@sequenceholdings/orm 0.1.0 → 0.1.2

package/dist/compiler.cjs

@@ -0,0 +1,3001 @@
+'use strict';
+
+var crypto = require('crypto');
+var zod = require('zod');
+var graphql = require('graphql');
+
+// src/compiler-gql/artifact.ts
+
+// src/constants.ts
+var CAPABILITY_KEY_PATTERN = /^(?:org\/)?[a-z0-9-]{1,64}$/;
+var ORM_SCHEMA_PREFIX = "orm_";
+var ormSchemaName = (namespace) => `${ORM_SCHEMA_PREFIX}${namespace}`;
+
+// src/hash.ts
+function stableJson(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+  const entries = Object.entries(value).filter(([, entryValue]) => entryValue !== void 0).sort(([a], [b]) => a < b ? -1 : 1).map(([key, entryValue]) => `${JSON.stringify(key)}:${stableJson(entryValue)}`);
+  return `{${entries.join(",")}}`;
+}
+var CANONICAL_FORMAT = 2;
+var IDENTIFIER_RE = /^[a-z][a-z0-9_]*$/;
+var identifier = zod.z.string().min(1).max(63).regex(IDENTIFIER_RE);
+var COLUMN_TYPES = [
+  "uuid",
+  "text",
+  "integer",
+  "bigint",
+  "numeric",
+  "double",
+  "boolean",
+  "timestamptz",
+  "date",
+  "jsonb"
+];
+var columnTypeSchema = zod.z.enum(COLUMN_TYPES);
+var canonicalEnumSchema = zod.z.object({
+  name: identifier,
+  values: zod.z.array(zod.z.string().min(1).max(63)).min(1).max(100)
+});
+var canonicalColumnSchema = zod.z.object({
+  /** Property name in TS (camelCase); columnName is the Postgres name. */
+  name: zod.z.string().min(1).max(63),
+  columnName: identifier,
+  type: zod.z.union([columnTypeSchema, zod.z.object({ enum: identifier })]),
+  nullable: zod.z.boolean().default(true),
+  unique: zod.z.boolean().default(false),
+  /** Literal default, or one of the allowlisted SQL functions. */
+  default: zod.z.union([zod.z.string(), zod.z.number(), zod.z.boolean(), zod.z.null()]).optional(),
+  defaultFn: zod.z.enum(["gen_random_uuid()", "now()"]).optional(),
+  description: zod.z.string().max(500).optional(),
+  /** Migration hints — same semantics as v1. */
+  renamedFrom: identifier.optional(),
+  cast: zod.z.string().max(200).optional(),
+  deprecated: zod.z.boolean().default(false)
+});
+var canonicalLinkSchema = zod.z.object({
+  name: zod.z.string().min(1).max(63),
+  kind: zod.z.enum(["toOne", "toMany", "toPlatformUser"]),
+  /** Target table name (namespace-local). Absent for toPlatformUser. */
+  target: identifier.optional(),
+  /** FK column on the owning side (toOne/toPlatformUser: on this table; toMany: on the target). */
+  on: identifier,
+  /** Referenced column on the target (default: target's PK / platform user `sub`). */
+  references: identifier.optional(),
+  /** enforce: true emits a real FK constraint (same-namespace toOne only). */
+  enforce: zod.z.boolean().default(false),
+  description: zod.z.string().max(500).optional()
+});
+var canonicalIndexSchema = zod.z.object({
+  columns: zod.z.array(identifier).min(1),
+  unique: zod.z.boolean().default(false),
+  name: identifier.optional()
+});
+var policyVariantSchema = zod.z.object({
+  /** Claims-only guard (capability()/role()/claim() comparisons — no columns). */
+  when: zod.z.string().min(1).max(1e3),
+  /** Exactly one of: allow-all bypass, or a row predicate. */
+  allow: zod.z.literal(true).optional(),
+  policy: zod.z.string().min(1).max(2e3).optional()
+}).refine((v) => v.allow === true !== (typeof v.policy === "string"), {
+  message: "A variant declares exactly one of allow: true or policy"
+});
+var policyExpressionSchema = zod.z.union([
+  zod.z.string().min(1).max(2e3),
+  zod.z.object({
+    default: zod.z.string().min(1).max(2e3),
+    variants: zod.z.array(policyVariantSchema).max(10).default([])
+  })
+]);
+var canonicalPoliciesSchema = zod.z.object({
+  read: policyExpressionSchema.optional(),
+  write: policyExpressionSchema.optional()
+});
+var canonicalActionSchema = zod.z.object({
+  name: identifier,
+  requires: zod.z.string().max(1e3).optional(),
+  params: zod.z.record(zod.z.string(), zod.z.object({
+    type: columnTypeSchema,
+    nullable: zod.z.boolean().default(false)
+  })).default({}),
+  executes: zod.z.string().min(1).max(1e4),
+  returns: zod.z.enum(["rows", "rowsAffected", "scalar"]).default("rowsAffected"),
+  audit: zod.z.object({ action: zod.z.string(), resource: zod.z.string() }).optional()
+});
+var canonicalTableSchema = zod.z.object({
+  table: identifier,
+  description: zod.z.string().max(2e3).optional(),
+  /** Table-level rename hint (new in v2). */
+  renamedFrom: identifier.optional(),
+  /** Synced/reflected read-only tables (`source: gold.*`) — v1 semantics. */
+  source: zod.z.string().regex(/^gold\.[a-z][a-z0-9_]*$/).optional(),
+  columns: zod.z.array(canonicalColumnSchema).default([]),
+  primaryKey: zod.z.array(identifier).min(1).max(8).optional(),
+  links: zod.z.array(canonicalLinkSchema).default([]),
+  indexes: zod.z.array(canonicalIndexSchema).default([]),
+  policies: canonicalPoliciesSchema.default({}),
+  actions: zod.z.array(canonicalActionSchema).default([])
+});
+var canonicalDefinitionSchema = zod.z.object({
+  definition_format: zod.z.literal(CANONICAL_FORMAT),
+  namespace: identifier.max(41),
+  description: zod.z.string().max(2e3).optional(),
+  enums: zod.z.array(canonicalEnumSchema).default([]),
+  tables: zod.z.array(canonicalTableSchema).min(0).max(500),
+  /** Verbatim custom-roles grammar (@sequenceholdings/custom-roles-manifest). */
+  capabilities: zod.z.object({
+    roles: zod.z.unknown().optional(),
+    uses: zod.z.array(zod.z.string()).default([])
+  }).default({ uses: [] })
+});
+function normalizeCanonical(definition) {
+  const sortByName = (items) => [...items].sort((a, b) => a.name.localeCompare(b.name));
+  return {
+    ...definition,
+    enums: sortByName(definition.enums),
+    tables: [...definition.tables].sort((a, b) => a.table.localeCompare(b.table)).map((t) => ({
+      ...t,
+      links: sortByName(t.links),
+      indexes: [...t.indexes].sort((a, b) => (a.name ?? a.columns.join("_")).localeCompare(b.name ?? b.columns.join("_"))),
+      actions: sortByName(t.actions)
+    }))
+  };
+}
+
+// src/ir/index.ts
+var IR_VERSION = 1;
+var CLAIMS_CONTRACT = {
+  sub: "string",
+  org: "string?",
+  roles: "string[]",
+  capabilities: "string[]"
+};
+var scalarLiteral = zod.z.union([zod.z.string(), zod.z.number(), zod.z.boolean(), zod.z.null()]);
+var valueIrSchema = zod.z.discriminatedUnion("kind", [
+  zod.z.object({ kind: zod.z.literal("literal"), value: zod.z.union([scalarLiteral, zod.z.array(scalarLiteral)]) }),
+  zod.z.object({ kind: zod.z.literal("variable"), name: zod.z.string() }),
+  zod.z.object({ kind: zod.z.literal("claim"), key: zod.z.enum(["sub", "org"]) })
+]);
+var CMP_OPS = [
+  "eq",
+  "neq",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "in",
+  "nin",
+  "like",
+  "ilike",
+  "isNull",
+  "contains",
+  "hasKey"
+];
+var predIrSchema = zod.z.lazy(
+  () => zod.z.discriminatedUnion("kind", [
+    zod.z.object({ kind: zod.z.literal("and"), operands: zod.z.array(predIrSchema).min(1) }),
+    zod.z.object({ kind: zod.z.literal("or"), operands: zod.z.array(predIrSchema).min(1) }),
+    zod.z.object({ kind: zod.z.literal("not"), operand: predIrSchema }),
+    zod.z.object({ kind: zod.z.literal("cmp"), op: zod.z.enum(CMP_OPS), column: zod.z.string(), value: valueIrSchema }),
+    zod.z.object({ kind: zod.z.literal("exists"), link: zod.z.string(), where: predIrSchema }),
+    zod.z.object({
+      kind: zod.z.literal("aggPredicate"),
+      link: zod.z.string(),
+      fn: zod.z.literal("count"),
+      op: zod.z.enum(["eq", "neq", "gt", "gte", "lt", "lte"]),
+      value: zod.z.number(),
+      where: predIrSchema.optional()
+    }),
+    zod.z.object({ kind: zod.z.literal("capability"), key: zod.z.string() }),
+    zod.z.object({ kind: zod.z.literal("role"), key: zod.z.string() }),
+    zod.z.object({ kind: zod.z.literal("dynamicFilter"), slot: zod.z.string() }),
+    zod.z.object({ kind: zod.z.literal("const"), value: zod.z.boolean() })
+  ])
+);
+var orderIrSchema = zod.z.discriminatedUnion("kind", [
+  zod.z.object({
+    kind: zod.z.literal("column"),
+    column: zod.z.string(),
+    /** Order through a to-one link: `link` is set and `column` is on the target. */
+    link: zod.z.string().optional(),
+    direction: zod.z.enum(["asc", "desc"]),
+    nulls: zod.z.enum(["first", "last"]).optional()
+  }),
+  /** §4f: `$orderBy: [FooOrderBy!]` variable — validated + lowered at runtime. */
+  zod.z.object({ kind: zod.z.literal("dynamic"), slot: zod.z.string() })
+]);
+var limitIrSchema = zod.z.object({
+  /** Fixed value or a variable, clamped to [1, max]; absent → default. */
+  variable: zod.z.string().optional(),
+  value: zod.z.number().int().positive().optional(),
+  default: zod.z.number().int().positive(),
+  max: zod.z.number().int().positive()
+});
+var selectionIrSchema = zod.z.lazy(
+  () => zod.z.object({
+    typename: zod.z.string(),
+    columns: zod.z.array(zod.z.object({ alias: zod.z.string(), column: zod.z.string() })),
+    relations: zod.z.array(zod.z.object({
+      alias: zod.z.string(),
+      link: zod.z.string(),
+      selection: selectionIrSchema,
+      where: predIrSchema.optional(),
+      orderBy: zod.z.array(orderIrSchema).optional(),
+      limit: limitIrSchema.optional(),
+      offset: zod.z.object({ variable: zod.z.string().optional(), value: zod.z.number().int().optional() }).optional()
+    })),
+    aggregates: zod.z.array(zod.z.object({
+      alias: zod.z.string(),
+      link: zod.z.string().optional(),
+      where: predIrSchema.optional(),
+      count: zod.z.object({ columns: zod.z.array(zod.z.string()).optional(), distinct: zod.z.boolean().optional() }).optional(),
+      sum: zod.z.array(zod.z.string()).optional(),
+      avg: zod.z.array(zod.z.string()).optional(),
+      nodes: selectionIrSchema.optional()
+    }))
+  })
+);
+var includeIfSchema = zod.z.object({ variable: zod.z.string(), negated: zod.z.boolean() });
+var selectRootSchema = zod.z.object({
+  kind: zod.z.literal("select"),
+  alias: zod.z.string(),
+  table: zod.z.string(),
+  selection: selectionIrSchema,
+  /** Composed at compile time: AND(policy, documentWhere?, dynamicFilter?). */
+  where: predIrSchema,
+  orderBy: zod.z.array(orderIrSchema).default([]),
+  distinctOn: zod.z.union([zod.z.array(zod.z.string()), zod.z.object({ slot: zod.z.string() })]).optional(),
+  limit: limitIrSchema,
+  offset: zod.z.object({ variable: zod.z.string().optional(), value: zod.z.number().int().optional() }).optional(),
+  includeIf: includeIfSchema.optional()
+});
+var byPkRootSchema = zod.z.object({
+  kind: zod.z.literal("byPk"),
+  alias: zod.z.string(),
+  table: zod.z.string(),
+  selection: selectionIrSchema,
+  pk: zod.z.array(zod.z.object({ column: zod.z.string(), value: valueIrSchema })).min(1),
+  /** Policy predicate — ANDed with the PK match. */
+  where: predIrSchema,
+  includeIf: includeIfSchema.optional()
+});
+var aggregateRootSchema = zod.z.object({
+  kind: zod.z.literal("aggregate"),
+  alias: zod.z.string(),
+  table: zod.z.string(),
+  where: predIrSchema,
+  count: zod.z.object({ columns: zod.z.array(zod.z.string()).optional(), distinct: zod.z.boolean().optional() }).optional(),
+  sum: zod.z.array(zod.z.string()).optional(),
+  avg: zod.z.array(zod.z.string()).optional(),
+  nodes: selectionIrSchema.optional(),
+  includeIf: includeIfSchema.optional()
+});
+var writeValuesSchema = zod.z.union([
+  zod.z.object({ slot: zod.z.string() }),
+  zod.z.object({ entries: zod.z.array(zod.z.object({ column: zod.z.string(), value: valueIrSchema })) })
+]);
+var onConflictIrSchema = zod.z.union([
+  zod.z.object({ slot: zod.z.string() }),
+  zod.z.object({ constraint: zod.z.string(), updateColumns: zod.z.array(zod.z.string()) })
+]);
+var mutationRootSchema = zod.z.object({
+  kind: zod.z.literal("mutation"),
+  op: zod.z.enum(["insert", "insertOne", "update", "updateByPk", "delete", "deleteByPk"]),
+  alias: zod.z.string(),
+  table: zod.z.string(),
+  /** insert/insertOne: rows come from a slot ($object/$objects) or literals. */
+  objects: zod.z.union([
+    zod.z.object({ slot: zod.z.string() }),
+    zod.z.object({ rows: zod.z.array(zod.z.array(zod.z.object({ column: zod.z.string(), value: valueIrSchema }))) })
+  ]).optional(),
+  /** Server-pinned columns (e.g. author_sub ← claim('sub')) merged into every inserted row. */
+  pinnedColumns: zod.z.array(zod.z.object({ column: zod.z.string(), value: valueIrSchema })).default([]),
+  onConflict: onConflictIrSchema.optional(),
+  set: writeValuesSchema.optional(),
+  append: writeValuesSchema.optional(),
+  inc: writeValuesSchema.optional(),
+  /** update/delete row filter: AND(writePolicy, documentWhere/pk, dynamicFilter?). */
+  where: predIrSchema.optional(),
+  pk: zod.z.array(zod.z.object({ column: zod.z.string(), value: valueIrSchema })).optional(),
+  /** WITH CHECK analogue evaluated against NEW row values (insert/update). */
+  insertCheck: predIrSchema.optional(),
+  returning: selectionIrSchema.nullable(),
+  affectedRows: zod.z.boolean().default(false),
+  includeIf: includeIfSchema.optional()
+});
+var actionRootSchema = zod.z.object({
+  kind: zod.z.literal("action"),
+  alias: zod.z.string(),
+  name: zod.z.string(),
+  params: zod.z.array(zod.z.object({ name: zod.z.string(), value: valueIrSchema })),
+  returns: zod.z.enum(["rows", "rowsAffected", "scalar"])
+});
+var rootIrSchema = zod.z.discriminatedUnion("kind", [
+  selectRootSchema,
+  byPkRootSchema,
+  aggregateRootSchema,
+  mutationRootSchema,
+  actionRootSchema
+]);
+var INPUT_REF_KINDS = [
+  "boolExp",
+  "orderBy",
+  "selectColumn",
+  "insertInput",
+  "setInput",
+  "appendInput",
+  "onConflict"
+];
+var variableDefaultIrSchema = zod.z.object({
+  value: zod.z.union([scalarLiteral, zod.z.array(scalarLiteral)])
+});
+var variableIrSchema = zod.z.object({
+  name: zod.z.string(),
+  type: zod.z.union([
+    zod.z.object({ kind: zod.z.literal("scalar"), scalar: zod.z.enum(COLUMN_TYPES) }),
+    /** `values` is the declared membership whitelist — the executor validates against it. */
+    zod.z.object({ kind: zod.z.literal("enum"), name: zod.z.string(), values: zod.z.array(zod.z.string()).min(1) }),
+    /** §4f dynamic slot: validated against `tables[table]` whitelists at runtime. */
+    zod.z.object({ kind: zod.z.literal("inputRef"), input: zod.z.enum(INPUT_REF_KINDS), table: zod.z.string() })
+  ]),
+  nullable: zod.z.boolean(),
+  list: zod.z.boolean(),
+  /** Absent = no default declared; see {@link variableDefaultIrSchema}. */
+  defaultValue: variableDefaultIrSchema.optional()
+});
+var compiledOperationSchema = zod.z.object({
+  irVersion: zod.z.literal(IR_VERSION),
+  name: zod.z.string(),
+  opHash: zod.z.string().regex(/^sha256:[0-9a-f]{64}$/),
+  kind: zod.z.enum(["query", "mutation", "action"]),
+  requires: zod.z.object({
+    capability: zod.z.string().optional(),
+    role: zod.z.string().optional()
+  }).nullable(),
+  variables: zod.z.array(variableIrSchema),
+  /** Every table the op touches — data-token scoping + audit. */
+  tableSet: zod.z.array(zod.z.string()).min(1),
+  roots: zod.z.array(rootIrSchema).min(1)
+});
+var tableMetaIrSchema = zod.z.object({
+  table: zod.z.string(),
+  schema: zod.z.string(),
+  typename: zod.z.string(),
+  columns: zod.z.array(zod.z.object({
+    name: zod.z.string(),
+    columnName: zod.z.string(),
+    type: zod.z.union([zod.z.enum(COLUMN_TYPES), zod.z.object({ enum: zod.z.string(), values: zod.z.array(zod.z.string()) })]),
+    nullable: zod.z.boolean()
+  })),
+  primaryKey: zod.z.array(zod.z.string()).min(1),
