@sequenceholdings/orm 0.1.2 → 0.1.3

package/dist/compiler.d.cts

@@ -1,6 +1,8 @@
-import { CanonicalEnum, CanonicalDefinition, PolicyExpression } from './canonical.cjs';
-import { ClaimKey, PredIr, RootIr, InputRefKind, TableMetaIr, CompiledOperation, CompiledArtifact, CmpOp, VariableIr, OrderIr, SelectionIr } from './ir.cjs';
+import { CanonicalEnum, CanonicalDefinition } from './canonical.cjs';
+import { ClaimKey, PredIr, RootIr, InputRefKind, TableMetaIr, CompiledOperation, CompiledArtifact, VariableIr, OrderIr, SelectionIr } from './ir.cjs';
 import { DocumentNode, OperationDefinitionNode, FragmentDefinitionNode, GraphQLSchema, ValueNode, SelectionSetNode } from 'graphql';
+export { DynamicInputIssue, DynamicInputResult, NormalizedBoolExp, NormalizedOnConflict, NormalizedOrderBy, NormalizedRow, ORDER_BY_DIRECTIONS, ScalarKind, allowedBoolExpOperators, allowedOps, validateAppendInput, validateBoolExpInput, validateInsertInput, validateOnConflictInput, validateOrderByInput, validateSelectColumns, validateSetInput } from './dynamic-input.cjs';
+export { CompilePolicyInput, CompilePredicateInput, POLICY_COMPARE_OPS, POLICY_MAX_LINK_DEPTH, ParsedPolicy, PolicyColumnInfo, PolicyCompareOp, PolicyCompileError, PolicyCompileErrorCode, PolicyLinkInfo, PolicyNode, PolicyOperand, PolicyParseError, PolicyResolver, PolicyTableInfo, assertClaimsOnlyWhen, compilePolicy, compilePredicateV2, parsePolicy, walkPolicy } from './predicate-v2.cjs';
 export { P as PLATFORM_USER_TYPENAME, c as camelCase, e as enumTypeName, p as pascalCase } from './naming-DRyinU4u.cjs';
 import 'zod';
 
@@ -133,10 +135,28 @@ interface QueryRootInfo {
     kind: 'select' | 'byPk' | 'aggregate';
     table: string;
 }
-interface MutationRootInfo {
+interface CrudMutationRootInfo {
     op: MutationOp;
     table: string;
 }
+/**
+ * A declared copy-on-write mutation root (canonical `cowMutations`). Carries
+ * everything lowering needs so the executor can generate the SQL — no
+ * authored statements anywhere in the pipeline.
+ */
+interface CowMutationRootInfo {
+    op: 'cowOverride' | 'cowRevert';
+    table: string;
+    /** Logical synced twin table (same namespace). */
+    synced: string;
+    /** Shared single-column primary-key property. */
+    pk: string;
+    /** Override: overlay properties written by the UPDATE. */
+    set: readonly string[];
+    /** Override: properties copied INSERT…SELECT from synced (pk included). */
+    copyColumns: readonly string[];
+}
+type MutationRootInfo = CrudMutationRootInfo | CowMutationRootInfo;
 interface CompileContext {
     namespace: string;
     tables: Record<string, TableMetaIr>;
@@ -147,9 +167,14 @@ interface CompileContext {
     /** GraphQL enum type name → canonical enum (SelectColumn enums are NOT here). */
     enumsByTypeName: Map<string, CanonicalEnum>;
     readPolicies: Map<string, PredIr>;
+    /** Legacy combined write policy (mutation row filters when insert/update are absent). */
     writePolicies: Map<string, PredIr>;
-    /** Per-table `col = claim(k)` write-policy pins (insert-merged, non-insertable). */
+    insertPolicies: Map<string, PredIr>;
+    updatePolicies: Map<string, PredIr>;
+    /** Per-table `col = claim(k)` insert-policy pins (insert-merged, non-insertable). */
     pins: Map<string, PinnedColumn[]>;
+    /** Tables with both `insert` and `update` declared (no legacy `write`-only path). */
+    splitWritePolicyTables: ReadonlySet<string>;
 }
 /**
  * §4b curated platform-users view — synthesized, never consumer-defined.
