graphddb 0.5.2 → 0.5.3

package/dist/index.d.ts

@@ -1,7 +1,11 @@
-import { S as SelectableOf, g as PrimaryKeyOf, h as RequestContext, i as Middleware, j as ReadRequestKind, k as CtxModel, l as ReadParams, m as ReadRequestCtx, D as DynamoDBOperation, I as Item, E as Executor, n as RetryPolicy, o as ExecutionPlanSpec, p as EntityMetadata, K as KeyDefinition, G as GsiDefinition, q as ModelKind, F as FieldOptions, r as DynamoType, s as ProjectionTransform, t as MaintainEvent, u as MembershipPredicate, v as MaintainConsistency, w as MaintainUpdateMode, x as MembershipPredicateOp, y as RelationOptions, A as AggregateOptions, z as AggregateValue, H as SelectBuilderSpec, J as RawCondition, L as TransactionSpec, N as Manifest, O as RetryOverride, Q as ExecutionPlan, V as FieldMetadata, X as ResolvedKey, R as ReadExecOptions, a as ExecutorResult, B as BatchGetExecInput, P as PutInput, W as WriteExecOptions, b as WriteResult, U as UpdateInput, c as DeleteInput, d as BatchWriteExecItem, e as BatchExecOptions, T as TransactWriteExecItem, Y as CdcEmulatorOptions, Z as ChangeHandler, _ as Unsubscribe, $ as FaultSpec, a0 as ConcurrentRecomputeRef, C as ChangeEvent, a1 as EventLog, a2 as ReplayOptions, a3 as ShardId, a4 as ViewDefinition, a5 as RelationMetadata, a6 as TransactionItemSpec, a7 as MaintainEffect, M as ModelStatic, f as DDBModel, a8 as Param, a9 as ParamDescriptor, aa as DefinitionMap, ab as OperationDefinition, ac as WriteDefinitionOptions, ad as PartialQueryKeyOf, ae as StrictSelectSpec, af as ReadDefinitionOptions, ag as EntityInput, ah as UniqueQueryKeyOf, ai as EntityRef, aj as ConditionInput, ak as QueryModelContract, al as QueryMethodSpec, am as CommandModelContract, an as CommandMethodSpec, ao as ContractSpec, ap as QuerySpec, aq as CommandSpec, ar as ContextSpec, as as OperationsDocument, at as AnyOperationDefinition, au as BridgeBundle, av as ConditionSpec } from './types-m1Ect6hG.js';
-export { aw as AggregateMetadata, ax as BatchDeleteRequest, ay as BatchGetOptions, az as BatchGetRequest, aA as BatchGetResult, aB as BatchPutRequest, aC as BatchResult, aD as BatchWriteRequest, aE as CONTRACT_RANGE_FANOUT_CONCURRENCY, aF as CdcMode, aG as CdcModelRegistry, aH as CdcSubscribeHandlers, aI as Change, aJ as ChangeBatch, aK as ChangeEventName, aL as ClockMode, aM as CollectionEffect, aN as CollectionOptions, aO as Column, aP as ColumnMap, aQ as CommandContractMethodSpec, aR as CommandInputShape, aS as CommandMethod, aT as CommandPlan, aU as CommandResolutionTarget, aV as CommandResultKind, aW as CommandSelectShape, aX as CompiledFragment, aY as ComposeSpec, aZ as CondSlot, a_ as ConditionCheckInput, a$ as Connection, b0 as ContractCallSignature, b1 as ContractCardinality, b2 as ContractCommandParams, b3 as ContractCommandResult, b4 as ContractComposeNode, b5 as ContractFromRef, b6 as ContractInputArity, b7 as ContractItem, b8 as ContractKeyFieldRef, b9 as ContractKeyInput, ba as ContractKeyRef, bb as ContractKeySpec, bc as ContractKind, bd as ContractMethodOp, be as ContractParamRef, bf as ContractQueryParams, bg as ContractResolution, bh as CounterAggregate, bi as CounterEffect, bj as CtxBase, bk as DEFAULT_MAX_ATTEMPTS, bl as DEFAULT_RETRY_POLICY, bm as DeleteOptions, bn as DeriveEffect, bo as DerivedEdgeWrite, bp as DerivedUpdate, bq as DescriptorBinding, br as ENTITY_WRITES_MARKER, bs as EdgeEffect, bt as EffectPath, bu as EmbeddedMetadata, bv as EmitEffect, bw as EntityWritesDefinition, bx as EntityWritesShape, by as ExecutableCommandContract, bz as ExecutableQueryContract, bA as FilterInput, bB as FilterSpec, bC as FragmentInput, bD as GsiDefinitionMarker, bE as GsiOptions, bF as IdempotencyEffect, bG as InProcessWriteDescriptor, bH as InputArity, bI as KeyDefinitionMarker, bJ as KeySegment, bK as KeySlot, bL as KeyStructure, bM as KeyedResult, bN as LIFECYCLE_CONTRACT_MARKER, bO as LifecycleContract, bP as LifecycleEffects, bQ as LiteralParam, bR as MaintainItem, bS as MaintainTrigger, bT as MaintenanceGraph, bU as ManifestEntity, bV as ManifestField, bW as ManifestFieldType, bX as ManifestGsi, bY as ManifestKey, bZ as ManifestRelation, b_ as ManifestTable, b$ as MembershipEffect, c0 as ModelRef, c1 as MutateMode, c2 as MutateOptions, c3 as MutateParallelResult, c4 as MutateTransactionResult, c5 as MutationBody, c6 as MutationDescriptorMap, c7 as MutationFragment, c8 as MutationInputProxy, c9 as MutationInputRef, ca as MutationIntent, cb as NumberParam, cc as OperationKind, cd as OperationSpec, ce as ParallelOpResult, cf as ParamKind, cg as ParamSpec, ch as ParamStructure, ci as PersistCtx, cj as PersistOrigin, ck as PlannedCommandMethod, cl as ProjectionMap, cm as ProjectionTransformOp, cn as PutOptions, co as QueryContractMethodSpec, cp as QueryEnvelopeResult, cq as QueryKeyOf, cr as QueryMethod, cs as QueryResult, ct as RangeConditionSpec, cu as ReadEnvelope, cv as ReadOpCtx, cw as ReadOpKind, cx as ReadOperationType, cy as ReadRouteDescriptor, cz as ReadRouteOptions, cA as ReadRouteResult, cB as RecordedCompose, cC as RelationBuilder, cD as RelationConsistency, cE as RelationLimitOptions, cF as RelationPattern, cG as RelationProjection, cH as RelationReadOptions, cI as RelationSelect, cJ as RelationSpec, cK as RelationUpdateMode, cL as RelationWriteOptions, cM as RequiresEffect, cN as Resolution, cO as RetryInfo, cP as RetryOperationKind, cQ as SPEC_VERSION, cR as SegmentSpec, cS as SegmentedKey, cT as SelectBuilder, cU as SelectOf, cV as SnapshotEffect, cW as StartingPosition, cX as StreamViewType, cY as StringParam, cZ as SubscribeHandler, c_ as SubscribeHandlers, c$ as TransactionContext, d0 as TransactionItemType, d1 as UniqueEffect, d2 as Updatable, d3 as UpdateOptions, d4 as ViewSourceSlice, d5 as WhenSpec, d6 as WriteCtx, d7 as WriteDescriptor, d8 as WriteEnvelope, d9 as WriteInput, da as WriteKind, db as WriteLifecyclePhase, dc as WriteMiddleware, dd as WriteOperationType, de as WriteRecorder, df as WriteResultProjection, dg as attachModelClass, dh as buildDeleteInput, di as buildMaintenanceGraph, dj as buildPutInput, dk as buildSubscribeHandler, dl as buildUpdateInput, dm as collectViewDefinitions, dn as compileFragment, dp as compileMutationPlan, dq as compileSingleFragmentPlan, dr as cond, ds as contractOfMethodSpec, dt as definePlan, du as entityWrites, dv as executeBatchGet, dw as executeBatchWrite, dx as executeCommandMethod, dy as executeDelete, dz as executeKeyedBatchGet, dA as executePut, dB as executeQueryMethod, dC as executeRangeFanout, dD as executeTransaction, dE as executeUpdate, dF as from, dG as getEntityWrites, dH as gsi, dI as identity, dJ as isColumn, dK as isCommandModelContract, dL as isCommandPlan, dM as isContractComposeNode, dN as isContractFromRef, dO as isContractKeyFieldRef, dP as isContractKeyRef, dQ as isContractParamRef, dR as isEntityWritesDefinition, dS as isKeySegment, dT as isLifecycleContract, dU as isMaintainTrigger, dV as isMutationFragment, dW as isMutationInputRef, dX as isParam, dY as isPlannedCommandMethod, dZ as isQueryModelContract, d_ as isRetryableError, d$ as isRetryableTransactionCancellation, e0 as k, e1 as key, e2 as lifecyclePhaseForIntent, e3 as maintainTrigger, e4 as mintContractKeyFieldRef, e5 as mintContractParamRef, e6 as mutation, e7 as param, e8 as preview, e9 as publicCommandModel, ea as publicQueryModel, eb as query, ec as resolveLifecycle, ed as wholeKeysSentinel } from './types-m1Ect6hG.js';
+export { a as LintResult, L as LintRule, b as Linter, M as MetadataRegistry } from './registry-BD_5Rm5C.js';
+import { aN as SelectableOf, aO as PrimaryKeyOf, aP as RequestContext, aQ as Middleware, aR as ReadRequestKind, aS as CtxModel, aT as ReadParams, aU as ReadRequestCtx, D as DynamoDBOperation, aV as Item, n as Executor, aW as RetryPolicy, am as ExecutionPlanSpec, aX as KeyDefinition, aY as GsiDefinition, aZ as ModelKind, a_ as FieldOptions, a$ as DynamoType, b0 as ProjectionTransform, b1 as MaintainEvent, b2 as MembershipPredicate, b3 as MaintainConsistency, b4 as MaintainUpdateMode, b5 as MembershipPredicateOp, b6 as RelationOptions, b7 as AggregateOptions, b8 as AggregateValue, b9 as SelectBuilderSpec, ba as RawCondition, m as EntityMetadata, N as TransactionSpec, _ as Manifest, bb as RetryOverride, bc as ExecutionPlan, bd as FieldMetadata, be as ResolvedKey, o as ReadExecOptions, p as ExecutorResult, q as BatchGetExecInput, P as PutInput, W as WriteExecOptions, r as WriteResult, s as UpdateInput, t as DeleteInput, u as BatchWriteExecItem, v as BatchExecOptions, T as TransactWriteExecItem, bf as RelationMetadata, aC as TransactionItemSpec, bg as MaintainEffect, M as ModelStatic, w as DDBModel, V as ViewDefinition, A as Param, x as ParamDescriptor, X as DefinitionMap, bh as OperationDefinition, bi as WriteDefinitionOptions, bj as PartialQueryKeyOf, bk as StrictSelectSpec, bl as ReadDefinitionOptions, bm as EntityInput, bn as UniqueQueryKeyOf } from './maintenance-view-adapter-D5t9taTE.js';