+  links: zod.z.array(zod.z.object({
+    name: zod.z.string(),
+    kind: zod.z.enum(["toOne", "toMany", "toPlatformUser"]),
+    target: zod.z.string(),
+    on: zod.z.string(),
+    references: zod.z.string()
+  })),
+  /** §4f whitelists: what dynamic inputs may reference. */
+  filterable: zod.z.array(zod.z.string()),
+  orderable: zod.z.array(zod.z.string()),
+  insertable: zod.z.array(zod.z.string()),
+  settable: zod.z.array(zod.z.string()),
+  appendable: zod.z.array(zod.z.string()),
+  constraints: zod.z.array(zod.z.object({ name: zod.z.string(), columns: zod.z.array(zod.z.string()) })),
+  /** Depth/node caps for dynamic filter trees on this table. */
+  dynamicFilterMaxDepth: zod.z.number().int().positive().default(6),
+  dynamicFilterMaxNodes: zod.z.number().int().positive().default(64)
+});
+var compiledArtifactSchema = zod.z.object({
+  irVersion: zod.z.literal(IR_VERSION),
+  namespace: zod.z.string(),
+  schemaHash: zod.z.string(),
+  opsHash: zod.z.string(),
+  tables: zod.z.record(zod.z.string(), tableMetaIrSchema),
+  operations: zod.z.record(zod.z.string(), compiledOperationSchema)
+});
+var IrVersionError = class extends Error {
+  constructor(found) {
+    super(`Unsupported IR version ${String(found)} \u2014 this executor supports up to ${IR_VERSION}. Upgrade @sequenceholdings/orm or re-push the namespace.`);
+    this.name = "IrVersionError";
+  }
+};
+function normalizeIr(raw) {
+  if (!raw || typeof raw !== "object") throw new IrVersionError(void 0);
+  const version = raw.irVersion;
+  if (version !== IR_VERSION) throw new IrVersionError(version);
+  return compiledArtifactSchema.parse(raw);
+}
+
+// src/predicate-v2/ast.ts
+var POLICY_COMPARE_OPS = ["=", "!=", "<", "<=", ">", ">="];
+function walkPolicy(node, visit) {
+  visit(node);
+  if (node.kind === "and" || node.kind === "or") {
+    for (const operand of node.operands) walkPolicy(operand, visit);
+  }
+  if (node.kind === "not") walkPolicy(node.operand, visit);
+  if (node.kind === "exists") walkPolicy(node.where, visit);
+}
+
+// src/predicate-v2/errors.ts
+var PolicyParseError = class extends Error {
+  constructor(message, position) {
+    super(`${message} (at position ${position})`);
+    this.position = position;
+  }
+  name = "PolicyParseError";
+};
+var PolicyCompileError = class extends Error {
+  constructor(message, code, candidates = []) {
+    super(candidates.length > 0 ? `${message} (candidates: ${candidates.join(", ")})` : message);
+    this.code = code;
+    this.candidates = candidates;
+  }
+  name = "PolicyCompileError";
+};
+
+// src/predicate-v2/parse.ts
+var KEYWORDS = /* @__PURE__ */ new Set(["and", "or", "not", "true", "false", "null", "claim", "capability", "role", "exists"]);
+var OPERATOR_PATTERN = /^(!=|<=|>=|<>|=|<|>)/;
+var IDENTIFIER_START = /[a-zA-Z_]/;
+var IDENTIFIER_CHAR = /[a-zA-Z0-9_]/;
+var NUMBER_PATTERN = /^-?\d+(\.\d+)?/;
+var SCALAR_CLAIM_KEYS = Object.entries(CLAIMS_CONTRACT).filter(([, type]) => !type.endsWith("[]")).map(([key]) => key);
+var ARRAY_CLAIM_KEYS = Object.entries(CLAIMS_CONTRACT).filter(([, type]) => type.endsWith("[]")).map(([key]) => key);
+function tokenize(source) {
+  const tokens = [];
+  let position = 0;
+  while (position < source.length) {
+    const char = source[position];
+    if (/\s/.test(char)) {
+      position += 1;
+      continue;
+    }
+    if (char === "(") {
+      tokens.push({ kind: "lparen", value: char, position });
+      position += 1;
+      continue;
+    }
+    if (char === ")") {
+      tokens.push({ kind: "rparen", value: char, position });
+      position += 1;
+      continue;
+    }
+    if (char === ",") {
+      tokens.push({ kind: "comma", value: char, position });
+      position += 1;
+      continue;
+    }
+    if (char === ".") {
+      tokens.push({ kind: "dot", value: char, position });
+      position += 1;
+      continue;
+    }
+    if (char === "'") {
+      const { value, end } = readString(source, position);
+      tokens.push({ kind: "string", value, position });
+      position = end;
+      continue;
+    }
+    const operator = OPERATOR_PATTERN.exec(source.slice(position));
+    if (operator) {
+      const value = operator[0] === "<>" ? "!=" : operator[0];
+      tokens.push({ kind: "operator", value, position });
+      position += operator[0].length;
+      continue;
+    }
+    const number = NUMBER_PATTERN.exec(source.slice(position));
+    if (number && !IDENTIFIER_START.test(char)) {
+      tokens.push({ kind: "number", value: number[0], position });
+      position += number[0].length;
+      continue;
+    }
+    if (IDENTIFIER_START.test(char)) {
+      let end = position;
+      while (end < source.length && IDENTIFIER_CHAR.test(source[end])) end += 1;
+      tokens.push({ kind: "identifier", value: source.slice(position, end), position });
+      position = end;
+      continue;
+    }
+    throw new PolicyParseError(`unexpected character '${char}'`, position);
+  }
+  tokens.push({ kind: "end", value: "", position: source.length });
+  return tokens;
+}
+function readString(source, start) {
+  let value = "";
+  let position = start + 1;
+  while (position < source.length) {
+    const char = source[position];
+    if (char !== "'") {
+      value += char;
+      position += 1;
+      continue;
+    }
+    if (source[position + 1] === "'") {
+      value += "'";
+      position += 2;
+      continue;
+    }
+    return { value, end: position + 1 };
+  }
+  throw new PolicyParseError("unterminated string literal", start);
+}
+var Parser = class {
+  constructor(tokens) {
+    this.tokens = tokens;
+  }
+  index = 0;
+  parse() {
+    const node = this.parseOr();
+    this.expect("end", "end of expression");
+    return node;
+  }
+  parseOr() {
+    const operands = [this.parseAnd()];
+    while (this.matchKeyword("or")) operands.push(this.parseAnd());
+    return operands.length === 1 ? operands[0] : { kind: "or", operands };
+  }
+  parseAnd() {
+    const operands = [this.parseNot()];
+    while (this.matchKeyword("and")) operands.push(this.parseNot());
+    return operands.length === 1 ? operands[0] : { kind: "and", operands };
+  }
+  parseNot() {
+    if (this.matchKeyword("not")) return { kind: "not", operand: this.parseNot() };
+    return this.parsePrimary();
+  }
+  parsePrimary() {
+    if (this.peek().kind === "lparen") {
+      this.advance();
+      const inner = this.parseOr();
+      this.expect("rparen", "')'");
+      return inner;
+    }
+    if (this.peekKeyword("capability") || this.peekKeyword("role")) {
+      const fn = this.peek().value;
+      const node = this.parseBooleanCall(fn);
+      const next = this.peek();
+      if (next.kind === "operator") {
+        throw new PolicyParseError(`${fn}() is boolean-valued and cannot appear in a comparison`, next.position);
+      }
+      return node;
+    }
+    if (this.peekKeyword("exists")) return this.parseExists();
+    return this.parseComparison();
+  }
+  parseBooleanCall(fn) {
+    this.advance();
+    const key = this.parseCallArgument(fn);
+    if (!CAPABILITY_KEY_PATTERN.test(key)) {
+      throw new PolicyParseError(`invalid ${fn} key '${key}'`, this.peek().position);
+    }
+    return { kind: fn, key };
+  }
+  parseExists() {
+    this.advance();
+    this.expect("lparen", "'(' after exists");
+    const path = this.parsePath("a link path in exists(...)");
+    this.expect("comma", "',' between the exists link path and its predicate");
+    const where = this.parseOr();
+    this.expect("rparen", "')' closing exists(...)");
+    return { kind: "exists", path, where };
+  }
+  parseComparison() {
+    const left = this.parseOperand();
+    const operator = this.expect("operator", "a comparison operator");
+    if (!POLICY_COMPARE_OPS.includes(operator.value)) {
+      throw new PolicyParseError(`unsupported operator '${operator.value}'`, operator.position);
+    }
+    const right = this.parseOperand();
+    return { kind: "compare", op: operator.value, left, right };
+  }
+  parseOperand() {
+    const token = this.peek();
+    if (token.kind === "string") {
+      this.advance();
+      return { kind: "literal", value: token.value };
+    }
+    if (token.kind === "number") {
+      this.advance();
+      const value = Number(token.value);
+      if (!Number.isFinite(value) || Number.isInteger(value) && !Number.isSafeInteger(value)) {
+        throw new PolicyParseError(
+          `numeric literal '${token.value}' exceeds safe integer precision \u2014 quote it as a string`,
+          token.position
+        );
+      }
+      return { kind: "literal", value };
+    }
+    if (token.kind !== "identifier") {
+      throw new PolicyParseError(`expected an operand, got '${token.value || "end"}'`, token.position);
+    }
+    if (token.value === "true" || token.value === "false") {
+      this.advance();
+      return { kind: "literal", value: token.value === "true" };
+    }
+    if (token.value === "null") {
+      this.advance();
+      return { kind: "literal", value: null };
+    }
+    if (token.value === "claim") {
+      this.advance();
+      const key = this.parseCallArgument("claim");
+      return { kind: "claim", key: this.validateClaimKey(key, token.position) };
+    }
+    if (token.value === "capability" || token.value === "role") {
+      throw new PolicyParseError(`${token.value}() is boolean-valued and cannot appear in a comparison`, token.position);
+    }
+    return { kind: "path", segments: this.parsePath("a column or link path") };
+  }
+  validateClaimKey(key, position) {
+    if (SCALAR_CLAIM_KEYS.includes(key)) return key;
+    if (ARRAY_CLAIM_KEYS.includes(key)) {
+      const fn = key === "roles" ? "role('\u2026')" : "capability('\u2026')";
+      throw new PolicyParseError(
+        `claim('${key}') is not reachable \u2014 '${key}' is an array claim; use ${fn} instead`,
+        position
+      );
+    }
+    throw new PolicyParseError(
+      `unknown claim key '${key}' \u2014 valid claim() keys are: ${SCALAR_CLAIM_KEYS.map((k) => `'${k}'`).join(", ")}`,
+      position
+    );
+  }
+  /** `ident(.ident)*` — first segment must not be a keyword; later segments may be (e.g. `author.role`). */
+  parsePath(description) {
+    const first = this.peek();
+    if (first.kind !== "identifier" || KEYWORDS.has(first.value)) {
+      throw new PolicyParseError(`expected ${description}, got '${first.value || "end"}'`, first.position);
+    }
+    this.advance();
+    const segments = [first.value];
+    while (this.peek().kind === "dot") {
+      this.advance();
+      const segment = this.expect("identifier", "a path segment after .");
+      segments.push(segment.value);
+    }
+    return segments;
+  }
+  parseCallArgument(fn) {
+    this.expect("lparen", `'(' after ${fn}`);
+    const argument = this.expect("string", `a quoted key in ${fn}(...)`);
+    this.expect("rparen", `')' after ${fn} key`);
+    return argument.value;
+  }
+  peek() {
+    return this.tokens[this.index];
+  }
+  peekKeyword(keyword) {
+    const token = this.peek();
+    return token.kind === "identifier" && token.value === keyword;
+  }
+  matchKeyword(keyword) {
+    if (!this.peekKeyword(keyword)) return false;
+    this.advance();
+    return true;
+  }
+  advance() {
+    const token = this.peek();
+    if (token.kind !== "end") this.index += 1;
+    return token;
+  }
+  expect(kind, description) {
+    const token = this.peek();
+    if (token.kind !== kind) {
+      throw new PolicyParseError(`expected ${description}, got '${token.value || "end"}'`, token.position);
+    }
+    return this.advance();
+  }
+};
+function parsePolicy(source) {
+  const trimmed = source.trim();
+  if (trimmed.length === 0) throw new PolicyParseError("empty policy expression", 0);
+  return { source: trimmed, ast: new Parser(tokenize(trimmed)).parse() };
+}
+
+// src/predicate-v2/compile.ts
+var POLICY_MAX_LINK_DEPTH = 3;
+var CMP_BY_OP = {
+  "=": "eq",
+  "!=": "neq",
+  "<": "lt",
+  "<=": "lte",
+  ">": "gt",
+  ">=": "gte"
+};
+var FLIPPED = {
+  "=": "=",
+  "!=": "!=",
+  "<": ">",
+  "<=": ">=",
+  ">": "<",
+  ">=": "<="
+};
+function resolveTable(resolver, table) {
+  const info = resolver.tables[table];
+  if (!info) {
+    throw new PolicyCompileError(`unknown table '${table}'`, "unknown-table", Object.keys(resolver.tables));
+  }
+  return info;
+}
+function resolveColumn(info, ref) {
+  const column = info.columns.find((c) => c.name === ref || c.columnName === ref);
+  return column?.name;
+}
+function resolveLink(info, ref) {
+  return info.links.find((l) => l.name === ref);
+}
+function columnCandidates(info) {
+  return [...info.columns.map((c) => c.name), ...info.links.map((l) => l.name)];
+}
+var PolicyCompiler = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  compile(node, table, depth) {
+    switch (node.kind) {
+      case "and":
+      case "or":
+        return { kind: node.kind, operands: node.operands.map((operand) => this.compile(operand, table, depth)) };
+      case "not":
+        return { kind: "not", operand: this.compile(node.operand, table, depth) };
+      case "capability":
+        return { kind: "capability", key: node.key };
+      case "role":
+        return { kind: "role", key: node.key };
+      case "exists":
+        return this.compileExists(node.path, node.where, table, depth);
+      case "compare":
+        return this.compileCompare(node, table, depth);
+    }
+  }
+  /** Traverse link path segments (any cardinality), then compile the inner predicate against the final target. */
+  compileExists(path, where, table, depth) {
+    const { links, finalTable } = this.resolveLinkPath(path, table, depth, { toOneOnly: false });
+    let pred = this.compile(where, finalTable, depth + links.length);
+    for (let i = links.length - 1; i >= 0; i -= 1) {
+      pred = { kind: "exists", link: links[i].name, where: pred };
+    }
+    return pred;
+  }
+  resolveLinkPath(path, table, depth, { toOneOnly }) {
+    const links = [];
+    let current = table;
+    for (const segment of path) {
+      const info = resolveTable(this.ctx.resolver, current);
+      const link = resolveLink(info, segment);
+      if (!link) {
+        throw new PolicyCompileError(
+          `unknown link '${segment}' on table '${current}'`,
+          "unknown-link",
+          info.links.map((l) => l.name)
+        );
+      }
+      if (toOneOnly && link.kind === "toMany") {
+        throw new PolicyCompileError(
+          `dotted paths traverse to-one links only \u2014 '${segment}' on '${current}' is to-many; use exists(${path.join(".")}, \u2026)`,
+          "not-to-one"
+        );
+      }
+      links.push(link);
+      current = link.target;
+      if (depth + links.length > this.ctx.maxLinkDepth) {
+        throw new PolicyCompileError(
+          `link traversal depth exceeds ${this.ctx.maxLinkDepth} (at '${segment}')`,
+          "link-depth-exceeded"
+        );
+      }
+    }
+    return { links, finalTable: current };
+  }
+  compileCompare(node, table, depth) {
+    const leftIsPath = node.left.kind === "path";
+    const rightIsPath = node.right.kind === "path";
+    if (leftIsPath && rightIsPath) {
+      throw new PolicyCompileError(
+        "column-to-column comparisons are not supported in v2.0 policies",
+        "unsupported-comparison"
+      );
+    }
+    if (!leftIsPath && !rightIsPath) {
+      throw new PolicyCompileError(
+        "a comparison must reference a column \u2014 claims-to-literal comparisons are not representable in v2.0; use capability() or role()",