@@ -202,7 +227,7 @@ declare function parseDocuments({ schema, documents, }: {
 declare function computeSchemaHash(canonical: CanonicalDefinition): string;
 interface ClientManifestOperation {
     opHash: string;
-    kind: 'query' | 'mutation' | 'action';
+    kind: 'query' | 'mutation';
     requires: CompiledOperation['requires'];
 }
 /** What codegen/the client transport needs: name → hash mapping + set identity. */
@@ -237,97 +262,6 @@ declare function compileNamespaceOrThrow(input: CompileNamespaceInput): {
 /** Per-table `col = claim(k)` write-policy pins — exposed for SDL generation options. */
 declare function computePinnedColumnsByTable(canonical: CanonicalDefinition): Record<string, PinnedColumn[]>;
 
-/**
- * §4f dynamic-input validators — PURE, data-only functions the data plane
- * imports to check client-supplied values for dynamic slots (BoolExp /
- * OrderBy / SelectColumn / InsertInput / SetInput / AppendInput / OnConflict)
- * against the artifact's per-table whitelist metadata (TableMetaIr).
- *
- * No drizzle imports, no IO. Each validator returns a normalized tree or
- * typed issues; the executor's runtime lowering step consumes the normalized
- * form and ANDs the result with the baked policy predicate — the policy is
- * non-negotiable regardless of what the client sends.
- */
-
-interface DynamicInputIssue {
-    code: 'invalid-shape' | 'unknown-column' | 'unknown-link' | 'unknown-operator' | 'invalid-value' | 'column-not-allowed' | 'nested-insert' | 'unknown-constraint' | 'too-deep' | 'too-many-nodes' | 'too-many-rows';
-    path: string;
-    message: string;
-}
-type DynamicInputResult<T> = {
-    ok: true;
-    value: T;
-} | {
-    ok: false;
-    issues: DynamicInputIssue[];
-};
-type NormalizedBoolExp = {
-    kind: 'and' | 'or';
-    operands: NormalizedBoolExp[];
-} | {
-    kind: 'not';
-    operand: NormalizedBoolExp;
-} | {
-    kind: 'cmp';
-    op: CmpOp;
-    column: string;
-    value: unknown;
-} | {
-    kind: 'exists';
-    link: string;
-    target: string;
-    where: NormalizedBoolExp;
-};
-interface NormalizedOrderBy {
-    column: string;
-    link?: string;
-    direction: 'asc' | 'desc';
-    nulls?: 'first' | 'last';
-}
-type NormalizedRow = Record<string, unknown>;
-interface NormalizedOnConflict {
-    constraint: string;
-    updateColumns: string[];
-}
-interface BoolExpInput {
-    table: TableMetaIr;
-    /** Artifact tables record — relationship predicates resolve targets here. */
-    tables: Record<string, TableMetaIr>;
-    value: unknown;
-    maxDepth?: number;
-    maxNodes?: number;
-}
-declare function validateBoolExpInput({ table, tables, value, maxDepth, maxNodes }: BoolExpInput): DynamicInputResult<NormalizedBoolExp>;
-declare function validateOrderByInput({ table, tables, value, }: {
-    table: TableMetaIr;
-    tables: Record<string, TableMetaIr>;
-    value: unknown;
-}): DynamicInputResult<NormalizedOrderBy[]>;
-declare function validateSelectColumns({ table, value }: {
-    table: TableMetaIr;
-    value: unknown;
-}): DynamicInputResult<string[]>;
-declare function validateInsertInput({ table, value, list, maxRows, }: {
-    table: TableMetaIr;
-    value: unknown;
-    /** true for `$objects: [FooInsertInput!]`, false for `$object: FooInsertInput`. */
-    list: boolean;
-    maxRows?: number;
-}): DynamicInputResult<NormalizedRow[]>;
-declare function validateSetInput({ table, value }: {
-    table: TableMetaIr;
-    value: unknown;
-}): DynamicInputResult<NormalizedRow>;
-/** _append targets jsonb columns; values are arbitrary JSON (no scalar check). */
-declare function validateAppendInput({ table, value }: {
-    table: TableMetaIr;
-    value: unknown;
-}): DynamicInputResult<NormalizedRow>;
-declare function validateOnConflictInput({ table, value, }: {
-    table: TableMetaIr;
-    value: unknown;
-}): DynamicInputResult<NormalizedOnConflict>;
-
 /**
  * Flatten pass — inline every fragment spread (and inline fragment) so the
  * lowering pass sees one plain selection tree. The bios corpus uses flat,
@@ -420,6 +354,14 @@ declare class OperationLowerer {
     /** byPk-style pk arguments: one argument per primary-key column, exactly. */
     private lowerPkArgs;
     private lowerMutationRoot;
+    /**
+     * Copy-on-write roots: flat args — the pk plus (override only) every
+     * declared set column. Overrides are full snapshots of the set columns, so
+     * every set argument must be supplied explicitly (pass null to clear a
+     * nullable column); the executor generates the copy/update/delete SQL from
+     * the structured fields, never from authored statements.