+export { bo as AggregateMetadata, Z as AnyOperationDefinition, bp as BatchDeleteRequest, bq as BatchGetOptions, br as BatchGetRequest, bs as BatchGetResult, bt as BatchPutRequest, B as BatchResult, bu as BatchWriteRequest, $ as BridgeBundle, bv as CONTRACT_RANGE_FANOUT_CONCURRENCY, C as CdcEmulatorOptions, a as CdcMode, bw as CdcModelRegistry, bx as CdcSubscribeHandlers, by as Change, b as ChangeBatch, c as ChangeEvent, d as ChangeEventName, e as ChangeHandler, f as ClockMode, bz as CollectionEffect, bA as CollectionOptions, bB as Column, bC as ColumnMap, a1 as CommandContractMethodSpec, bD as CommandInputShape, bE as CommandMethod, I as CommandMethodSpec, H as CommandModelContract, bF as CommandPlan, a2 as CommandResolutionTarget, bG as CommandResultKind, bH as CommandSelectShape, L as CommandSpec, a3 as CompiledFragment, a5 as ComposeSpec, g as ConcurrentRecomputeRef, bI as CondSlot, bJ as ConditionCheckInput, z as ConditionInput, a0 as ConditionSpec, bK as Connection, O as ContextSpec, bL as ContractCallSignature, a7 as ContractCardinality, bM as ContractCommandParams, a8 as ContractCommandResult, bN as ContractComposeNode, bO as ContractFromRef, a9 as ContractInputArity, bP as ContractItem, bQ as ContractKeyFieldRef, bR as ContractKeyInput, bS as ContractKeyRef, aa as ContractKeySpec, ab as ContractKind, bT as ContractMethodOp, bU as ContractParamRef, bV as ContractQueryParams, ac as ContractResolution, J as ContractSpec, bW as CounterAggregate, bX as CounterEffect, bY as CtxBase, bZ as DEFAULT_MAX_ATTEMPTS, b_ as DEFAULT_RETRY_POLICY, b$ as DeleteOptions, c0 as DeriveEffect, ae as DerivedEdgeWrite, ak as DerivedUpdate, c1 as DescriptorBinding, c2 as ENTITY_WRITES_MARKER, c3 as EdgeEffect, c4 as EffectPath, c5 as EmbeddedMetadata, c6 as EmitEffect, y as EntityRef, c7 as EntityWritesDefinition, c8 as EntityWritesShape, E as EventLog, c9 as ExecutableCommandContract, ca as ExecutableQueryContract, F as FaultSpec, cb as FilterInput, an as FilterSpec, cc as FragmentInput, cd as GsiDefinitionMarker, ce as GsiOptions, cf as IdempotencyEffect, cg as InProcessWriteDescriptor, ch as InputArity, ci as KeyDefinitionMarker, cj as KeySegment, ck as KeySlot, cl as KeyStructure, cm as KeyedResult, cn as LIFECYCLE_CONTRACT_MARKER, co as LifecycleContract, cp as LifecycleEffects, cq as LiteralParam, cr as MaintainItem, cs as MaintainTrigger, ct as MaintenanceGraph, ap as ManifestEntity, aq as ManifestField, ar as ManifestFieldType, as as ManifestGsi, at as ManifestKey, au as ManifestRelation, av as ManifestTable, cu as MembershipEffect, cv as ModelRef, cw as MutateMode, cx as MutateOptions, cy as MutateParallelResult, cz as MutateTransactionResult, cA as MutationBody, cB as MutationDescriptorMap, cC as MutationFragment, cD as MutationInputProxy, cE as MutationInputRef, cF as MutationIntent, cG as NumberParam, cH as OperationKind, aw as OperationSpec, Y as OperationsDocument, cI as ParallelOpResult, cJ as ParamKind, ax as ParamSpec, cK as ParamStructure, cL as PersistCtx, cM as PersistOrigin, cN as PlannedCommandMethod, cO as ProjectionMap, cP as ProjectionTransformOp, cQ as PutOptions, ay as QueryContractMethodSpec, cR as QueryEnvelopeResult, cS as QueryKeyOf, cT as QueryMethod, G as QueryMethodSpec, Q as QueryModelContract, cU as QueryResult, K as QuerySpec, az as RangeConditionSpec, cV as ReadEnvelope, cW as ReadOpCtx, cX as ReadOpKind, aA as ReadOperationType, cY as ReadRouteDescriptor, cZ as ReadRouteOptions, c_ as ReadRouteResult, c$ as RecordedCompose, d0 as RelationBuilder, d1 as RelationConsistency, d2 as RelationLimitOptions, d3 as RelationPattern, d4 as RelationProjection, d5 as RelationReadOptions, d6 as RelationSelect, d7 as RelationSpec, d8 as RelationUpdateMode, d9 as RelationWriteOptions, R as ReplayOptions, da as RequiresEffect, db as Resolution, dc as RetryInfo, dd as RetryOperationKind, aB as SPEC_VERSION, de as SegmentSpec, df as SegmentedKey, dg as SelectBuilder, dh as SelectOf, S as ShardId, di as SnapshotEffect, h as StartingPosition, i as StreamViewType, dj as StringParam, j as SubscribeHandler, k as SubscribeHandlers, dk as TransactionContext, aD as TransactionItemType, dl as UniqueEffect, dm as Updatable, dn as UpdateOptions, dp as ViewSourceSlice, aE as WhenSpec, dq as WriteCtx, dr as WriteDescriptor, ds as WriteEnvelope, dt as WriteInput, du as WriteKind, dv as WriteLifecyclePhase, dw as WriteMiddleware, aF as WriteOperationType, dx as WriteRecorder, dy as WriteResultProjection, dz as attachModelClass, dA as buildDeleteInput, dB as buildMaintenanceGraph, dC as buildPutInput, l as buildSubscribeHandler, dD as buildUpdateInput, dE as collectViewDefinitions, aH as compileFragment, aI as compileMutationPlan, aJ as compileSingleFragmentPlan, dF as cond, dG as contractOfMethodSpec, dH as definePlan, dI as entityWrites, dJ as executeBatchGet, dK as executeBatchWrite, dL as executeCommandMethod, dM as executeDelete, dN as executeKeyedBatchGet, dO as executePut, dP as executeQueryMethod, dQ as executeRangeFanout, dR as executeTransaction, dS as executeUpdate, dT as from, dU as getEntityWrites, dV as gsi, dW as identity, dX as isColumn, dY as isCommandModelContract, dZ as isCommandPlan, d_ as isContractComposeNode, d$ as isContractFromRef, e0 as isContractKeyFieldRef, e1 as isContractKeyRef, e2 as isContractParamRef, e3 as isEntityWritesDefinition, e4 as isKeySegment, e5 as isLifecycleContract, e6 as isMaintainTrigger, e7 as isMutationFragment, e8 as isMutationInputRef, e9 as isParam, ea as isPlannedCommandMethod, eb as isQueryModelContract, ec as isRetryableError, ed as isRetryableTransactionCancellation, ee as k, ef as key, eg as lifecyclePhaseForIntent, eh as maintainTrigger, ei as mintContractKeyFieldRef, ej as mintContractParamRef, ek as mutation, el as param, em as preview, en as publicCommandModel, eo as publicQueryModel, ep as query, aL as resolveLifecycle, eq as wholeKeysSentinel } from './maintenance-view-adapter-D5t9taTE.js';
 import { DynamoDBClient } from '@aws-sdk/client-dynamodb';
 import { DynamoDBDocumentClient } from '@aws-sdk/lib-dynamodb';
+export { C as CdcEmulator, M as MAINT_OUTBOX_PK_PREFIX, a as MaintenanceDrain, b as MaintenanceDrainOptions, c as createCdcEmulator, d as createMaintenanceDrain, e as createMaintenanceDrainHandler, p as parseChange } from './from-change-DQK2Jm9R.js';
+export { c as createDefaultLinter, g as gsiAmbiguityRule, m as missingGsiRule, n as noScanRule, q as queryBoundaryRule, r as relationDepthRule, a as requireLimitRule } from './relation-depth-DLkhG0xX.js';
+export { A as AnyModelContract, B as BuiltContracts, C as ContextOwnership, a as ContextOwnershipMap, b as ContractBoundaryViolation, c as ContractInputs, d as ContractMap, e as ContractN1Violation, T as TransactionDefinition, f as TransactionParamShape, g as TransactionRef, h as TxConditionCheckOptions, i as TxForEachInstruction, j as TxForEachOptions, k as TxInstruction, l as TxRecorder, m as TxWriteInstruction, n as TxWriteOptions, W as WhenComparison, o as assertBundleSerializable, p as assertContractBoundaries, q as assertContractN1Safe, r as assertJsonSerializable, s as assertSupportedCondition, t as buildBridgeBundle, u as buildContexts, v as buildContracts, w as buildManifest, x as buildOperations, y as buildQuerySpec, z as buildTransactionSpec, D as buildTransactions, E as collectContractBoundaryViolations, F as collectContractN1Violations, G as defineTransaction, H as defineTransactions, I as isTransactionRef, J as when } from './index-CtDBo8Se.js';
 
 /**
  * Query options with conditional `consistentRead` availability.
@@ -313,72 +317,6 @@ interface RelationExecutionPlan {
     readonly resultPaths: readonly string[];
 }
 
-interface LintRule {
-    id: string;
-    severity: 'error' | 'warning';
-    check(metadata: EntityMetadata, registry: typeof MetadataRegistry): LintResult[];
-}
-interface LintResult {
-    ruleId: string;
-    severity: 'error' | 'warning';
-    message: string;
-    entity: string;
-    field?: string;
-}
-
-declare class Linter {
-    private rules;
-    addRule(rule: LintRule): void;
-    run(metadata: EntityMetadata, registry: typeof MetadataRegistry): LintResult[];
-    runAll(registry: typeof MetadataRegistry): LintResult[];
-}
-
-declare class MetadataRegistry {
-    private static store;
-    private static _linter;
-    /**
-     * A monotonically-increasing counter bumped on every change to the set of
-     * registered models ({@link register} / {@link clear}). It lets a consumer that
-     * caches a structure derived from the whole registry (e.g. the maintenance graph
-     * in `src/spec/mutation-command.ts`) detect that the registry has changed since
-     * the cache was built and rebuild — closing the silent-drop window where a model
-     * registered after a cache build would be invisible to it. Only the membership
-     * of {@link store} changes here; per-model lazy finalize ({@link finalize}) does
-     * not bump it (it adds no relations/triggers, so it cannot change the graph).
-     */
-    private static _generation;
-    /**
-     * The current registry generation (see {@link _generation}). A consumer caches
-     * the value it built against and rebuilds when it no longer matches.
