graphddb 0.7.8 → 0.7.10

package/dist/{from-change-w2Ih8fkm.d.ts → from-change-Ty95KA8C.d.ts}

@@ -1,4 +1,4 @@
-import { C as CdcEmulatorOptions, e as ChangeHandler, U as Unsubscribe, F as FaultSpec, g as ConcurrentRecomputeRef, c as ChangeEvent, E as EventLog, R as ReplayOptions, S as ShardId, V as ViewDefinition, m as EntityMetadata } from './maintenance-view-adapter-BCbgKG5d.js';
+import { C as CdcEmulatorOptions, e as ChangeHandler, U as Unsubscribe, F as FaultSpec, g as ConcurrentRecomputeRef, c as ChangeEvent, E as EventLog, R as ReplayOptions, S as ShardId, V as ViewDefinition, m as EntityMetadata } from './maintenance-view-adapter-BAZ9uBGe.js';
 
 /**
  * CDC emulator (issue #72). Subscribes to the core write-capture seam

package/dist/{index-Deugy2sa.d.ts → index-Dc7d8mWI.d.ts}

@@ -1,5 +1,6 @@
-import { Q as QueryModelContract, x as QueryMethodSpec, y as CommandModelContract, z as CommandMethodSpec, A as ContractSpec, G as QuerySpec, H as CommandSpec, I as TransactionSpec, J as ContextSpec, K as SPEC_VERSION, L as ParamSpec, m as EntityMetadata, N as ParamDescriptor, O as EntityRef, X as ConditionInput, Y as Param, M as ModelStatic, w as DDBModel, Z as DefinitionMap, _ as OperationsDocument, $ as AnyOperationDefinition, a0 as Manifest, a1 as BridgeBundle, a2 as ConditionSpec, a3 as PreparedBody } from './maintenance-view-adapter-BCbgKG5d.js';
-import { M as MetadataRegistry } from './registry-pAnFcc62.js';
+import { Q as QueryModelContract, x as QueryMethodSpec, y as CommandModelContract, z as CommandMethodSpec, m as EntityMetadata, A as ParamDescriptor, G as EntityRef, H as ConditionInput, M as ModelStatic, w as DDBModel, I as DefinitionMap, J as AnyOperationDefinition, K as PreparedBody } from './maintenance-view-adapter-BAZ9uBGe.js';
+import { C as ContractSpec, Q as QuerySpec, a as CommandSpec, T as TransactionSpec, b as ContextSpec, S as SPEC_VERSION, P as ParamSpec, c as Param, E as ExpressionSpec, O as OperationsDocument, M as Manifest, B as BridgeBundle, d as ConditionSpec, e as SpecVersion } from './types-BQLzTEqh.js';
+import { M as MetadataRegistry } from './registry-LWE54Sdc.js';
 
 /**
  * Contract-layer serialization (issue #59, CQRS Contract layer, Epic #57;
@@ -410,6 +411,14 @@ interface TxWriteInstruction {
     readonly condition?: ConditionInput<TransactionRef>;
     /** Optional declarative guard (skip this item when it does not hold). */
     readonly when?: WhenComparison;
+    /**
+     * Optional SCP expression guard (issue #261, Phase 3 S1): a behavior-contracts
+     * Expression IR `{ exprVersion: 1, expr }` envelope, carried beside the legacy
+     * `when`. Validated + canonicalized by the spec serializer; a bundle carrying
+     * one is stamped spec version 1.2 and loud-rejected by runtimes whose
+     * expression evaluation has not landed yet (fail-closed).
+     */
+    readonly guard?: ExpressionSpec;
 }
 /** A `forEach` block expanding `body` once per element of an array param. */
 interface TxForEachInstruction {
@@ -426,6 +435,8 @@ type TxInstruction = TxWriteInstruction | TxForEachInstruction;
 interface TxWriteOptions {
     readonly condition?: ConditionInput<TransactionRef>;
     readonly when?: WhenComparison;
+    /** Optional SCP expression guard (issue #261); see {@link TxWriteInstruction.guard}. */
+    readonly guard?: ExpressionSpec;
 }
 /**
  * Options accepted by `tx.conditionCheck` (issue #81). The `condition` is the
@@ -436,6 +447,8 @@ interface TxWriteOptions {
 interface TxConditionCheckOptions {
     readonly condition: ConditionInput<TransactionRef>;
     readonly when?: WhenComparison;
+    /** Optional SCP expression guard (issue #261); see {@link TxWriteInstruction.guard}. */
+    readonly guard?: ExpressionSpec;
 }
 /** Options accepted by `tx.forEach`. */
 interface TxForEachOptions {
@@ -461,10 +474,16 @@ interface TxRecorder {
     conditionCheck(model: ModelStatic<DDBModel>, key: Record<string, unknown>, options: TxConditionCheckOptions): void;
     forEach<E>(source: E, body: (element: ElementProxy<E>) => void, options?: TxForEachOptions): void;
 }
-/** The element proxy type inside a `forEach` body (fields → refs). */
+/** The element proxy type inside a `forEach` body (fields → refs). The second
+ * arm types a **value-typed** array source — the shape the SCP native-syntax
+ * form's `p` proxy carries (issue #263: `defineScpTransaction`'s transformed
+ * output calls `tx.forEach(p.<arrayParam>, …)` through the value-typed view);
+ * at runtime the source is always the array param placeholder either way. */
 type ElementProxy<E> = E extends Param<infer T> ? T extends (infer Item)[] ? {
     readonly [K in keyof Item]: TransactionRef;
-} : never : never;
+} : never : E extends readonly (infer Item)[] ? {
+    readonly [K in keyof Item]: TransactionRef;
+} : never;
 /** The typed IR node produced by {@link defineTransaction}. */
 interface TransactionDefinition {
     /** @internal Marks this object as a transaction definition IR node. */
@@ -476,7 +495,30 @@ interface TransactionDefinition {
 }
 /** A param map accepted by {@link defineTransaction}. */
 type TransactionParamShape = Record<string, Param<unknown>>;
-/** The `p` proxy type: each scalar param → ref; each array param → itself. */
+/**
+ * The `p` proxy type: each scalar param → ref; each array param → itself.
+ *
+ * ## Input Port 統一 (issue #264, Phase 3 S4; the #252 note)
+ *
+ * This `p.*` proxy **IS the Input Port model**: the three existing authoring
+ * proxies — this one, `mutation`'s `$.*`
+ * ({@link import('./mutation.js').MutationInputProxy}) and `prepare`'s `$.*`
+ * ({@link import('../runtime/prepared.js').PreparedInputProxy}) — share one
+ * reference semantics: *a declared input field, referenced by name, bound at
+ * execution time*. The serialized spellings mirror each other 1:1:
+ *
+ * - template positions render `{<field>}` / `{item.<field>}` (the `{param}` /
+ *   `{item.*}` scopes of behavior-contracts runtime-boundary.md §4.1);
+ * - lowered EXPRESSION positions (guards — issues #262/#263/#264) reference
+ *   the same namespace as `{ref:["input","<field>"]}` /
+ *   `{ref:["item","<field>"]}` with the FIXED scope names `input` / `item`.