+     */
+    private lowerCowRoot;
     private lowerMutationResponse;
     private lowerInsertObjects;
     private lowerInsertRow;
@@ -444,138 +386,4 @@ declare function predContainsExists(pred: PredIr): boolean;
 /** Structural containment: does `haystack` carry `needle` as a subtree? */
 declare function predContains(haystack: PredIr, needle: PredIr): boolean;
 
-declare const POLICY_COMPARE_OPS: readonly ["=", "!=", "<", "<=", ">", ">="];
-type PolicyCompareOp = (typeof POLICY_COMPARE_OPS)[number];
-type PolicyOperand = 
-/** A column reference, or a dotted to-one path ending in a column (`a.b.c`). */
-{
-    kind: 'path';
-    segments: readonly string[];
-}
-/** `claim('sub')` / `claim('org')` — the only claim() keys in CLAIMS_CONTRACT. */
- | {
-    kind: 'claim';
-    key: ClaimKey;
-} | {
-    kind: 'literal';
-    value: string | number | boolean | null;
-};
-type PolicyNode = {
-    kind: 'and';
-    operands: readonly PolicyNode[];
-} | {
-    kind: 'or';
-    operands: readonly PolicyNode[];
-} | {
-    kind: 'not';
-    operand: PolicyNode;
-} | {
-    kind: 'compare';
-    op: PolicyCompareOp;
-    left: PolicyOperand;
-    right: PolicyOperand;
-}
-/** Boolean claims leaves — pre-resolved against the caller's claims at runtime. */
- | {
-    kind: 'capability';
-    key: string;
-} | {
-    kind: 'role';
-    key: string;
-}
-/** `exists(<link-path>, <pred>)` — the inner predicate runs against the final target. */
- | {
-    kind: 'exists';
-    path: readonly string[];
-    where: PolicyNode;
-};
-interface ParsedPolicy {
-    readonly source: string;
-    readonly ast: PolicyNode;
-}
-declare function walkPolicy(node: PolicyNode, visit: (node: PolicyNode) => void): void;
-
-/** Parse-time failure — bad token stream, malformed call, invalid claim key. */
-declare class PolicyParseError extends Error {
-    readonly position: number;
-    readonly name = "PolicyParseError";
-    constructor(message: string, position: number);
-}
-type PolicyCompileErrorCode = 'unknown-table' | 'unknown-column' | 'unknown-link' | 'not-to-one' | 'link-depth-exceeded' | 'unsupported-comparison' | 'invalid-null-comparison' | 'when-not-claims-only';
-/**
- * Compile-time failure — the parsed policy references something the table
- * doesn't declare, or uses a shape the v2.0 IR cannot represent. Carries
- * `candidates` so the error can name what IS available.
- */
-declare class PolicyCompileError extends Error {
-    readonly code: PolicyCompileErrorCode;
-    readonly candidates: readonly string[];
-    readonly name = "PolicyCompileError";
-    constructor(message: string, code: PolicyCompileErrorCode, candidates?: readonly string[]);
-}
-
-declare function parsePolicy(source: string): ParsedPolicy;
-
-/**
- * Policy DSL v2 → PredIr compiler. Resolves column/link references against a
- * table resolver (TableMetaIr satisfies the shapes structurally), normalizes
- * everything to LOGICAL column names, and enforces the v2.0 representability
- * rules the frozen IR imposes:
- *
- *  - dotted to-one paths (`deal.org = claim('org')`) lower to nested
- *    `exists(link, …)` with the comparison innermost;
- *  - total link-traversal depth (dotted hops + exists nesting) ≤ 3;
- *  - a comparison must reference exactly ONE column side (column↔column and
- *    claims↔literal comparisons have no PredIr shape in v2.0);
- *  - `col = null` / `col != null` normalize to the isNull operator;
- *  - variant `when` guards are claims-only: capability()/role() under
- *    and/or/not. (claim() comparisons in `when` are not representable in the
- *    v2.0 IR — a targeted error says so.)