-     */
-    static get generation(): number;
-    static register(target: Function, metadata: EntityMetadata): void;
-    static get(target: Function): EntityMetadata;
-    static has(target: Function): boolean;
-    static getAll(): Map<Function, EntityMetadata>;
-    /**
-     * Snapshot of the entities that are **already finalized**, WITHOUT triggering
-     * finalize on any pending entity (unlike {@link getAll}). This is the safe view
-     * for a cross-entity lint rule that runs *inside* `finalize`: eagerly
-     * finalizing the rest of the registry from within a finalize pass would
-     * re-enter (and duplicate) the in-progress entity's finalize. A whole-registry
-     * rule instead reasons over the already-finalized peers plus the entity
-     * currently being checked; any conflicting pair is caught when the later of the
-     * two finalizes (both are present by then).
-     *
-     * @internal — for cross-entity linter rules.
-     */
-    static getFinalized(): Map<Function, EntityMetadata>;
-    static get linter(): Linter;
-    static set linter(linter: Linter);
-    /** Resets linter to the default built-in rule set. */
-    static resetLinter(): void;
-    /** @internal — for testing only */
-    static clear(): void;
-    private static finalize;
-    private static handleLintResults;
-}
-
 declare function derivePrefix(customPrefix: string | undefined, className: string | undefined): string;
 
 /**
@@ -1342,330 +1280,6 @@ declare function encodeCursor(lastEvaluatedKey: Record<string, unknown>): string
  */
 declare function decodeCursor(cursor: string): Record<string, unknown>;
 
-/**
- * CDC emulator (issue #72). Subscribes to the core write-capture seam
- * ({@link ChangeCaptureRegistry}) and turns each {@link RawWriteRecord} into a
- * DynamoDB-Streams-equivalent {@link ChangeEvent}, then delivers events to a
- * consumer under a deterministic delivery contract (spec §6): per-shard ordered,
- * batched, at-least-once, with checkpoint/resume, partial-batch failure, and a
- * dead-letter queue. Faults (duplicate / reorder / delay / dropThenRedeliver /
- * partialBatchFailure) and a concurrent-recompute race are injectable and
- * seeded for deterministic reproduction (spec §8).
- *
- * The emulator is dev/test only. The {@link ChangeEvent} type and delivery
- * contract match real Streams so a consumer is portable to production (spec §1).
- */
-
-/**
- * The CDC emulator (spec §10 API). Construct via {@link createCdcEmulator}.
- */
-declare class CdcEmulator {
-    private readonly mode;
-    private readonly clockMode;
-    private readonly batchSize;
-    private readonly maxRetries;
-    private readonly startingPosition;
-    private readonly shardCount;
-    private readonly seed;
-    private rng;
-    private faultSpec;
-    private concurrentRecompute;
-    private concurrentRecomputeHook;
-    /** Per-shard monotonic sequence counter. */
-    private seqCounters;
-    /** Per-shard delivery queue (queued/replay modes). */
-    private queues;
-    /** Per-shard last successfully checkpointed sequence number. */
-    private checkpointMap;
-    /**
-     * Per-shard set of acked sequence numbers (as ints) not yet folded into the
-     * checkpoint. The checkpoint advances over the contiguous prefix of acked
-     * sequences (ReportBatchItemFailures semantics): a sequence is checkpointed
-     * only once every sequence at or before it has been acked.
-     */
-    private ackedSeqs;
-    /** Per-shard count of sequences ever assigned, to bound the prefix scan. */
-    private maxSeqSeen;
-    /** Recorded event log (record mode and always, for replay()). */
-    private log;
-    /** Dead-letter buffer. */
-    private dlq;
-    private handler;
-    /** Virtual clock (ms since EPOCH). */
-    private clockMs;
-    /** Pending async work from inline-mode captures, awaited by callers. */
-    private inflight;
-    private detachCapture;
-    private readonly models;
-    constructor(opts?: CdcEmulatorOptions);
-    private onRawWrite;
-    private toChangeEvent;
-    /** Parse a zero-padded sequence string back to its integer value. */
-    private seqToInt;
-    /** Render an integer sequence as the zero-padded string form. */
-    private intToSeq;
-    /**
-     * Advance a shard's checkpoint over the contiguous prefix of acked sequence
-     * numbers. Starting just past the current checkpoint, consume every
-     * consecutive acked sequence; stop at the first gap (an un-acked sequence
-     * still pending redelivery). Consumed sequences are removed from the acked
-     * set to bound its size.
-     */
-    private advanceCheckpoint;
-    private deriveEventName;
-    private nowIso;
-    private enqueue;
-    /**
-     * Deliver buffered, due records to the consumer, advancing per-shard
-     * checkpoints on success and redelivering failures. In `queued`/`replay`
-     * modes call this (or {@link advanceClock}) to drive delivery; `inline` calls
-     * it automatically after each capture.
-     */
-    pump(maxBatches?: number): Promise<void>;
-    /**
-     * Pull up to `batchSize` due records from a shard, preserving ascending
-     * sequence order (spec §6). When the `reorder` fault is on, the within-shard
-     * order is deliberately shuffled to exercise invariant detection.
-     */
-    private collectBatch;
-    private deliverBatch;
-    /** Register the consumer. Returns an unsubscribe handle. */
-    subscribe(handler: ChangeHandler): Unsubscribe;
-    /** Await any inline-mode async deliveries triggered by writes. */
-    flush(): Promise<void>;
-    /**
-     * Advance the virtual clock by `ms` and deliver records whose due-time has
-     * arrived (spec §7). Reproduces throttle T / sweep period / staleness S time
-     * behavior deterministically (AC4).
-     */
-    advanceClock(ms: number): Promise<void>;
-    /** Current virtual time (ms since the emulator epoch). */
-    now(): number;
-    /** Configure fault injection (spec §8). Merges into the current spec. */
-    fault(spec: FaultSpec): void;
-    /**
-     * Force a recompute to race a mark for the given ref (spec §8, §7). The
-     * harness supplies the actual recompute via {@link onConcurrentRecompute};
-     * this records which ref to race and arms the hook.
-     */
-    injectConcurrentRecompute(ref: ConcurrentRecomputeRef): void;
-    /**
-     * Register the callback the emulator invokes (before each record reaches the
-     * consumer) when a concurrent recompute has been injected. This is how the
-     * test harness wires its recompute into the delivery race.
-     */
-    onConcurrentRecompute(hook: (ref: ConcurrentRecomputeRef, event: ChangeEvent) => void | Promise<void>): void;
-    /** Snapshot the recorded event log (spec §10). */
-    record(): EventLog;
-    /**
-     * Replay an event log through the delivery pipeline, optionally shuffled and
-     * duplicated (spec §10, AC5). Used to prove **replay equivalence**: starting
-     * from any global order plus duplicates, a consumer that respects the
-     * per-shard ordering contract (spec §6) reaches a final aggregate equal to a
-     * full recompute from source.
-     *
-     * The shuffle models cross-shard reordering and at-least-once chaos at the
-     * delivery boundary. It must NOT, however, break the within-shard ordering
-     * guarantee that real DynamoDB Streams provides and that incremental
-     * aggregation depends on — so after shuffling/duplicating, each shard's queue
-     * is re-sorted into ascending original `sequenceNumber` order before delivery.
-     * The original `sequenceNumber` (assigned at record time) is preserved so it
-     * remains the source-of-truth ordering the consumer can rely on.
-     */
-    replay(log: EventLog, opts?: ReplayOptions): Promise<void>;
-    /** Per-shard checkpoints (last acked sequence number). */
-    checkpoints(): Record<ShardId, string>;
-    /** Dead-lettered events (exceeded maxRetries). */
-    deadLetters(): ChangeEvent[];
-    /** Reset delivery state and re-seed (keeps the subscription + model opt-in). */
-    reset(): void;
-    /** Tear down: detach from the core seam and disable model streaming. */
-    close(): void;
-}
-/** Create a CDC emulator (spec §10). */
-declare function createCdcEmulator(opts?: CdcEmulatorOptions): CdcEmulator;
-
-/**
- * CDC **maintenance drain** (issue #130) — the asynchronous lower for
- * `updateMode: 'stream'` maintainers (Epic #118 §5.1).
- *
- * A synchronous (`updateMode: 'mutation'`) maintainer composes its owner-row write
- * into the SAME atomic `TransactWriteItems` as the source write (#127). A
- * `updateMode: 'stream'` maintainer instead emits a **maintenance-outbox** marker row
- * (`OUTBOX#MAINT#…`) ATOMICALLY with the source write (the #130 compile lowering in
- * `src/spec/mutation-command.ts`), and THIS consumer — driven by the {@link
- * import('./emulator.js').CdcEmulator} (or, in production, real DynamoDB Streams +
- * a Lambda built around {@link createMaintenanceDrainHandler}) — applies the owner-row
- * write asynchronously.
- *
- * ## Why a separate async path exists (not just "do it later synchronously")
- *
- * The async path realizes the maintenance operations a single synchronous
- * `UpdateExpression` cannot express against an unread item:
- *
- * - **collection `maxItems` trim** — keeping a bounded, ordered list requires reading
- *   the current list, appending, sorting, and trimming (a read-modify-write); a
- *   synchronous `list_append` can only append (Phase 1 was append-only, #127).
- * - **`removed`-driven splice** — removing an entry from a maintained collection on a
- *   source `removed` event likewise needs the current list.
- * - **running `max(field)`** — a conditional `SET` (`#a = :v` guarded by
- *   `attribute_not_exists(#a) OR #a < :v`) whose failed guard, if run synchronously,
- *   would roll back the legitimate source write.
- *
- * ## Delivery guarantees (reused from the CDC substrate)
- *
- * The maintenance-outbox row is recorded ATOMICALLY with the source write, so the
- * intent can never be lost ("wrote the row, lost the maintenance" is impossible). The
- * CDC substrate then delivers it **at-least-once**, **per-shard ordered** (a shard is
- * `hash(pk)`, and the outbox row's `pk` is keyed off the SOURCE row's key, so all
- * maintenance events for one source entity land on one shard in source-write order),
- * with a **DLQ** for poison events. This consumer is therefore written to be
- * **idempotent / commutative** wherever at-least-once redelivery could double-apply:
- *
- * - a `snapshot` `SET` is naturally idempotent (re-applying the same projection is a
- *   no-op);
- * - a `collection` rebuild de-duplicates by the projected item's identity key, so a
- *   redelivered append does not grow the list twice;
- * - a `max` conditional `SET` is idempotent (the guard rejects a non-greater value);
- * - a `count` `ADD` is the ONE non-idempotent op — but the source-row create guard
- *   (`attribute_not_exists`) means a given source `created` event is emitted at most
- *   once into the outbox, and the per-shard checkpoint advances only over acked events,
- *   so a `count` is applied once per genuine source lifecycle. (A duplicate DELIVERY of
- *   the same event is folded by the consumer's per-event de-dup set within a drain.)