+ *
+ * The namespace is single: expression refs must name declared `param.*`
+ * inputs (enforced at build by `spec/transaction.ts` and at lowering by the
+ * declared-field gate — the #243 no-unbound-leak rule). `param.*` authoring
+ * itself is UNCHANGED through 0.7.x (interop kept; bundles byte-identical) —
+ * its absorption into the unified surface is the #251/#252 0.8.0 work.
+ */
 type ParamProxy<P extends TransactionParamShape> = {
     readonly [K in keyof P]: P[K] extends {
         readonly kind: 'array';
@@ -493,6 +535,57 @@ type ParamProxy<P extends TransactionParamShape> = {
  * @param build  `(tx, p) => void` — records the write instructions.
  */
 declare function defineTransaction<const P extends TransactionParamShape>(params: P, build: (tx: TxRecorder, p: ParamProxy<P>) => void): TransactionDefinition;
+/**
+ * The **value-typed** params view of the SCP native-syntax body form: each
+ * scalar param surfaces as its represented value type (`p.qty: number`,
+ * `p.status: 'open' | 'closed'`) and each array param as its element-object
+ * array (`p.items: { qty: number }[]`), so native conditions
+ * (`p.qty > 0 && tx.put(…)`) and `.map` fan-out typecheck as ordinary TS.
+ */
+type ScpParamValues<P extends TransactionParamShape> = {
+    readonly [K in keyof P]: P[K] extends Param<infer T> ? T : never;
+};
+/**
+ * The lowered-body marker `transformScpTransactionSource` stamps as the third
+ * argument of every `defineScpTransaction` call it compiles (issue #263).
+ *
+ * {@link defineScpTransaction} **throws at definition time when the marker is
+ * absent** — this is the mechanical no-silent-path closure. The recorder's
+ * own guards cannot close every untransformed native shape: `===` / `!==` do
+ * not coerce (the coercion ledger never fires), ToBoolean has no Proxy trap
+ * (bare truthiness is invisible), and the consumed-field check is
+ * token-level, so a param consumed by a native condition is masked whenever
+ * the same field ALSO surfaces faithfully in another item — an untransformed
+ * body could then silently record a wrong spec (a dropped or unguarded
+ * item). The marker check does not depend on any of those blind spots: an
+ * untransformed `defineScpTransaction` never records anything. The ledger /
+ * consumed-field / differential checks remain as defense-in-depth behind it.
+ * Hand-writing the marker is a deliberate, greppable opt-out, not a silent
+ * path.
+ */
+declare const SCP_LOWERED_MARKER: "graphddb:scp-lowered/v1";
+/**
+ * Define a declarative transaction in the **SCP native-syntax body form**
+ * (issue #263, Phase 3 S3): the body may additionally use TS native control
+ * syntax — `cond && tx.put(…)` (Guard), `cond ? tx.put(A,…) : tx.put(B,…)`
+ * (Conditional / Φ), and `p.<arrayParam>.map(($el) => tx.put(…))` (Map) —
+ * which the **opt-in build-time transform**
+ * (`transformScpTransactionSource`, `graphddb/transform`) lowers onto the
+ * untouched recorder vocabulary: `guard:` options (S2-lowered Expression IR
+ * conditions) and `tx.forEach`. The `p` proxy is value-typed
+ * ({@link ScpParamValues}) so the native form typechecks.
+ *
+ * The transform stamps every call it compiles with
+ * {@link SCP_LOWERED_MARKER}; an unstamped (= untransformed) call **throws
+ * here at definition time**, so a native-operator body can never record a
+ * spec without having been lowered (see the marker doc for why the
+ * recorder's own guards alone cannot close the masked `===` / `!==` /
+ * truthiness shapes). A stamped call **delegates directly to
+ * {@link defineTransaction}** — the transformed output is ordinary recorder
+ * authoring, still covered by the coercion ledger / differential passes as
+ * defense-in-depth.
+ */
+declare function defineScpTransaction<const P extends TransactionParamShape>(params: P, build: (tx: TxRecorder, p: ScpParamValues<P>) => void, lowered?: typeof SCP_LOWERED_MARKER): TransactionDefinition;
 /**
  * Group a record of transaction definitions into the IR consumed by the static
  * planner (#42/#46). Validates each entry is a transaction definition.
@@ -843,6 +936,68 @@ declare function assertJsonSerializable(value: unknown, path?: string): void;
 /** Convenience: assert an entire {@link BridgeBundle} is JSON-serializable. */
 declare function assertBundleSerializable(bundle: BridgeBundle): void;
 
+/**
+ * SCP Expression IR — build-time validation + canonicalization (issue #261,
+ * Phase 3 S1; behavior-contracts `expression-ir.md` §2).
+ *
+ * This module is the spec-side **vocabulary** gate: it validates an authored
+ * expression against the closed v1 node/operator set (fail-closed — anything
+ * outside the set is a build error, never a silently-carried unknown) and
+ * rewrites it into the **canonical serialization form** of §2.3/§2.4:
+ *
+ * - object keys sorted in **Unicode code-point order** at every level
+ *   (canonical-serialization.md §2 — NOT JS default `.sort()`, which compares
+ *   UTF-16 code units and diverges on astral-plane keys);
+ * - an integer-valued JSON number within the safe range stays a plain number
+ *   (an int literal); beyond ±2^53−1 it must be `{int:"…"}` (raw is invalid);
+ * - `{int:"…"}` whose value fits the safe range canonicalizes to the plain
+ *   number; outside it stays `{int:"…"}` (must fit i64);
+ * - `{float:n}` with an integer value stays wrapped; a fractional `{float:n}`
+ *   canonicalizes to the plain number (JSON preserves its decimal part).
+ *
+ * Because the canonical form of the expression NODES is produced HERE (at
+ * build time), the documents flow through graphddb's ordinary JSON emitters
+ * unchanged — no special-cased serializer. Note the distinction: §2.3/§2.4
+ * key-sorting governs the expression nodes (`obj` construction keys; operator
+ * nodes are single-key by definition); the `{ exprVersion, expr }` ENVELOPE and
+ * the surrounding spec documents serialize in graphddb's usual emitter order
+ * like every other spec object (conformance value comparison is structural,
+ * expression-ir.md §2.4).
+ *
+ * Evaluation lives in the Phase 3 S5/S6/S7 sub-issues — this module never
+ * evaluates anything. It also hosts the conditional spec-version presence scan
+ * ({@link operationsSpecVersion}): a document that actually CONTAINS an SCP
+ * node is stamped `1.2`, everything else keeps `1.1` byte-identically.
