@sequenceholdings/orm 0.1.0 → 0.1.2

package/dist/index.cjs

@@ -1,13 +1,865 @@
 'use strict';
 
+var crypto = require('crypto');
 var zod = require('zod');
+var jiti = require('jiti');
+var promises = require('fs/promises');
+var module$1 = require('module');
+var path = require('path');
 var api = require('drizzle-kit/api');
 var pgCore = require('drizzle-orm/pg-core');
 var drizzleOrm = require('drizzle-orm');
-var crypto = require('crypto');
-var promises = require('fs/promises');
-var path = require('path');
 var jsYaml = require('js-yaml');
+var customRolesManifest = require('@sequenceholdings/custom-roles-manifest');
+
+var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
+// src/authoring/columns.ts
+var COLUMN_BRAND = "seq-column";
+var ENUM_BRAND = "seq-enum";
+function isEnumRef(value) {
+  return typeof value === "object" && value !== null && value.kind === ENUM_BRAND;
+}
+var COLUMN_DEFAULT_FNS = ["gen_random_uuid()", "now()"];
+function deriveColumnName(propertyName) {
+  return propertyName.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1_$2").toLowerCase();
+}
+var ColumnBuilder = class {
+  kind = COLUMN_BRAND;
+  state;
+  constructor(type, columnName) {
+    this.state = {
+      type,
+      columnName,
+      primaryKey: false,
+      notNull: false,
+      unique: false,
+      hasDefault: false,
+      defaultValue: void 0,
+      defaultFn: void 0,
+      description: void 0,
+      renamedFrom: void 0,
+      cast: void 0,
+      deprecated: false
+    };
+  }
+  /** Marks this column as (part of) the primary key. Implies NOT NULL. */
+  primaryKey() {
+    this.state.primaryKey = true;
+    return this;
+  }
+  notNull() {
+    this.state.notNull = true;
+    return this;
+  }
+  unique() {
+    this.state.unique = true;
+    return this;
+  }
+  /**
+   * Column default: a literal, or one of the allowlisted SQL functions
+   * (`'gen_random_uuid()'` / `'now()'`), which serialize as `defaultFn`.
+   */
+  default(value) {
+    if (value === "gen_random_uuid()" || value === "now()") {
+      this.state.defaultFn = value;
+      this.state.hasDefault = false;
+      this.state.defaultValue = void 0;
+      return this;
+    }
+    this.state.hasDefault = true;
+    this.state.defaultValue = value;
+    this.state.defaultFn = void 0;
+    return this;
+  }
+  description(text3) {
+    this.state.description = text3;
+    return this;
+  }
+  /** Migration rename hint: the previous Postgres column name. */
+  renamedFrom(previousColumnName) {
+    this.state.renamedFrom = previousColumnName;
+    return this;
+  }
+  /** Migration cast hint: the `USING` SQL applied when this column changes type. */
+  cast(usingSql) {
+    this.state.cast = usingSql;
+    return this;
+  }
+  /** Emits `@deprecated` in the generated SDL; the column stays queryable. */
+  deprecated() {
+    this.state.deprecated = true;
+    return this;
+  }
+  /** Whether `.primaryKey()` was called — collected into the table-level PK. */
+  get isPrimaryKey() {
+    return this.state.primaryKey;
+  }
+  /** The enum name when this is an enum column, else undefined. */
+  get enumName() {
+    return typeof this.state.type === "object" ? this.state.type.enum : void 0;
+  }
+  /** Postgres column name: explicit override, else snake_case of the property name. */
+  columnNameFor(propertyName) {
+    return this.state.columnName ?? deriveColumnName(propertyName);
+  }