- */
-
-/**
- * The PK prefix a maintenance-outbox row keys on — the single source of truth shared
- * with the compiler ({@link import('../spec/mutation-command.js')}'s
- * `MAINT_OUTBOX_PK_PREFIX`). The drain selects its events by `keys.pk.startsWith` of
- * this. Kept as a local literal (rather than importing a non-exported compiler const)
- * so the cdc module does not depend on the spec module; the value is asserted equal by
- * the integration tests that round-trip a real stream maintainer through both.
- */
-declare const MAINT_OUTBOX_PK_PREFIX = "OUTBOX#MAINT#";
-/** Options for {@link createMaintenanceDrain}. */
-interface MaintenanceDrainOptions {
-    /**
-     * The model classes (or `ModelStatic`s) whose stream maintainers this drain
-     * applies. The drain builds a scoped {@link MaintenanceGraph} over them to resolve
-     * each maintenance-outbox event back to its declared effect. Defaults to the GLOBAL
-     * registry when omitted.
-     */
-    readonly models?: readonly Function[];
-    /**
-     * The {@link ViewDefinition}s (`defineView`) whose maintainers this drain applies
-     * (issue #132). A view's destination is its dedicated view model; its source
-     * classes should also be in {@link models} so the drain can resolve their
-     * maintenance-outbox events. Defaults to none.
-     */
-    readonly views?: readonly ViewDefinition[];
-}
-/**
- * A maintenance drain: a CDC consumer ({@link ChangeHandler}) that applies the
- * owner-row writes for `updateMode: 'stream'` maintainers. Construct via
- * {@link createMaintenanceDrain}, then `subscribe` its {@link handler} to a
- * {@link import('./emulator.js').CdcEmulator} (dev/test) or wire it into a real
- * Streams Lambda (production).
- */
-declare class MaintenanceDrain {
-    private readonly graph;
-    /** Owner entity name → its model class (for the owner-row key derivation). */
-    private readonly ownerByName;
-    /** Per-event-id de-dup within a single handler invocation (at-least-once). */
-    private appliedSeq;
-    /** Count of owner-row writes applied (test/diagnostic). */
-    private applied;
-    constructor(opts?: MaintenanceDrainOptions);
-    /** The CDC {@link ChangeHandler} to subscribe to an emulator / Streams source. */
-    readonly handler: ChangeHandler;
-    /** Resolve one maintenance-outbox event to its effect and apply the owner-row write. */
-    private applyOne;
-    /** Resolve a maintenance-outbox event back to the declared {@link MaintainItem}. */
-    private resolve;
-    /** A `snapshot` SET of each projected attribute onto the owner row (idempotent). */
-    private applySnapshot;
-    /**
-     * A sparse-view **membership** write (#133): evaluate the membership predicate against
-     * the source image; PUT the view row (its projection + key fields) when the predicate
-     * holds, DELETE it when it flips false. A source `removed` event always deletes (the
-     * source no longer exists, so its view row must disappear regardless of the predicate).
-     *
-     * Both ops are idempotent under at-least-once redelivery: a repeated PUT writes the same
-     * row, a repeated DELETE is a no-op. The view row is keyed by the source identity
-     * (`effect.keys`), so the PUT/DELETE always targets the SAME physical row the predicate
-     * gates.
-     */
-    private applyMembership;
-    /**
-     * A running `max`: read the owner row, and `SET` the attribute to the source value
-     * only when it is greater (or absent). Implemented as a conditional update so a
-     * redelivered / out-of-order older value never regresses the stored max — idempotent
-     * and commutative under at-least-once delivery.
-     */
-    private applyMax;
-    /**
-     * A bounded `collection`: read the current list, apply the event (append for a
-     * `created`/`updated` source, splice for a `removed`), de-duplicate by the projected
-     * identity key, order by `orderBy` (in `orderDir`, default DESC), trim to `maxItems`, and write the whole
-     * list back. The read-modify-write is exactly what a single synchronous
-     * `UpdateExpression` cannot do — the reason a bounded/ordered collection is a stream
-     * maintainer (Phase 1 sync was append-only).
-     */
-    private applyCollection;
-    /** Owner-row writes applied so far (test/diagnostic). */
-    appliedCount(): number;
-    /** Clear the per-delivery de-dup set + counters (test reset). */
-    reset(): void;
-}
-/** Create a {@link MaintenanceDrain} (issue #130). */
-declare function createMaintenanceDrain(opts?: MaintenanceDrainOptions): MaintenanceDrain;
-/**
- * Create just the CDC {@link ChangeHandler} for a maintenance drain — the form to
- * subscribe to an emulator or wire into a production Streams Lambda. A thin wrapper
- * over {@link createMaintenanceDrain} for callers that only need the handler.
- */
-declare function createMaintenanceDrainHandler(opts?: MaintenanceDrainOptions): ChangeHandler;
-
-/**
- * `fromChange` — the pure `(event) => [old, new]` typed mapper (issue #153).
- *
- * This is graphddb's HALF of the CDC-projection boundary (see
- * `docs/cdc-projection.md`): it parses a raw {@link ChangeEvent}'s `oldImage` /
- * `newImage` into typed model instances and does nothing downstream of that (no
- * sink write, no dedup, no subscription). `Model.fromChange(event)` on `DDBModel`
- * delegates here.
- *
- * The two responsibilities packed into one call are **routing** and **parse**:
- *
- * - Routing — an event that is not for `modelClass` yields `[null, null]`. A valid
- *   event for the class always has at least one non-null image, so `[null, null]`
- *   is an unambiguous "not for this model" signal and no separate `owns()` guard is
- *   needed. The match is by `event.model` (the resolved model name the write path /
- *   emulator stamps) when present, falling back to the model's PK prefix
- *   (`keys.pk` begins with `<prefix>`) when the event carries no `model`.
- * - Parse — each present image is hydrated via the existing {@link hydrate}
- *   (raw item → typed value, INCLUDING ISO 8601 → `Date` for `@datetime` and
- *   embedded reconstruction), returning ALL fields (no projection — narrowing does
- *   not reduce network cost since the image is already on the stream). The hydrated
- *   plain record is then loaded onto a fresh model instance so the result is a
- *   genuine `InstanceType` (like the read path's `{ hydrate }` factory option).
- *
- * The image side present per event kind mirrors DynamoDB Streams:
- *
- * - INSERT → `[null,      new ]`
- * - MODIFY → `[old,       new ]`
- * - REMOVE → `[old,       null]`
- */
-
-/**
- * Parse a {@link ChangeEvent} into the `[oldRecord, newRecord]` tuple for the given
- * model. Returns `[null, null]` when the event is not for this model (routing). The
- * caller (`DDBModel.fromChange`) supplies the resolved metadata + class; this
- * function is the runtime core and is deliberately model-name-string driven so
- * `DDBModel.subscribe` can reuse it when routing a batch.
- */
-declare function parseChange<T extends object>(event: ChangeEvent, metadata: EntityMetadata, modelName: string, modelClass: new () => T): [T | null, T | null];
-
 /**
  * Per-key cursor envelope for batched `range` (`list`) contract methods (issue
  * #62, CQRS single-service runtime; spec `docs/cqrs-contract.md`,
@@ -1747,39 +1361,6 @@ declare function encodePerKeyCursor(key: Record<string, unknown>, inner: string
  */
 declare function decodePerKeyCursor(cursor: string, expectedKey: Record<string, unknown>): string;
 
-/**
- * Creates a Linter pre-loaded with rules safe for Entity registration.
- *
- * Rules included: no-scan, require-limit, gsi-ambiguity, missing-gsi,
- * relation-depth, same-partition-preset, plus the Epic #118 Phase 1 maintenance
- * validators (issue #126): missing-context, 400kb, hot-partition, fan-out,
- * multi-maintainer-same-row. The maintenance validators are no-ops for any
- * relation that does not declare `write.maintainedOn`, so unannotated models are
- * unaffected. query-boundary is excluded because it flags non-unique GSIs which
- * are valid for list() operations; boundary enforcement is handled at runtime by
- * the planner's boundary-check.
- *
- * Also includes cfn-schema-consistency (issue #169): a whole-table validator
- * that rejects entities sharing a physical table with an ambiguous base
- * KeySchema, inconsistently-shared GSI index names, or more than 20 unioned
- * GSIs — the CFn deploy-consistency user-error class, caught statically at
- * finalize. It is additive: a single entity on its own table with ≤ 20 GSIs is
- * never affected.
- */
-declare function createDefaultLinter(): Linter;
-
-declare const noScanRule: LintRule;
-
-declare const requireLimitRule: LintRule;
-
-declare const queryBoundaryRule: LintRule;
-
-declare const gsiAmbiguityRule: LintRule;
-
-declare const missingGsiRule: LintRule;
-
-declare const relationDepthRule: LintRule;
-
 declare function detectRelationFields(select: Record<string, unknown>, metadata: EntityMetadata): RelationMetadata[];
 declare function getImplicitKeyFields(select: Record<string, unknown>, metadata: EntityMetadata): string[];
 
@@ -2474,690 +2055,4 @@ type WriteOnlyDefinitions<D extends DefinitionMap> = {
     [K in keyof D]: D[K] extends OperationDefinition<infer _T, infer Op, infer _K, infer _S, infer _Ch, infer _P> ? Op extends 'put' | 'update' | 'delete' ? D[K] : OperationDefinition<DDBModel, 'put' | 'update' | 'delete', unknown, unknown, unknown, Record<string, ParamDescriptor>> : never;
 };
 
-/**
- * Declarative transaction definition DSL (issue #46, Python-bridge Phase 4).
- *
- * `defineTransaction(params, (tx, p) => { … })` captures a **single source of
- * truth** for a `TransactWriteItems` batch: a parameter map plus a declarative
- * instruction list (`tx.put` / `tx.update` / `tx.delete`, plus `tx.forEach` over
- * an array param). The callback is evaluated at definition time with sentinel
- * proxies in place of params / loop elements, so the recorded instructions carry
- * **field-reference templates** (`{groupId}`, `{item.userId}`) rather than
- * concrete values — exactly the shape the static planner (#42) turns into a
- * serializable `transaction` op the TS and Python runtimes expand identically.
- *
- * ## Declarativity boundary (enforced — same soundness as #42 keys)
- *
- * The callback body may only:
- *  - call `tx.put/update/delete(Model, …)` with **field references** (from `p`
- *    or a `forEach` element) or **concrete literals** at scalar leaves;
- *  - call `tx.forEach(p.<arrayParam>, (el) => { … }, { when? })` whose body is
- *    itself only `tx.*` writes;
- *  - attach a declarative `when` (a small comparison over field refs) and/or a
- *    `condition` (the `{ notExists } | equality` subset, as for single writes).