+        "unsupported-comparison"
+      );
+    }
+    const [pathSide, valueSide, op] = leftIsPath ? [node.left, node.right, node.op] : [node.right, node.left, FLIPPED[node.op]];
+    const segments = pathSide.segments;
+    const linkSegments = segments.slice(0, -1);
+    const columnRef = segments[segments.length - 1];
+    const { links, finalTable } = this.resolveLinkPath(linkSegments, table, depth, { toOneOnly: true });
+    const info = resolveTable(this.ctx.resolver, finalTable);
+    const column = resolveColumn(info, columnRef);
+    if (!column) {
+      throw new PolicyCompileError(
+        `unknown column '${columnRef}' on table '${finalTable}'`,
+        "unknown-column",
+        columnCandidates(info)
+      );
+    }
+    let cmp = this.buildCmp(op, column, valueSide);
+    for (let i = links.length - 1; i >= 0; i -= 1) {
+      cmp = { kind: "exists", link: links[i].name, where: cmp };
+    }
+    return cmp;
+  }
+  buildCmp(op, column, valueSide) {
+    if (valueSide.kind === "literal" && valueSide.value === null) {
+      if (op !== "=" && op !== "!=") {
+        throw new PolicyCompileError(
+          `null only supports = and != comparisons, got '${op}'`,
+          "invalid-null-comparison"
+        );
+      }
+      return { kind: "cmp", op: "isNull", column, value: { kind: "literal", value: op === "=" } };
+    }
+    const value = valueSide.kind === "claim" ? { kind: "claim", key: valueSide.key } : { kind: "literal", value: valueSide.value };
+    return { kind: "cmp", op: CMP_BY_OP[op], column, value };
+  }
+};
+function compilePredicateV2({ expression, table, resolver, maxLinkDepth }) {
+  const parsed = typeof expression === "string" ? parsePolicy(expression) : expression;
+  const compiler = new PolicyCompiler({ resolver, maxLinkDepth: maxLinkDepth ?? POLICY_MAX_LINK_DEPTH });
+  return compiler.compile(parsed.ast, table, 0);
+}
+function assertClaimsOnlyWhen(parsed) {
+  walkPolicy(parsed.ast, (node) => {
+    if (node.kind === "compare") {
+      const columnRef = [node.left, node.right].find((operand) => operand.kind === "path");
+      if (columnRef) {
+        throw new PolicyCompileError(
+          `variant 'when' guards are claims-only \u2014 column reference '${columnRef.segments.join(".")}' is not allowed`,
+          "when-not-claims-only"
+        );
+      }
+      throw new PolicyCompileError(
+        "variant 'when' guards support capability() and role() checks only in v2.0",
+        "when-not-claims-only"
+      );
+    }
+    if (node.kind === "exists") {
+      throw new PolicyCompileError(
+        "variant 'when' guards are claims-only \u2014 exists() is not allowed",
+        "when-not-claims-only"
+      );
+    }
+  });
+}
+function compilePolicy({ expression, table, resolver, maxLinkDepth }) {
+  if (typeof expression === "string") {
+    return compilePredicateV2({ expression, table, resolver, maxLinkDepth });
+  }
+  const defaultPred = compilePredicateV2({ expression: expression.default, table, resolver, maxLinkDepth });
+  if (expression.variants.length === 0) return defaultPred;
+  const branches = expression.variants.map((variant) => {
+    const parsedWhen = parsePolicy(variant.when);
+    assertClaimsOnlyWhen(parsedWhen);
+    const when = compilePredicateV2({ expression: parsedWhen, table, resolver, maxLinkDepth });
+    const grant = variant.allow === true ? { kind: "const", value: true } : compilePredicateV2({ expression: variant.policy, table, resolver, maxLinkDepth });
+    return { kind: "and", operands: [when, grant] };
+  });
+  return { kind: "or", operands: [defaultPred, ...branches] };
+}
+
+// src/compiler-gql/diagnostics.ts
+var DocumentCompileError = class extends Error {
+  constructor(message, code, candidates = []) {
+    super(candidates.length > 0 ? `${message} (candidates: ${candidates.join(", ")})` : message);
+    this.code = code;
+    this.candidates = candidates;
+  }
+  name = "DocumentCompileError";
+};
+var NamespaceCompileError = class extends Error {
+  constructor(diagnostics) {
+    const errors = diagnostics.filter((d) => d.severity === "error");
+    super(
+      `namespace compilation failed with ${errors.length} error${errors.length === 1 ? "" : "s"}:
+` + errors.map((d) => `  - [${d.code}] ${d.message}`).join("\n")
+    );
+    this.diagnostics = diagnostics;
+  }
+  name = "NamespaceCompileError";
+};
+
+// src/compiler-gql/pred-utils.ts
+var CONST_TRUE = { kind: "const", value: true };
+function andPred(...preds) {
+  const operands = preds.filter(
+    (pred) => pred !== void 0 && !(pred.kind === "const" && pred.value)
+  );
+  if (operands.length === 0) return CONST_TRUE;
+  if (operands.length === 1) return operands[0];
+  return { kind: "and", operands };
+}
+function walkPred(pred, visit) {
+  visit(pred);
+  switch (pred.kind) {
+    case "and":
+    case "or":
+      for (const operand of pred.operands) walkPred(operand, visit);
+      return;
+    case "not":
+      walkPred(pred.operand, visit);
+      return;
+    case "exists":
+      walkPred(pred.where, visit);
+      return;
+    case "aggPredicate":
+      if (pred.where) walkPred(pred.where, visit);
+      return;
+    default:
+      return;
+  }
+}
+function predContainsExists(pred) {
+  let found = false;
+  walkPred(pred, (node) => {
+    if (node.kind === "exists" || node.kind === "aggPredicate") found = true;
+  });
+  return found;
+}
+function predContains(haystack, needle) {
+  const needleJson = JSON.stringify(needle);
+  let found = false;
+  walkPred(haystack, (node) => {
+    if (!found && JSON.stringify(node) === needleJson) found = true;
+  });
+  return found;
+}
+
+// src/compiler-gql/inject.ts
+function collectPinnedColumns(writePolicy) {
+  const key = (pin) => `${pin.column}\0${pin.claim}`;
+  const visit = (node) => {
+    if (node.kind === "and") {
+      const merged = [];
+      const seen2 = /* @__PURE__ */ new Set();
+      for (const operand of node.operands) {
+        for (const pin of visit(operand)) {
+          if (seen2.has(key(pin))) continue;
+          seen2.add(key(pin));
+          merged.push(pin);
+        }
+      }
+      return merged;
+    }
+    if (node.kind === "or") {
+      const [first, ...rest] = node.operands;
+      if (first === void 0) return [];
+      let common = visit(first);
+      for (const operand of rest) {
+        const branch = new Set(visit(operand).map(key));
+        common = common.filter((pin) => branch.has(key(pin)));
+        if (common.length === 0) break;
+      }
+      return common;
+    }
+    if (node.kind === "cmp" && node.op === "eq" && node.value.kind === "claim") {
+      return [{ column: node.column, claim: node.value.key }];
+    }
+    return [];
+  };
+  const seen = /* @__PURE__ */ new Set();
+  return visit(writePolicy).filter((pin) => {
+    if (seen.has(pin.column)) return false;
+    seen.add(pin.column);
+    return true;
+  });
+}
+var PolicyInjector = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  read(table) {
+    return this.ctx.readPolicies.get(table) ?? { kind: "const", value: true };
+  }
+  write(table) {
+    return this.ctx.writePolicies.get(table) ?? { kind: "const", value: true };
+  }
+  linkTarget(table, link) {
+    const meta = this.ctx.tables[table];
+    const resolved = meta?.links.find((l) => l.name === link);
+    if (!resolved) throw new DocumentCompileError(`internal: unresolved link '${link}' on '${table}' during injection`, "internal");
+    return resolved.target;
+  }
+  /**
+   * Walk a DOCUMENT-authored predicate and AND the target read policy into
+   * every relationship traversal. Policy predicates themselves never pass
+   * through here — they are composed around the result, not rewritten.
+   */
+  injectDocPred(pred, table) {
+    switch (pred.kind) {
+      case "and":
+      case "or":
+        return { kind: pred.kind, operands: pred.operands.map((operand) => this.injectDocPred(operand, table)) };
+      case "not":
+        return { kind: "not", operand: this.injectDocPred(pred.operand, table) };
+      case "exists": {
+        const target = this.linkTarget(table, pred.link);
+        return { kind: "exists", link: pred.link, where: andPred(this.read(target), this.injectDocPred(pred.where, target)) };
+      }
+      case "aggPredicate": {
+        const target = this.linkTarget(table, pred.link);
+        const where = andPred(this.read(target), pred.where ? this.injectDocPred(pred.where, target) : void 0);
+        return { ...pred, where };
+      }
+      default:
+        return pred;
+    }
+  }
+  injectSelection(selection, table) {
+    return {
+      ...selection,
+      relations: selection.relations.map((relation) => {
+        const target = this.linkTarget(table, relation.link);
+        return {
+          ...relation,
+          selection: this.injectSelection(relation.selection, target),
+          where: andPred(this.read(target), relation.where ? this.injectDocPred(relation.where, target) : void 0)
+        };
+      }),
+      aggregates: selection.aggregates.map((aggregate) => {
+        const target = aggregate.link ? this.linkTarget(table, aggregate.link) : table;
+        return {
+          ...aggregate,
+          where: andPred(this.read(target), aggregate.where ? this.injectDocPred(aggregate.where, target) : void 0),
+          ...aggregate.nodes ? { nodes: this.injectSelection(aggregate.nodes, target) } : {}
+        };
+      })
+    };
+  }
+  injectRoot(root) {
+    switch (root.kind) {
+      case "select":
+        return {
+          ...root,
+          selection: this.injectSelection(root.selection, root.table),
+          where: andPred(this.read(root.table), this.injectDocPred(root.where, root.table))
+        };
+      case "byPk":
+        return {
+          ...root,
+          selection: this.injectSelection(root.selection, root.table),
+          where: andPred(this.read(root.table), this.injectDocPred(root.where, root.table))
+        };
+      case "aggregate":
+        return {
+          ...root,
+          where: andPred(this.read(root.table), this.injectDocPred(root.where, root.table)),
+          ...root.nodes ? { nodes: this.injectSelection(root.nodes, root.table) } : {}
+        };
+      case "mutation":
+        return this.injectMutation(root);
+      case "action":
+        return root;
+    }
+  }
+  injectMutation(root) {
+    const table = root.table;
+    const writePolicy = this.write(table);
+    const returning = root.returning ? this.injectSelection(root.returning, table) : root.returning;
+    if (root.op === "insert" || root.op === "insertOne") {
+      if (predContainsExists(writePolicy)) {
+        throw new DocumentCompileError(
+          `table '${table}' cannot be inserted into: v2.0 insert checks are claims + inserted-values only, but its write policy traverses a link (exists)`,
+          "insert-check-unrepresentable"
+        );
+      }
+      const pins = (this.ctx.pins.get(table) ?? []).map(
+        (pin) => ({ column: pin.column, value: { kind: "claim", key: pin.claim } })
+      );
+      return { ...root, pinnedColumns: pins, insertCheck: writePolicy, returning };
+    }
+    const where = andPred(writePolicy, root.where ? this.injectDocPred(root.where, table) : void 0);
+    if (root.op === "update" || root.op === "updateByPk") {
+      const check = predContainsExists(writePolicy) ? {} : { insertCheck: writePolicy };
+      return { ...root, where, ...check, returning };
+    }
+    return { ...root, where, returning };
+  }
+};
+function collectTableSet(roots, ctx) {
+  const tables = /* @__PURE__ */ new Set();
+  const linkTarget = (table, link) => ctx.tables[table]?.links.find((l) => l.name === link)?.target;
+  const visitPred = (pred, table) => {
+    switch (pred.kind) {
+      case "and":
+      case "or":
+        for (const operand of pred.operands) visitPred(operand, table);
+        return;
+      case "not":
+        visitPred(pred.operand, table);
+        return;
+      case "exists":
+      case "aggPredicate": {
+        const target = linkTarget(table, pred.link);
+        if (!target) return;
+        tables.add(target);
+        if (pred.kind === "exists") visitPred(pred.where, target);
+        else if (pred.where) visitPred(pred.where, target);
+        return;
+      }
+      default:
+        return;
+    }
+  };
+  const visitSelection = (selection, table) => {
+    for (const relation of selection.relations) {
+      const target = linkTarget(table, relation.link);
+      if (!target) continue;
+      tables.add(target);
+      if (relation.where) visitPred(relation.where, target);
+      visitSelection(relation.selection, target);
+    }
+    for (const aggregate of selection.aggregates) {
+      const target = aggregate.link ? linkTarget(table, aggregate.link) : table;
+      if (!target) continue;
+      tables.add(target);
+      if (aggregate.where) visitPred(aggregate.where, target);
+      if (aggregate.nodes) visitSelection(aggregate.nodes, target);
+    }
+  };
+  for (const root of roots) {
+    if (root.kind === "action") continue;
+    tables.add(root.table);
+    if (root.kind === "select" || root.kind === "byPk") {
+      visitPred(root.where, root.table);
+      visitSelection(root.selection, root.table);
+    }
+    if (root.kind === "aggregate") {
+      visitPred(root.where, root.table);
+      if (root.nodes) visitSelection(root.nodes, root.table);
+    }
+    if (root.kind === "mutation") {
+      if (root.where) visitPred(root.where, root.table);
+      if (root.insertCheck) visitPred(root.insertCheck, root.table);
+      if (root.returning) visitSelection(root.returning, root.table);
+    }
+  }
+  return [...tables].sort();
+}
+function injectPolicies({ roots, ctx }) {
+  const injector = new PolicyInjector(ctx);
+  const injected = roots.map((root) => injector.injectRoot(root));
+  return { roots: injected, tableSet: collectTableSet(injected, ctx) };
+}
+
+// src/sdl/naming.ts
+function camelCase(name) {
+  const segments = name.split("_").filter((segment) => segment.length > 0);
+  const first = segments[0];
+  if (first === void 0) return name;
+  const head = first.charAt(0).toLowerCase() + first.slice(1);
+  return head + segments.slice(1).map(capitalizeFirst).join("");
+}
+function pascalCase(name) {
+  return capitalizeFirst(camelCase(name));
+}
+function capitalizeFirst(segment) {
+  return segment.charAt(0).toUpperCase() + segment.slice(1);
+}
+function singularizeWord(word) {
+  if (word.endsWith("ies") && word.length > 3) return `${word.slice(0, -3)}y`;
+  for (const suffix of ["sses", "xes", "ches", "shes"]) {
+    if (word.endsWith(suffix)) return word.slice(0, -2);
+  }
+  if (word.endsWith("ss")) return word;
+  if (word.endsWith("s") && word.length > 1) return word.slice(0, -1);
+  return word;
+}
+function typeName(table) {
+  const segments = table.split("_").filter((segment) => segment.length > 0);
+  const last = segments[segments.length - 1];
+  if (last === void 0) return pascalCase(table);
+  return [...segments.slice(0, -1), singularizeWord(last)].map(capitalizeFirst).join("");
+}
+function enumTypeName(name) {
+  return pascalCase(name);
+}
+var SCALAR_FOR_COLUMN_TYPE = {
+  uuid: "uuid",
+  text: "String",
+  integer: "Int",
+  bigint: "bigint",
+  numeric: "numeric",
+  double: "Float",
+  boolean: "Boolean",
+  timestamptz: "timestamptz",
+  date: "date",
+  jsonb: "jsonb"
+};
+function graphqlScalarFor(type) {
