimId: string;
+        readonly detail: string;
+    } | {
+        readonly kind: 'transport-ambiguous';
+        readonly detail: string;
+    };
 }
 
 type EvidenceClaimConclusion = 'established' | 'undischarged' | 'refuted' | 'conflicted';
@@ -965,6 +1633,15 @@ interface TransitionSessionClient {
 }
 interface TransitionQueryClient {
     query(sql: string, params?: unknown): Promise<TransitionQueryResult>;
+    /**
+     * Execute a statement contributed by a plan operation.
+     *
+     * This is intentionally a separate, optional channel rather than a SQL
+     * classifier.  Core only routes the client it gives to executeOperation()
+     * through it; adapter-owned preflight, journalling, and cleanup continue to
+     * use query().
+     */
+    queryPlanOperation?(sql: string, params?: unknown): Promise<TransitionQueryResult>;
     release(error?: unknown): void;
 }
 declare const transitionLessorTypeBrand: unique symbol;
@@ -982,6 +1659,19 @@ interface TransitionLessor {
      */
     readonly acquire: () => Promise<TransitionQueryClient>;
 }
+declare const exclusiveTransitionTargetTypeBrand: unique symbol;
+/**
+ * A callback-scoped target for durable execution.
+ *
+ * Adapters mint this only after they have acquired their exclusive backend
+ * lease.  Its representation deliberately has no public members: core is the
+ * only package that can turn it back into a query lease.  This is a nominal
+ * accidental-misuse guard, not a security boundary against code which imports
+ * core's public factory deliberately.
+ */
+interface ExclusiveTransitionTarget {
+    readonly [exclusiveTransitionTargetTypeBrand]: never;
+}
 interface OperationEffectAssessment {
     readonly effects: OperationEffects;
     readonly restsOn: readonly Assumption[];
@@ -1114,13 +1804,56 @@ interface Comparator {
     compare(desired: ModelIR, current: ModelIR, context?: EquivalenceContext): CompareOutcome;
 }
 
-interface AssumptionAcceptance {
-    readonly class: string;
-    readonly fromTrustRoot?: TrustRoot;
-    readonly withinScope?: readonly ResourceSelector[];
+/** The two destructive effects defined by the managed-ledger authority table. */
+type DestructiveAction = {
+    readonly kind: 'removal';
+    readonly address: LedgerAddress;
+    /** Digest of the exact cascade set admitted under the ledger locks. */
+    readonly closureDigest?: string;
+} | {
+    readonly kind: 'data-destructive';
+    readonly address: LedgerAddress;
+};
+type DeclarationDestructiveOutcome = 'requires-removal' | 'requires-lossy-change' | 'replacement-requested-by-plan' | 'requires-neither' | 'absent' | 'uncomputable';
+type OwnershipDestructiveOutcome = 'managed-by-me' | 'managed-by-other' | 'pending' | 'blocked' | 'unknown' | 'uncomputable';
+type CatalogueIdentityDestructiveOutcome = 'matches-recorded' | 'differs' | 'object-absent' | 'catalogue-unavailable';
+type OperatorAcceptanceDestructiveOutcome = 'destructive-plan-accepted' | 'absent';
+type ContainmentClosureDestructiveOutcome = 'all-contained-or-managed' | 'reaches-unmanaged' | 'undecidable';
+type LedgerLineageDestructiveOutcome = 'matches-database' | 'differs' | 'unreadable';
+/** Closed evidence supplied to the sole destructive-decision interpreter. */
+interface DestructiveAuthorityEvidence {
+    readonly declaration: DeclarationDestructiveOutcome;
+    /** Present only for replacement-requested-by-plan; it limits that permit. */
+    readonly replacementAddress?: LedgerAddress;
+    readonly ownership: OwnershipDestructiveOutcome;
+    readonly catalogueIdentity: CatalogueIdentityDestructiveOutcome;
+    readonly operatorAcceptance: OperatorAcceptanceDestructiveOutcome;
+    /** Required only for removals. */
+    readonly containment?: ContainmentClosureDestructiveOutcome;
+    /** The exact live cascade member that made `reaches-unmanaged` refuse. */
+    readonly containmentUnmanaged?: LedgerAddress;
+    /** The live catalogue error that made containment undecidable. */
+    readonly containmentReason?: string;
+    readonly ledgerLineage: LedgerLineageDestructiveOutcome;
+}
+declare const destructiveAuthorityPermitBrand: unique symbol;
+/**
+ * Opaque positive evidence. It has no constructible fields, so an execution
+ * sink can require it without accepting a caller-assembled set of booleans.