+ */
+
+/**
+ * Validate an authored `{ exprVersion: 1, expr: <node> }` envelope against the
+ * closed v1 vocabulary and return it in canonical form (§2.3/§2.4: key-sorted,
+ * normalized `{int:"…"}` / `{float:n}` literal wrapping). Fail-closed: an
+ * unknown `exprVersion`, an extra envelope key, or any node outside the closed
+ * set is a build error with the offending path.
+ */
+declare function canonicalizeExpressionSpec(input: unknown, context: string): ExpressionSpec;
+/**
+ * Does this operations-document content actually contain an SCP Expression IR
+ * node — a `{ kind: 'scpExpr' }` write condition or a `guard` (transaction
+ * item / contract command method)? This is the **presence scan** behind the
+ * conditional stamp (issue #261): the walk visits exactly the slots the spec
+ * vocabulary defines, so an SCP-free document is provably stamped `1.1` and
+ * stays byte-identical.
+ */
+declare function operationsContainScpNodes(doc: {
+    readonly commands: Readonly<Record<string, CommandSpec>>;
+    readonly transactions?: Readonly<Record<string, TransactionSpec>>;
+    readonly contracts?: Readonly<Record<string, ContractSpec>>;
+}): boolean;
+/**
+ * The spec version to stamp on an operations document: `1.2` iff it actually
+ * contains an SCP node ({@link operationsContainScpNodes}), else the base
+ * `1.1` — so every pre-#261 bundle serializes byte-identically.
+ */
+declare function operationsSpecVersion(doc: Parameters<typeof operationsContainScpNodes>[0]): SpecVersion;
+
 /**
  * Static prepared-plan artifact — the **build-time** (AOT) compilation of
  * `DDBModel.prepare` bodies (issue #208; design #203 phase 4, on top of the #205
@@ -931,4 +1086,4 @@ declare function buildPreparedPlanDocument(plans: Readonly<Record<string, Prepar
  */
 declare function buildBridgeBundle(queries?: DefinitionMap, commands?: DefinitionMap, registry?: typeof MetadataRegistry, transactions?: Record<string, TransactionDefinition>, contractInputs?: ContractInputs): BridgeBundle;
 
-export { type AnyModelContract as A, type BuiltContracts as B, type ContextOwnership as C, buildManifest as D, buildOperations as E, buildQuerySpec as F, buildTransactionSpec as G, buildTransactions as H, collectContractBoundaryViolations as I, collectContractN1Violations as J, defineTransaction as K, defineTransactions as L, isTransactionRef as M, when as N, PREPARED_FORMAT_VERSION as O, type PreparedWriteOpSpec as P, type PreparedBindMap as Q, buildPreparedPlanDocument as R, canonicalJson as S, type TransactionDefinition as T, compilePreparedPlan as U, entityFingerprint as V, type WhenComparison as W, planFingerprint as X, type PreparedPlanDocument as a, type ContextOwnershipMap as b, type ContractBoundaryViolation as c, type ContractInputs as d, type ContractMap as e, type ContractN1Violation as f, type PreparedBindSpec as g, type PreparedPlanSpec as h, type PreparedReadRouteSpec as i, type TransactionParamShape as j, type TransactionRef as k, type TxConditionCheckOptions as l, type TxForEachInstruction as m, type TxForEachOptions as n, type TxInstruction as o, type TxRecorder as p, type TxWriteInstruction as q, type TxWriteOptions as r, assertBundleSerializable as s, assertContractBoundaries as t, assertContractN1Safe as u, assertJsonSerializable as v, assertSupportedCondition as w, buildBridgeBundle as x, buildContexts as y, buildContracts as z };
+export { compilePreparedPlan as $, type AnyModelContract as A, type BuiltContracts as B, type ContextOwnership as C, buildContracts as D, buildManifest as E, buildOperations as F, buildQuerySpec as G, buildTransactionSpec as H, buildTransactions as I, canonicalizeExpressionSpec as J, collectContractBoundaryViolations as K, collectContractN1Violations as L, defineScpTransaction as M, defineTransaction as N, defineTransactions as O, type PreparedWriteOpSpec as P, isTransactionRef as Q, operationsContainScpNodes as R, SCP_LOWERED_MARKER as S, type TransactionDefinition as T, operationsSpecVersion as U, when as V, type WhenComparison as W, PREPARED_FORMAT_VERSION as X, type PreparedBindMap as Y, buildPreparedPlanDocument as Z, canonicalJson as _, type PreparedPlanDocument as a, entityFingerprint as a0, planFingerprint as a1, type ContextOwnershipMap as b, type ContractBoundaryViolation as c, type ContractInputs as d, type ContractMap as e, type ContractN1Violation as f, type PreparedBindSpec as g, type PreparedPlanSpec as h, type PreparedReadRouteSpec as i, type ScpParamValues as j, type TransactionParamShape as k, type TransactionRef as l, type TxConditionCheckOptions as m, type TxForEachInstruction as n, type TxForEachOptions as o, type TxInstruction as p, type TxRecorder as q, type TxWriteInstruction as r, type TxWriteOptions as s, assertBundleSerializable as t, assertContractBoundaries as u, assertContractN1Safe as v, assertJsonSerializable as w, assertSupportedCondition as x, buildBridgeBundle as y, buildContexts as z };

package/dist/index.d.ts

@@ -1,12 +1,14 @@
-export { a as LintResult, L as LintRule, b as Linter, M as MetadataRegistry } from './registry-pAnFcc62.js';
-import { aO as SelectableOf, aP as PrimaryKeyOf, aQ as RequestContext, aR as Middleware, aS as ReadRequestKind, aT as CtxModel, aU as ReadParams, aV as ReadRequestCtx, D as DynamoDBOperation, aW as Item, n as Executor, aX as RetryPolicy, ap as ExecutionPlanSpec, aY as KeyDefinition, aZ as GsiDefinition, a_ as ModelKind, a$ as FieldOptions, b0 as DynamoType, b1 as ProjectionTransform, b2 as MaintainEvent, b3 as MembershipPredicate, b4 as MaintainConsistency, b5 as MaintainUpdateMode, b6 as MembershipPredicateOp, b7 as RelationOptions, b8 as AggregateOptions, b9 as AggregateValue, ba as SelectBuilderSpec, bb as RawCondition, m as EntityMetadata, I as TransactionSpec, a0 as Manifest, bc as RetryOverride, bd as ExecutionPlan, be as FieldMetadata, bf as ResolvedKey, o as ReadExecOptions, p as ExecutorResult, q as BatchGetExecInput, P as PutInput, W as WriteExecOptions, r as WriteResult, s as UpdateInput, t as DeleteInput, u as BatchWriteExecItem, v as BatchExecOptions, T as TransactWriteExecItem, M as ModelStatic, w as DDBModel, bg as Slot, bh as PreparedWriteExecOptions, bi as CommandReturn, bj as ParallelOpResult, a3 as PreparedBody, bk as PreparedStatement, bl as RelationMetadata, aD as TransactionItemSpec, bm as MaintainEffect, V as ViewDefinition, Y as Param, N as ParamDescriptor, Z as DefinitionMap, bn as OperationDefinition, bo as WriteDefinitionOptions, bp as PartialQueryKeyOf, bq as StrictSelectSpec, br as ReadDefinitionOptions, bs as EntityInput, bt as UniqueQueryKeyOf } from './maintenance-view-adapter-BCbgKG5d.js';