+  return SCALAR_FOR_COLUMN_TYPE[type];
+}
+var COLUMN_TYPE_BY_SCALAR = new Map([
+  ["ID", "text"],
+  ...COLUMN_TYPES.map((type) => [graphqlScalarFor(type), type])
+]);
+function columnTypeForScalar(scalarName) {
+  return COLUMN_TYPE_BY_SCALAR.get(scalarName);
+}
+var VARIABLE_SCALAR_NAMES = [...COLUMN_TYPE_BY_SCALAR.keys()];
+var PLATFORM_USER_TYPENAME = "PlatformUser";
+function tableNames(table) {
+  const root = camelCase(table);
+  const rootPascal = pascalCase(table);
+  const type = typeName(table);
+  return {
+    typename: type,
+    selectRoot: root,
+    byPkRoot: `${root}ByPk`,
+    aggregateRoot: `${root}Aggregate`,
+    insertRoot: `insert${rootPascal}`,
+    insertOneRoot: `insert${rootPascal}One`,
+    updateRoot: `update${rootPascal}`,
+    updateByPkRoot: `update${rootPascal}ByPk`,
+    deleteRoot: `delete${rootPascal}`,
+    deleteByPkRoot: `delete${rootPascal}ByPk`,
+    boolExp: `${type}BoolExp`,
+    orderBy: `${type}OrderBy`,
+    selectColumn: `${type}SelectColumn`,
+    insertInput: `${type}InsertInput`,
+    setInput: `${type}SetInput`,
+    appendInput: `${type}AppendInput`,
+    incInput: `${type}IncInput`,
+    onConflict: `${type}OnConflict`,
+    pkColumnsInput: `${type}PkColumnsInput`,
+    constraintEnum: `${type}Constraint`,
+    updateColumnEnum: `${type}UpdateColumn`,
+    mutationResponse: `${type}MutationResponse`,
+    aggregate: `${type}Aggregate`,
+    aggregateFields: `${type}AggregateFields`,
+    sumFields: `${type}SumFields`,
+    avgFields: `${type}AvgFields`,
+    aggregateBoolExp: `${type}AggregateBoolExp`,
+    aggregateBoolExpCount: `${type}AggregateBoolExpCount`
+  };
+}
+
+// src/compiler-gql/naming.ts
+var PLATFORM_USER_TABLE = "platformUsers";
+function typeNameForTable(table) {
+  return table === PLATFORM_USER_TABLE ? PLATFORM_USER_TYPENAME : typeName(table);
+}
+function queryRootNames(table) {
+  const names = tableNames(table);
+  return { select: names.selectRoot, byPk: names.byPkRoot, aggregate: names.aggregateRoot };
+}
+function mutationRootNames(table) {
+  const names = tableNames(table);
+  return {
+    insert: names.insertRoot,
+    insertOne: names.insertOneRoot,
+    update: names.updateRoot,
+    updateByPk: names.updateByPkRoot,
+    delete: names.deleteRoot,
+    deleteByPk: names.deleteByPkRoot
+  };
+}
+var INPUT_TYPE_SUFFIXES = [
+  ["BoolExp", "boolExp"],
+  ["OrderBy", "orderBy"],
+  ["SelectColumn", "selectColumn"],
+  ["InsertInput", "insertInput"],
+  ["SetInput", "setInput"],
+  ["AppendInput", "appendInput"],
+  ["OnConflict", "onConflict"]
+];
+var NAME_KEY_BY_KIND = {
+  boolExp: "boolExp",
+  orderBy: "orderBy",
+  selectColumn: "selectColumn",
+  insertInput: "insertInput",
+  setInput: "setInput",
+  appendInput: "appendInput",
+  onConflict: "onConflict"
+};
+function inputTypeName(table, kind) {
+  return tableNames(table)[NAME_KEY_BY_KIND[kind]];
+}
+function classifyInputType(name, tableByTypename) {
+  for (const [suffix, input] of INPUT_TYPE_SUFFIXES) {
+    if (!name.endsWith(suffix) || name.length <= suffix.length) continue;
+    const table = tableByTypename.get(name.slice(0, -suffix.length));
+    if (table !== void 0) return { input, table };
+  }
+  return void 0;
+}
+
+// src/compiler-gql/context.ts
+function platformUserMeta() {
+  const columns = [
+    // `sub` is the view's key (auth0_id, filtered NOT NULL in the view).
+    { name: "sub", columnName: "sub", type: "text", nullable: false },
+    { name: "email", columnName: "email", type: "text", nullable: true },
+    { name: "name", columnName: "name", type: "text", nullable: true },
+    { name: "organization", columnName: "organization", type: "text", nullable: true },
+    { name: "role", columnName: "role", type: "text", nullable: true },
+    { name: "managerId", columnName: "manager_id", type: "text", nullable: true },
+    // NOT NULL DEFAULT true on chat.users, so non-null through the view.
+    { name: "accountEnabled", columnName: "account_enabled", type: "boolean", nullable: false }
+  ];
+  return {
+    table: "users_directory",
+    schema: "platform",
+    typename: PLATFORM_USER_TYPENAME,
+    columns: columns.map((c) => ({ ...c })),
+    primaryKey: ["sub"],
+    links: [],
+    filterable: columns.map((c) => c.name),
+    orderable: columns.map((c) => c.name),
+    insertable: [],
+    settable: [],
+    appendable: [],
+    constraints: [],
+    dynamicFilterMaxDepth: 6,
+    dynamicFilterMaxNodes: 64
+  };
+}
+function resolveColumnEntries(table, enums, diagnostics) {
+  return table.columns.map((column) => {
+    let type;
+    if (typeof column.type === "string") {
+      type = column.type;
+    } else {
+      const enumDef = enums.get(column.type.enum);
+      if (!enumDef) {
+        diagnostics.push({
+          severity: "error",
+          code: "unknown-enum",
+          message: `column '${column.name}' on table '${table.table}' references undeclared enum '${column.type.enum}'`,
+          table: table.table
+        });
+        type = "text";
+      } else {
+        type = { enum: enumDef.name, values: [...enumDef.values] };
+      }
+    }
+    return { name: column.name, columnName: column.columnName, type, nullable: column.nullable, deprecated: column.deprecated };
+  });
+}
+function logicalColumn(entries, ref) {
+  return entries.find((c) => c.name === ref || c.columnName === ref)?.name;
+}
+function buildCompileContext(rawCanonical) {
+  const canonical = normalizeCanonical(canonicalDefinitionSchema.parse(rawCanonical));
+  const diagnostics = [];
+  const enums = new Map(canonical.enums.map((e) => [e.name, e]));
+  const columnEntries = /* @__PURE__ */ new Map();
+  const tables = {};
+  const usesPlatformUsers = canonical.tables.some((t) => t.links.some((l) => l.kind === "toPlatformUser"));
+  const platformMeta = usesPlatformUsers ? platformUserMeta() : void 0;
+  if (platformMeta) tables[PLATFORM_USER_TABLE] = platformMeta;
+  for (const table of canonical.tables) {
+    const entries = resolveColumnEntries(table, enums, diagnostics);
+    columnEntries.set(table.table, entries);
+    const pkRefs = table.primaryKey ?? ["id"];
+    const primaryKey = [];
+    for (const ref of pkRefs) {
+      const resolved = logicalColumn(entries, ref);
+      if (!resolved) {
+        diagnostics.push({
+          severity: "error",
+          code: "unknown-pk-column",
+          message: `primary key column '${ref}' does not exist on table '${table.table}'`,
+          table: table.table
+        });
+        continue;
+      }
+      primaryKey.push(resolved);
+    }
+    const active = entries.filter((c) => !c.deprecated);
+    const constraints = [];
+    if (primaryKey.length > 0) constraints.push({ name: `${table.table}_pkey`, columns: [...primaryKey] });
+    for (const column of table.columns) {
+      if (column.unique) {
+        const logical = logicalColumn(entries, column.columnName);
+        constraints.push({ name: `${table.table}_${column.columnName}_key`, columns: [logical] });
+      }
+    }
+    for (const index of table.indexes) {
+      if (!index.unique) continue;
+      const logicalCols = index.columns.map((ref) => logicalColumn(entries, ref)).filter((c) => !!c);
+      constraints.push({ name: index.name ?? `${table.table}_${index.columns.join("_")}_key`, columns: logicalCols });
+    }
+    tables[table.table] = {
+      table: table.table,
+      schema: ormSchemaName(canonical.namespace),
+      typename: typeNameForTable(table.table),
+      columns: entries.map(({ deprecated: _deprecated, ...column }) => column),
+      primaryKey: primaryKey.length > 0 ? primaryKey : ["id"],
+      links: [],
+      filterable: entries.map((c) => c.name),
+      orderable: entries.filter((c) => c.type !== "jsonb").map((c) => c.name),
+      insertable: active.map((c) => c.name),
+      settable: active.map((c) => c.name),
+      appendable: active.filter((c) => c.type === "jsonb").map((c) => c.name),
+      constraints,
+      dynamicFilterMaxDepth: 6,
+      dynamicFilterMaxNodes: 64
+    };
+  }
+  for (const table of canonical.tables) {
+    const meta = tables[table.table];
+    const entries = columnEntries.get(table.table);
+    for (const link of table.links) {
+      const targetName = link.kind === "toPlatformUser" ? PLATFORM_USER_TABLE : link.target;
+      const target = targetName === void 0 ? void 0 : tables[targetName];
+      if (!targetName || !target) {
+        diagnostics.push({
+          severity: "error",
+          code: "unknown-link-target",
+          message: `link '${link.name}' on table '${table.table}' targets unknown table '${targetName ?? "(none)"}'`,
+          table: table.table
+        });
+        continue;
+      }
+      const targetEntries = targetName === PLATFORM_USER_TABLE ? target.columns.map((c) => ({ ...c, deprecated: false })) : columnEntries.get(targetName);
+      const onEntries = link.kind === "toMany" ? targetEntries : entries;
+      const referencesEntries = link.kind === "toMany" ? entries : targetEntries;
+      const on = logicalColumn(onEntries, link.on);
+      const defaultReferences = link.kind === "toPlatformUser" ? "sub" : link.kind === "toMany" ? meta.primaryKey[0] : target.primaryKey[0];
+      const references = link.references ? logicalColumn(referencesEntries, link.references) : defaultReferences;
+      if (!on || !references) {
+        diagnostics.push({
+          severity: "error",
+          code: "unknown-link-column",
+          message: `link '${link.name}' on table '${table.table}' references unknown column '${!on ? link.on : link.references}'`,
+          table: table.table
+        });
+        continue;
+      }
+      meta.links.push({ name: link.name, kind: link.kind, target: targetName, on, references });
+    }
+  }
+  const readPolicies = /* @__PURE__ */ new Map();
+  const writePolicies = /* @__PURE__ */ new Map();
+  const pins = /* @__PURE__ */ new Map();
+  const resolver = { tables };
+  for (const table of canonical.tables) {
+    for (const [access, store] of [
+      ["read", readPolicies],
+      ["write", writePolicies]
+    ]) {
+      const expression = table.policies[access];
+      if (expression === void 0) {
+        store.set(table.table, CONST_TRUE);
+        continue;
+      }
+      try {
+        store.set(table.table, compilePolicy({ expression, table: table.table, resolver }));
+      } catch (error) {
+        if (error instanceof PolicyCompileError || error instanceof PolicyParseError) {
+          diagnostics.push({
+            severity: "error",
+            code: error instanceof PolicyCompileError ? error.code : "policy-parse-error",
+            message: `${access} policy on table '${table.table}': ${error.message}`,
+            table: table.table
+          });
+          store.set(table.table, CONST_TRUE);
+          continue;
+        }
+        throw error;
+      }
+    }
+    const tablePins = collectPinnedColumns(writePolicies.get(table.table));
+    pins.set(table.table, tablePins);
+    const pinned = new Set(tablePins.map((pin) => pin.column));
+    const meta = tables[table.table];
+    meta.insertable = meta.insertable.filter((column) => !pinned.has(column));
+    meta.settable = meta.settable.filter((column) => !pinned.has(column));
+  }
+  if (platformMeta) {
+    readPolicies.set(PLATFORM_USER_TABLE, CONST_TRUE);
+    writePolicies.set(PLATFORM_USER_TABLE, { kind: "const", value: false });
+    pins.set(PLATFORM_USER_TABLE, []);
+  }
+  const tableByTypename = new Map(Object.entries(tables).map(([key, meta]) => [meta.typename, key]));
+  const queryRoots = /* @__PURE__ */ new Map();
+  const mutationRoots = /* @__PURE__ */ new Map();
+  for (const table of canonical.tables) {
+    const roots = queryRootNames(table.table);
+    queryRoots.set(roots.select, { kind: "select", table: table.table });
+    queryRoots.set(roots.byPk, { kind: "byPk", table: table.table });
+    queryRoots.set(roots.aggregate, { kind: "aggregate", table: table.table });
+    if (table.source === void 0) {
+      for (const [op, field] of Object.entries(mutationRootNames(table.table))) {
+        mutationRoots.set(field, { op, table: table.table });
+      }
+    }
+  }
+  const enumsByTypeName = new Map(canonical.enums.map((e) => [enumTypeName(e.name), e]));
+  return {
+    ctx: {
+      namespace: canonical.namespace,
+      tables,
+      tableByTypename,
+      queryRoots,
+      mutationRoots,
+      enumsByTypeName,
+      readPolicies,
+      writePolicies,
+      pins
+    },
+    diagnostics
+  };
+}
+function flattenSelectionSet(selectionSet, fragments, stack) {
+  const selections = [];
+  for (const selection of selectionSet.selections) {
+    if (selection.kind === graphql.Kind.FIELD) {
+      selections.push(
+        selection.selectionSet ? { ...selection, selectionSet: flattenSelectionSet(selection.selectionSet, fragments, stack) } : selection
+      );
+      continue;
+    }
+    if (selection.kind === graphql.Kind.FRAGMENT_SPREAD) {
+      const name = selection.name.value;
+      if (selection.directives && selection.directives.length > 0) {
+        throw new DocumentCompileError(`directives on fragment spread '...${name}' are not supported`, "fragment-directive");
+      }
+      if (stack.includes(name)) {
+        throw new DocumentCompileError(`fragment cycle detected through '${name}'`, "fragment-cycle");
+      }
+      const fragment = fragments.get(name);
+      if (!fragment) {
+        throw new DocumentCompileError(`unknown fragment '${name}'`, "unknown-fragment");
+      }
+      const inlined2 = flattenSelectionSet(fragment.selectionSet, fragments, [...stack, name]);
+      selections.push(...inlined2.selections);
+      continue;
+    }
+    if (selection.directives && selection.directives.length > 0) {
+      throw new DocumentCompileError("directives on inline fragments are not supported", "fragment-directive");
+    }
+    const inlined = flattenSelectionSet(selection.selectionSet, fragments, stack);
+    selections.push(...inlined.selections);
+  }
+  return { ...selectionSet, selections };
+}
+function flattenOperation({
+  operation,
+  fragments
+}) {
+  return { ...operation, selectionSet: flattenSelectionSet(operation.selectionSet, fragments, []) };
+}
+var COMPILER_MAJOR = 1;
+var OP_HASH_DOMAIN = "sequence-orm-op\0";
+var OPS_HASH_DOMAIN = "sequence-orm-opset\0";
+function canonicalOperationText(definition) {
+  const document = { kind: graphql.Kind.DOCUMENT, definitions: [definition] };
+  return graphql.print(document);
+}
+function computeOpHash({
+  definition,
+  schemaHash
+}) {
+  const digest = crypto.createHash("sha256").update(OP_HASH_DOMAIN).update(`${COMPILER_MAJOR}\0${schemaHash}\0`).update(canonicalOperationText(definition)).digest("hex");
+  return `sha256:${digest}`;
+}
+function computeOpsHash(opHashes) {
+  const digest = crypto.createHash("sha256").update(OPS_HASH_DOMAIN).update([...opHashes].sort().join("\n")).digest("hex");
+  return `sha256:${digest}`;
+}
+var DEFAULT_LIMIT = 100;
+var MAX_LIMIT = 1e3;
+var BOOLEXP_OPS = {
+  _eq: "eq",
+  _neq: "neq",
+  _gt: "gt",
+  _gte: "gte",
+  _lt: "lt",
+  _lte: "lte",
+  _in: "in",
+  _nin: "nin",
+  _like: "like",
+  _ilike: "ilike",
+  _isNull: "isNull",
+  _contains: "contains",
+  _hasKey: "hasKey"
+};
+var AGG_PREDICATE_OPS = ["_eq", "_neq", "_gt", "_gte", "_lt", "_lte"];
+var ORDER_DIRECTIONS = {
+  ASC: { direction: "asc" },
+  DESC: { direction: "desc" },
+  ASC_NULLS_FIRST: { direction: "asc", nulls: "first" },