+ */
+interface DestructiveAuthorityPermit {
+    readonly [destructiveAuthorityPermitBrand]: 'dbsp-destructive-authority-permit';
 }
-interface ApplyPolicy {
-    readonly accepts: readonly AssumptionAcceptance[];
+interface PermittedDestructiveDecision {
+    readonly kind: 'destructive-decision-permitted';
+    readonly action: DestructiveAction;
+    readonly permit: DestructiveAuthorityPermit;
+}
+interface RefusedDestructiveDecision {
+    readonly kind: 'destructive-decision-refused';
+    readonly action: DestructiveAction;
+    readonly reasons: readonly string[];
 }
+type DestructiveDecision = PermittedDestructiveDecision | RefusedDestructiveDecision;
 
-export { AdjacencyTraversal, type AdvisoryObservation, type AdvisoryObservationId, AggregateWindowFunction, type ApplicableAssessment, type ApplicableEvaluation, type ApplyGuard, type ApplyPolicy, type ApplyResult, type Assumption, type AssumptionAcceptance, type AssumptionId, type BigintJsReadConversionContext, type BoundBinding, type CapabilityAvailabilityPredicate, type CapabilityDescriptor, type ClaimConclusion, type ClaimDerivation, type ClaimId, type ClaimSelector, CoalesceExpressionIntent, type CollationRef, ColumnAliasIntent, ColumnJsReadType, ColumnListInput, type Comparator, type CompareOutcome, type CompositionFactSatisfactionOwner, type ContextFact, type ContextMutation, CustomTraversal, DeleteIntent, type DurableIntentRecord, EXECUTION_CONTRACT_VERSION, EdgeTableTraversal, type EquivalenceCapability, type EquivalenceContext, type EquivalenceResult, type EvidenceClaimConclusion, type EvidenceClaimResult, type EvidenceId, type EvidenceObservation, type EvidenceObservationFilters, type EvidenceView, type ExecutableAssertion, type ExecutionContract, type ExecutionRequirement, type ExecutionRequirementMode, type ExpressionEquivalenceCategory, ExpressionIntent, type ExpressionValue, type ExternalEffectCoverage, type FingerprintManifest, ForeignKeyIR, type GuardPredicate, type GuardProtocol, type GuardProtocolKind, type GuardedPlan, type GuardedPlanSegment, type GuardedPlanStep, type InapplicableAssessment, InsertIntent, type IssuedObservation, type JsonAggOrderKey, type JsonValue, type LoadedSchema, type LockRequirement, ModelIR, MutationIntent, NQL_SELECT_AGGREGATE_FUNCTIONS, NQL_SELECT_FUNCTION_ALLOWLIST, NQL_SELECT_JSON_FUNCTIONS, NQL_SELECT_SCALAR_FUNCTIONS, NQL_SELECT_SCALAR_FUNCTION_ALLOWLIST, NQL_SELECT_VALUE_FUNCTIONS, NQL_SELECT_WINDOW_FUNCTIONS, NQL_SELECT_WINDOW_FUNCTION_ALLOWLIST, NQL_SELECT_WINDOW_ONLY_FUNCTIONS, type ObservationBooleanClaim, type ObservationContext, type ObservationIssuer, type ObservationPrivilegeMergeResult, type ObservationRequest, type ObservationResult, type ObservationStability, type ObservedOutcomeRecord, OffsetWindowFunction, type OperationEffectAssessment, type OperationEffects, type OperationExecutionOutcome, type OperationExecutionSemantics, OperationKindRef, type OperationRecoverySemantics, type OperationSemantics, type OutcomeReason, type OutcomeReasonCode, type PhysicalOperation, type PlanAssessment, type PortableExpression, type PostgreSqlAuthorityRequirement, type PostgreSqlEngineRequirement, type PostgreSqlNamespaceIdentity, type PostgreSqlObservationTargetIdentity, type PostgreSqlPhysicalTargetRequirement, type PostgreSqlSessionSettingRequirement, type ProofClaim, type ProofClaimDraft, type ProofEvidenceAccess, type ProofObligation, type Proposition, type ProvenApplyGuard, type