+  /** Serialize to a canonical v2 column. Validation happens in serializeNamespace. */
+  toCanonicalColumn(propertyName) {
+    const column = {
+      name: propertyName,
+      columnName: this.columnNameFor(propertyName),
+      type: typeof this.state.type === "object" ? { enum: this.state.type.enum } : this.state.type,
+      nullable: !(this.state.notNull || this.state.primaryKey),
+      unique: this.state.unique,
+      deprecated: this.state.deprecated
+    };
+    if (this.state.hasDefault) column.default = this.state.defaultValue ?? null;
+    if (this.state.defaultFn !== void 0) column.defaultFn = this.state.defaultFn;
+    if (this.state.description !== void 0) column.description = this.state.description;
+    if (this.state.renamedFrom !== void 0) column.renamedFrom = this.state.renamedFrom;
+    if (this.state.cast !== void 0) column.cast = this.state.cast;
+    return column;
+  }
+};
+function isColumnBuilder(value) {
+  return typeof value === "object" && value !== null && value.kind === COLUMN_BRAND;
+}
+var scalar = (type) => (columnName) => new ColumnBuilder(type, columnName);
+var t = {
+  uuid: scalar("uuid"),
+  text: scalar("text"),
+  integer: scalar("integer"),
+  bigint: scalar("bigint"),
+  numeric: scalar("numeric"),
+  double: scalar("double"),
+  boolean: scalar("boolean"),
+  timestamptz: scalar("timestamptz"),
+  date: scalar("date"),
+  jsonb: scalar("jsonb"),
+  enum: (ref, columnName) => new ColumnBuilder({ enum: ref.name }, columnName)
+};
+
+// src/constants.ts
+var NAMESPACE_PATTERN = /^[a-z][a-z0-9_]{0,40}$/;
+var IDENTIFIER_PATTERN = /^[a-z][a-z0-9_]*$/;
+var MAX_IDENTIFIER_LENGTH = 63;
+var ORM_DATA_TOKEN_HEADER = "x-sequence-data-token";
+var ORM_SERVICE_DATA_TOKEN_HEADER = "x-sequence-data-token-service";
+var CAPABILITY_KEY_PATTERN = /^(?:org\/)?[a-z0-9-]{1,64}$/;
+var CLAIM_KEY_PATTERN = /^[a-z][a-z0-9_]*$/;
+var QUALIFIED_TABLE_PATTERN = /^[a-z][a-z0-9_]*\.[a-z][a-z0-9_]*$/;
+var SYNCED_SOURCE_PATTERN = /^gold\.[a-z][a-z0-9_]*$/;
+var ORM_SCHEMA_PREFIX = "orm_";
+var CONSUMER_ROLE_SUFFIX = "_consumer";
+var ormSchemaName = (namespace) => `${ORM_SCHEMA_PREFIX}${namespace}`;
+var consumerRoleName = (namespace) => `${ORM_SCHEMA_PREFIX}${namespace}${CONSUMER_ROLE_SUFFIX}`;
+var DEFINITION_FILE_EXTENSIONS = [".yml", ".yaml"];
+var NAMESPACE_CONFIG_FILENAMES = /* @__PURE__ */ new Set(["namespace.yaml", "namespace.yml"]);
+var HASH_DOMAIN = "sequence-orm-definitions\0";
+var MAX_DEFINITION_FILE_BYTES = 1024 * 1024;
+var RESERVED_TABLE_NAMES = /* @__PURE__ */ new Set(["actions", "query"]);
+var RESERVED_COLUMN_NAMES = /* @__PURE__ */ new Set(["select", "order", "limit", "offset"]);
+
+// src/errors.ts
+var OrmDefinitionError = class extends Error {
+  constructor(message, file) {
+    super(file ? `${file}: ${message}` : message);
+    this.file = file;
+  }
+  name = "OrmDefinitionError";
+};
+var PredicateParseError = class extends Error {
+  constructor(message, position) {
+    super(`${message} (at position ${position})`);
+    this.position = position;
+  }
+  name = "PredicateParseError";
+};
+
+// src/authoring/registry.ts
+var CONTEXT_STACK_KEY = Symbol.for("sequence.orm.authoring.context-stack.v2");
+function contextStack() {
+  const holder = globalThis;
+  const existing = holder[CONTEXT_STACK_KEY];
+  if (Array.isArray(existing)) {
+    return existing;
+  }
+  const created = [];
+  holder[CONTEXT_STACK_KEY] = created;
+  return created;
+}
+function beginAuthoringContext() {