+  ASC_NULLS_LAST: { direction: "asc", nulls: "last" },
+  DESC_NULLS_FIRST: { direction: "desc", nulls: "first" },
+  DESC_NULLS_LAST: { direction: "desc", nulls: "last" }
+};
+var NUMERIC_TYPES = /* @__PURE__ */ new Set(["integer", "bigint", "numeric", "double"]);
+function fail(message, code, candidates = []) {
+  throw new DocumentCompileError(message, code, candidates);
+}
+function argsByName(field) {
+  return new Map((field.arguments ?? []).map((arg) => [arg.name.value, arg]));
+}
+function assertKnownArgs(field, allowed) {
+  for (const arg of field.arguments ?? []) {
+    if (!allowed.includes(arg.name.value)) {
+      fail(`argument '${arg.name.value}' on '${field.name.value}' is not supported in v2.0`, "unsupported-argument", allowed);
+    }
+  }
+}
+var OperationLowerer = class {
+  constructor(ctx, restricted) {
+    this.ctx = ctx;
+    this.variables = new Map(restricted.variables.map((v) => [v.name, v]));
+  }
+  variables;
+  meta(table) {
+    return this.ctx.tables[table];
+  }
+  column(table, name) {
+    return this.meta(table).columns.find((c) => c.name === name);
+  }
+  link(table, name) {
+    return this.meta(table).links.find((l) => l.name === name);
+  }
+  fieldCandidates(table) {
+    const meta = this.meta(table);
+    return [
+      ...meta.columns.map((c) => c.name),
+      ...meta.links.map((l) => l.name),
+      ...meta.links.filter((l) => l.kind === "toMany").map((l) => `${l.name}Aggregate`)
+    ];
+  }
+  /** Validate that a whole-variable argument is the declared §4f slot for this table. */
+  slot(name, input, table) {
+    const variable = this.variables.get(name);
+    if (!variable || variable.type.kind !== "inputRef" || variable.type.input !== input || variable.type.table !== table) {
+      fail(`variable $${name} must be declared as the ${input} input type for table '${table}'`, "slot-mismatch");
+    }
+    return name;
+  }
+  // -------------------------------------------------------------------------
+  // Values
+  // -------------------------------------------------------------------------
+  lowerValue(node) {
+    switch (node.kind) {
+      case graphql.Kind.VARIABLE:
+        return { kind: "variable", name: node.name.value };
+      case graphql.Kind.INT:
+      case graphql.Kind.FLOAT:
+        return { kind: "literal", value: Number(node.value) };
+      case graphql.Kind.STRING:
+      case graphql.Kind.ENUM:
+        return { kind: "literal", value: node.value };
+      case graphql.Kind.BOOLEAN:
+        return { kind: "literal", value: node.value };
+      case graphql.Kind.NULL:
+        return { kind: "literal", value: null };
+      case graphql.Kind.LIST: {
+        const items = node.values.map((item) => {
+          const lowered = this.lowerValue(item);
+          if (lowered.kind !== "literal" || Array.isArray(lowered.value)) {
+            fail("list literals must contain scalar literals only \u2014 pass the whole list as a variable instead", "unsupported-literal");
+          }
+          return lowered.value;
+        });
+        return { kind: "literal", value: items };
+      }
+      case graphql.Kind.OBJECT:
+        fail("literal JSON objects are not supported in documents \u2014 pass the value via a variable", "unsupported-literal");
+    }
+  }
+  // -------------------------------------------------------------------------
+  // BoolExp / orderBy / distinctOn / paging
+  // -------------------------------------------------------------------------
+  lowerBoolExp(node, table) {
+    if (node.kind === graphql.Kind.VARIABLE) {
+      return { kind: "dynamicFilter", slot: this.slot(node.name.value, "boolExp", table) };
+    }
+    if (node.kind !== graphql.Kind.OBJECT) fail(`a boolean expression on '${table}' must be an object or a variable`, "invalid-boolexp");
+    const operands = [];
+    for (const field of node.fields) {
+      const key = field.name.value;
+      if (key === "_and" || key === "_or") {
+        const children = field.value.kind === graphql.Kind.LIST ? field.value.values : [field.value];
+        const lowered = children.map((child) => this.lowerBoolExp(child, table));
+        if (lowered.length > 0) operands.push(lowered.length === 1 ? lowered[0] : { kind: key === "_and" ? "and" : "or", operands: lowered });
+        continue;
+      }
+      if (key === "_not") {
+        operands.push({ kind: "not", operand: this.lowerBoolExp(field.value, table) });
+        continue;
+      }
+      const column = this.column(table, key);
+      if (column) {
+        operands.push(...this.lowerComparison(field.value, key, table));
+        continue;
+      }
+      const link = this.link(table, key);
+      if (link) {
+        operands.push({ kind: "exists", link: link.name, where: this.lowerBoolExp(field.value, link.target) });
+        continue;
+      }
+      if (key.endsWith("Aggregate")) {
+        const aggLink = this.link(table, key.slice(0, -"Aggregate".length));
+        if (aggLink && aggLink.kind === "toMany") {
+          operands.push(this.lowerAggPredicate(field.value, aggLink.name, aggLink.target));
+          continue;
+        }
+      }
+      fail(`unknown field '${key}' in a boolean expression on '${table}'`, "unknown-column", this.fieldCandidates(table));
+    }
+    if (operands.length === 0) return CONST_TRUE;
+    return operands.length === 1 ? operands[0] : { kind: "and", operands };
+  }
+  lowerComparison(node, column, table) {
+    if (node.kind !== graphql.Kind.OBJECT) {
+      fail(`comparison on '${table}.${column}' must be an object like { _eq: \u2026 }`, "invalid-comparison", Object.keys(BOOLEXP_OPS));
+    }
+    return node.fields.map((field) => {
+      const op = BOOLEXP_OPS[field.name.value];
+      if (!op) {
+        fail(`unknown comparison operator '${field.name.value}' on '${table}.${column}'`, "unknown-operator", Object.keys(BOOLEXP_OPS));
+      }
+      return { kind: "cmp", op, column, value: this.lowerValue(field.value) };
+    });
+  }
+  /** Hasura aggregation predicate: `{ count: { predicate: { _gt: 2 }, filter: {…} } }`. */
+  lowerAggPredicate(node, link, target) {
+    if (node.kind !== graphql.Kind.OBJECT) fail(`aggregate predicate through '${link}' must be an object`, "invalid-agg-predicate");
+    const countField = node.fields.find((f) => f.name.value === "count");
+    if (!countField || node.fields.length !== 1) {
+      fail(`aggregate predicates support { count: \u2026 } only in v2.0 (through '${link}')`, "invalid-agg-predicate", ["count"]);
+    }
+    if (countField.value.kind !== graphql.Kind.OBJECT) fail(`count predicate through '${link}' must be an object`, "invalid-agg-predicate");
+    let predicate;
+    let where;
+    for (const field of countField.value.fields) {
+      if (field.name.value === "predicate") {
+        if (field.value.kind !== graphql.Kind.OBJECT || field.value.fields.length !== 1) {
+          fail(`count predicate through '${link}' needs exactly one operator`, "invalid-agg-predicate", [...AGG_PREDICATE_OPS]);
+        }
+        const opField = field.value.fields[0];
+        const opName = opField.name.value;
+        if (!AGG_PREDICATE_OPS.includes(opName)) {
+          fail(`aggregate count predicates support ${AGG_PREDICATE_OPS.join("/")} only, got '${opName}'`, "invalid-agg-predicate");
+        }
+        if (opField.value.kind !== graphql.Kind.INT) {
+          fail(`aggregate count predicate value must be an integer literal`, "invalid-agg-predicate");
+        }
+        predicate = { op: opName.slice(1), value: Number(opField.value.value) };
+        continue;
+      }
+      if (field.name.value === "filter") {
+        where = this.lowerBoolExp(field.value, target);
+        continue;
+      }
+      fail(`unknown key '${field.name.value}' in a count predicate`, "invalid-agg-predicate", ["predicate", "filter"]);
+    }
+    if (!predicate) fail(`count predicate through '${link}' needs a { predicate: { _gt: n } }`, "invalid-agg-predicate");
+    return { kind: "aggPredicate", link, fn: "count", op: predicate.op, value: predicate.value, ...where ? { where } : {} };
+  }
+  lowerOrderBy(node, table) {
+    if (node.kind === graphql.Kind.VARIABLE) {
+      return [{ kind: "dynamic", slot: this.slot(node.name.value, "orderBy", table) }];
+    }
+    const items = node.kind === graphql.Kind.LIST ? node.values : [node];
+    const lowered = [];
+    for (const item of items) {
+      if (item.kind !== graphql.Kind.OBJECT) fail(`orderBy entries on '${table}' must be objects`, "invalid-orderby");
+      for (const field of item.fields) {
+        const key = field.name.value;
+        const column = this.column(table, key);
+        if (column) {
+          lowered.push({ kind: "column", column: key, ...this.lowerDirection(field.value, table, key) });
+          continue;
+        }
+        const link = this.link(table, key);
+        if (link && link.kind !== "toMany") {
+          if (field.value.kind !== graphql.Kind.OBJECT || field.value.fields.length !== 1) {
+            fail(`orderBy through '${key}' needs exactly one target column`, "invalid-orderby");
+          }
+          const inner = field.value.fields[0];
+          const targetColumn = this.column(link.target, inner.name.value);
+          if (!targetColumn) {
+            fail(`unknown column '${inner.name.value}' on '${link.target}' in orderBy`, "unknown-column", this.meta(link.target).columns.map((c) => c.name));
+          }
+          lowered.push({ kind: "column", column: inner.name.value, link: key, ...this.lowerDirection(inner.value, link.target, inner.name.value) });
+          continue;
+        }
+        fail(`unknown orderBy key '${key}' on '${table}' (to-one links only)`, "invalid-orderby", this.fieldCandidates(table));
+      }
+    }
+    return lowered;
+  }
+  lowerDirection(node, table, column) {
+    if (node.kind !== graphql.Kind.ENUM) fail(`orderBy direction on '${table}.${column}' must be a direction enum`, "invalid-orderby", Object.keys(ORDER_DIRECTIONS));
+    const direction = ORDER_DIRECTIONS[node.value];
+    if (!direction) fail(`unknown orderBy direction '${node.value}'`, "invalid-orderby", Object.keys(ORDER_DIRECTIONS));
+    return direction.nulls ? { direction: direction.direction, nulls: direction.nulls } : { direction: direction.direction };
+  }
+  lowerDistinctOn(node, table) {
+    if (node.kind === graphql.Kind.VARIABLE) {
+      return { slot: this.slot(node.name.value, "selectColumn", table) };
+    }
+    const items = node.kind === graphql.Kind.LIST ? node.values : [node];
+    return items.map((item) => {
+      if (item.kind !== graphql.Kind.ENUM) fail(`distinctOn entries on '${table}' must be select-column enum values`, "invalid-distinct-on");
+      if (!this.column(table, item.value)) {
+        fail(`unknown distinctOn column '${item.value}' on '${table}'`, "unknown-column", this.meta(table).columns.map((c) => c.name));
+      }
+      return item.value;
+    });
+  }
+  lowerLimit(node) {
+    const base = { default: DEFAULT_LIMIT, max: MAX_LIMIT };
+    if (!node) return base;
+    if (node.kind === graphql.Kind.VARIABLE) return { ...base, variable: node.name.value };
+    if (node.kind === graphql.Kind.INT) {
+      const value = Number(node.value);
+      if (value < 1) fail("limit must be a positive integer", "invalid-limit");
+      return { ...base, value: Math.min(value, MAX_LIMIT) };
+    }
+    fail("limit must be an integer literal or a variable", "invalid-limit");
+  }
+  lowerOffset(node) {
+    if (!node) return void 0;
+    if (node.kind === graphql.Kind.VARIABLE) return { variable: node.name.value };
+    if (node.kind === graphql.Kind.INT) return { value: Number(node.value) };
+    fail("offset must be an integer literal or a variable", "invalid-offset");
+  }
+  // -------------------------------------------------------------------------
+  // Selections
+  // -------------------------------------------------------------------------
+  lowerSelection(selectionSet, table) {
+    const meta = this.meta(table);
+    const selection = { typename: meta.typename, columns: [], relations: [], aggregates: [] };
+    for (const node of selectionSet.selections) {
+      if (node.kind !== graphql.Kind.FIELD) fail("fragments must be flattened before lowering", "internal");
+      if (node.directives && node.directives.length > 0) {
+        fail(`@include/@skip are supported on root fields only ('${node.name.value}' is nested)`, "nested-directive");
+      }
+      const name = node.name.value;
+      if (name === "__typename") continue;
+      const alias = node.alias?.value ?? name;
+      const column = this.column(table, name);
+      if (column) {
+        if (node.arguments !== void 0 && node.arguments.length > 0 || node.selectionSet !== void 0) {
+          fail(`column '${table}.${name}' takes no arguments or sub-selection`, "invalid-selection");
+        }
+        selection.columns.push({ alias, column: name });
+        continue;
+      }
+      const link = this.link(table, name);
+      if (link) {
+        if (!node.selectionSet) fail(`link '${table}.${name}' needs a selection set`, "invalid-selection");
+        const relation = {
+          alias,
+          link: name,
+          selection: this.lowerSelection(node.selectionSet, link.target)
+        };
+        if (link.kind === "toMany") {
+          assertKnownArgs(node, ["where", "orderBy", "limit", "offset"]);
+          const args = argsByName(node);
+          const where = args.get("where");
+          if (where) relation.where = this.lowerBoolExp(where.value, link.target);
+          const orderBy = args.get("orderBy");
+          if (orderBy) relation.orderBy = this.lowerOrderBy(orderBy.value, link.target);
+          if (args.get("limit") ?? args.get("offset")) {
+            relation.limit = this.lowerLimit(args.get("limit")?.value);
+            const offset = this.lowerOffset(args.get("offset")?.value);
+            if (offset) relation.offset = offset;
+          }
+        } else if (node.arguments && node.arguments.length > 0) {
+          fail(`to-one link '${table}.${name}' takes no arguments`, "invalid-selection");
+        }
+        selection.relations.push(relation);
+        continue;
+      }
+      if (name.endsWith("Aggregate")) {
+        const aggLink = this.link(table, name.slice(0, -"Aggregate".length));
+        if (aggLink && aggLink.kind === "toMany") {
+          if (!node.selectionSet) fail(`'${name}' needs a selection set`, "invalid-selection");
+          assertKnownArgs(node, ["where"]);
+          const whereArg = argsByName(node).get("where");
+          const aggregate = this.lowerAggregateSelection(node.selectionSet, aggLink.target);
+          selection.aggregates.push({
+            alias,
+            link: aggLink.name,
+            ...whereArg ? { where: this.lowerBoolExp(whereArg.value, aggLink.target) } : {},
+            ...aggregate
+          });
+          continue;
+        }
+      }
+      fail(`unknown field '${name}' on '${table}'`, "unknown-field", this.fieldCandidates(table));
+    }
+    return selection;
+  }
+  /** The `{ aggregate { count sum {…} avg {…} } nodes {…} }` block shared by roots and relations. */
+  lowerAggregateSelection(selectionSet, table) {
+    const result = {};
+    let sawAggregate = false;
+    for (const node of selectionSet.selections) {
+      if (node.kind !== graphql.Kind.FIELD) fail("fragments must be flattened before lowering", "internal");
+      const name = node.name.value;