ProvenGuardProtocol, type ProvenPlanShape, type ProvenPlanStep, QueryIntent, RankingWindowFunction, RawExpressionIntent, type RecognitionContext, type RecognitionResult, type RecoveryArtefact, RecursiveIntent, RecursiveTraversal, RelationColumnIntent, RelationIR, type RelationKeyBuilderOptions, type RelationKeyDirection, type RelationKeyFields, type RelationKeyForeignKey, type ResourceAddress, type ResourceSelector, type RuleEvaluation, type RulePrecedenceFact, type RuleRef, type RuleSelectionRationale, type RuleSupport, SelectAggregateIntent, SelectAllIntent, SelectFieldsIntent, SelectIntent, SelectWithExpressionsIntent, SemanticArtifactRef, type SerializedProvenPlan, type StepJournal, type StepOutcome, SubqueryRefIntent, TableIR, type TargetBinding, type TransactionalCompletionRecord, type TransitionCandidate, type TransitionCompositionFact, type TransitionFragment, type TransitionFragmentComposition, type TransitionJournalEvent, type TransitionJournalEventName, type TransitionJournalEventRecord, type TransitionLessor, type TransitionQueryClient, type TransitionQueryResult, type TransitionRule, type TransitionRunJournal, type TransitionRunMetadata, type TransitionSessionClient, TrustRoot, type TypeRef, type UnknownCoverage, type UnknownTransitionRecognition, type UnresolvableExpression, type UnsafeNativeFragment, UpdateIntent, UpsertIntent, type VendorValidatedExpression, WhereAndIntent, WhereAnyIntent, WhereComparisonIntent, WhereExistsIntent, WhereInIntent, WhereIntent, WhereLikeIntent, WhereNotExistsIntent, WhereNotIntent, WhereNullIntent, WhereOrIntent, WhereRangeIntent, WhereRelationFilterIntent, WhereSubqueryIntent, WindowFunction, WindowIntent, buildRelationKeyFields, convertBigintJsReadValue, isAdjacencyTraversal, isAggregateWindowFunction, isCoalesceExpression, isColumnAliasExpression, isCustomTraversal, isDeleteIntent, isEdgeTableTraversal, isInsertIntent, isMutationIntent, isNqlSelectFunctionAllowed, isNqlSelectScalarFunctionAllowed, isNqlSelectWindowFunctionAllowed, isRankingWindowFunction, isRawExpression, isRecursiveIntent, isRelationColumnExpression, isSelectAggregate, isSelectAll, isSelectFields, isSelectWithExpressions, isSubqueryRef, isUpdateIntent, isUpsertIntent, isValidSchema, isWhereAnd, isWhereAny, isWhereComparison, isWhereExists, isWhereIn, isWhereLike, isWhereLogical, isWhereNot, isWhereNotExists, isWhereNull, isWhereOr, isWhereRange, isWhereRelationBased, isWhereRelationFilter, isWhereSubquery, isWindowIntent, resolveJsonAggOrderKey };
+export { AdjacencyTraversal, type AdmittedOutcomeClaim, type AdmittedPermit, type AdoptionOutcomeClaimPlan, type AdvisoryObservation, type AdvisoryObservationId, AggregateWindowFunction, type ApplicableAssessment, type ApplicableEvaluation, type ApplyGuard, type ApplyPolicy, type ApplyResult, type Assumption, type AssumptionAcceptance, type AssumptionId, type BigintJsReadConversionContext, type BoundBinding, type CapabilityAvailabilityPredicate, type CapabilityDescriptor, type CascadeCoveredOutcomeClaimPlan, type CatalogueIdentity, type CatalogueIdentityDestructiveOutcome, type ClaimBundleStatement, type ClaimConclusion, type ClaimDerivation, type ClaimId, type ClaimSelector, type ClaimStatementBundle, type ClaimToken, CoalesceExpressionIntent, type CollationRef, ColumnAliasIntent, ColumnJsReadType, ColumnListInput, type Comparator, type CompareOutcome, type CompositionFactSatisfactionOwner, type ContainmentClosureDestructiveOutcome, type