- */
-
-declare const POLICY_MAX_LINK_DEPTH = 3;
-interface PolicyColumnInfo {
-    readonly name: string;
-    readonly columnName: string;
-}
-interface PolicyLinkInfo {
-    readonly name: string;
-    readonly kind: 'toOne' | 'toMany' | 'toPlatformUser';
-    readonly target: string;
-}
-interface PolicyTableInfo {
-    readonly columns: readonly PolicyColumnInfo[];
-    readonly links: readonly PolicyLinkInfo[];
-}
-/** `{ tables }` keyed by table name — TableMetaIr's record is assignable. */
-interface PolicyResolver {
-    readonly tables: Record<string, PolicyTableInfo>;
-}
-interface CompilePredicateInput {
-    /** DSL source text, or an already-parsed policy. */
-    expression: string | ParsedPolicy;
-    table: string;
-    resolver: PolicyResolver;
-    maxLinkDepth?: number;
-}
-declare function compilePredicateV2({ expression, table, resolver, maxLinkDepth }: CompilePredicateInput): PredIr;
-/** Variant `when` guards may only test claims: capability()/role() under and/or/not. */
-declare function assertClaimsOnlyWhen(parsed: ParsedPolicy): void;
-interface CompilePolicyInput {
-    expression: PolicyExpression;
-    table: string;
-    resolver: PolicyResolver;
-    maxLinkDepth?: number;
-}
-/**
- * Policy expression (string or `{default, variants}`) → one PredIr under §4c
- * permissive-union semantics:
- *
- *   OR(default, …variants.map(v => AND(when, v.allow ? const(true) : policy)))
- *
- * Granting a role/capability only ever widens access; `allow: true`
- * short-circuits its branch to the guard alone.
- */
-declare function compilePolicy({ expression, table, resolver, maxLinkDepth }: CompilePolicyInput): PredIr;
-
-export { type BuildContextResult, COMPILER_MAJOR, CONST_TRUE, type ClientManifest, type ClientManifestOperation, type CompileContext, type CompileNamespaceInput, type CompileNamespaceResult, type CompilePolicyInput, type CompilePredicateInput, type CompilerDiagnostic, DEFAULT_LIMIT, type DiagnosticSeverity, DocumentCompileError, type DynamicInputIssue, type DynamicInputResult, MAX_LIMIT, type MutationOp, type MutationRootInfo, NamespaceCompileError, type NormalizedBoolExp, type NormalizedOnConflict, type NormalizedOrderBy, type NormalizedRow, OperationLowerer, PLATFORM_USER_TABLE, POLICY_COMPARE_OPS, POLICY_MAX_LINK_DEPTH, type ParseDocumentsResult, type ParsedDocument, type ParsedPolicy, type PinnedColumn, type PolicyColumnInfo, type PolicyCompareOp, PolicyCompileError, type PolicyCompileErrorCode, type PolicyLinkInfo, type PolicyNode, type PolicyOperand, PolicyParseError, type PolicyResolver, type PolicyTableInfo, type QueryRootInfo, type RestrictedOperation, type SourceDocument, andPred, assertClaimsOnlyWhen, buildCompileContext, canonicalOperationText, classifyInputType, collectPinnedColumns, compileNamespace, compileNamespaceOrThrow, compilePolicy, compilePredicateV2, computeOpHash, computeOpsHash, computePinnedColumnsByTable, computeSchemaHash, flattenOperation, injectPolicies, inputTypeName, lowerOperation, mutationRootNames, parseDocuments, parsePolicy, parseSdl, platformUserMeta, predContains, predContainsExists, queryRootNames, restrictOperation, typeNameForTable, validateAppendInput, validateBoolExpInput, validateInsertInput, validateOnConflictInput, validateOrderByInput, validateSelectColumns, validateSetInput, walkPolicy, walkPred };
+export { type BuildContextResult, COMPILER_MAJOR, CONST_TRUE, type ClientManifest, type ClientManifestOperation, type CompileContext, type CompileNamespaceInput, type CompileNamespaceResult, type CompilerDiagnostic, DEFAULT_LIMIT, type DiagnosticSeverity, DocumentCompileError, MAX_LIMIT, type MutationOp, type MutationRootInfo, NamespaceCompileError, OperationLowerer, PLATFORM_USER_TABLE, type ParseDocumentsResult, type ParsedDocument, type PinnedColumn, type QueryRootInfo, type RestrictedOperation, type SourceDocument, andPred, buildCompileContext, canonicalOperationText, classifyInputType, collectPinnedColumns, compileNamespace, compileNamespaceOrThrow, computeOpHash, computeOpsHash, computePinnedColumnsByTable, computeSchemaHash, flattenOperation, injectPolicies, inputTypeName, lowerOperation, mutationRootNames, parseDocuments, parseSdl, platformUserMeta, predContains, predContainsExists, queryRootNames, restrictOperation, typeNameForTable, walkPred };