-export { bu as AggregateMetadata, $ as AnyOperationDefinition, bv as BatchDeleteRequest, bw as BatchGetOptions, bx as BatchGetRequest, by as BatchGetResult, bz as BatchPutRequest, B as BatchResult, bA as BatchWriteRequest, a1 as BridgeBundle, bB as CONTRACT_RANGE_FANOUT_CONCURRENCY, C as CdcEmulatorOptions, a as CdcMode, bC as CdcModelRegistry, bD as CdcSubscribeHandlers, bE as Change, b as ChangeBatch, c as ChangeEvent, d as ChangeEventName, e as ChangeHandler, f as ClockMode, bF as CollectionEffect, bG as CollectionOptions, bH as Column, bI as ColumnMap, a4 as CommandContractMethodSpec, bJ as CommandInputShape, bK as CommandMethod, z as CommandMethodSpec, y as CommandModelContract, bL as CommandPlan, a5 as CommandResolutionTarget, bM as CommandResultKind, bN as CommandSelectShape, H as CommandSpec, a6 as CompiledFragment, a8 as ComposeSpec, g as ConcurrentRecomputeRef, bO as CondSlot, bP as ConditionCheckInput, X as ConditionInput, a2 as ConditionSpec, bQ as Connection, J as ContextSpec, bR as ContractCallSignature, aa as ContractCardinality, bS as ContractCommandParams, ab as ContractCommandResult, bT as ContractComposeNode, bU as ContractFromRef, ac as ContractInputArity, bV as ContractItem, bW as ContractKeyFieldRef, bX as ContractKeyInput, bY as ContractKeyRef, ad as ContractKeySpec, ae as ContractKind, bZ as ContractMethodOp, b_ as ContractParamRef, b$ as ContractQueryParams, af as ContractResolution, A as ContractSpec, c0 as CounterAggregate, c1 as CounterEffect, c2 as CtxBase, c3 as DEFAULT_MAX_ATTEMPTS, c4 as DEFAULT_RETRY_POLICY, c5 as DeleteOptions, c6 as DeriveEffect, ah as DerivedEdgeWrite, an as DerivedUpdate, c7 as DescriptorBinding, c8 as ENTITY_WRITES_MARKER, c9 as EdgeEffect, ca as EffectPath, cb as EmbeddedMetadata, cc as EmitEffect, O as EntityRef, cd as EntityWritesDefinition, ce as EntityWritesShape, E as EventLog, cf as ExecutableCommandContract, cg as ExecutableQueryContract, F as FaultSpec, ch as FilterInput, aq as FilterSpec, ci as FragmentCondition, cj as FragmentConditionOperatorObject, ck as FragmentInput, cl as GsiDefinitionMarker, cm as GsiOptions, cn as IdempotencyEffect, co as InProcessWriteDescriptor, cp as InlineSnapshotSpec, cq as InputArity, cr as KeyDefinitionMarker, cs as KeySegment, ct as KeySlot, cu as KeyStructure, cv as KeyedResult, cw as LIFECYCLE_CONTRACT_MARKER, cx as LifecycleContract, cy as LifecycleEffects, cz as LiteralParam, cA as MaintainItem, cB as MaintainTrigger, cC as MaintenanceGraph, as as ManifestEntity, at as ManifestField, au as ManifestFieldType, av as ManifestGsi, aw as ManifestKey, ax as ManifestRelation, ay as ManifestTable, cD as MembershipEffect, cE as ModelRef, cF as MutateMode, cG as MutateOptions, cH as MutateParallelResult, cI as MutateTransactionResult, cJ as MutationBody, cK as MutationDescriptorMap, cL as MutationFragment, cM as MutationInputProxy, cN as MutationInputRef, cO as MutationIntent, cP as NumberParam, cQ as OperationKind, az as OperationSpec, _ as OperationsDocument, cR as PREPARE_CACHE_MAX, cS as ParamKind, L as ParamSpec, cT as ParamStructure, cU as PersistCtx, cV as PersistOrigin, cW as PlannedCommandMethod, cX as PreparedInputProxy, cY as PreparedParamRef, cZ as PreparedReadExecOptions, c_ as PreparedReadRoute, c$ as PreparedReadStatement, d0 as PreparedWriteRoute, d1 as PreparedWriteStatement, d2 as ProjectionMap, d3 as ProjectionTransformOp, d4 as PutOptions, aA as QueryContractMethodSpec, d5 as QueryEnvelopeResult, d6 as QueryKeyOf, d7 as QueryMethod, x as QueryMethodSpec, Q as QueryModelContract, d8 as QueryResult, G as QuerySpec, aB as RangeConditionSpec, d9 as ReadEnvelope, da as ReadOpCtx, db as ReadOpKind, aC as ReadOperationType, dc as ReadRouteDescriptor, dd as ReadRouteOptions, de as ReadRouteResult, df as RecordedCompose, dg as RelationBuilder, dh as RelationConsistency, di as RelationLimitOptions, dj as RelationPattern, dk as RelationProjection, dl as RelationReadOptions, dm as RelationSelect, dn as RelationSpec, dp as RelationUpdateMode, dq as RelationWriteOptions, R as ReplayOptions, dr as RequiresEffect, ds as Resolution, dt as RetryInfo, du as RetryOperationKind, K as SPEC_VERSION, dv as SegmentSpec, dw as SegmentedKey, dx as SelectBuilder, dy as SelectOf, S as ShardId, dz as SnapshotEffect, h as StartingPosition, i as StreamViewType, dA as StringParam, j as SubscribeHandler, k as SubscribeHandlers, dB as TransactionContext, aE as TransactionItemType, dC as UniqueEffect, dD as Updatable, dE as UpdateOptions, dF as ViewSourceSlice, aF as WhenSpec, dG as WriteCtx, dH as WriteDescriptor, dI as WriteEnvelope, dJ as WriteInput, dK as WriteKind, dL as WriteLifecyclePhase, dM as WriteMiddleware, aG as WriteOperationType, dN as WriteRecorder, dO as WriteResultProjection, dP as attachModelClass, dQ as buildDeleteInput, dR as buildMaintenanceGraph, dS as buildPutInput, l as buildSubscribeHandler, dT as buildUpdateInput, dU as collectViewDefinitions, aI as compileFragment, aJ as compileMutationPlan, aK as compileSingleFragmentPlan, dV as cond, dW as contractOfMethodSpec, dX as definePlan, dY as entityWrites, dZ as executeBatchGet, d_ as executeBatchWrite, d$ as executeCommandMethod, e0 as executeDelete, e1 as executeKeyedBatchGet, e2 as executePut, e3 as executeQueryMethod, e4 as executeRangeFanout, e5 as executeTransaction, e6 as executeUpdate, e7 as from, e8 as getEntityWrites, e9 as gsi, ea as identity, eb as isColumn, ec as isCommandModelContract, ed as isCommandPlan, ee as isContractComposeNode, ef as isContractFromRef, eg as isContractKeyFieldRef, eh as isContractKeyRef, ei as isContractParamRef, ej as isEntityWritesDefinition, ek as isKeySegment, el as isLifecycleContract, em as isMaintainTrigger, en as isMutationFragment, eo as isMutationInputRef, ep as isParam, eq as isPlannedCommandMethod, er as isPreparedParamRef, es as isQueryModelContract, et as isRetryableError, eu as isRetryableTransactionCancellation, ev as k, ew as key, ex as lifecyclePhaseForIntent, ey as maintainTrigger, ez as mintContractKeyFieldRef, eA as mintContractParamRef, eB as mutation, eC as param, eD as prepare, eE as preview, eF as publicCommandModel, eG as publicQueryModel, eH as query, aM as resolveLifecycle, eI as wholeKeysSentinel } from './maintenance-view-adapter-BCbgKG5d.js';