ContextFact, type ContextMutation, type ControllerIdentity, CustomTraversal, type DeclarableKind, type DeclarableResourceAddress, type DeclarationDestructiveOutcome, type DeclarationSet, DeleteIntent, type DestructiveAction, type DestructiveAuthorityEvidence, type DestructiveAuthorityPermit, type DestructiveDecision, type DurableApplyOutcome, type DurableIntentRecord, EXECUTION_CONTRACT_VERSION, EdgeTableTraversal, type EmptyClaimStatementBundle, type EquivalenceCapability, type EquivalenceContext, type EquivalenceResult, type EvidenceClaimConclusion, type EvidenceClaimResult, type EvidenceId, type EvidenceObservation, type EvidenceObservationFilters, type EvidenceView, type ExclusiveTransitionTarget, type ExecutableAssertion, type ExecutionContract, type ExecutionRequirement, type ExecutionRequirementMode, type ExpressionEquivalenceCategory, ExpressionIntent, type ExpressionValue, type ExternalEffectCoverage, type FingerprintManifest, ForeignKeyIR, type GuardPredicate, type GuardProtocol, type GuardProtocolKind, type GuardedPlan, type GuardedPlanSegment, type GuardedPlanStep, type InapplicableAssessment, InsertIntent, type IssuedObservation, type JsonAggOrderKey, type JsonObject, type JsonValue, LEDGER_EVENT_KINDS, type LedgerAddress, type LedgerChainMember, type LedgerChainProjection, type LedgerClaimKind, type LedgerEventKind, type LedgerHome, type LedgerIdentity, type LedgerLifecycleGrammarColumn, type LedgerLineageDestructiveOutcome, type LedgerMarkerState, type LedgerOpenClaim, type LedgerPayload, type LedgerRefusal, type LedgerReportedState, type LedgerReservationRow, type LedgerShapeMarker, type LedgerStableState, type LoadedSchema, type LockRequirement, type ManagedDeclaration, type ManagedStepClaimMaterial, type ManagedStepClassification, type ManagedStepClosureMember, type ManagedStepLifecycle, type ManagedStepReplayPolicy, type ManagedStepSelectionRequirement, ModelIR, MutationIntent, NQL_SELECT_AGGREGATE_FUNCTIONS, NQL_SELECT_FUNCTION_ALLOWLIST, NQL_SELECT_JSON_FUNCTIONS, NQL_SELECT_SCALAR_FUNCTIONS, NQL_SELECT_SCALAR_FUNCTION_ALLOWLIST, NQL_SELECT_VALUE_FUNCTIONS, NQL_SELECT_WINDOW_FUNCTIONS, NQL_SELECT_WINDOW_FUNCTION_ALLOWLIST, NQL_SELECT_WINDOW_ONLY_FUNCTIONS, type NormalizedManagedStep, type ObservationBooleanClaim, type ObservationContext, type ObservationIssuer, type ObservationPrivilegeMergeResult, type ObservationRequest, type ObservationResult, type ObservationStability, type ObservedOutcomeRecord, OffsetWindowFunction, type OperationEffectAssessment, type OperationEffects, type OperationExecutionOutcome, type OperationExecutionSemantics, OperationKindRef, type OperationRecoverySemantics, type OperationSemantics, type OperatorAcceptanceDestructiveOutcome, type OutcomeCatalogueUnavailable, type OutcomeClaimAdmission, type OutcomeClaimAdmissionInput, type OutcomeClaimPlan, type OutcomeIndeterminateRecoveryEvidence, type OutcomeProtocolRefusal, type OutcomeReason, type OutcomeReasonCode, type OutcomeRecoveryCatalogueRead, type OutcomeRecoveryCatalogueReader, type OutcomeRecoveryClassification, type OutcomeRecoveryEffect, type OutcomeRecoveryInput, type OutcomeRecoveryReadBack, type OutcomeRecoveryResolution, type OutcomeVacancy, type OwnershipDestructiveOutcome, type PermittedDestructiveDecision, type PhysicalOperation, type PlanAssessment, type PortableExpression, type PostgreSqlAuthorityRequirement, type PostgreSqlEngineRequirement, type PostgreSqlNamespaceIdentity, type