- *
- * The same hardening that protects **key** positions (#42 `src/spec/symbolic.ts`)
- * is applied to **value** positions (item / changes / condition values, `when`
- * right-hand side). Value positions are in fact held to a *stricter* boundary
- * than keys: a key may legitimately interpolate a field (`` `USER#${id}` ``), so
- * coercion is allowed there and the differential template check is the boundary;
- * a value leaf may **only** be a *direct* field reference or a concrete literal,
- * so at a value position a faithful reference is **never coerced**. That single
- * fact is the soundness boundary:
- *
- *  1. **Throwing sentinel Proxy.** Each param / element placeholder is a Proxy
- *     whose `get` trap whitelists only primitive coercion
- *     (`Symbol.toPrimitive` / `toString` / `valueOf`) and the brand / `token` /
- *     `origin` reads the planner needs, and **throws on every other property or
- *     method access**. So a *direct* transform on a value placeholder —
- *     `p.role.length`, `p.role[0]`, `p.role.toUpperCase()` — fails at the access
- *     site, exactly like a key sentinel. (Same first-line defense as #42.)
- *  2. **Per-access coercion ledger (primary boundary).** Every minted field ref
- *     records each time it is coerced to a primitive (`Symbol.toPrimitive` /
- *     `toString` / `valueOf`). Because a faithful value reference is stored as
- *     the Proxy *object* and never coerced, **any** coercion of a value ref is
- *     positive proof the callback consumed the parameter into a transform, a
- *     branch, an interpolation, or a comparison — and the build is rejected. This
- *     is *access-site* accurate: it fires even when the same field is *also*
- *     referenced faithfully elsewhere in the item (so its token still surfaces),
- *     and it catches transforms that **converge to a constant or a shared marker
- *     fragment** — `String(p.role).slice(0,0)` → `''`, `.slice(0,3)` → a shared
- *     prefix, `[0]` / `.charAt(0)`, `.includes('Tx')` → a constant boolean, any
- *     `… + 'CONST'` built atop them — which a purely output-comparing check could
- *     not (the dropped field is masked by its faithful sibling, and the converged
- *     value is byte-identical across passes).
- *  3. **Differential evaluation (secondary).** The callback is evaluated **twice**,
- *     each run delivering placeholders that coerce to a *different* per-field
- *     marker (the two markers share no common prefix and no common substring of
- *     length ≥ 2, and differ in length). Every recorded value leaf must be either
- *     (a) a faithful field reference (the Proxy object survived intact in *both*
- *     runs) or (b) a concrete literal byte-identical across both runs. This is a
- *     defense-in-depth layer behind the coercion ledger.
- *  4. **Consumed-field check.** A placeholder field that the callback *accessed*
- *     but that never reached the recorded output — e.g. `(p.role === 'admin') ?
- *     'A' : 'B'`, where `===` does **not** coerce (so the ledger does not fire),
- *     the comparison is `false`, and only a literal is emitted — is rejected: the
- *     param was silently dropped and a branch burned into the spec. (Same
- *     consumed-field accounting #42 uses for `kind === 'admin' ? … : …`.)
- *
- * Arbitrary JS, reads, value branching, arithmetic, coercion, or string
- * transforms on a param / element placeholder are therefore rejected at build
- * time, in **both** key and value positions — **never silently emitted as a
- * wrong spec**. Unlike key positions, value positions have **no residual class**:
- * because a faithful value ref is never coerced, even an identity-shaped
- * transform (`String(p.x).slice(0)`, `.normalize()`, `.trim()`, `.replace('§',…)`
- * on an absent substring) is rejected (it coerced the ref). The only operations
- * that *do not* coerce a ref are (a) storing it directly and (b) the brand read;
- * (a) is the supported faithful reference and (b) is internal — so the ledger has
- * no false positives and no escape.
- */
-
-declare const TX_REF_BRAND: unique symbol;
-/**
- * A captured reference to a parameter (`{name}`) or a `forEach` element field
- * (`{item.<field>}`). Branded so the planner can distinguish a reference from a
- * concrete literal, and so a stray reference cannot be silently coerced.
- */
-interface TransactionRef {
-    readonly [TX_REF_BRAND]: true;
-    /** The template token this reference renders to, e.g. `{groupId}`. */
-    readonly token: string;
-    /** Human-readable origin (for error messages), e.g. `param 'groupId'`. */
-    readonly origin: string;
-}
-/** Runtime guard: is `value` a {@link TransactionRef}? */
-declare function isTransactionRef(value: unknown): value is TransactionRef;
-/** A declarative comparison used by `when` (the only branching allowed). */
-type WhenComparison = {
-    readonly op: 'eq';
-    readonly left: TransactionRef;
-    readonly right: unknown;
-} | {
-    readonly op: 'ne';
-    readonly left: TransactionRef;
-    readonly right: unknown;
-};
-/**
- * A single captured instruction inside a transaction. The three write operations
- * (`put` / `update` / `delete`) mutate an item; `conditionCheck` (issue #81) is a
- * **read-only assertion** on another keyed item — it carries a `key` and a
- * **required** `condition` and never mutates, but its failure rolls the whole
- * transaction back. It is the foundation for referential-integrity derivation
- * (`requires <Entity> exists` → a `conditionCheck` with `attributeExists`).
- */
-interface TxWriteInstruction {
-    readonly kind: 'write';
-    readonly operation: 'put' | 'update' | 'delete' | 'conditionCheck';
-    readonly entity: EntityRef;
-    /** Put: the item structure (field → ref / literal). */
-    readonly item?: Record<string, unknown>;
-    /** Update / delete / conditionCheck: the key structure. */
-    readonly key?: Record<string, unknown>;
-    /** Update: the changes structure. */
-    readonly changes?: Record<string, unknown>;
-    /**
-     * The write / assertion condition (subset). Optional on `put` / `update` /
-     * `delete`; **required** on a `conditionCheck` (the assertion it makes).
-     */
-    readonly condition?: ConditionInput;
-    /** Optional declarative guard (skip this item when it does not hold). */
-    readonly when?: WhenComparison;
-}
-/** A `forEach` block expanding `body` once per element of an array param. */
-interface TxForEachInstruction {
-    readonly kind: 'forEach';
-    /** The array-param name iterated. */
-    readonly source: string;
-    /** Optional per-element declarative guard. */
-    readonly when?: WhenComparison;
-    /** The (write-only) instructions emitted per element. */
-    readonly body: TxWriteInstruction[];
-}
-type TxInstruction = TxWriteInstruction | TxForEachInstruction;
-/** Options accepted by `tx.put/update/delete`. */
-interface TxWriteOptions {
-    readonly condition?: ConditionInput;
-    readonly when?: WhenComparison;
-}
-/**
- * Options accepted by `tx.conditionCheck` (issue #81). The `condition` is the
- * read-only assertion the check makes against the keyed item and is **required**
- * — a ConditionCheck with no condition is meaningless. An optional `when` skips
- * the check entirely when the guard does not hold.
- */
-interface TxConditionCheckOptions {
-    readonly condition: ConditionInput;
-    readonly when?: WhenComparison;
-}
-/** Options accepted by `tx.forEach`. */
-interface TxForEachOptions {
-    readonly when?: WhenComparison;
-}
-/** A small comparison helper: `when.eq(ref, value)` / `when.ne(ref, value)`. */
-declare const when: {
-    readonly eq: (left: TransactionRef, right: unknown) => WhenComparison;
-    readonly ne: (left: TransactionRef, right: unknown) => WhenComparison;
-};
-/** The transaction recorder handed to the callback as `tx`. */
-interface TxRecorder {
-    put(model: ModelStatic<DDBModel>, item: Record<string, unknown>, options?: TxWriteOptions): void;
-    update(model: ModelStatic<DDBModel>, key: Record<string, unknown>, changes: Record<string, unknown>, options?: TxWriteOptions): void;
-    delete(model: ModelStatic<DDBModel>, key: Record<string, unknown>, options?: TxWriteOptions): void;
-    /**
-     * Record a **read-only** `ConditionCheck` assertion on a keyed item (issue
-     * #81): the item is not mutated, but `options.condition` must hold or the whole
-     * transaction is cancelled atomically. The foundation for referential-integrity
-     * derivation (`requires <Entity> exists` → `conditionCheck(Model, key, {
-     * condition: { attributeExists: 'PK' } })`).
-     */
-    conditionCheck(model: ModelStatic<DDBModel>, key: Record<string, unknown>, options: TxConditionCheckOptions): void;
-    forEach<E>(source: E, body: (element: ElementProxy<E>) => void, options?: TxForEachOptions): void;
-}
-/** The element proxy type inside a `forEach` body (fields → refs). */
-type ElementProxy<E> = E extends Param<infer T> ? T extends (infer Item)[] ? {
-    readonly [K in keyof Item]: TransactionRef;
-} : never : never;
-/** The typed IR node produced by {@link defineTransaction}. */
-interface TransactionDefinition {
-    /** @internal Marks this object as a transaction definition IR node. */
-    readonly __isTransactionDefinition: true;
-    /** Collected parameters: name → descriptor (array params carry `element`). */
-    readonly params: Readonly<Record<string, ParamDescriptor>>;
-    /** The captured, declarative instruction list. */
-    readonly instructions: readonly TxInstruction[];
-}
-/** A param map accepted by {@link defineTransaction}. */
-type TransactionParamShape = Record<string, Param<unknown>>;
-/** The `p` proxy type: each scalar param → ref; each array param → itself. */
-type ParamProxy<P extends TransactionParamShape> = {
-    readonly [K in keyof P]: P[K] extends {
-        readonly kind: 'array';
-    } ? P[K] : TransactionRef;
-};
-/**
- * Define a declarative transaction. The callback is evaluated **twice** with
- * throwing value sentinels (one differential marker set per pass); its `tx.*`
- * calls are recorded and the two passes are checked against each other so any
- * non-declarative value (a transform, a value branch, a coercion escape) is
- * rejected at build time — the same soundness #42 enforces for key positions.
- *
- * @param params A record of `param.*` placeholders (scalars and/or `param.array`).
- * @param build  `(tx, p) => void` — records the write instructions.
- */
-declare function defineTransaction<const P extends TransactionParamShape>(params: P, build: (tx: TxRecorder, p: ParamProxy<P>) => void): TransactionDefinition;
-/**
- * Group a record of transaction definitions into the IR consumed by the static
- * planner (#42/#46). Validates each entry is a transaction definition.
- */
-declare function defineTransactions<const D extends Record<string, TransactionDefinition>>(definitions: D): D;
-
-/**
- * Contract-layer serialization (issue #59, CQRS Contract layer, Epic #57;
- * spec `docs/cqrs-contract.md`, "SSoT Schema").
- *
- * The Contract IR (#58, `src/define/contract.ts`) holds, per contract method, a
- * resolved declarative {@link ContractMethodOp} plus the **decided facts** the
- * planner derived (`resolution` / `inputArity` / `result`). This module
- * **serializes** those facts into the JSON SSoT — it does **not** re-derive them:
- *
- * - The `contracts` map (contract name → {@link ContractSpec}) is layered **on
- *   top of** the existing `queries` / `commands` / `transactions`. Each method
- *   references one of them by name (`ContractName__methodName`), so the existing
- *   operation-spec shapes are unchanged and the current runtime keeps working.