+  const context = { currentFile: void 0, tables: [], enums: [], configs: [] };
+  contextStack().push(context);
+  return context;
+}
+function endAuthoringContext(context) {
+  const stack = contextStack();
+  const top = stack[stack.length - 1];
+  if (top !== context) {
+    throw new Error("endAuthoringContext: the given context is not the active one \u2014 begin/end calls are mismatched");
+  }
+  stack.pop();
+}
+function activeAuthoringContext() {
+  const stack = contextStack();
+  return stack[stack.length - 1];
+}
+function register(bucket, value) {
+  const context = activeAuthoringContext();
+  if (!context) return;
+  context[bucket].push({ value, file: context.currentFile });
+}
+function registerTable(value) {
+  register("tables", value);
+}
+function registerEnum(value) {
+  register("enums", value);
+}
+function registerNamespaceConfig(value) {
+  register("configs", value);
+}
+
+// src/authoring/table.ts
+var TABLE_BRAND = "seq-table";
+var LINK_BRAND = "seq-link";
+function toOne(target, options) {
+  return {
+    kind: LINK_BRAND,
+    linkKind: "toOne",
+    target,
+    on: options.on,
+    references: options.references,
+    enforce: options.enforce ?? false,
+    description: options.description
+  };
+}
+function toMany(target, options) {
+  return {
+    kind: LINK_BRAND,
+    linkKind: "toMany",
+    target,
+    on: options.on,
+    references: options.references,
+    enforce: false,
+    description: options.description
+  };
+}
+function toPlatformUser(options) {
+  return {
+    kind: LINK_BRAND,
+    linkKind: "toPlatformUser",
+    target: void 0,
+    on: options.on,
+    references: options.references,
+    enforce: false,
+    description: options.description
+  };
+}
+function isSeqLink(value) {
+  return typeof value === "object" && value !== null && value.kind === LINK_BRAND;
+}
+function isSeqTable(value) {
+  return typeof value === "object" && value !== null && value.kind === TABLE_BRAND;
+}
+function assertIdentifier({ value, what, file }) {
+  if (!IDENTIFIER_PATTERN.test(value) || value.length > MAX_IDENTIFIER_LENGTH) {
+    throw new OrmDefinitionError(
+      `${what} "${value}" must match ${IDENTIFIER_PATTERN} and be at most ${MAX_IDENTIFIER_LENGTH} characters`,
+      file
+    );
+  }
+}
+function defineTable(name, columns, config = {}) {
+  const file = activeAuthoringContext()?.currentFile;
+  assertIdentifier({ value: name, what: "table name", file });
+  const entries = Object.entries(columns);
+  if (entries.length === 0) {
+    throw new OrmDefinitionError(`table "${name}" declares no columns`, file);
+  }
+  const seenColumnNames = /* @__PURE__ */ new Map();
+  for (const [propertyName, builder] of entries) {
+    if (!isColumnBuilder(builder)) {
+      throw new OrmDefinitionError(
+        `table "${name}": column "${propertyName}" is not a column builder \u2014 use the t.* factories (t.uuid(), t.text(), \u2026)`,
+        file
+      );
+    }
+    const columnName = builder.columnNameFor(propertyName);
+    assertIdentifier({ value: columnName, what: `table "${name}": column "${propertyName}" column name`, file });
+    const existing = seenColumnNames.get(columnName);
+    if (existing !== void 0) {
+      throw new OrmDefinitionError(
+        `table "${name}": columns "${existing}" and "${propertyName}" both map to Postgres column "${columnName}"`,
+        file
+      );
+    }
+    seenColumnNames.set(columnName, propertyName);
+  }