package/dist/compiler.d.ts

@@ -1,6 +1,8 @@
-import { CanonicalEnum, CanonicalDefinition, PolicyExpression } from './canonical.js';
-import { ClaimKey, PredIr, RootIr, InputRefKind, TableMetaIr, CompiledOperation, CompiledArtifact, CmpOp, VariableIr, OrderIr, SelectionIr } from './ir.js';
+import { CanonicalEnum, CanonicalDefinition } from './canonical.js';
+import { ClaimKey, PredIr, RootIr, InputRefKind, TableMetaIr, CompiledOperation, CompiledArtifact, VariableIr, OrderIr, SelectionIr } from './ir.js';
 import { DocumentNode, OperationDefinitionNode, FragmentDefinitionNode, GraphQLSchema, ValueNode, SelectionSetNode } from 'graphql';
+export { DynamicInputIssue, DynamicInputResult, NormalizedBoolExp, NormalizedOnConflict, NormalizedOrderBy, NormalizedRow, ORDER_BY_DIRECTIONS, ScalarKind, allowedBoolExpOperators, allowedOps, validateAppendInput, validateBoolExpInput, validateInsertInput, validateOnConflictInput, validateOrderByInput, validateSelectColumns, validateSetInput } from './dynamic-input.js';
+export { CompilePolicyInput, CompilePredicateInput, POLICY_COMPARE_OPS, POLICY_MAX_LINK_DEPTH, ParsedPolicy, PolicyColumnInfo, PolicyCompareOp, PolicyCompileError, PolicyCompileErrorCode, PolicyLinkInfo, PolicyNode, PolicyOperand, PolicyParseError, PolicyResolver, PolicyTableInfo, assertClaimsOnlyWhen, compilePolicy, compilePredicateV2, parsePolicy, walkPolicy } from './predicate-v2.js';
 export { P as PLATFORM_USER_TYPENAME, c as camelCase, e as enumTypeName, p as pascalCase } from './naming-CTvWSRTf.js';
 import 'zod';
 
@@ -133,10 +135,28 @@ interface QueryRootInfo {
     kind: 'select' | 'byPk' | 'aggregate';
     table: string;
 }
-interface MutationRootInfo {
+interface CrudMutationRootInfo {
     op: MutationOp;
     table: string;
 }
+/**
+ * A declared copy-on-write mutation root (canonical `cowMutations`). Carries
+ * everything lowering needs so the executor can generate the SQL — no
+ * authored statements anywhere in the pipeline.
+ */
+interface CowMutationRootInfo {
+    op: 'cowOverride' | 'cowRevert';
+    table: string;
+    /** Logical synced twin table (same namespace). */
+    synced: string;
+    /** Shared single-column primary-key property. */
+    pk: string;
+    /** Override: overlay properties written by the UPDATE. */
+    set: readonly string[];
+    /** Override: properties copied INSERT…SELECT from synced (pk included). */
+    copyColumns: readonly string[];
+}
+type MutationRootInfo = CrudMutationRootInfo | CowMutationRootInfo;
 interface CompileContext {
     namespace: string;
     tables: Record<string, TableMetaIr>;
@@ -147,9 +167,14 @@ interface CompileContext {
     /** GraphQL enum type name → canonical enum (SelectColumn enums are NOT here). */
     enumsByTypeName: Map<string, CanonicalEnum>;
     readPolicies: Map<string, PredIr>;
+    /** Legacy combined write policy (mutation row filters when insert/update are absent). */
     writePolicies: Map<string, PredIr>;
-    /** Per-table `col = claim(k)` write-policy pins (insert-merged, non-insertable). */
+    insertPolicies: Map<string, PredIr>;
+    updatePolicies: Map<string, PredIr>;
+    /** Per-table `col = claim(k)` insert-policy pins (insert-merged, non-insertable). */
     pins: Map<string, PinnedColumn[]>;
+    /** Tables with both `insert` and `update` declared (no legacy `write`-only path). */
+    splitWritePolicyTables: ReadonlySet<string>;
 }
 /**
  * §4b curated platform-users view — synthesized, never consumer-defined.