- * - The referenced operation spec is produced by **reusing** the proven
- *   {@link buildQuerySpec} / {@link buildCommandSpec} planners: a
- *   {@link ContractMethodOp} is translated back into the {@link AnyOperationDefinition}
- *   shape those planners consume (the contract's sentinel references become the
- *   `Param` placeholders the planner already understands), so the symbolic key
- *   evaluation, projection, relation chaining, and condition handling are shared
- *   — never re-implemented, never drifting.
- *
- * Everything emitted is **JSON-serializable** by construction (only strings /
- * numbers / booleans / arrays / plain objects). A contract-free input emits no
- * `contracts` / `contexts` keys, so the pre-#59 operations document is reproduced
- * byte-for-byte (backward compatibility).
- *
- * ## What this issue serializes vs. defers
- *
- * The #58 IR captures a single declarative op per method with a boolean `select`
- * projection; it does **not** model External Query / Query Composition (no
- * `query(Contract.method, { from(...) })` primitive exists yet). So no #58
- * contract produces a `compose`. The serializer nonetheless **supports** it: when
- * a method op carries composition (a forward-compatible {@link ContractMethodOp}
- * extension), it is emitted per the proposal's `compose` shape. The N+1 checker
- * (#60), boundary lint (#61), and runtime execution (#62) are out of scope here —
- * this is serialization + generator only.
- */
-
-/**
- * A contract as accepted by the serializer: either a resolved
- * {@link QueryModelContract} or a {@link CommandModelContract} (the #58 factory
- * output). The Key type is erased — the serializer reads the key **fields** off
- * the resolved op / model metadata, not the phantom type.
- */
-type AnyModelContract = QueryModelContract<unknown, Record<string, QueryMethodSpec<unknown, unknown, unknown>>> | CommandModelContract<unknown, Record<string, CommandMethodSpec<unknown, unknown, unknown>>>;
-/** A map of contract name → resolved contract IR (as passed to the generator). */
-type ContractMap = Record<string, AnyModelContract>;
-/**
- * A context-ownership declaration as authored by the producer: context name →
- * the Model (entity) and Contract names that belong to it. The serializer sorts
- * the member lists deterministically; see {@link ContextSpec}.
- */
-interface ContextOwnership {
-    readonly models?: readonly string[];
-    readonly contracts?: readonly string[];
-}
-/** A map of context name → its membership (as passed to the generator). */
-type ContextOwnershipMap = Record<string, ContextOwnership>;
-/**
- * The output of {@link buildContracts}: the `contracts` map and the
- * **synthesized** operation specs each method references. The caller merges the
- * synthesized `queries` / `commands` / `transactions` into the document's
- * existing maps (a contract method's referenced op lives alongside hand-written
- * definitions, addressed by name).
- */
-interface BuiltContracts {
-    readonly contracts: Record<string, ContractSpec>;
-    /** Synthesized read ops referenced by query contract methods. */
-    readonly queries: Record<string, QuerySpec>;
-    /** Synthesized write ops referenced by command contract methods (single form). */
-    readonly commands: Record<string, CommandSpec>;
-    /**
-     * Synthesized transactions referenced by command contract methods whose array
-     * form resolves to a `'transact'` batched write (issue #64). One transaction per
-     * such method, named `<Contract>__<method>__batch`: a single `forEach`-over-keys
-     * write item that the runtime expands once per key (≤25, atomic), reusing the
-     * proven declarative-transaction machinery (#46). Empty when no command method
-     * declares a `'transact'` batch.
-     */
-    readonly transactions: Record<string, TransactionSpec>;
-}
-/**
- * Serialize a map of resolved contracts into the `contracts` SSoT map plus the
- * synthesized operation specs each method references. Deterministic: contracts
- * and methods are emitted in sorted-key order.
- *
- * @param contracts Contract name → resolved {@link QueryModelContract} /
- *   {@link CommandModelContract} (the #58 factory output). Empty → empty output.
- * @throws if a contract method op cannot be serialized (a non-boolean projection
- *   slot, an unsupported write condition); or if a contract violates an N+1
- *   safety rule (#60, {@link assertContractN1Safe}) — an array into a `range`
- *   method, a "list under a list", or a `range` composed child.
- */
-declare function buildContracts(contracts?: ContractMap): BuiltContracts;
-/**
- * Serialize the context-ownership declarations into the SSoT `contexts` map.
- * Member lists are sorted for determinism. An empty input yields an empty map
- * (the caller then omits the key for backward compatibility).
- */
-declare function buildContexts(contexts?: ContextOwnershipMap): Record<string, ContextSpec>;
-
-/**
- * Static parameterized operation-spec generation (issue #42, Phase 0b).
- *
- * Turns the parameterized definition IR (#41) into JSON-serializable
- * {@link OperationSpec} / {@link CommandSpec} via **symbolic evaluation** of the
- * key / GSI mapping functions. The result is deterministic and contains only
- * `{param}` / `{result.field}` template placeholders, never concrete values.
- *
- * Relation chains in a read `select` become **multiple operations** wired with
- * `resultPath` and `{result.*}` key templates, mirroring the runtime
- * `relation-planner` policy: `hasMany` → `Query` + `begins_with`, `belongsTo` /
- * `hasOne` → `BatchGetItem`.
- */
-
-/** Build the {@link QuerySpec} for a single read definition. */
-declare function buildQuerySpec(def: AnyOperationDefinition): QuerySpec;
-/**
- * Optional contract-layer inputs to {@link buildOperations} (issue #59). Both are
- * absent on a pre-#59 (contract-free) build, in which case the produced document
- * is byte-identical to the pre-#59 shape (no `contracts` / `contexts` keys).
- */
-interface ContractInputs {
-    /** Resolved contracts (publicQueryModel / publicCommandModel output). */
-    readonly contracts?: ContractMap;
-    /** Context-ownership declarations (context → member models / contracts). */
-    readonly contexts?: ContextOwnershipMap;
-}
-/**
- * Build the operations document from grouped read (`queries`) and write
- * (`commands`) definition maps, plus the optional CQRS contract layer (#59).
- * All inputs are optional. Output is deterministic (definitions emitted in
- * sorted-key order; the runtime resolves by name).
- *
- * The contract layer (#59) is layered **on top of** the existing specs: each
- * contract method's underlying op is synthesized into `queries` / `commands` and
- * referenced by name, and the `contracts` / `contexts` maps are emitted. A
- * contract-free input (`contractInputs` empty / absent) reproduces the pre-#59
- * document byte-for-byte — no `contracts` / `contexts` keys appear.
- *
- * @throws if a command carries a write condition outside the supported subset
- *   (`{ notExists }` or pure equality) — the bridge guard; or if a contract op
- *   name collides with a hand-written definition.
- */
-declare function buildOperations(queries?: DefinitionMap, commands?: DefinitionMap, transactions?: Record<string, TransactionDefinition>, contractInputs?: ContractInputs): OperationsDocument;
-
-/**
- * Manifest generation (issue #42, Python-bridge Phase 0b).
- *
- * Produces the JSON-serializable {@link Manifest} from a {@link MetadataRegistry}
- * snapshot: entity → table / physicalName / prefix / field types / key & GSI
- * templates / relation metadata. Generation is **deterministic** — entities,
- * fields, GSIs, and relations are emitted in a stable (sorted) order so the same
- * registry always yields byte-identical JSON.
- */
-
-/**
- * Build the full {@link Manifest} from the {@link MetadataRegistry}.
- *
- * Every registered entity is included. Output ordering is deterministic
- * (entities / fields / relations sorted by name, GSIs by index name).
- */
-declare function buildManifest(registry?: typeof MetadataRegistry): Manifest;
-
-/**
- * N+1 static checker for the CQRS Contract layer (issue #60, Epic #57; proposal
- * `docs/cqrs-contract.md`, "N+1 Safety (Static Restriction)").
- *
- * Whether a resolution is N+1-safe depends on **two** facts the planner already
- * decided in #58 and #59 serialized into the SSoT — the checker **honors** them,
- * it does **not** re-derive policy ("decide once, declare in the SSoT"):
- *
- * - `resolution` — `'point'` (target keys known → `BatchGetItem` / another
- *   contract's `get(keys[])`; coalesces) or `'range'` (target key set unknown →
- *   partition `Query`; one request per partition key).
- * - `inputArity` / parent `cardinality` — how many keys are fed in. A `range`
- *   method is one query for one key but N queries for N keys.
- *
- * The rule (absolute, no opt-in escape hatch): **a `range` resolution is allowed
- * only with single-key input.** Three forms are build-time errors:
- *
- *  (a) **array into a `range` method** — a `range` method whose `inputArity` is
- *      not `'single'` (`'array'` / `'either'`). A `range` method must be
- *      `'single'`; anything else is an N partition-`Query` fan-out.
- *  (a′) **array into a unique-GSI `point` method** (issue #71) — a `point` method
- *      whose Key resolves via a **unique GSI** (a per-key `Query`, since
- *      `BatchGetItem` cannot read a GSI) but whose `inputArity` is not `'single'`.
- *      A base-table `point` coalesces a key array into one `BatchGetItem`, but a
- *      unique-GSI `point` would issue N `Query`s — an N+1 fan-out, the same shape
- *      as (a). graphddb's official spec does not include N+1-producing queries, so
- *      it is rejected at build time; the application-side loop is the escape (same
- *      philosophy as `range`).
- *  (b) **"list under a list"** — a `range` child nested under a parent step whose
- *      output cardinality is `'many'`. The composition's parent yields N records,
- *      so a `range` child fans out to N partition `Query`s.
- *  (c) **`compose` child that is `range`** — the cross-contract / composition form
- *      of (b): a composed (External Query) child declared `range` under a parent
- *      that can yield many. (Rule (b) and (c) are the same axis — a `range` child
- *      under a many-yielding parent — surfaced through nested model relations vs.
- *      cross-contract composition respectively.)
- *
- * `point` resolutions are always allowed (they coalesce). If a caller genuinely
- * needs "just these few", it loops in its own application code (the proposal's
- * `Promise.all(ids.map(...))`), keeping the N visible at the call site —
- * the contract surface never hides a fan-out.
- *
- * ## Placement — build path, not the model `LintRule` framework
- *
- * This checker runs on the **contract build path** ({@link buildContracts} in
- * `src/spec/contracts.ts`), where every other contract validation surfaces
- * (#59's projection audit, write-condition guard, and the original inline
- * `compose` rule all `throw` there). It operates on the serialized
- * {@link ContractSpec} facts, not on {@link EntityMetadata}: the existing
- * `src/linter/` `LintRule` framework is keyed on a single model's `EntityMetadata`
- * (model relations / GSIs), which carries none of the contract `resolution` /
- * `inputArity` / `compose` facts the N+1 rule needs. Surfacing the violation as a
- * thrown build error — exactly as `relation/traversal.ts` `validateDepth` and the
- * #59 contract validations do — fails the build the same way `inputArity`
- * mismatches and `range` composed children already failed it.