+export { a as LintResult, L as LintRule, b as Linter, M as MetadataRegistry } from './registry-LWE54Sdc.js';
+import { ab as SelectableOf, ac as PrimaryKeyOf, ad as RequestContext, ae as Middleware, af as ReadRequestKind, ag as CtxModel, ah as ReadParams, ai as ReadRequestCtx, D as DynamoDBOperation, aj as Item, n as Executor, ak as RetryPolicy, al as RetryOverride, am as KeyDefinition, an as GsiDefinition, ao as ModelKind, ap as FieldOptions, aq as DynamoType, ar as ProjectionTransform, as as MaintainEvent, at as MembershipPredicate, au as MaintainConsistency, av as MaintainUpdateMode, aw as MembershipPredicateOp, ax as RelationOptions, ay as AggregateOptions, az as AggregateValue, aA as SelectBuilderSpec, aB as RawCondition, m as EntityMetadata, aC as ExecutionPlan, aD as FieldMetadata, aE as ResolvedKey, o as ReadExecOptions, p as ExecutorResult, q as BatchGetExecInput, P as PutInput, W as WriteExecOptions, r as WriteResult, s as UpdateInput, t as DeleteInput, u as BatchWriteExecItem, v as BatchExecOptions, T as TransactWriteExecItem, M as ModelStatic, w as DDBModel, aF as Slot, aG as PreparedWriteExecOptions, aH as CommandReturn, aI as ParallelOpResult, K as PreparedBody, aJ as PreparedStatement, aK as RelationMetadata, aL as MaintainEffect, V as ViewDefinition, A as ParamDescriptor, I as DefinitionMap, aM as OperationDefinition, aN as WriteDefinitionOptions, aO as PartialQueryKeyOf, aP as StrictSelectSpec, aQ as ReadDefinitionOptions, aR as EntityInput, aS as UniqueQueryKeyOf } from './maintenance-view-adapter-BAZ9uBGe.js';
+export { aT as AggregateMetadata, J as AnyOperationDefinition, aU as BatchDeleteRequest, aV as BatchGetOptions, aW as BatchGetRequest, aX as BatchGetResult, aY as BatchPutRequest, B as BatchResult, aZ as BatchWriteRequest, a_ as CONTRACT_RANGE_FANOUT_CONCURRENCY, C as CdcEmulatorOptions, a as CdcMode, a$ as CdcModelRegistry, b0 as CdcSubscribeHandlers, b1 as Change, b as ChangeBatch, c as ChangeEvent, d as ChangeEventName, e as ChangeHandler, f as ClockMode, b2 as CollectionEffect, b3 as CollectionOptions, b4 as Column, b5 as ColumnMap, b6 as CommandInputShape, b7 as CommandMethod, z as CommandMethodSpec, y as CommandModelContract, b8 as CommandPlan, b9 as CommandResultKind, ba as CommandSelectShape, L as CompiledFragment, g as ConcurrentRecomputeRef, bb as CondSlot, bc as ConditionCheckInput, H as ConditionInput, bd as Connection, be as ContractCallSignature, bf as ContractCommandParams, bg as ContractComposeNode, bh as ContractFromRef, bi as ContractItem, bj as ContractKeyFieldRef, bk as ContractKeyInput, bl as ContractKeyRef, bm as ContractMethodOp, bn as ContractParamRef, bo as ContractQueryParams, bp as CounterAggregate, bq as CounterEffect, br as CtxBase, bs as DEFAULT_MAX_ATTEMPTS, bt as DEFAULT_RETRY_POLICY, bu as DeleteOptions, bv as DeriveEffect, X as DerivedEdgeWrite, a1 as DerivedUpdate, bw as DescriptorBinding, bx as ENTITY_WRITES_MARKER, by as EdgeEffect, bz as EffectPath, bA as EmbeddedMetadata, bB as EmitEffect, G as EntityRef, bC as EntityWritesDefinition, bD as EntityWritesShape, E as EventLog, bE as ExecutableCommandContract, bF as ExecutableQueryContract, F as FaultSpec, bG as FilterInput, bH as FragmentCondition, bI as FragmentConditionOperatorObject, bJ as FragmentInput, bK as GsiDefinitionMarker, bL as GsiOptions, bM as IdempotencyEffect, bN as InProcessWriteDescriptor, bO as InlineSnapshotSpec, bP as InputArity, bQ as KeyDefinitionMarker, bR as KeySegment, bS as KeySlot, bT as KeyStructure, bU as KeyedResult, bV as LIFECYCLE_CONTRACT_MARKER, bW as LifecycleContract, bX as LifecycleEffects, bY as MaintainItem, bZ as MaintainTrigger, b_ as MaintenanceGraph, b$ as MembershipEffect, c0 as ModelRef, c1 as MutateMode, c2 as MutateOptions, c3 as MutateParallelResult, c4 as MutateTransactionResult, c5 as MutationBody, c6 as MutationDescriptorMap, c7 as MutationFragment, c8 as MutationInputProxy, c9 as MutationInputRef, ca as MutationIntent, cb as OperationKind, cc as PREPARE_CACHE_MAX, cd as ParamStructure, ce as PersistCtx, cf as PersistOrigin, cg as PlannedCommandMethod, ch as PreparedInputProxy, ci as PreparedParamRef, cj as PreparedReadExecOptions, ck as PreparedReadRoute, cl as PreparedReadStatement, cm as PreparedWriteRoute, cn as PreparedWriteStatement, co as ProjectionMap, cp as ProjectionTransformOp, cq as PutOptions, cr as QueryEnvelopeResult, cs as QueryKeyOf, ct as QueryMethod, x as QueryMethodSpec, Q as QueryModelContract, cu as QueryResult, cv as ReadEnvelope, cw as ReadOpCtx, cx as ReadOpKind, cy as ReadRouteDescriptor, cz as ReadRouteOptions, cA as ReadRouteResult, cB as RecordedCompose, cC as RelationBuilder, cD as RelationConsistency, cE as RelationLimitOptions, cF as RelationPattern, cG as RelationProjection, cH as RelationReadOptions, cI as RelationSelect, cJ as RelationSpec, cK as RelationUpdateMode, cL as RelationWriteOptions, R as ReplayOptions, cM as RequiresEffect, cN as Resolution, cO as RetryInfo, cP as RetryOperationKind, cQ as SegmentSpec, cR as SegmentedKey, cS as SelectBuilder, cT as SelectOf, S as ShardId, cU as SnapshotEffect, h as StartingPosition, i as StreamViewType, j as SubscribeHandler, k as SubscribeHandlers, cV as TransactionContext, cW as UniqueEffect, cX as Updatable, cY as UpdateOptions, cZ as ViewSourceSlice, c_ as WriteCtx, c$ as WriteDescriptor, d0 as WriteEnvelope, d1 as WriteInput, d2 as WriteKind, d3 as WriteLifecyclePhase, d4 as WriteMiddleware, d5 as WriteRecorder, d6 as WriteResultProjection, d7 as attachModelClass, d8 as