+  const table = { kind: TABLE_BRAND, tableName: name, columns, config, source: void 0, file };
+  registerTable(table);
+  return table;
+}
+function defineSyncedTable(name, config) {
+  const file = activeAuthoringContext()?.currentFile;
+  assertIdentifier({ value: name, what: "table name", file });
+  if (!SYNCED_SOURCE_PATTERN.test(config.source)) {
+    throw new OrmDefinitionError(
+      `synced table "${name}": source "${config.source}" must match ${SYNCED_SOURCE_PATTERN} (gold layer only)`,
+      file
+    );
+  }
+  const table = {
+    kind: TABLE_BRAND,
+    tableName: name,
+    columns: {},
+    config: config.description !== void 0 ? { description: config.description } : {},
+    source: config.source,
+    file
+  };
+  registerTable(table);
+  return table;
+}
+function defineEnum(name, values) {
+  const file = activeAuthoringContext()?.currentFile;
+  assertIdentifier({ value: name, what: "enum name", file });
+  if (values.length === 0 || values.length > 100) {
+    throw new OrmDefinitionError(`enum "${name}" must declare between 1 and 100 values`, file);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const value of values) {
+    if (value.length === 0 || value.length > MAX_IDENTIFIER_LENGTH) {
+      throw new OrmDefinitionError(
+        `enum "${name}": value ${JSON.stringify(value)} must be 1-${MAX_IDENTIFIER_LENGTH} characters`,
+        file
+      );
+    }
+    if (seen.has(value)) {
+      throw new OrmDefinitionError(`enum "${name}" declares duplicate value "${value}"`, file);
+    }
+    seen.add(value);
+  }
+  const ref = { kind: ENUM_BRAND, name, values: [...values] };
+  registerEnum(ref);
+  return ref;
+}
+var CANONICAL_FORMAT = 2;
+var IDENTIFIER_RE = /^[a-z][a-z0-9_]*$/;
+var identifier = zod.z.string().min(1).max(63).regex(IDENTIFIER_RE);
+var COLUMN_TYPES = [
+  "uuid",
+  "text",
+  "integer",
+  "bigint",
+  "numeric",
+  "double",
+  "boolean",
+  "timestamptz",
+  "date",
+  "jsonb"
+];
+var columnTypeSchema = zod.z.enum(COLUMN_TYPES);
+var canonicalEnumSchema = zod.z.object({
+  name: identifier,
+  values: zod.z.array(zod.z.string().min(1).max(63)).min(1).max(100)
+});
+var canonicalColumnSchema = zod.z.object({
+  /** Property name in TS (camelCase); columnName is the Postgres name. */
+  name: zod.z.string().min(1).max(63),
+  columnName: identifier,
+  type: zod.z.union([columnTypeSchema, zod.z.object({ enum: identifier })]),
+  nullable: zod.z.boolean().default(true),
+  unique: zod.z.boolean().default(false),
+  /** Literal default, or one of the allowlisted SQL functions. */
+  default: zod.z.union([zod.z.string(), zod.z.number(), zod.z.boolean(), zod.z.null()]).optional(),
+  defaultFn: zod.z.enum(["gen_random_uuid()", "now()"]).optional(),
+  description: zod.z.string().max(500).optional(),
+  /** Migration hints — same semantics as v1. */
+  renamedFrom: identifier.optional(),
+  cast: zod.z.string().max(200).optional(),
+  deprecated: zod.z.boolean().default(false)
+});
+var canonicalLinkSchema = zod.z.object({
+  name: zod.z.string().min(1).max(63),
+  kind: zod.z.enum(["toOne", "toMany", "toPlatformUser"]),
+  /** Target table name (namespace-local). Absent for toPlatformUser. */
+  target: identifier.optional(),
+  /** FK column on the owning side (toOne/toPlatformUser: on this table; toMany: on the target). */
+  on: identifier,
+  /** Referenced column on the target (default: target's PK / platform user `sub`). */
+  references: identifier.optional(),