+      if (name === "__typename") continue;
+      if (node.alias) fail(`aliases are not supported inside aggregate blocks ('${node.alias.value}')`, "invalid-aggregate");
+      if (name === "nodes") {
+        if (!node.selectionSet) fail("'nodes' needs a selection set", "invalid-aggregate");
+        result.nodes = this.lowerSelection(node.selectionSet, table);
+        continue;
+      }
+      if (name !== "aggregate") fail(`unknown aggregate field '${name}'`, "invalid-aggregate", ["aggregate", "nodes"]);
+      if (sawAggregate) fail("one aggregate block per field \u2014 alias the root instead", "invalid-aggregate");
+      sawAggregate = true;
+      if (!node.selectionSet) fail("'aggregate' needs a selection set", "invalid-aggregate");
+      for (const aggField of node.selectionSet.selections) {
+        if (aggField.kind !== graphql.Kind.FIELD) fail("fragments must be flattened before lowering", "internal");
+        const aggName = aggField.name.value;
+        if (aggName === "__typename") continue;
+        if (aggField.alias) fail(`aliases are not supported inside aggregate blocks ('${aggField.alias.value}')`, "invalid-aggregate");
+        if (aggName === "count") {
+          assertKnownArgs(aggField, ["columns", "distinct"]);
+          const args = argsByName(aggField);
+          const count = {};
+          const columns = args.get("columns");
+          if (columns) count.columns = this.lowerDistinctOn(columns.value, table);
+          const distinct = args.get("distinct");
+          if (distinct) {
+            if (distinct.value.kind !== graphql.Kind.BOOLEAN) fail("count(distinct:) must be a boolean literal", "invalid-aggregate");
+            count.distinct = distinct.value.value;
+          }
+          result.count = count;
+          continue;
+        }
+        if (aggName === "sum" || aggName === "avg") {
+          if (!aggField.selectionSet) fail(`'${aggName}' needs a column selection`, "invalid-aggregate");
+          const columns = [];
+          for (const columnField of aggField.selectionSet.selections) {
+            if (columnField.kind !== graphql.Kind.FIELD) fail("fragments must be flattened before lowering", "internal");
+            if (columnField.name.value === "__typename") continue;
+            const column = this.column(table, columnField.name.value);
+            if (!column || typeof column.type !== "string" || !NUMERIC_TYPES.has(column.type)) {
+              fail(
+                `'${aggName}' supports numeric columns only, got '${columnField.name.value}' on '${table}'`,
+                "invalid-aggregate",
+                this.meta(table).columns.filter((c) => typeof c.type === "string" && NUMERIC_TYPES.has(c.type)).map((c) => c.name)
+              );
+            }
+            columns.push(columnField.name.value);
+          }
+          result[aggName] = columns;
+          continue;
+        }
+        fail(`aggregate '${aggName}' is not supported in v2.0 (count/sum/avg only)`, "invalid-aggregate", ["count", "sum", "avg"]);
+      }
+    }
+    if (!sawAggregate && !result.nodes) fail("aggregate selection needs an aggregate or nodes block", "invalid-aggregate");
+    return result;
+  }
+  // -------------------------------------------------------------------------
+  // Roots
+  // -------------------------------------------------------------------------
+  lowerRoots(operation, kind) {
+    const roots = [];
+    for (const node of operation.selectionSet.selections) {
+      if (node.kind !== graphql.Kind.FIELD) fail("fragments are not supported at the operation root", "invalid-root");
+      const gate = this.parseRootDirectives(node);
+      if (gate.omit) continue;
+      const root = kind === "query" ? this.lowerQueryRoot(node) : this.lowerMutationRoot(node);
+      roots.push(gate.includeIf ? { ...root, includeIf: gate.includeIf } : root);
+    }
+    if (roots.length === 0) fail("operation has no roots (all statically skipped?)", "invalid-root");
+    return roots;
+  }
+  parseRootDirectives(node) {
+    let includeIf;
+    let omit = false;
+    for (const directive of node.directives ?? []) {
+      const name = directive.name.value;
+      if (name !== "include" && name !== "skip") {
+        fail(`directive @${name} is not supported on fields`, "unknown-directive", ["include", "skip"]);
+      }
+      const ifArg = directive.arguments?.find((a) => a.name.value === "if");
+      if (!ifArg) fail(`@${name} needs an if: argument`, "invalid-directive");
+      if (ifArg.value.kind === graphql.Kind.BOOLEAN) {
+        const keep = name === "include" ? ifArg.value.value : !ifArg.value.value;
+        if (!keep) omit = true;
+        continue;
+      }
+      if (ifArg.value.kind !== graphql.Kind.VARIABLE) fail(`@${name}(if:) must be a boolean literal or variable`, "invalid-directive");
+      if (includeIf) fail("at most one of @include/@skip per root field", "invalid-directive");
+      includeIf = { variable: ifArg.value.name.value, negated: name === "skip" };
+    }
+    return omit ? { omit: true } : { includeIf, omit: false };
+  }
+  lowerQueryRoot(node) {
+    const name = node.name.value;
+    const alias = node.alias?.value ?? name;
+    const rootInfo = this.ctx.queryRoots.get(name);
+    if (!rootInfo) fail(`unknown query root '${name}'`, "unknown-root", [...this.ctx.queryRoots.keys()]);
+    const { table } = rootInfo;
+    const args = argsByName(node);
+    if (rootInfo.kind === "select") {
+      assertKnownArgs(node, ["where", "orderBy", "distinctOn", "limit", "offset"]);
+      if (!node.selectionSet) fail(`'${name}' needs a selection set`, "invalid-selection");
+      const where = args.get("where");
+      const orderBy = args.get("orderBy");
+      const distinctOn = args.get("distinctOn");
+      const offset = this.lowerOffset(args.get("offset")?.value);
+      const distinct = distinctOn ? this.lowerDistinctOn(distinctOn.value, table) : void 0;
+      return {
+        kind: "select",
+        alias,
+        table,
+        selection: this.lowerSelection(node.selectionSet, table),
+        where: where ? this.lowerBoolExp(where.value, table) : CONST_TRUE,
+        orderBy: orderBy ? this.lowerOrderBy(orderBy.value, table) : [],
+        ...distinct ? { distinctOn: distinct } : {},
+        limit: this.lowerLimit(args.get("limit")?.value),
+        ...offset ? { offset } : {}
+      };
+    }
+    if (rootInfo.kind === "byPk") {
+      if (!node.selectionSet) fail(`'${name}' needs a selection set`, "invalid-selection");
+      const pk = this.lowerPkArgs(node, table);
+      return { kind: "byPk", alias, table, selection: this.lowerSelection(node.selectionSet, table), pk, where: CONST_TRUE };
+    }
+    assertKnownArgs(node, ["where"]);
+    if (!node.selectionSet) fail(`'${name}' needs a selection set`, "invalid-selection");
+    const whereArg = args.get("where");
+    const aggregate = this.lowerAggregateSelection(node.selectionSet, table);
+    return {
+      kind: "aggregate",
+      alias,
+      table,
+      where: whereArg ? this.lowerBoolExp(whereArg.value, table) : CONST_TRUE,
+      ...aggregate
+    };
+  }
+  /** byPk-style pk arguments: one argument per primary-key column, exactly. */
+  lowerPkArgs(node, table) {
+    const meta = this.meta(table);
+    const args = argsByName(node);
+    assertKnownArgs(node, meta.primaryKey);
+    return meta.primaryKey.map((column) => {
+      const arg = args.get(column);
+      if (!arg) fail(`'${node.name.value}' is missing primary-key argument '${column}'`, "missing-pk-argument", meta.primaryKey);
+      return { column, value: this.lowerValue(arg.value) };
+    });
+  }
+  // -------------------------------------------------------------------------
+  // Mutations
+  // -------------------------------------------------------------------------
+  lowerMutationRoot(node) {
+    const name = node.name.value;
+    const alias = node.alias?.value ?? name;
+    const rootInfo = this.ctx.mutationRoots.get(name);
+    if (!rootInfo) fail(`unknown mutation root '${name}'`, "unknown-root", [...this.ctx.mutationRoots.keys()]);
+    const { op, table } = rootInfo;
+    const args = argsByName(node);
+    if (!node.selectionSet) fail(`'${name}' needs a selection set`, "invalid-selection");
+    const base = { kind: "mutation", op, alias, table, pinnedColumns: [], affectedRows: false };
+    switch (op) {
+      case "insert": {
+        assertKnownArgs(node, ["objects", "onConflict"]);
+        const objects = args.get("objects");
+        if (!objects) fail(`'${name}' needs objects:`, "missing-argument");
+        const response = this.lowerMutationResponse(node.selectionSet, table);
+        return {
+          ...base,
+          ...response,
+          objects: this.lowerInsertObjects(objects.value, table, { list: true }),
+          ...this.lowerOnConflictArg(args.get("onConflict"), table)
+        };
+      }
+      case "insertOne": {
+        assertKnownArgs(node, ["object", "onConflict"]);
+        const object = args.get("object");
+        if (!object) fail(`'${name}' needs object:`, "missing-argument");
+        return {
+          ...base,
+          objects: this.lowerInsertObjects(object.value, table, { list: false }),
+          ...this.lowerOnConflictArg(args.get("onConflict"), table),
+          returning: this.lowerSelection(node.selectionSet, table)
+        };
+      }
+      case "update": {
+        assertKnownArgs(node, ["where", "_set", "_append", "_inc"]);
+        const where = args.get("where");
+        if (!where) fail(`'${name}' needs where: (bulk updates without a filter are not allowed)`, "missing-argument");
+        return {
+          ...base,
+          ...this.lowerMutationResponse(node.selectionSet, table),
+          where: this.lowerBoolExp(where.value, table),
+          ...this.lowerWriteValues(args, table)
+        };
+      }
+      case "updateByPk": {
+        assertKnownArgs(node, ["pkColumns", "_set", "_append", "_inc"]);
+        const pkColumns = args.get("pkColumns");
+        if (!pkColumns) fail(`'${name}' needs pkColumns:`, "missing-argument");
+        return {
+          ...base,
+          pk: this.lowerPkColumnsArg(pkColumns.value, table),
+          ...this.lowerWriteValues(args, table),
+          returning: this.lowerSelection(node.selectionSet, table)
+        };
+      }
+      case "delete": {
+        assertKnownArgs(node, ["where"]);
+        const where = args.get("where");
+        if (!where) fail(`'${name}' needs where: (bulk deletes without a filter are not allowed)`, "missing-argument");
+        return {
+          ...base,
+          ...this.lowerMutationResponse(node.selectionSet, table),
+          where: this.lowerBoolExp(where.value, table)
+        };
+      }
+      case "deleteByPk": {
+        return {
+          ...base,
+          pk: this.lowerPkArgs(node, table),
+          returning: this.lowerSelection(node.selectionSet, table)
+        };
+      }
+    }
+  }
+  lowerMutationResponse(selectionSet, table) {
+    let affectedRows = false;
+    let returning = null;
+    for (const node of selectionSet.selections) {
+      if (node.kind !== graphql.Kind.FIELD) fail("fragments must be flattened before lowering", "internal");
+      const name = node.name.value;
+      if (name === "__typename") continue;
+      if (name === "affectedRows") {
+        affectedRows = true;
+        continue;
+      }
+      if (name === "returning") {
+        if (!node.selectionSet) fail("'returning' needs a selection set", "invalid-selection");
+        returning = this.lowerSelection(node.selectionSet, table);
+        continue;
+      }
+      fail(`unknown mutation-response field '${name}'`, "invalid-selection", ["affectedRows", "returning"]);
+    }
+    return { affectedRows, returning };
+  }
+  lowerInsertObjects(node, table, { list }) {
+    if (node.kind === graphql.Kind.VARIABLE) return { slot: this.slot(node.name.value, "insertInput", table) };
+    if (list) {
+      if (node.kind !== graphql.Kind.LIST) fail(`objects: must be a list literal or a variable`, "invalid-insert");
+      return { rows: node.values.map((item) => this.lowerInsertRow(item, table)) };
+    }
+    return { rows: [this.lowerInsertRow(node, table)] };
+  }
+  lowerInsertRow(node, table) {
+    if (node.kind !== graphql.Kind.OBJECT) fail(`insert rows on '${table}' must be objects`, "invalid-insert");
+    const meta = this.meta(table);
+    return node.fields.map((field) => {
+      const key = field.name.value;
+      if (this.link(table, key)) {
+        fail(`nested inserts are not supported in v2.0 \u2014 '${key}' is a link on '${table}'`, "nested-insert-unsupported");
+      }
+      if (!meta.insertable.includes(key)) {
+        const column = this.column(table, key);
+        if (column) fail(`column '${table}.${key}' is not insertable (pinned by the write policy or deprecated)`, "column-not-insertable", meta.insertable);
+        fail(`unknown column '${key}' in an insert on '${table}'`, "unknown-column", meta.insertable);
+      }
+      return { column: key, value: this.lowerValue(field.value) };
+    });
+  }
+  lowerOnConflictArg(arg, table) {
+    if (!arg) return {};
+    const node = arg.value;
+    if (node.kind === graphql.Kind.VARIABLE) return { onConflict: { slot: this.slot(node.name.value, "onConflict", table) } };
+    if (node.kind !== graphql.Kind.OBJECT) fail("onConflict: must be an object literal or a variable", "invalid-on-conflict");
+    const meta = this.meta(table);
+    let constraint;
+    const updateColumns = [];
+    for (const field of node.fields) {
+      if (field.name.value === "constraint") {
+        if (field.value.kind !== graphql.Kind.ENUM) fail("onConflict.constraint must be a constraint enum value", "invalid-on-conflict");
+        constraint = field.value.value;
+        continue;
+      }
+      if (field.name.value === "updateColumns") {
+        const items = field.value.kind === graphql.Kind.LIST ? field.value.values : [field.value];
+        for (const item of items) {
+          if (item.kind !== graphql.Kind.ENUM) fail("onConflict.updateColumns must be update-column enum values", "invalid-on-conflict");
+          if (!meta.settable.includes(item.value)) {
+            fail(`onConflict.updateColumns: '${item.value}' is not updatable on '${table}'`, "invalid-on-conflict", meta.settable);
+          }
+          updateColumns.push(item.value);
+        }
+        continue;
+      }
+      fail(`unknown onConflict key '${field.name.value}'`, "invalid-on-conflict", ["constraint", "updateColumns"]);
+    }
+    if (!constraint) fail("onConflict needs a constraint", "invalid-on-conflict", meta.constraints.map((c) => c.name));
+    if (!meta.constraints.some((c) => c.name === constraint)) {
+      fail(`unknown constraint '${constraint}' on '${table}'`, "invalid-on-conflict", meta.constraints.map((c) => c.name));
+    }
+    return { onConflict: { constraint, updateColumns } };
+  }
+  lowerWriteValues(args, table) {
+    const meta = this.meta(table);
+    const result = {};
+    const set = args.get("_set");
+    if (set) {
+      result.set = set.value.kind === graphql.Kind.VARIABLE ? { slot: this.slot(set.value.name.value, "setInput", table) } : { entries: this.lowerColumnEntries(set.value, table, meta.settable, "_set") };
+    }
+    const append = args.get("_append");
+    if (append) {