buildDeleteInput, d9 as buildMaintenanceGraph, da as buildPutInput, l as buildSubscribeHandler, db as buildUpdateInput, dc as collectViewDefinitions, a5 as compileFragment, a6 as compileMutationPlan, a7 as compileSingleFragmentPlan, dd as cond, de as contractOfMethodSpec, df as definePlan, dg as entityWrites, dh as executeBatchGet, di as executeBatchWrite, dj as executeCommandMethod, dk as executeDelete, dl as executeKeyedBatchGet, dm as executePut, dn as executeQueryMethod, dp as executeRangeFanout, dq as executeTransaction, dr as executeUpdate, ds as from, dt as getEntityWrites, du as gsi, dv as identity, dw as isColumn, dx as isCommandModelContract, dy as isCommandPlan, dz as isContractComposeNode, dA as isContractFromRef, dB as isContractKeyFieldRef, dC as isContractKeyRef, dD as isContractParamRef, dE as isEntityWritesDefinition, dF as isKeySegment, dG as isLifecycleContract, dH as isMaintainTrigger, dI as isMutationFragment, dJ as isMutationInputRef, dK as isPlannedCommandMethod, dL as isPreparedParamRef, dM as isQueryModelContract, dN as isRetryableError, dO as isRetryableTransactionCancellation, dP as k, dQ as key, dR as lifecyclePhaseForIntent, dS as maintainTrigger, dT as mintContractKeyFieldRef, dU as mintContractParamRef, dV as mutation, dW as prepare, dX as preview, dY as publicCommandModel, dZ as publicQueryModel, d_ as query, a9 as resolveLifecycle, d$ as wholeKeysSentinel } from './maintenance-view-adapter-BAZ9uBGe.js';
 import { DynamoDBClient } from '@aws-sdk/client-dynamodb';
 import { DynamoDBDocumentClient } from '@aws-sdk/lib-dynamodb';
-export { C as CdcEmulator, M as MAINT_OUTBOX_PK_PREFIX, a as MaintenanceDrain, b as MaintenanceDrainOptions, c as createCdcEmulator, d as createMaintenanceDrain, e as createMaintenanceDrainHandler, p as parseChange } from './from-change-w2Ih8fkm.js';
-import { P as PreparedWriteOpSpec, a as PreparedPlanDocument } from './index-Deugy2sa.js';
-export { A as AnyModelContract, B as BuiltContracts, C as ContextOwnership, b as ContextOwnershipMap, c as ContractBoundaryViolation, d as ContractInputs, e as ContractMap, f as ContractN1Violation, g as PreparedBindSpec, h as PreparedPlanSpec, i as PreparedReadRouteSpec, T as TransactionDefinition, j as TransactionParamShape, k as TransactionRef, l as TxConditionCheckOptions, m as TxForEachInstruction, n as TxForEachOptions, o as TxInstruction, p as TxRecorder, q as TxWriteInstruction, r as TxWriteOptions, W as WhenComparison, s as assertBundleSerializable, t as assertContractBoundaries, u as assertContractN1Safe, v as assertJsonSerializable, w as assertSupportedCondition, x as buildBridgeBundle, y as buildContexts, z as buildContracts, D as buildManifest, E as buildOperations, F as buildQuerySpec, G as buildTransactionSpec, H as buildTransactions, I as collectContractBoundaryViolations, J as collectContractN1Violations, K as defineTransaction, L as defineTransactions, M as isTransactionRef, N as when } from './index-Deugy2sa.js';
-export { c as createDefaultLinter, g as gsiAmbiguityRule, m as missingGsiRule, n as noScanRule, q as queryBoundaryRule, r as relationDepthRule, a as requireLimitRule } from './relation-depth-C9t4s9bt.js';
+import { q as ExecutionPlanSpec, T as TransactionSpec, M as Manifest, Y as TransactionItemSpec, c as Param } from './types-BQLzTEqh.js';
+export { B as BridgeBundle, f as CommandContractMethodSpec, g as CommandResolutionTarget, a as CommandSpec, h as ComposeSpec, d as ConditionSpec, b as ContextSpec, j as ContractCardinality, k as ContractCommandResult, l as ContractInputArity, m as ContractKeySpec, n as ContractKind, o as ContractResolution, C as ContractSpec, p as EXPR_VERSION, u as ExpressionNode, x as ExpressionOperator, E as ExpressionSpec, F as FilterSpec, a1 as LiteralParam, D as ManifestEntity, G as ManifestField, H as ManifestFieldType, I as ManifestGsi, J as ManifestKey, K as ManifestRelation, L as ManifestTable, a2 as NumberParam, N as OperationSpec, O as OperationsDocument, a0 as ParamKind, P as ParamSpec, R as QueryContractMethodSpec, Q as QuerySpec, U as RangeConditionSpec, V as ReadOperationType, S as SPEC_VERSION, W as SPEC_VERSION_SCP, e as SpecVersion, a3 as StringParam, Z as TransactionItemType, _ as WhenSpec, $ as WriteOperationType, a4 as isParam, a5 as param } from './types-BQLzTEqh.js';
+export { C as CdcEmulator, M as MAINT_OUTBOX_PK_PREFIX, a as MaintenanceDrain, b as MaintenanceDrainOptions, c as createCdcEmulator, d as createMaintenanceDrain, e as createMaintenanceDrainHandler, p as parseChange } from './from-change-Ty95KA8C.js';
+import { P as PreparedWriteOpSpec, a as PreparedPlanDocument } from './index-Dc7d8mWI.js';
+export { A as AnyModelContract, B as BuiltContracts, C as ContextOwnership, b as ContextOwnershipMap, c as ContractBoundaryViolation, d as ContractInputs, e as ContractMap, f as ContractN1Violation, g as PreparedBindSpec, h as PreparedPlanSpec, i as PreparedReadRouteSpec, S as SCP_LOWERED_MARKER, j as ScpParamValues, T as TransactionDefinition, k as TransactionParamShape, l as TransactionRef, m as TxConditionCheckOptions, n as TxForEachInstruction, o as TxForEachOptions, p as TxInstruction, q as TxRecorder, r as TxWriteInstruction, s as TxWriteOptions, W as WhenComparison, t as assertBundleSerializable, u as assertContractBoundaries, v as assertContractN1Safe, w as assertJsonSerializable, x as assertSupportedCondition, y as buildBridgeBundle, z as buildContexts, D as buildContracts, E as buildManifest, F as buildOperations, G as buildQuerySpec, H as buildTransactionSpec, I as buildTransactions, J as canonicalizeExpressionSpec, K as collectContractBoundaryViolations, L as collectContractN1Violations, M as defineScpTransaction, N as defineTransaction, O as defineTransactions, Q as isTransactionRef, R as operationsContainScpNodes, U as operationsSpecVersion, V as when } from './index-Dc7d8mWI.js';
+export { c as createDefaultLinter, g as gsiAmbiguityRule, m as missingGsiRule, n as noScanRule, q as queryBoundaryRule, r as relationDepthRule, a as requireLimitRule } from './relation-depth-BRS513Tq.js';
 
 /**
  * Query options with conditional `consistentRead` availability.