@@ -202,7 +227,7 @@ declare function parseDocuments({ schema, documents, }: {
 declare function computeSchemaHash(canonical: CanonicalDefinition): string;
 interface ClientManifestOperation {
     opHash: string;
-    kind: 'query' | 'mutation' | 'action';
+    kind: 'query' | 'mutation';
     requires: CompiledOperation['requires'];
 }
 /** What codegen/the client transport needs: name → hash mapping + set identity. */
@@ -237,97 +262,6 @@ declare function compileNamespaceOrThrow(input: CompileNamespaceInput): {
 /** Per-table `col = claim(k)` write-policy pins — exposed for SDL generation options. */
 declare function computePinnedColumnsByTable(canonical: CanonicalDefinition): Record<string, PinnedColumn[]>;
 
-/**
- * §4f dynamic-input validators — PURE, data-only functions the data plane
- * imports to check client-supplied values for dynamic slots (BoolExp /
- * OrderBy / SelectColumn / InsertInput / SetInput / AppendInput / OnConflict)
- * against the artifact's per-table whitelist metadata (TableMetaIr).
- *
- * No drizzle imports, no IO. Each validator returns a normalized tree or
- * typed issues; the executor's runtime lowering step consumes the normalized
- * form and ANDs the result with the baked policy predicate — the policy is
- * non-negotiable regardless of what the client sends.
- */
-
-interface DynamicInputIssue {
-    code: 'invalid-shape' | 'unknown-column' | 'unknown-link' | 'unknown-operator' | 'invalid-value' | 'column-not-allowed' | 'nested-insert' | 'unknown-constraint' | 'too-deep' | 'too-many-nodes' | 'too-many-rows';
-    path: string;
-    message: string;
-}
-type DynamicInputResult<T> = {
-    ok: true;
-    value: T;
-} | {
-    ok: false;
-    issues: DynamicInputIssue[];
-};
-type NormalizedBoolExp = {
-    kind: 'and' | 'or';
-    operands: NormalizedBoolExp[];
-} | {
-    kind: 'not';
-    operand: NormalizedBoolExp;
-} | {
-    kind: 'cmp';
-    op: CmpOp;
-    column: string;
-    value: unknown;
-} | {
-    kind: 'exists';
-    link: string;
-    target: string;
-    where: NormalizedBoolExp;
-};
-interface NormalizedOrderBy {
-    column: string;
-    link?: string;
-    direction: 'asc' | 'desc';
-    nulls?: 'first' | 'last';
-}
-type NormalizedRow = Record<string, unknown>;
-interface NormalizedOnConflict {
-    constraint: string;
-    updateColumns: string[];
-}
-interface BoolExpInput {
-    table: TableMetaIr;
-    /** Artifact tables record — relationship predicates resolve targets here. */
-    tables: Record<string, TableMetaIr>;
-    value: unknown;
-    maxDepth?: number;
-    maxNodes?: number;
-}
-declare function validateBoolExpInput({ table, tables, value, maxDepth, maxNodes }: BoolExpInput): DynamicInputResult<NormalizedBoolExp>;
-declare function validateOrderByInput({ table, tables, value, }: {
-    table: TableMetaIr;
-    tables: Record<string, TableMetaIr>;
-    value: unknown;
-}): DynamicInputResult<NormalizedOrderBy[]>;
-declare function validateSelectColumns({ table, value }: {
-    table: TableMetaIr;
-    value: unknown;
-}): DynamicInputResult<string[]>;
-declare function validateInsertInput({ table, value, list, maxRows, }: {
-    table: TableMetaIr;
-    value: unknown;
-    /** true for `$objects: [FooInsertInput!]`, false for `$object: FooInsertInput`. */
-    list: boolean;
-    maxRows?: number;
-}): DynamicInputResult<NormalizedRow[]>;
-declare function validateSetInput({ table, value }: {
-    table: TableMetaIr;
-    value: unknown;
-}): DynamicInputResult<NormalizedRow>;
-/** _append targets jsonb columns; values are arbitrary JSON (no scalar check). */
-declare function validateAppendInput({ table, value }: {
-    table: TableMetaIr;
-    value: unknown;
-}): DynamicInputResult<NormalizedRow>;
-declare function validateOnConflictInput({ table, value, }: {
-    table: TableMetaIr;
-    value: unknown;
-}): DynamicInputResult<NormalizedOnConflict>;
-
 /**
  * Flatten pass — inline every fragment spread (and inline fragment) so the
  * lowering pass sees one plain selection tree. The bios corpus uses flat,
@@ -420,6 +354,14 @@ declare class OperationLowerer {
     /** byPk-style pk arguments: one argument per primary-key column, exactly. */
     private lowerPkArgs;
     private lowerMutationRoot;
+    /**
+     * Copy-on-write roots: flat args — the pk plus (override only) every
+     * declared set column. Overrides are full snapshots of the set columns, so
+     * every set argument must be supplied explicitly (pass null to clear a
+     * nullable column); the executor generates the copy/update/delete SQL from
+     * the structured fields, never from authored statements.