- *
- * The cross-contract `range`-child form (c) and the nested-relation form (b) are
- * only fully reachable once the composition DSL primitive
- * (`query(Contract.method, { from() })`, owned by #63) lands; until then no #58
- * DSL produces a `compose` node. The checker implements the full logic now so it
- * is ready, and the forward forms are exercised by feeding synthesized SSoT nodes
- * (exactly as #59's serializer tests do).
- */
-
-/** A single N+1 rule violation, carrying the rule label and a clear message. */
-interface ContractN1Violation {
-    /** Which of the N+1 forms was violated. */
-    readonly rule: 'array-into-range' | 'array-into-gsi-point' | 'list-under-list' | 'compose-range-under-many';
-    /** The offending contract name. */
-    readonly contract: string;
-    /** The offending method name. */
-    readonly method: string;
-    /** A clear, actionable error message (the same text the thrown error carries). */
-    readonly message: string;
-}
-/**
- * Tells, for a query contract method name, whether its `point` read resolves via
- * a **unique GSI** (a per-key `Query`) rather than the base-table primary key (a
- * coalescible `GetItem` / `BatchGetItem`). Supplied by the serializer (issue #71),
- * which recovers the fact from the method's synthesized read op (a root `Query`
- * carrying an `indexName`). Absent → no method is treated as a GSI point (the
- * pre-#71 default; e.g. synthesized-SSoT checker tests that exercise only the
- * `range` / `compose` rules).
- */
-type IsGsiPointMethod = (methodName: string) => boolean;
-/**
- * Collect every N+1 violation in a single serialized {@link ContractSpec}.
- * Command contracts carry no `resolution` / `compose` and are always N+1-safe
- * (writes resolve to known keys), so only query contracts are inspected.
- *
- * @param isGsiPoint Optional predicate (issue #71): does the named method's
- *   `point` read resolve via a unique GSI? Used to reject array-into-GSI-point
- *   (rule a′). Defaults to "never" when not supplied.
- */
-declare function collectContractN1Violations(contractName: string, spec: ContractSpec, isGsiPoint?: IsGsiPointMethod): ContractN1Violation[];
-/**
- * Assert a single serialized contract is N+1-safe, throwing the first violation
- * as a build error (mirroring `relation/traversal.ts` `validateDepth` and the
- * #59 contract validations, which `throw` on the build path). Multiple violations
- * are summarized in the thrown message so the build surfaces them all at once.
- *
- * @throws if any of the N+1 forms is present.
- *
- * @param isGsiPoint Optional predicate (issue #71) identifying unique-GSI `point`
- *   methods, so rule (a′) (array into a GSI point) can be enforced.
- */
-declare function assertContractN1Safe(contractName: string, spec: ContractSpec, isGsiPoint?: IsGsiPointMethod): void;
-
-/**
- * Bounded-context boundary checker for the CQRS Contract layer (issue #61, Epic
- * #57; spec `docs/cqrs-contract.md`, External Query section "Why it
- * exists: boundary enforcement").
- *
- * The rule, stated in the proposal and the issue: a **Model is a private
- * implementation detail of its bounded context; a Contract is the published
- * interface**. Within its own context a contract resolves its own Models directly
- * (internal `query` / `list` / `put` / `update` / `delete`). Across a context
- * boundary it may depend on another context **only through that context's
- * published Contract** (an External Query / Command). Reaching directly into a
- * **foreign** Model is a **build-time error** — it couples one context to
- * another's private storage shape and silently defeats the boundary the contexts
- * declaration is meant to enforce.
- *
- * ## What "own" vs. "foreign" means here
- *
- * The decision is made entirely from the **context-ownership declaration** (#59,
- * the `contexts` map: context name → `{ models, contracts }`). For each contract:
- *
- *  - its **owning context** is the (unique) context whose `contracts` list names
- *    it; and
- *  - for every Model its method ops touch (the recorded {@link ContractMethodOp}
- *    `entity` refs, #58), that Model's **owning context** is the context whose
- *    `models` list names it.
- *
- * A method op against a Model owned by a **different** context than the contract's
- * own is the violation. Three cases are deliberately **allowed**, never flagged:
- *
- *  - the Model and the contract are in the **same** context (the normal internal
- *    case);
- *  - the **contract is in no declared context** — there is no boundary to enforce
- *    *from*, so the contract is unconstrained (a partial / incremental adoption of
- *    the contexts declaration must not turn unrelated contracts into errors);
- *  - the touched **Model is in no declared context** — an undeclared Model has no
- *    owner to protect, so it is not "foreign" to anyone. (Declaring the Model into
- *    a context is what opts it into boundary protection.)
- *
- * In short: the check fires **only** when both the contract *and* the foreign
- * Model have declared, *different* owners. This is the least-surprising reading of
- * a *partial* contexts declaration and keeps the rule purely additive — declaring
- * more ownership can only ever surface *more* violations, never fewer.
- *
- * ## Placement — build path, not the model `LintRule` framework (decision B)
- *
- * This checker runs in **{@link buildOperations}** (`src/spec/operations.ts`),
- * immediately before the {@link buildContracts} call — the seam where both the
- * raw contract IR (the recorded op `entity` refs) and the `contexts` map are
- * still available, alongside #59's projection audit, the write-condition guard,
- * and #60's N+1 checker — every contract validation surfaces there as a thrown
- * build error. It is **not** added to the `src/linter/` `LintRule`
- * framework, even though the issue text suggests a `context-boundary` rule there,
- * because that framework's contract — `check(metadata: EntityMetadata, registry)`
- * — is keyed on a **single model's** {@link EntityMetadata} and carries **none** of
- * the facts this rule needs:
- *
- *  - which context a *contract* belongs to (a contract is not an `EntityMetadata`);
- *  - which Models a contract's *methods* touch (these live on the unserialized
- *    {@link ContractMethodOp} `entity` refs, not on any model's metadata);
- *  - the cross-cutting `contexts` map relating the two.
- *
- * A `LintRule` sees one model at a time and no contract facts at all, so a naive
- * rule physically cannot observe a contract→foreign-Model reference. Bending the
- * framework to carry contracts + contexts would be an invasive, parallel
- * "rule kind" that no other rule uses — exactly the ugly refactor the brief warns
- * against. Placing the check here is consistent with how #60 already resolved the
- * identical tension (`src/spec/contract-n1-check.ts`, "Placement"), and it reads
- * the **same facts the rule actually depends on** at the one point where contracts
- * and contexts are both in hand. The boundary violation fails the build the same
- * way an `inputArity` mismatch or a `range` composed child already does.
- */
-
-/** A single context-boundary violation, carrying the offending facts + message. */
-interface ContractBoundaryViolation {
-    /** The offending contract name. */
-    readonly contract: string;
-    /** The context that owns the offending contract. */
-    readonly contractContext: string;
-    /** The contract method whose op touched the foreign Model. */
-    readonly method: string;
-    /** The foreign Model (entity / model-class name) referenced directly. */
-    readonly foreignModel: string;
-    /** The context that owns the foreign Model. */
-    readonly foreignContext: string;
-    /** A clear, actionable error message (the same text the thrown error carries). */
-    readonly message: string;
-}
-/**
- * Collect every context-boundary violation across a map of resolved contracts,
- * given the context-ownership declaration. A violation is a contract method whose
- * recorded op touches a Model owned by a **different** context than the contract's
- * own (see the module doc for the precise own / foreign / undeclared rule).
- *
- * @param contracts Contract name → resolved {@link QueryModelContract} /
- *   {@link CommandModelContract} (the #58 factory output).
- * @param contexts  The context-ownership declaration (#59). When empty, no
- *   contract has a declared owner, so there are no boundaries to enforce → no
- *   violations.
- * @throws if the contexts declaration claims a Model / Contract in two contexts
- *   (an ambiguous, self-contradictory declaration).
- */
-declare function collectContractBoundaryViolations(contracts: ContractMap, contexts: ContextOwnershipMap): ContractBoundaryViolation[];
-/**
- * Assert a map of resolved contracts respects bounded-context boundaries, throwing
- * the first violation as a build error (mirroring #60's {@link assertContractN1Safe}
- * and the other #59 contract validations, which `throw` on the build path).
- * Multiple violations are summarized in the thrown message so the build surfaces
- * them all at once.
- *
- * @param contracts Contract name → resolved contract IR.
- * @param contexts  The context-ownership declaration (#59).
- * @throws if any contract directly references a foreign context's Model, or if the
- *   contexts declaration is ambiguous (a Model / Contract claimed twice).
- */
-declare function assertContractBoundaries(contracts: ContractMap, contexts: ContextOwnershipMap): void;
-
-/**
- * Static planning for declarative transactions (issue #46, Phase 4).
- *
- * Turns a {@link TransactionDefinition} (captured by `defineTransaction`) into a
- * serializable {@link TransactionSpec}. Each `tx.put/update/delete` becomes a
- * templated {@link TransactionItemSpec}; a `tx.forEach` block marks its items
- * with a `forEach` binding so the runtime expands them once per array-param
- * element. Key templates are derived with the **same** symbolic key-mapping
- * evaluator (#42 `evaluateKey`) the single-write planner uses — the
- * declarativity of the field references is what lets that reuse work: every
- * key / item / changes leaf is either a field reference (whose token the planner
- * substitutes) or a concrete literal.
- */
-
-/** Build the {@link TransactionSpec} for one transaction definition. */
-declare function buildTransactionSpec(txName: string, def: TransactionDefinition): TransactionSpec;
-/** Build the transactions map from a record of transaction definitions. */
-declare function buildTransactions(transactions?: Record<string, TransactionDefinition>): Record<string, TransactionSpec>;
-
-/**
- * Bridge guard (issue #42, Phase 0b).
- *
- * The Python bridge can only carry a **declarative, serializable subset** of
- * graphddb. This module enforces that subset at build time:
- *
- * 1. **Write conditions** must be `{ notExists }`, an existence primitive
- *    (`{ attributeExists }` / `{ attributeNotExists }` on any field, issue #81),
- *    *or* pure field equality (mirroring `expression/condition-expression.ts`,
- *    which only emits `attribute_(not_)exists(...)` or `#f = :v` clauses). Any
- *    other condition shape is rejected — there is no serializable representation
- *    for it. {@link conditionInputToSpec} is the single place the IR-shaped input
- *    is mapped to the {@link ConditionSpec} subset.
- * 2. The produced bundle must be **JSON-serializable** — no functions, classes,
- *    `Date`, `Set`, `Map`, `Symbol`, or non-finite numbers may leak into the
- *    spec. {@link assertJsonSerializable} walks the value and throws on any.