+  /** enforce: true emits a real FK constraint (same-namespace toOne only). */
+  enforce: zod.z.boolean().default(false),
+  description: zod.z.string().max(500).optional()
+});
+var canonicalIndexSchema = zod.z.object({
+  columns: zod.z.array(identifier).min(1),
+  unique: zod.z.boolean().default(false),
+  name: identifier.optional()
+});
+var policyVariantSchema = zod.z.object({
+  /** Claims-only guard (capability()/role()/claim() comparisons — no columns). */
+  when: zod.z.string().min(1).max(1e3),
+  /** Exactly one of: allow-all bypass, or a row predicate. */
+  allow: zod.z.literal(true).optional(),
+  policy: zod.z.string().min(1).max(2e3).optional()
+}).refine((v) => v.allow === true !== (typeof v.policy === "string"), {
+  message: "A variant declares exactly one of allow: true or policy"
+});
+var policyExpressionSchema = zod.z.union([
+  zod.z.string().min(1).max(2e3),
+  zod.z.object({
+    default: zod.z.string().min(1).max(2e3),
+    variants: zod.z.array(policyVariantSchema).max(10).default([])
+  })
+]);
+var canonicalPoliciesSchema = zod.z.object({
+  read: policyExpressionSchema.optional(),
+  write: policyExpressionSchema.optional()
+});
+var canonicalActionSchema = zod.z.object({
+  name: identifier,
+  requires: zod.z.string().max(1e3).optional(),
+  params: zod.z.record(zod.z.string(), zod.z.object({
+    type: columnTypeSchema,
+    nullable: zod.z.boolean().default(false)
+  })).default({}),
+  executes: zod.z.string().min(1).max(1e4),
+  returns: zod.z.enum(["rows", "rowsAffected", "scalar"]).default("rowsAffected"),
+  audit: zod.z.object({ action: zod.z.string(), resource: zod.z.string() }).optional()
+});
+var canonicalTableSchema = zod.z.object({
+  table: identifier,
+  description: zod.z.string().max(2e3).optional(),
+  /** Table-level rename hint (new in v2). */
+  renamedFrom: identifier.optional(),
+  /** Synced/reflected read-only tables (`source: gold.*`) — v1 semantics. */
+  source: zod.z.string().regex(/^gold\.[a-z][a-z0-9_]*$/).optional(),
+  columns: zod.z.array(canonicalColumnSchema).default([]),
+  primaryKey: zod.z.array(identifier).min(1).max(8).optional(),
+  links: zod.z.array(canonicalLinkSchema).default([]),
+  indexes: zod.z.array(canonicalIndexSchema).default([]),
+  policies: canonicalPoliciesSchema.default({}),
+  actions: zod.z.array(canonicalActionSchema).default([])
+});
+var canonicalDefinitionSchema = zod.z.object({
+  definition_format: zod.z.literal(CANONICAL_FORMAT),
+  namespace: identifier.max(41),
+  description: zod.z.string().max(2e3).optional(),
+  enums: zod.z.array(canonicalEnumSchema).default([]),
+  tables: zod.z.array(canonicalTableSchema).min(0).max(500),
+  /** Verbatim custom-roles grammar (@sequenceholdings/custom-roles-manifest). */
+  capabilities: zod.z.object({
+    roles: zod.z.unknown().optional(),
+    uses: zod.z.array(zod.z.string()).default([])
+  }).default({ uses: [] })
+});
+function normalizeCanonical(definition) {
+  const sortByName = (items) => [...items].sort((a, b) => a.name.localeCompare(b.name));
+  return {
+    ...definition,
+    enums: sortByName(definition.enums),
+    tables: [...definition.tables].sort((a, b) => a.table.localeCompare(b.table)).map((t2) => ({
+      ...t2,
+      links: sortByName(t2.links),
+      indexes: [...t2.indexes].sort((a, b) => (a.name ?? a.columns.join("_")).localeCompare(b.name ?? b.columns.join("_"))),
+      actions: sortByName(t2.actions)
+    }))
+  };