+     */
+    private lowerCowRoot;
     private lowerMutationResponse;
     private lowerInsertObjects;
     private lowerInsertRow;
@@ -444,138 +386,4 @@ declare function predContainsExists(pred: PredIr): boolean;
 /** Structural containment: does `haystack` carry `needle` as a subtree? */
 declare function predContains(haystack: PredIr, needle: PredIr): boolean;
 
-declare const POLICY_COMPARE_OPS: readonly ["=", "!=", "<", "<=", ">", ">="];
-type PolicyCompareOp = (typeof POLICY_COMPARE_OPS)[number];
-type PolicyOperand = 
-/** A column reference, or a dotted to-one path ending in a column (`a.b.c`). */
-{
-    kind: 'path';
-    segments: readonly string[];
-}
-/** `claim('sub')` / `claim('org')` — the only claim() keys in CLAIMS_CONTRACT. */
- | {
-    kind: 'claim';
-    key: ClaimKey;
-} | {
-    kind: 'literal';
-    value: string | number | boolean | null;
-};
-type PolicyNode = {
-    kind: 'and';
-    operands: readonly PolicyNode[];
-} | {
-    kind: 'or';
-    operands: readonly PolicyNode[];
-} | {
-    kind: 'not';
-    operand: PolicyNode;
-} | {
-    kind: 'compare';
-    op: PolicyCompareOp;
-    left: PolicyOperand;
-    right: PolicyOperand;
-}
-/** Boolean claims leaves — pre-resolved against the caller's claims at runtime. */
- | {
-    kind: 'capability';
-    key: string;
-} | {
-    kind: 'role';
-    key: string;
-}
-/** `exists(<link-path>, <pred>)` — the inner predicate runs against the final target. */
- | {
-    kind: 'exists';
-    path: readonly string[];
-    where: PolicyNode;
-};
-interface ParsedPolicy {
-    readonly source: string;
-    readonly ast: PolicyNode;
-}
-declare function walkPolicy(node: PolicyNode, visit: (node: PolicyNode) => void): void;
-
-/** Parse-time failure — bad token stream, malformed call, invalid claim key. */
-declare class PolicyParseError extends Error {
-    readonly position: number;
-    readonly name = "PolicyParseError";
-    constructor(message: string, position: number);
-}
-type PolicyCompileErrorCode = 'unknown-table' | 'unknown-column' | 'unknown-link' | 'not-to-one' | 'link-depth-exceeded' | 'unsupported-comparison' | 'invalid-null-comparison' | 'when-not-claims-only';
-/**
- * Compile-time failure — the parsed policy references something the table
- * doesn't declare, or uses a shape the v2.0 IR cannot represent. Carries
- * `candidates` so the error can name what IS available.
- */
-declare class PolicyCompileError extends Error {
-    readonly code: PolicyCompileErrorCode;
-    readonly candidates: readonly string[];
-    readonly name = "PolicyCompileError";
-    constructor(message: string, code: PolicyCompileErrorCode, candidates?: readonly string[]);
-}
-
-declare function parsePolicy(source: string): ParsedPolicy;
-
-/**
- * Policy DSL v2 → PredIr compiler. Resolves column/link references against a
- * table resolver (TableMetaIr satisfies the shapes structurally), normalizes
- * everything to LOGICAL column names, and enforces the v2.0 representability
- * rules the frozen IR imposes:
- *
- *  - dotted to-one paths (`deal.org = claim('org')`) lower to nested
- *    `exists(link, …)` with the comparison innermost;
- *  - total link-traversal depth (dotted hops + exists nesting) ≤ 3;
- *  - a comparison must reference exactly ONE column side (column↔column and
- *    claims↔literal comparisons have no PredIr shape in v2.0);
- *  - `col = null` / `col != null` normalize to the isNull operator;
- *  - variant `when` guards are claims-only: capability()/role() under
- *    and/or/not. (claim() comparisons in `when` are not representable in the
- *    v2.0 IR — a targeted error says so.)