- *
- * (Note: the post-load TS predicate `refine` was removed in #49, so no guard for
- * it is needed; see `docs/python-bridge.md`.)
- */
-
-/**
- * Assert a write {@link ConditionSpec} is within the supported subset. The spec
- * type already constrains it to `notExists` | `attributeExists` |
- * `attributeNotExists` | `equals`, so this defends against a malformed `equals`
- * (empty / non-template values) or a blank existence field and gives a clear,
- * single-source build-time error message for any future widening.
- */
-declare function assertSupportedCondition(commandName: string, condition: ConditionSpec): void;
-/**
- * Walk an arbitrary value and throw if it contains anything that does not
- * survive `JSON.stringify` round-tripping as itself (functions, symbols,
- * `undefined`, `Date`, `Map`, `Set`, class instances, non-finite numbers).
- */
-declare function assertJsonSerializable(value: unknown, path?: string): void;
-/** Convenience: assert an entire {@link BridgeBundle} is JSON-serializable. */
-declare function assertBundleSerializable(bundle: BridgeBundle): void;
-
-/**
- * Static parameterized planner: serializable OperationSpec + manifest + bridge
- * guard (issue #42, Python-bridge Phase 0b). Public surface.
- *
- * The CLI / file output is #43's responsibility; this module stops at the
- * **generation functions** producing the typed, JSON-serializable
- * `{ manifest, operations }` bundle.
- */
-
-/**
- * Build the full `{ manifest, operations }` bridge bundle from grouped query /
- * command definition maps. The bundle is typed and JSON-serializable; the bridge
- * guard runs (unsupported write conditions throw during `buildOperations`, and
- * the whole bundle is asserted JSON-serializable here).
- *
- * @param queries  Read definitions (`defineQueries(...)` output). Optional.
- * @param commands Write definitions (`defineCommands(...)` output). Optional.
- * @param registry Metadata source (defaults to the global registry).
- * @param transactions Declarative transactions (`defineTransactions(...)`). Optional.
- * @param contractInputs The CQRS contract layer (#59): resolved contracts +
- *   context-ownership. Optional — absent reproduces the pre-#59 document.
- */
-declare function buildBridgeBundle(queries?: DefinitionMap, commands?: DefinitionMap, registry?: typeof MetadataRegistry, transactions?: Record<string, TransactionDefinition>, contractInputs?: ContractInputs): BridgeBundle;
-
-export { AggregateOptions, AggregateValue, type AnyModelContract, AnyOperationDefinition, BATCH_GET_MAX_KEYS, BATCH_WRITE_MAX_ITEMS, BatchExecOptions, BatchGetExecInput, BatchWriteExecItem, BridgeBundle, type BuiltContracts, CdcEmulator, CdcEmulatorOptions, ChangeEvent, ChangeHandler, ClientManager, type CollectParams, CommandMethodSpec, CommandModelContract, CommandSpec, ConcurrentRecomputeRef, type ConditionExpressionResult, ConditionInput, ConditionSpec, type ContextOwnership, type ContextOwnershipMap, ContextSpec, type ContractBoundaryViolation, type ContractInputs, type ContractMap, type ContractN1Violation, ContractSpec, CtxModel, DDBModel, DefinitionMap, DeleteInput, type DriftReport, DynamoDBOperation, DynamoExecutor, DynamoType, EDGE_WRITES_MARKER, type EdgeLifecycle, type EdgeWriteDeclaration, type EdgeWriteRecorder, type EdgeWritesDefinition, EntityMetadata, EntityRef, EventLog, ExecutionPlan, Executor, ExecutorResult, type ExplainInput, FaultSpec, FieldMetadata, FieldOptions, type FilterExpressionResult, GsiDefinition, type HasManyVersionedCallback, type HasManyVersionedOptions, type HasOneVersionedCallback, type HasOneVersionedOptions, Item, KeyDefinition, type LintResult, type LintRule, Linter, type ListInput, type ListOptions, MAINT_OUTBOX_PK_PREFIX, MAX_TRANSACT_ITEMS, MaintainConsistency, MaintainEffect, MaintainEvent, MaintainUpdateMode, type MaintainedFromCallback, type MaintainedFromOptions, MaintenanceDrain, type MaintenanceDrainOptions, type MaintenanceRebuildOptions, MaintenanceRebuilder, Manifest, MembershipPredicate, MembershipPredicateOp, MetadataRegistry, Middleware, type ModelOptions, ModelStatic, OLD_VALUE_NAMESPACE, OperationDefinition, OperationsDocument, Param, ParamDescriptor, type Parameterize, PartialQueryKeyOf, type PerKeyCursorEnvelope, type PlanInput, PrimaryKeyOf, type ProjectionResult, ProjectionTransform, type ProjectionValue, PutInput, QueryMethodSpec, QueryModelContract, type QueryOptions$1 as QueryOptions, QuerySpec, RawCondition, ReadExecOptions, ReadParams, ReadRequestCtx, ReadRequestKind, type RebuildResult, RelationMetadata, RelationOptions, type RelationTraversalOptions, ReplayOptions, RequestContext, ResolvedKey, RetryOverride, RetryPolicy, RetryingExecutor, SelectableOf, type SelfProxy, type SelfRef, ShardId, type SourceProxy, type SourceRef, TableMapping, TransactWriteExecItem, type TransactionDefinition, TransactionItemSpec, type TransactionParamShape, type TransactionRef, TransactionSpec, type TxConditionCheckOptions, type TxForEachInstruction, type TxForEachOptions, type TxInstruction, type TxRecorder, type TxWriteInstruction, type TxWriteOptions, UniqueQueryKeyOf, type UpdateExpressionResult, UpdateInput, type VersionedHistoryOptions, type VersionedLatestOptions, ViewDefinition, type WhenComparison, WriteDefinitionOptions, WriteExecOptions, WriteResult, aggregate, assertBundleSerializable, assertContractBoundaries, assertContractN1Safe, assertJsonSerializable, assertSupportedCondition, belongsTo, binary, boolean, buildBridgeBundle, buildConditionExpression, buildContexts, buildContracts, buildManifest, buildOperations, buildProjection, buildQuerySpec, buildTransactionSpec, buildTransactions, buildUpdateExpression, cdcProjected, collectContractBoundaryViolations, collectContractN1Violations, compileFilterExpression, count, createCdcEmulator, createDefaultLinter, createMaintenanceDrain, createMaintenanceDrainHandler, createMaintenanceRebuilder, datetime, decodeCursor, decodePerKeyCursor, defineCommands, defineDelete, defineList, definePut, defineQueries, defineQuery, defineTransaction, defineTransactions, defineUpdate, deriveEdgeWriteItems, deriveEdgeWriteItemsFor, deriveModelEdgeWriteItems, derivePrefix, detectRelationFields, edgeWrites, embedded, encodeCursor, encodePerKeyCursor, evaluateFilter, execute, executeDeclarativeTransaction, executeExplain, executeList, executeQuery, expandTransaction, field, getEdgeWrites, getImplicitKeyFields, gsiAmbiguityRule, hasMany, hasOne, hydrate, isEdgeWritesDefinition, isSelectBuilder, isTransactionRef, list, literal, maintainedFrom, map, max, missingGsiRule, model, noScanRule, number, numberSet, parseChange, plan, queryBoundaryRule, relationDepthRule, requireLimitRule, resolveKey, resolveRelations, serializeContractKey, serializeFieldValue, string, stringSet, ttl, validateDepth, validateGsiAmbiguity, when, whenMember };
+export { AggregateOptions, AggregateValue, BATCH_GET_MAX_KEYS, BATCH_WRITE_MAX_ITEMS, BatchExecOptions, BatchGetExecInput, BatchWriteExecItem, ClientManager, type CollectParams, type ConditionExpressionResult, CtxModel, DDBModel, DefinitionMap, DeleteInput, type DriftReport, DynamoDBOperation, DynamoExecutor, DynamoType, EDGE_WRITES_MARKER, type EdgeLifecycle, type EdgeWriteDeclaration, type EdgeWriteRecorder, type EdgeWritesDefinition, EntityMetadata, ExecutionPlan, Executor, ExecutorResult, type ExplainInput, FieldMetadata, FieldOptions, type FilterExpressionResult, GsiDefinition, type HasManyVersionedCallback, type HasManyVersionedOptions, type HasOneVersionedCallback, type HasOneVersionedOptions, Item, KeyDefinition, type ListInput, type ListOptions, MAX_TRANSACT_ITEMS, MaintainConsistency, MaintainEffect, MaintainEvent, MaintainUpdateMode, type MaintainedFromCallback, type MaintainedFromOptions, type MaintenanceRebuildOptions, MaintenanceRebuilder, Manifest, MembershipPredicate, MembershipPredicateOp, Middleware, type ModelOptions, ModelStatic, OLD_VALUE_NAMESPACE, OperationDefinition, Param, ParamDescriptor, type Parameterize, PartialQueryKeyOf, type PerKeyCursorEnvelope, type PlanInput, PrimaryKeyOf, type ProjectionResult, ProjectionTransform, type ProjectionValue, PutInput, type QueryOptions$1 as QueryOptions, RawCondition, ReadExecOptions, ReadParams, ReadRequestCtx, ReadRequestKind, type RebuildResult, RelationMetadata, RelationOptions, type RelationTraversalOptions, RequestContext, ResolvedKey, RetryOverride, RetryPolicy, RetryingExecutor, SelectableOf, type SelfProxy, type SelfRef, type SourceProxy, type SourceRef, TableMapping, TransactWriteExecItem, TransactionItemSpec, TransactionSpec, UniqueQueryKeyOf, type UpdateExpressionResult, UpdateInput, type VersionedHistoryOptions, type VersionedLatestOptions, ViewDefinition, WriteDefinitionOptions, WriteExecOptions, WriteResult, aggregate, belongsTo, binary, boolean, buildConditionExpression, buildProjection, buildUpdateExpression, cdcProjected, compileFilterExpression, count, createMaintenanceRebuilder, datetime, decodeCursor, decodePerKeyCursor, defineCommands, defineDelete, defineList, definePut, defineQueries, defineQuery, defineUpdate, deriveEdgeWriteItems, deriveEdgeWriteItemsFor, deriveModelEdgeWriteItems, derivePrefix, detectRelationFields, edgeWrites, embedded, encodeCursor, encodePerKeyCursor, evaluateFilter, execute, executeDeclarativeTransaction, executeExplain, executeList, executeQuery, expandTransaction, field, getEdgeWrites, getImplicitKeyFields, hasMany, hasOne, hydrate, isEdgeWritesDefinition, isSelectBuilder, list, literal, maintainedFrom, map, max, model, number, numberSet, plan, resolveKey, resolveRelations, serializeContractKey, serializeFieldValue, string, stringSet, ttl, validateDepth, validateGsiAmbiguity, whenMember };