PostgreSqlObservationTargetIdentity, type PostgreSqlPhysicalTargetRequirement, type PostgreSqlSessionSettingRequirement, type ProjectedLedgerChain, type ProofClaim, type ProofClaimDraft, type ProofEvidenceAccess, type ProofObligation, type Proposition, type ProvenApplyGuard, type ProvenGuardProtocol, type ProvenPlanShape, type ProvenPlanStep, QueryIntent, REFUSAL_VOCABULARY, RankingWindowFunction, RawExpressionIntent, type RecognitionContext, type RecognitionResult, type RecoveryArtefact, type RecoveryOutcome, RecursiveIntent, RecursiveTraversal, type RefusalCode, type RefusedDestructiveDecision, type ReinitializePreflightAdoptionCandidate, type ReinitializePreflightFailureReason, type ReinitializePreflightFailureStep, type ReinitializePreflightRefusalCode, type ReinitializePreflightReport, type ReinitializePreflightScopeOutcome, type ReinitializePreflightScopeReport, RelationColumnIntent, RelationIR, type RelationKeyBuilderOptions, type RelationKeyDirection, type RelationKeyFields, type RelationKeyForeignKey, type ResourceAddress, type ResourceSelector, type RuleEvaluation, type RulePrecedenceFact, type RuleRef, type RuleSelectionRationale, type RuleSupport, type ScopedApprovalSet, SelectAggregateIntent, SelectAllIntent, SelectFieldsIntent, SelectIntent, SelectWithExpressionsIntent, SemanticArtifactRef, type SerializedProvenPlan, type SqlBearingOutcomeClaimPlan, type StepJournal, type StepOutcome, SubqueryRefIntent, TableIR, TableReaddressDeclaration, type TargetBinding, type TransactionalCompletionRecord, type TransitionCandidate, type TransitionCompositionFact, type TransitionFragment, type TransitionFragmentComposition, type TransitionJournalEvent, type TransitionJournalEventName, type TransitionJournalEventRecord, type TransitionLessor, type TransitionQueryClient, type TransitionQueryResult, type TransitionRule, type TransitionRunAuthorization, type TransitionRunJournal, type TransitionRunMetadata, type TransitionSessionClient, TrustRoot, type TypeRef, type UnknownCoverage, type UnknownTransitionRecognition, type UnprojectableChainReason, type UnprojectableLedgerChain, type UnresolvableExpression, type UnsafeNativeFragment, UpdateIntent, UpsertIntent, type VendorValidatedExpression, WhereAndIntent, WhereAnyIntent, WhereComparisonIntent, WhereExistsIntent, WhereInIntent, WhereIntent, WhereLikeIntent, WhereNotExistsIntent, WhereNotIntent, WhereNullIntent, WhereOrIntent, WhereRangeIntent, WhereRelationFilterIntent, WhereSubqueryIntent, WindowFunction, WindowIntent, buildRelationKeyFields, canonicalResourceParent, convertBigintJsReadValue, isAdjacencyTraversal, isAggregateWindowFunction, isCoalesceExpression, isColumnAliasExpression, isCustomTraversal, isDeleteIntent, isEdgeTableTraversal, isInsertIntent, isMutationIntent, isNqlSelectFunctionAllowed, isNqlSelectScalarFunctionAllowed, isNqlSelectWindowFunctionAllowed, isRankingWindowFunction, isRawExpression, isRecursiveIntent, isRelationColumnExpression, isSelectAggregate, isSelectAll, isSelectFields, isSelectWithExpressions, isSubqueryRef, isUpdateIntent, isUpsertIntent, isValidSchema, isWhereAnd, isWhereAny, isWhereComparison, isWhereExists, isWhereIn, isWhereLike, isWhereLogical, isWhereNot, isWhereNotExists, isWhereNull, isWhereOr, isWhereRange, isWhereRelationBased, isWhereRelationFilter, isWhereSubquery, isWindowIntent, ledgerAddressKey, ledgerAddressParentJson, refusalFor, resolveJsonAggOrderKey, sameControllerIdentity, sameLedgerAddress };