@@ -318,6 +320,113 @@ interface RelationExecutionPlan {
     readonly resultPaths: readonly string[];
 }
 
+interface QueryOptions {
+    consistentRead?: boolean;
+    maxDepth?: number;
+    /**
+     * Per-call throttle / transient-error retry override (issue #111), applied to the
+     * parent read AND to every relation-fan-out send under it. A {@link RetryPolicy}
+     * replaces the global policy for this call; `false` disables retry. Omit to use
+     * the configured (or built-in default) policy.
+     */
+    retry?: RetryOverride;
+    /**
+     * When `true`, the returned item carries its resolved base-table key as a
+     * non-enumerable Symbol property so it can be passed back to `update()`
+     * directly — even for a partial `select` or a GSI-based query. Host-side
+     * runtime behaviour only; not part of the serialized query.
+     */
+    updatable?: boolean;
+    /**
+     * Opt-in class / domain-object hydration (issue #53). When provided, the
+     * factory is applied as the **final after-fetch step** to the fully-built
+     * plain object (after projection, relation resolution, and any `updatable`
+     * hidden-key attachment) and its return value is what the read resolves to —
+     * the return type propagates from the factory (see `ModelStatic.query`).
+     *
+     * Semantics:
+     * - applied to a **present** item only; a `null` read stays `null` and the
+     *   factory is NOT invoked, so the factory need not be null-tolerant;
+     * - a throw from the factory propagates verbatim as the read's rejection
+     *   (the fetch already succeeded; the failure is purely in caller code);
+     * - synchronous by design — an async transform is a caller-side `await` on
+     *   the plain result, intentionally out of scope here.
+     *
+     * Host-side runtime behaviour ONLY: like `updatable` / `consistentRead`, the
+     * factory is a host-language closure that is NEVER serialized into the SSoT /
+     * `operations.json`, so it does not impede the multi-language bridge (#48).
+     * "What to fetch" stays declarative; "what object to load it onto" is host-side.
+     */
+    hydrate?: (raw: Record<string, unknown> | null) => unknown;
+    /**
+     * Host-injected per-call read context (issue #50 / #138) — exposed to every
+     * read hook (R1–R5) as `ctx.context`, and threaded UNCHANGED to every relation
+     * fan-out op so a hook (e.g. a tenant-scope R2 filter) applies across the root
+     * read AND the fan-out fetches. A host-language value, NEVER serialized into the
+     * SSoT / `operations.json` (the bridge #48 is unaffected). Absent ⇒ `{}`.
+     */
+    context?: RequestContext;
+}
+declare function executeQuery(modelClass: Function, key: Record<string, unknown>, selectSpec: Record<string, unknown>, options?: QueryOptions): Promise<Record<string, unknown> | null>;
+
+interface ListInput {
+    limit?: number;
+    after?: string;
+    order?: 'ASC' | 'DESC';
+    /** Declarative server-side DynamoDB FilterExpression input. */
+    filter?: Record<string, unknown>;
+    /**
+     * When `true`, each returned item carries its resolved base-table key as a
+     * non-enumerable Symbol property so it can be passed back to `update()`
+     * directly. Host-side runtime behaviour only; not part of the serialized
+     * query.
+     */
+    updatable?: boolean;
+    /**
+     * Per-call throttle / transient-error retry override (issue #111). A
+     * {@link RetryPolicy} replaces the global policy for this read; `false` disables
+     * retry. Omit to use the configured (or built-in default) policy.
+     */
+    retry?: RetryOverride;
+    /**
+     * Host-injected per-call read context (issue #50 / #138) — exposed to every
+     * read hook as `ctx.context`. Used only when this `list` is the read ENTRY
+     * point (the public `DDBModel.list` / a `list` envelope route): a fresh
+     * {@link MiddlewareRuntime} is built from it. Ignored when a relation fan-out
+     * threads an already-built {@link mw} (the runtime then carries the root read's
+     * context). Absent ⇒ `{}`.
+     */
+    context?: RequestContext;
+    /**
+     * @internal The per-read middleware runtime, threaded UNCHANGED from a relation
+     * fan-out (issue #138) so the hasMany Query's op-level hooks (R2/R3/R5) fire
+     * with the root read's context + the fan-out's {@link relationPath}. When absent
+     * at the entry point, one is built from {@link context}.
+     */
+    mw?: MiddlewareRuntime;
+    /**
+     * @internal The relation path to THIS list read — `[]` (or absent) for a
+     * top-level `list`; the fan-out leg (e.g. `['orders']`) for a hasMany Query.
+     * Populates the op-level ctx's `relationPath` (issue #138).
+     */
+    relationPath?: readonly string[];
+}
+/**
+ * Public list result returned by `DDBModel.list()`. Contains exactly the
+ * `items` and `cursor` keys — no `rawItems` leak.
+ */
+interface ListResult {
+    items: Record<string, unknown>[];
+    cursor: string | null;
+}
+/**
+ * Public list execution backing `DDBModel.list()`. Delegates to
+ * {@link executeListInternal} and constructs a fresh result object exposing
+ * only `{ items, cursor }`, so internal-only fields such as `rawItems` never
+ * cross the public API boundary (no reliance on `as` type narrowing).