- */
-
-declare const POLICY_MAX_LINK_DEPTH = 3;
-interface PolicyColumnInfo {
-    readonly name: string;
-    readonly columnName: string;
-}
-interface PolicyLinkInfo {
-    readonly name: string;
-    readonly kind: 'toOne' | 'toMany' | 'toPlatformUser';
-    readonly target: string;
-}
-interface PolicyTableInfo {
-    readonly columns: readonly PolicyColumnInfo[];
-    readonly links: readonly PolicyLinkInfo[];
-}
-/** `{ tables }` keyed by table name — TableMetaIr's record is assignable. */
-interface PolicyResolver {
-    readonly tables: Record<string, PolicyTableInfo>;
-}
-interface CompilePredicateInput {
-    /** DSL source text, or an already-parsed policy. */
-    expression: string | ParsedPolicy;
-    table: string;
-    resolver: PolicyResolver;
-    maxLinkDepth?: number;
-}
-declare function compilePredicateV2({ expression, table, resolver, maxLinkDepth }: CompilePredicateInput): PredIr;
-/** Variant `when` guards may only test claims: capability()/role() under and/or/not. */
-declare function assertClaimsOnlyWhen(parsed: ParsedPolicy): void;
-interface CompilePolicyInput {
-    expression: PolicyExpression;
-    table: string;
-    resolver: PolicyResolver;
-    maxLinkDepth?: number;
-}
-/**
- * Policy expression (string or `{default, variants}`) → one PredIr under §4c
- * permissive-union semantics:
- *
- *   OR(default, …variants.map(v => AND(when, v.allow ? const(true) : policy)))
- *
- * Granting a role/capability only ever widens access; `allow: true`
- * short-circuits its branch to the guard alone.
- */
-declare function compilePolicy({ expression, table, resolver, maxLinkDepth }: CompilePolicyInput): PredIr;
-
-export { type BuildContextResult, COMPILER_MAJOR, CONST_TRUE, type ClientManifest, type ClientManifestOperation, type CompileContext, type CompileNamespaceInput, type CompileNamespaceResult, type CompilePolicyInput, type CompilePredicateInput, type CompilerDiagnostic, DEFAULT_LIMIT, type DiagnosticSeverity, DocumentCompileError, type DynamicInputIssue, type DynamicInputResult, MAX_LIMIT, type MutationOp, type MutationRootInfo, NamespaceCompileError, type NormalizedBoolExp, type NormalizedOnConflict, type NormalizedOrderBy, type NormalizedRow, OperationLowerer, PLATFORM_USER_TABLE, POLICY_COMPARE_OPS, POLICY_MAX_LINK_DEPTH, type ParseDocumentsResult, type ParsedDocument, type ParsedPolicy, type PinnedColumn, type PolicyColumnInfo, type PolicyCompareOp, PolicyCompileError, type PolicyCompileErrorCode, type PolicyLinkInfo, type PolicyNode, type PolicyOperand, PolicyParseError, type PolicyResolver, type PolicyTableInfo, type QueryRootInfo, type RestrictedOperation, type SourceDocument, andPred, assertClaimsOnlyWhen, buildCompileContext, canonicalOperationText, classifyInputType, collectPinnedColumns, compileNamespace, compileNamespaceOrThrow, compilePolicy, compilePredicateV2, computeOpHash, computeOpsHash, computePinnedColumnsByTable, computeSchemaHash, flattenOperation, injectPolicies, inputTypeName, lowerOperation, mutationRootNames, parseDocuments, parsePolicy, parseSdl, platformUserMeta, predContains, predContainsExists, queryRootNames, restrictOperation, typeNameForTable, validateAppendInput, validateBoolExpInput, validateInsertInput, validateOnConflictInput, validateOrderByInput, validateSelectColumns, validateSetInput, walkPolicy, walkPred };
+export { type BuildContextResult, COMPILER_MAJOR, CONST_TRUE, type ClientManifest, type ClientManifestOperation, type CompileContext, type CompileNamespaceInput, type CompileNamespaceResult, type CompilerDiagnostic, DEFAULT_LIMIT, type DiagnosticSeverity, DocumentCompileError, MAX_LIMIT, type MutationOp, type MutationRootInfo, NamespaceCompileError, OperationLowerer, PLATFORM_USER_TABLE, type ParseDocumentsResult, type ParsedDocument, type PinnedColumn, type QueryRootInfo, type RestrictedOperation, type SourceDocument, andPred, buildCompileContext, canonicalOperationText, classifyInputType, collectPinnedColumns, compileNamespace, compileNamespaceOrThrow, computeOpHash, computeOpsHash, computePinnedColumnsByTable, computeSchemaHash, flattenOperation, injectPolicies, inputTypeName, lowerOperation, mutationRootNames, parseDocuments, parseSdl, platformUserMeta, predContains, predContainsExists, queryRootNames, restrictOperation, typeNameForTable, walkPred };