+      result.append = append.value.kind === graphql.Kind.VARIABLE ? { slot: this.slot(append.value.name.value, "appendInput", table) } : { entries: this.lowerColumnEntries(append.value, table, meta.appendable, "_append") };
+    }
+    const inc = args.get("_inc");
+    if (inc) {
+      if (inc.value.kind === graphql.Kind.VARIABLE) {
+        fail("_inc has no dynamic input type \u2014 inline the columns with variable leaf values", "invalid-inc");
+      }
+      const numeric = meta.columns.filter((c) => typeof c.type === "string" && NUMERIC_TYPES.has(c.type) && meta.settable.includes(c.name)).map((c) => c.name);
+      result.inc = { entries: this.lowerColumnEntries(inc.value, table, numeric, "_inc") };
+    }
+    if (!result.set && !result.append && !result.inc) {
+      fail(`an update on '${table}' needs at least one of _set/_append/_inc`, "missing-argument");
+    }
+    return result;
+  }
+  lowerColumnEntries(node, table, whitelist, argName) {
+    if (node.kind !== graphql.Kind.OBJECT) fail(`${argName} on '${table}' must be an object literal or a variable`, "invalid-write-values");
+    return node.fields.map((field) => {
+      const key = field.name.value;
+      if (!whitelist.includes(key)) {
+        fail(`${argName}: column '${key}' is not allowed on '${table}'`, "column-not-settable", [...whitelist]);
+      }
+      return { column: key, value: this.lowerValue(field.value) };
+    });
+  }
+  lowerPkColumnsArg(node, table) {
+    if (node.kind !== graphql.Kind.OBJECT) fail(`pkColumns on '${table}' must be an object literal`, "invalid-pk-columns");
+    const meta = this.meta(table);
+    const provided = new Map(node.fields.map((field) => [field.name.value, field.value]));
+    for (const key of provided.keys()) {
+      if (!meta.primaryKey.includes(key)) fail(`pkColumns: '${key}' is not a primary-key column of '${table}'`, "invalid-pk-columns", meta.primaryKey);
+    }
+    return meta.primaryKey.map((column) => {
+      const value = provided.get(column);
+      if (!value) fail(`pkColumns is missing '${column}'`, "invalid-pk-columns", meta.primaryKey);
+      return { column, value: this.lowerValue(value) };
+    });
+  }
+};
+function lowerOperation({ restricted, ctx }) {
+  const lowerer = new OperationLowerer(ctx, restricted);
+  return lowerer.lowerRoots(restricted.definition, restricted.kind);
+}
+function parseSdl(sdl) {
+  return graphql.buildSchema(sdl);
+}
+function parseDocuments({
+  schema,
+  documents
+}) {
+  const parsed = [];
+  const diagnostics = [];
+  for (const source of documents) {
+    let document;
+    try {
+      document = graphql.parse(source.contents);
+    } catch (error) {
+      diagnostics.push({
+        severity: "error",
+        code: "graphql-syntax-error",
+        message: error instanceof Error ? error.message : String(error),
+        document: source.path
+      });
+      continue;
+    }
+    const validationErrors = graphql.validate(schema, document);
+    if (validationErrors.length > 0) {
+      for (const validationError of validationErrors) {
+        diagnostics.push({
+          severity: "error",
+          code: "graphql-validation-error",
+          message: validationError.message,
+          document: source.path
+        });
+      }
+      continue;
+    }
+    const operations = [];
+    const fragments = /* @__PURE__ */ new Map();
+    for (const definition of document.definitions) {
+      if (definition.kind === graphql.Kind.OPERATION_DEFINITION) operations.push(definition);
+      if (definition.kind === graphql.Kind.FRAGMENT_DEFINITION) fragments.set(definition.name.value, definition);
+    }
+    parsed.push({ path: source.path, document, operations, fragments });
+  }
+  return { documents: parsed, diagnostics };
+}
+function unwrapType(node, variable) {
+  let nullable = true;
+  let list = false;
+  let current = node;
+  for (; ; ) {
+    if (current.kind === graphql.Kind.NON_NULL_TYPE) {
+      if (current === node) nullable = false;
+      current = current.type;
+      continue;
+    }
+    if (current.kind === graphql.Kind.LIST_TYPE) {
+      if (list) {
+        throw new DocumentCompileError(`variable $${variable}: nested list types are not supported`, "unsupported-variable-type");
+      }
+      list = true;
+      current = current.type;
+      continue;
+    }
+    return { named: current.name.value, list, nullable };
+  }
+}
+function classifyVariableType({ named, list }, variable, ctx) {
+  const inputRef = classifyInputType(named, ctx.tableByTypename);
+  if (inputRef) {
+    const listable = {
+      boolExp: "never",
+      onConflict: "never",
+      setInput: "never",
+      appendInput: "never",
+      orderBy: "must",
+      selectColumn: "must",
+      insertInput: "either"
+    };
+    const rule = listable[inputRef.input];
+    if (rule === "must" && !list) {
+      throw new DocumentCompileError(
+        `variable $${variable}: ${named} must be used as a list (e.g. [${named}!])`,
+        "unsupported-variable-type"
+      );
+    }
+    if (rule === "never" && list) {
+      throw new DocumentCompileError(
+        `variable $${variable}: ${named} cannot be used as a list`,
+        "unsupported-variable-type"
+      );
+    }
+    return { kind: "inputRef", input: inputRef.input, table: inputRef.table };
+  }
+  const scalar = columnTypeForScalar(named);
+  if (scalar) return { kind: "scalar", scalar };
+  const enumDef = ctx.enumsByTypeName.get(named);
+  if (enumDef) return { kind: "enum", name: enumDef.name, values: [...enumDef.values] };
+  throw new DocumentCompileError(
+    `variable $${variable}: type '${named}' is not usable as a variable \u2014 allowed: scalars (${VARIABLE_SCALAR_NAMES.join(", ")}), declared enums, or the generated dynamic input types (FooBoolExp, [FooOrderBy!], [FooSelectColumn!], FooInsertInput, FooSetInput, FooAppendInput, FooOnConflict)`,
+    "unsupported-variable-type"
+  );
+}
+function restrictDefaultLiteral(item, variable, type) {
+  if (item !== null && typeof item !== "string" && typeof item !== "number" && typeof item !== "boolean") {
+    throw new DocumentCompileError(
+      `variable $${variable}: default values must be scalar literals \u2014 got ${JSON.stringify(item) ?? "undefined"}`,
+      "unsupported-variable-default"
+    );
+  }
+  if (type.kind === "enum" && !(typeof item === "string" && type.values.includes(item))) {
+    throw new DocumentCompileError(
+      `variable $${variable}: default ${JSON.stringify(item)} is not a value of enum ${type.name}`,
+      "unsupported-variable-default",
+      type.values
+    );
+  }
+  return item;
+}
+function restrictDefault({
+  node,
+  variable,
+  type,
+  list,
+  nullable
+}) {
+  if (type.kind === "inputRef") {
+    throw new DocumentCompileError(
+      `variable $${variable}: dynamic input types cannot declare a default \u2014 omit the variable instead (an absent slot prunes to a no-op)`,
+      "unsupported-variable-default"
+    );
+  }
+  const value = graphql.valueFromASTUntyped(node);
+  if (value === null) {
+    if (!nullable) {
+      throw new DocumentCompileError(
+        `variable $${variable}: default null is not valid for a non-nullable variable`,
+        "unsupported-variable-default"
+      );
+    }
+    return { value: null };
+  }
+  if (Array.isArray(value)) {
+    if (!list) {
+      throw new DocumentCompileError(
+        `variable $${variable}: default for a non-list variable must not be a list`,
+        "unsupported-variable-default"
+      );
+    }
+    return { value: value.map((item) => restrictDefaultLiteral(item, variable, type)) };
+  }
+  if (list) {
+    throw new DocumentCompileError(
+      `variable $${variable}: default for a list variable must be a list`,
+      "unsupported-variable-default"
+    );
+  }
+  return { value: restrictDefaultLiteral(value, variable, type) };
+}
+function parseRequires(operation) {
+  const directive = operation.directives?.find((d) => d.name.value === "requires");
+  if (!directive) return null;
+  const requires = {};
+  for (const key of ["capability", "role"]) {
+    const arg = directive.arguments?.find((a) => a.name.value === key);
+    if (!arg) continue;
+    if (arg.value.kind !== graphql.Kind.STRING) {
+      throw new DocumentCompileError(`@requires(${key}:) must be a string literal`, "invalid-requires");
+    }
+    if (!CAPABILITY_KEY_PATTERN.test(arg.value.value)) {
+      throw new DocumentCompileError(`@requires(${key}: "${arg.value.value}") is not a valid key`, "invalid-requires");
+    }
+    requires[key] = arg.value.value;
+  }
+  if (requires.capability === void 0 && requires.role === void 0) {
+    throw new DocumentCompileError("@requires needs a capability or a role argument", "invalid-requires");
+  }
+  return requires;
+}
+function restrictOperation({
+  operation,
+  ctx
+}) {
+  if (operation.operation === "subscription") {
+    throw new DocumentCompileError("subscriptions are not supported in v2.0 \u2014 poll a query instead", "subscription-unsupported");
+  }
+  const name = operation.name?.value;
+  if (!name) {
+    throw new DocumentCompileError(
+      "anonymous operations are not supported \u2014 every operation must be named (the name keys the registry)",
+      "anonymous-operation"
+    );
+  }
+  const variables = (operation.variableDefinitions ?? []).map((definition) => {
+    const variable = definition.variable.name.value;
+    const unwrapped = unwrapType(definition.type, variable);
+    const { list, nullable } = unwrapped;
+    const type = classifyVariableType(unwrapped, variable, ctx);
+    const ir = { name: variable, type, nullable, list };
+    if (definition.defaultValue === void 0) return ir;
+    return { ...ir, defaultValue: restrictDefault({ node: definition.defaultValue, variable, type, list, nullable }) };
+  });
+  return {
+    name,
+    kind: operation.operation === "mutation" ? "mutation" : "query",
+    requires: parseRequires(operation),
+    variables,
+    definition: operation
+  };
+}
+
+// src/compiler-gql/artifact.ts
+var SCHEMA_HASH_DOMAIN = "sequence-orm-canonical-v2\0";
+function computeSchemaHash(canonical) {
+  const digest = crypto.createHash("sha256").update(SCHEMA_HASH_DOMAIN).update(stableJson(canonical)).digest("hex");
+  return `sha256:${digest}`;
+}
+function compileNamespace({ canonical, sdl, documents }) {
+  const { ctx, diagnostics } = buildCompileContext(canonical);
+  if (diagnostics.some((d) => d.severity === "error")) return { ok: false, diagnostics };
+  const schema = parseSdl(sdl);
+  const schemaHash = computeSchemaHash(canonical);
+  const parsed = parseDocuments({ schema, documents });
+  diagnostics.push(...parsed.diagnostics);
+  const operations = {};
+  const operationSources = /* @__PURE__ */ new Map();
+  for (const document of parsed.documents) {
+    for (const operationNode of document.operations) {
+      const operationName = operationNode.name?.value;
+      try {
+        const restricted = restrictOperation({ operation: operationNode, ctx });
+        const flattened = flattenOperation({ operation: restricted.definition, fragments: document.fragments });
+        const previousSource = operationSources.get(restricted.name);
+        if (previousSource !== void 0) {
+          throw new DocumentCompileError(
+            `duplicate operation name '${restricted.name}' (also defined in ${previousSource})`,
+            "duplicate-operation"
+          );
+        }
+        const loweredRoots = lowerOperation({ restricted: { ...restricted, definition: flattened }, ctx });
+        const { roots, tableSet } = injectPolicies({ roots: loweredRoots, ctx });
+        operations[restricted.name] = {
+          irVersion: IR_VERSION,
+          name: restricted.name,
+          opHash: computeOpHash({ definition: flattened, schemaHash }),
+          kind: restricted.kind,
+          requires: restricted.requires,
+          variables: restricted.variables,
+          tableSet,
+          roots
+        };
+        operationSources.set(restricted.name, document.path);
+      } catch (error) {
+        if (error instanceof DocumentCompileError) {
+          diagnostics.push({
+            severity: "error",
+            code: error.code,
+            message: error.message,
+            document: document.path,
+            ...operationName !== void 0 ? { operation: operationName } : {}
+          });
+          continue;
+        }
+        throw error;
+      }
+    }
+  }
+  if (diagnostics.some((d) => d.severity === "error")) return { ok: false, diagnostics };
+  const artifact = {
+    irVersion: IR_VERSION,
+    namespace: ctx.namespace,
+    schemaHash,
+    opsHash: computeOpsHash(Object.values(operations).map((op) => op.opHash)),
+    tables: ctx.tables,
+    operations
+  };
+  const normalized = normalizeIr(artifact);
+  const manifest = {
+    namespace: ctx.namespace,
+    schemaHash,
+    opsHash: normalized.opsHash,
+    operations: Object.fromEntries(
+      Object.values(normalized.operations).map((op) => [
+        op.name,
+        { opHash: op.opHash, kind: op.kind, requires: op.requires }
+      ])
+    )
+  };
+  return { ok: true, artifact: normalized, manifest, diagnostics };
+}
+function compileNamespaceOrThrow(input) {
+  const result = compileNamespace(input);
+  if (!result.ok) throw new NamespaceCompileError(result.diagnostics);
+  return result;
+}
+function computePinnedColumnsByTable(canonical) {
+  const { ctx, diagnostics } = buildCompileContext(canonical);
+  if (diagnostics.some((d) => d.severity === "error")) {
+    throw new NamespaceCompileError(diagnostics);
+  }
+  return Object.fromEntries([...ctx.pins.entries()].map(([table, pins]) => [table, pins]));
+}
+
+// src/compiler-gql/dynamic-input.ts
+var CONST_TRUE2 = { kind: "and", operands: [] };
+var ORDER_DIRECTIONS2 = {
+  ASC: { direction: "asc" },
+  DESC: { direction: "desc" },
+  ASC_NULLS_FIRST: { direction: "asc", nulls: "first" },
+  ASC_NULLS_LAST: { direction: "asc", nulls: "last" },
+  DESC_NULLS_FIRST: { direction: "desc", nulls: "first" },
+  DESC_NULLS_LAST: { direction: "desc", nulls: "last" }
+};
+var BOOLEXP_OPS2 = {
+  _eq: "eq",
+  _neq: "neq",
+  _gt: "gt",
+  _gte: "gte",
+  _lt: "lt",
+  _lte: "lte",
+  _in: "in",
+  _nin: "nin",
+  _like: "like",
+  _ilike: "ilike",
+  _isNull: "isNull",
+  _contains: "contains",
+  _hasKey: "hasKey"
+};
+function allowedOps(type) {
+  if (typeof type !== "string") return ["eq", "neq", "in", "nin", "isNull"];
+  switch (type) {
+    case "text":
+      return ["eq", "neq", "gt", "gte", "lt", "lte", "in", "nin", "like", "ilike", "isNull"];
+    case "uuid":
+      return ["eq", "neq", "in", "nin", "isNull"];
+    case "integer":
+    case "bigint":
+    case "numeric":
+    case "double":
+    case "timestamptz":
+    case "date":
+      return ["eq", "neq", "gt", "gte", "lt", "lte", "in", "nin", "isNull"];
+    case "boolean":
+      return ["eq", "neq", "isNull"];
+    case "jsonb":
+      return ["eq", "neq", "contains", "hasKey", "isNull"];
+  }
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function scalarMatches(type, value) {
+  if (typeof type !== "string") return typeof value === "string" && type.values.includes(value);
+  switch (type) {
+    case "text":
+    case "uuid":
+    case "timestamptz":
+    case "date":
+      return typeof value === "string";
+    case "integer":
+      return typeof value === "number" && Number.isInteger(value);
+    case "double":
+      return typeof value === "number";
+    // bigint/numeric exceed JS number precision — the JSON wire form may be a string.