+ */
+declare function executeList(modelClass: Function, key: Record<string, unknown>, selectSpec: Record<string, unknown>, options?: ListInput): Promise<ListResult>;
+
 declare function derivePrefix(customPrefix: string | undefined, className: string | undefined): string;
 
 /**
@@ -1062,113 +1171,6 @@ declare function expandTransaction(spec: TransactionSpec, manifest: Manifest, pa
  */
 declare function executeDeclarativeTransaction(spec: TransactionSpec, manifest: Manifest, params: Record<string, unknown>): Promise<void>;
 
-interface QueryOptions {
-    consistentRead?: boolean;
-    maxDepth?: number;
-    /**
-     * Per-call throttle / transient-error retry override (issue #111), applied to the
-     * parent read AND to every relation-fan-out send under it. A {@link RetryPolicy}
-     * replaces the global policy for this call; `false` disables retry. Omit to use
-     * the configured (or built-in default) policy.
-     */
-    retry?: RetryOverride;
-    /**
-     * When `true`, the returned item carries its resolved base-table key as a
-     * non-enumerable Symbol property so it can be passed back to `update()`
-     * directly — even for a partial `select` or a GSI-based query. Host-side
-     * runtime behaviour only; not part of the serialized query.
-     */
-    updatable?: boolean;
-    /**
-     * Opt-in class / domain-object hydration (issue #53). When provided, the
-     * factory is applied as the **final after-fetch step** to the fully-built
-     * plain object (after projection, relation resolution, and any `updatable`
-     * hidden-key attachment) and its return value is what the read resolves to —
-     * the return type propagates from the factory (see `ModelStatic.query`).
-     *
-     * Semantics:
-     * - applied to a **present** item only; a `null` read stays `null` and the
-     *   factory is NOT invoked, so the factory need not be null-tolerant;
-     * - a throw from the factory propagates verbatim as the read's rejection
-     *   (the fetch already succeeded; the failure is purely in caller code);
-     * - synchronous by design — an async transform is a caller-side `await` on
-     *   the plain result, intentionally out of scope here.
-     *
-     * Host-side runtime behaviour ONLY: like `updatable` / `consistentRead`, the
-     * factory is a host-language closure that is NEVER serialized into the SSoT /
-     * `operations.json`, so it does not impede the multi-language bridge (#48).
-     * "What to fetch" stays declarative; "what object to load it onto" is host-side.
-     */
-    hydrate?: (raw: Record<string, unknown> | null) => unknown;
-    /**
-     * Host-injected per-call read context (issue #50 / #138) — exposed to every
-     * read hook (R1–R5) as `ctx.context`, and threaded UNCHANGED to every relation
-     * fan-out op so a hook (e.g. a tenant-scope R2 filter) applies across the root
-     * read AND the fan-out fetches. A host-language value, NEVER serialized into the
-     * SSoT / `operations.json` (the bridge #48 is unaffected). Absent ⇒ `{}`.
-     */
-    context?: RequestContext;
-}
-declare function executeQuery(modelClass: Function, key: Record<string, unknown>, selectSpec: Record<string, unknown>, options?: QueryOptions): Promise<Record<string, unknown> | null>;
-
-interface ListInput {
-    limit?: number;
-    after?: string;
-    order?: 'ASC' | 'DESC';
-    /** Declarative server-side DynamoDB FilterExpression input. */
-    filter?: Record<string, unknown>;
-    /**
-     * When `true`, each returned item carries its resolved base-table key as a
-     * non-enumerable Symbol property so it can be passed back to `update()`
-     * directly. Host-side runtime behaviour only; not part of the serialized
-     * query.
-     */
-    updatable?: boolean;
-    /**
-     * Per-call throttle / transient-error retry override (issue #111). A
-     * {@link RetryPolicy} replaces the global policy for this read; `false` disables
-     * retry. Omit to use the configured (or built-in default) policy.
-     */
-    retry?: RetryOverride;
-    /**
-     * Host-injected per-call read context (issue #50 / #138) — exposed to every
-     * read hook as `ctx.context`. Used only when this `list` is the read ENTRY
-     * point (the public `DDBModel.list` / a `list` envelope route): a fresh
-     * {@link MiddlewareRuntime} is built from it. Ignored when a relation fan-out
-     * threads an already-built {@link mw} (the runtime then carries the root read's
-     * context). Absent ⇒ `{}`.
-     */
-    context?: RequestContext;
-    /**
-     * @internal The per-read middleware runtime, threaded UNCHANGED from a relation
-     * fan-out (issue #138) so the hasMany Query's op-level hooks (R2/R3/R5) fire
-     * with the root read's context + the fan-out's {@link relationPath}. When absent
-     * at the entry point, one is built from {@link context}.
-     */
-    mw?: MiddlewareRuntime;
-    /**
-     * @internal The relation path to THIS list read — `[]` (or absent) for a
-     * top-level `list`; the fan-out leg (e.g. `['orders']`) for a hasMany Query.
-     * Populates the op-level ctx's `relationPath` (issue #138).
-     */
-    relationPath?: readonly string[];
-}
-/**
- * Public list result returned by `DDBModel.list()`. Contains exactly the
- * `items` and `cursor` keys — no `rawItems` leak.
- */
-interface ListResult {
-    items: Record<string, unknown>[];
-    cursor: string | null;
-}
-/**
- * Public list execution backing `DDBModel.list()`. Delegates to
- * {@link executeListInternal} and constructs a fresh result object exposing
- * only `{ items, cursor }`, so internal-only fields such as `rawItems` never
- * cross the public API boundary (no reliance on `as` type narrowing).
- */
-declare function executeList(modelClass: Function, key: Record<string, unknown>, selectSpec: Record<string, unknown>, options?: ListInput): Promise<ListResult>;
-
 interface ExplainInput {
     select?: Record<string, unknown>;
     limit?: number;
@@ -1375,10 +1377,20 @@ interface PerKeyCursorEnvelope {
 /**
  * Canonical, cross-runtime-stable string identity of a contract key. Object
  * fields are sorted by name so `{ a, b }` and `{ b, a }` serialize identically;
- * values are emitted via `JSON.stringify`, matching the Python runtime's
+ * values are emitted as compact JSON, matching the Python runtime's
  * `serialize_contract_key` (sorted items, compact separators). This is the
  * identity used to key a batch result map and to bind a per-key cursor.
  *
+ * **#253 adapter (behavior-contracts)**: this is the shared COMMON
+ * `canonicalValue` primitive (runtime-boundary.md §2.1 →
+ * canonical-serialization.md §2: key identity = top-level key sort + compact
+ * JSON), the same delegation the Python / Rust / Go runtimes adopted in #255.
+ * graphddb's former field-sorted `JSON.stringify` is deleted; plain JS key
+ * values cross the boundary through {@link toSharedValue} (integral `number` →
+ * shared int, `Date` → ISO string, `undefined` fields dropped — the exact
+ * `JSON.stringify` semantics the old implementation had). Byte identity of the
+ * output is locked by the frozen #253 conformance golden.
+ *
  * @param key A plain contract-key object (e.g. `{ categoryId: 'tech' }`).
  * @returns A deterministic JSON string, e.g. `{"categoryId":"tech"}`.
  */