+    case "bigint":
+    case "numeric":
+      return typeof value === "number" || typeof value === "string";
+    case "boolean":
+      return typeof value === "boolean";
+    case "jsonb":
+      return true;
+  }
+}
+var IssueCollector = class {
+  issues = [];
+  add(code, path, message) {
+    this.issues.push({ code, path, message });
+  }
+};
+function finish(collector, value) {
+  return collector.issues.length > 0 ? { ok: false, issues: collector.issues } : { ok: true, value };
+}
+function validateBoolExpInput({ table, tables, value, maxDepth, maxNodes }) {
+  const collector = new IssueCollector();
+  const depthCap = maxDepth ?? table.dynamicFilterMaxDepth;
+  const nodeCap = maxNodes ?? table.dynamicFilterMaxNodes;
+  let nodes = 0;
+  let capped = false;
+  const consumeNode = (path) => {
+    nodes += 1;
+    if (nodes <= nodeCap) return true;
+    if (!capped) {
+      capped = true;
+      collector.add("too-many-nodes", path, `filter tree exceeds the node cap of ${nodeCap}`);
+    }
+    return false;
+  };
+  const walk = (input, meta, depth, path) => {
+    if (capped) return CONST_TRUE2;
+    if (depth > depthCap) {
+      collector.add("too-deep", path, `filter tree exceeds the depth cap of ${depthCap}`);
+      return CONST_TRUE2;
+    }
+    if (!isPlainObject(input)) {
+      collector.add("invalid-shape", path, "a boolean expression must be an object");
+      return CONST_TRUE2;
+    }
+    const operands = [];
+    for (const [key, entry] of Object.entries(input)) {
+      if (entry === void 0 || entry === null) continue;
+      if (!consumeNode(path)) return CONST_TRUE2;
+      if (key === "_and" || key === "_or") {
+        const items = Array.isArray(entry) ? entry : [entry];
+        const children = items.map((item, index) => walk(item, meta, depth + 1, `${path}.${key}[${index}]`));
+        if (children.length > 0) operands.push({ kind: key === "_and" ? "and" : "or", operands: children });
+        continue;
+      }
+      if (key === "_not") {
+        operands.push({ kind: "not", operand: walk(entry, meta, depth + 1, `${path}._not`) });
+        continue;
+      }
+      const column = meta.columns.find((c) => c.name === key);
+      if (column) {
+        if (!meta.filterable.includes(key)) {
+          collector.add("column-not-allowed", `${path}.${key}`, `column '${key}' is not filterable on '${meta.table}'`);
+          continue;
+        }
+        if (!isPlainObject(entry)) {
+          collector.add("invalid-shape", `${path}.${key}`, `comparison on '${key}' must be an object like { _eq: \u2026 }`);
+          continue;
+        }
+        for (const [opKey, opValue] of Object.entries(entry)) {
+          if (opValue === void 0) continue;
+          if (!consumeNode(`${path}.${key}`)) return CONST_TRUE2;
+          const op = BOOLEXP_OPS2[opKey];
+          if (!op || !allowedOps(column.type).includes(op)) {
+            collector.add("unknown-operator", `${path}.${key}.${opKey}`, `operator '${opKey}' is not allowed on '${meta.table}.${key}'`);
+            continue;
+          }
+          const issue = checkOperatorValue(op, column.type, opValue);
+          if (issue) {
+            collector.add("invalid-value", `${path}.${key}.${opKey}`, issue);
+            continue;
+          }
+          operands.push({ kind: "cmp", op, column: key, value: opValue });
+        }
+        continue;
+      }
+      const link = meta.links.find((l) => l.name === key);
+      if (link) {
+        const target = tables[link.target];
+        if (!target) {
+          collector.add("unknown-link", `${path}.${key}`, `link target '${link.target}' is not in the artifact`);
+          continue;
+        }
+        operands.push({ kind: "exists", link: key, target: link.target, where: walk(entry, target, depth + 1, `${path}.${key}`) });
+        continue;
+      }
+      collector.add(
+        "unknown-column",
+        `${path}.${key}`,
+        `unknown field '${key}' in a filter on '${meta.table}' (declared columns and links only)`
+      );
+    }
+    if (operands.length === 0) return CONST_TRUE2;
+    return operands.length === 1 ? operands[0] : { kind: "and", operands };
+  };
+  const normalized = walk(value, table, 1, "$");
+  return finish(collector, normalized);
+}
+function checkOperatorValue(op, type, value) {
+  if (op === "isNull") return typeof value === "boolean" ? void 0 : "_isNull takes a boolean";
+  if (op === "hasKey") return typeof value === "string" ? void 0 : "_hasKey takes a string key";
+  if (op === "contains") return void 0;
+  if (op === "in" || op === "nin") {
+    if (!Array.isArray(value)) return `${op === "in" ? "_in" : "_nin"} takes an array`;
+    return value.every((item) => scalarMatches(type, item)) ? void 0 : "array items do not match the column type";
+  }
+  if (op === "like" || op === "ilike") return typeof value === "string" ? void 0 : "pattern must be a string";
+  return scalarMatches(type, value) ? void 0 : "value does not match the column type";
+}
+function validateOrderByInput({
+  table,
+  tables,
+  value
+}) {
+  const collector = new IssueCollector();
+  const normalized = [];
+  const items = Array.isArray(value) ? value : [value];
+  items.forEach((item, index) => {
+    const path = `$[${index}]`;
+    if (!isPlainObject(item)) {
+      collector.add("invalid-shape", path, "orderBy entries must be objects");
+      return;
+    }
+    for (const [key, direction] of Object.entries(item)) {
+      if (direction === void 0 || direction === null) continue;
+      if (table.orderable.includes(key)) {
+        const resolved = typeof direction === "string" ? ORDER_DIRECTIONS2[direction] : void 0;
+        if (!resolved) {
+          collector.add("invalid-value", `${path}.${key}`, `unknown order direction '${String(direction)}'`);
+          continue;
+        }
+        normalized.push({ column: key, ...resolved });
+        continue;
+      }
+      const link = table.links.find((l) => l.name === key);
+      if (link && link.kind !== "toMany") {
+        const target = tables[link.target];
+        if (!target || !isPlainObject(direction) || Object.keys(direction).length !== 1) {
+          collector.add("invalid-shape", `${path}.${key}`, `orderBy through '${key}' needs exactly one target column`);
+          continue;
+        }
+        const [targetColumn, targetDirection] = Object.entries(direction)[0];
+        const resolved = typeof targetDirection === "string" ? ORDER_DIRECTIONS2[targetDirection] : void 0;
+        if (!target.orderable.includes(targetColumn)) {
+          collector.add("unknown-column", `${path}.${key}.${targetColumn}`, `'${targetColumn}' is not orderable on '${link.target}'`);
+          continue;
+        }
+        if (!resolved) {
+          collector.add("invalid-value", `${path}.${key}.${targetColumn}`, `unknown order direction '${String(targetDirection)}'`);
+          continue;
+        }
+        normalized.push({ column: targetColumn, link: key, ...resolved });
+        continue;
+      }
+      collector.add("unknown-column", `${path}.${key}`, `'${key}' is not orderable on '${table.table}' (columns and to-one links only)`);
+    }
+  });
+  return finish(collector, normalized);
+}
+function validateSelectColumns({ table, value }) {
+  const collector = new IssueCollector();
+  const items = Array.isArray(value) ? value : [value];
+  const normalized = [];
+  items.forEach((item, index) => {
+    if (typeof item !== "string" || !table.filterable.includes(item)) {
+      collector.add("unknown-column", `$[${index}]`, `'${String(item)}' is not a selectable column of '${table.table}'`);
+      return;
+    }
+    normalized.push(item);
+  });
+  return finish(collector, normalized);
+}
+function validateInsertInput({
+  table,
+  value,
+  list,
+  maxRows
+}) {
+  const collector = new IssueCollector();
+  const rowCap = maxRows ?? 1e3;
+  const rows = list ? value : [value];
+  if (!Array.isArray(rows)) {
+    collector.add("invalid-shape", "$", "objects must be an array of rows");
+    return { ok: false, issues: collector.issues };
+  }
+  if (rows.length > rowCap) {
+    collector.add("too-many-rows", "$", `insert exceeds the row cap of ${rowCap}`);
+    return { ok: false, issues: collector.issues };
+  }
+  const normalized = [];
+  rows.forEach((row, index) => {
+    const path = list ? `$[${index}]` : "$";
+    if (!isPlainObject(row)) {
+      collector.add("invalid-shape", path, "insert rows must be objects");
+      return;
+    }
+    const out = {};
+    for (const [key, entry] of Object.entries(row)) {
+      if (entry === void 0) continue;
+      if (table.links.some((l) => l.name === key)) {
+        collector.add("nested-insert", `${path}.${key}`, `nested inserts are not supported \u2014 '${key}' is a link (a { data: \u2026 } shape was rejected)`);
+        continue;
+      }
+      const column = table.columns.find((c) => c.name === key);
+      if (!column || !table.insertable.includes(key)) {
+        const reason = column ? "not insertable (pinned by the write policy or deprecated)" : "not a declared column";
+        collector.add(column ? "column-not-allowed" : "unknown-column", `${path}.${key}`, `'${key}' is ${reason} on '${table.table}'`);
+        continue;
+      }
+      if (entry === null) {
+        if (!column.nullable) {
+          collector.add("invalid-value", `${path}.${key}`, `'${key}' is not nullable`);
+          continue;
+        }
+      } else if (!scalarMatches(column.type, entry)) {
+        collector.add("invalid-value", `${path}.${key}`, `value for '${key}' does not match its column type`);
+        continue;
+      }
+      out[key] = entry;
+    }
+    normalized.push(out);
+  });
+  return finish(collector, normalized);
+}
+function validateColumnMap({
+  table,
+  value,
+  whitelist,
+  argName,
+  typeCheck
+}) {
+  const collector = new IssueCollector();
+  if (!isPlainObject(value)) {
+    collector.add("invalid-shape", "$", `${argName} must be an object`);
+    return { ok: false, issues: collector.issues };
+  }
+  const out = {};
+  for (const [key, entry] of Object.entries(value)) {
+    if (entry === void 0) continue;
+    if (!whitelist.includes(key)) {
+      const known = table.columns.some((c) => c.name === key);
+      collector.add(known ? "column-not-allowed" : "unknown-column", `$.${key}`, `'${key}' is not allowed in ${argName} on '${table.table}'`);
+      continue;
+    }
+    const column = table.columns.find((c) => c.name === key);
+    if (column && entry === null && !column.nullable) {
+      collector.add("invalid-value", `$.${key}`, `'${key}' is not nullable`);
+      continue;
+    }
+    if (typeCheck && column && entry !== null && !scalarMatches(column.type, entry)) {
+      collector.add("invalid-value", `$.${key}`, `value for '${key}' does not match its column type`);
+      continue;
+    }
+    out[key] = entry;
+  }
+  return finish(collector, out);
+}
+function validateSetInput({ table, value }) {
+  return validateColumnMap({ table, value, whitelist: table.settable, argName: "_set", typeCheck: true });
+}
+function validateAppendInput({ table, value }) {
+  return validateColumnMap({ table, value, whitelist: table.appendable, argName: "_append", typeCheck: false });
+}
+function validateOnConflictInput({
+  table,
+  value
+}) {
+  const collector = new IssueCollector();
+  if (!isPlainObject(value)) {
+    collector.add("invalid-shape", "$", "onConflict must be an object");
+    return { ok: false, issues: collector.issues };
+  }
+  for (const key of Object.keys(value)) {
+    if (key !== "constraint" && key !== "updateColumns") {
+      collector.add("invalid-shape", `$.${key}`, `unknown onConflict key '${key}' (constraint, updateColumns)`);
+    }
+  }
+  const constraint = value["constraint"];
+  if (typeof constraint !== "string" || !table.constraints.some((c) => c.name === constraint)) {
+    collector.add(
+      "unknown-constraint",
+      "$.constraint",
+      `'${String(constraint)}' is not a declared constraint of '${table.table}'`
+    );
+  }
+  const updateColumns = [];
+  const rawColumns = value["updateColumns"] ?? [];
+  if (!Array.isArray(rawColumns)) {
+    collector.add("invalid-shape", "$.updateColumns", "updateColumns must be an array");
+  } else {
+    rawColumns.forEach((item, index) => {
+      if (typeof item !== "string" || !table.settable.includes(item)) {
+        collector.add("column-not-allowed", `$.updateColumns[${index}]`, `'${String(item)}' is not updatable on '${table.table}'`);
+        return;
+      }
+      updateColumns.push(item);
+    });
+  }
+  return finish(collector, { constraint, updateColumns });
+}
+
+exports.COMPILER_MAJOR = COMPILER_MAJOR;
+exports.CONST_TRUE = CONST_TRUE;
+exports.DEFAULT_LIMIT = DEFAULT_LIMIT;
+exports.DocumentCompileError = DocumentCompileError;
+exports.MAX_LIMIT = MAX_LIMIT;
+exports.NamespaceCompileError = NamespaceCompileError;
+exports.OperationLowerer = OperationLowerer;
+exports.PLATFORM_USER_TABLE = PLATFORM_USER_TABLE;
+exports.PLATFORM_USER_TYPENAME = PLATFORM_USER_TYPENAME;
+exports.POLICY_COMPARE_OPS = POLICY_COMPARE_OPS;
+exports.POLICY_MAX_LINK_DEPTH = POLICY_MAX_LINK_DEPTH;
+exports.PolicyCompileError = PolicyCompileError;
+exports.PolicyParseError = PolicyParseError;
+exports.andPred = andPred;
+exports.assertClaimsOnlyWhen = assertClaimsOnlyWhen;
+exports.buildCompileContext = buildCompileContext;
+exports.camelCase = camelCase;
+exports.canonicalOperationText = canonicalOperationText;
+exports.classifyInputType = classifyInputType;
+exports.collectPinnedColumns = collectPinnedColumns;
+exports.compileNamespace = compileNamespace;
+exports.compileNamespaceOrThrow = compileNamespaceOrThrow;
+exports.compilePolicy = compilePolicy;
+exports.compilePredicateV2 = compilePredicateV2;
+exports.computeOpHash = computeOpHash;
+exports.computeOpsHash = computeOpsHash;
+exports.computePinnedColumnsByTable = computePinnedColumnsByTable;
+exports.computeSchemaHash = computeSchemaHash;
+exports.enumTypeName = enumTypeName;
+exports.flattenOperation = flattenOperation;
+exports.injectPolicies = injectPolicies;
+exports.inputTypeName = inputTypeName;
+exports.lowerOperation = lowerOperation;
+exports.mutationRootNames = mutationRootNames;
+exports.parseDocuments = parseDocuments;
+exports.parsePolicy = parsePolicy;
+exports.parseSdl = parseSdl;
+exports.pascalCase = pascalCase;
+exports.platformUserMeta = platformUserMeta;
+exports.predContains = predContains;
+exports.predContainsExists = predContainsExists;
+exports.queryRootNames = queryRootNames;
+exports.restrictOperation = restrictOperation;
+exports.typeNameForTable = typeNameForTable;
+exports.validateAppendInput = validateAppendInput;
+exports.validateBoolExpInput = validateBoolExpInput;
+exports.validateInsertInput = validateInsertInput;
+exports.validateOnConflictInput = validateOnConflictInput;
+exports.validateOrderByInput = validateOrderByInput;
+exports.validateSelectColumns = validateSelectColumns;
+exports.validateSetInput = validateSetInput;
+exports.walkPolicy = walkPolicy;
+exports.walkPred = walkPred;
+//# sourceMappingURL=compiler.cjs.map
+//# sourceMappingURL=compiler.cjs.map