+}
+function stableJson(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+  const entries = Object.entries(value).filter(([, entryValue]) => entryValue !== void 0).sort(([a], [b]) => a < b ? -1 : 1).map(([key, entryValue]) => `${JSON.stringify(key)}:${stableJson(entryValue)}`);
+  return `{${entries.join(",")}}`;
+}
+function emptyToNull(value) {
+  if (value == null) return null;
+  if (Array.isArray(value)) return value.length === 0 ? null : value;
+  if (typeof value === "object" && Object.keys(value).length === 0) return null;
+  return value;
+}
+function canonicalTable(table) {
+  return {
+    table: table.table,
+    description: table.description ?? null,
+    columns: table.columns ?? null,
+    source: table.source ?? null,
+    links: emptyToNull(table.links),
+    indexes: emptyToNull(table.indexes),
+    policies: {
+      read: table.policies?.read?.source ?? null,
+      write: table.policies?.write?.source ?? null
+    },
+    actions: emptyToNull(
+      Object.fromEntries(
+        Object.entries(table.actions ?? {}).map(([name, action]) => [
+          name,
+          {
+            description: action.description ?? null,
+            requires: action.requires?.source ?? null,
+            params: emptyToNull(action.params),
+            validates: emptyToNull(action.validates?.map((entry) => entry.source)),
+            executes: action.executes,
+            returns: emptyToNull(action.returns),
+            audit: action.audit ?? null
+          }
+        ])
+      )
+    )
+  };
+}
+function canonicalCapabilities(capabilities) {
+  const { definitions, capabilities: declared } = capabilities.roles;
+  const isEmpty = Object.keys(definitions).length === 0 && Object.keys(declared).length === 0 && capabilities.uses.length === 0;
+  if (isEmpty) return null;
+  return {
+    roles: {
+      definitions: Object.fromEntries(
+        Object.entries(definitions).map(([key, def]) => [
+          key,
+          {
+            ...def.description !== void 0 ? { description: def.description } : {},
+            default: def.default,
+            inherits: [...def.inherits].sort(),
+            grants: [...def.grants].sort()
+          }
+        ])
+      ),
+      capabilities: Object.fromEntries(
+        Object.entries(declared).map(([key, cap]) => [
+          key,
+          cap.description !== void 0 ? { description: cap.description } : {}
+        ])
+      )
+    },
+    uses: [...capabilities.uses].sort()
+  };
+}
+function canonicalizeDefinition(definition) {
+  return {
+    namespace: definition.namespace,
+    description: definition.description,
+    capabilities: canonicalCapabilities(definition.capabilities),
+    tables: definition.tables.map(canonicalTable)
+  };
+}
+function computeDefinitionHash(definition) {
+  return crypto.createHash("sha256").update(HASH_DOMAIN).update(stableJson(canonicalizeDefinition(definition))).digest("hex");
+}
+
+// src/authoring/namespace.ts
+var NAMESPACE_CONFIG_BRAND = "seq-namespace-config";
+function isSeqNamespaceConfig(value) {
+  return typeof value === "object" && value !== null && value.kind === NAMESPACE_CONFIG_BRAND;
+}
+function defineNamespace(input) {
+  const file = activeAuthoringContext()?.currentFile;
+  if (!NAMESPACE_PATTERN.test(input.namespace)) {
+    throw new OrmDefinitionError(`namespace "${input.namespace}" must match ${NAMESPACE_PATTERN}`, file);
+  }
+  const config = {
+    kind: NAMESPACE_CONFIG_BRAND,
+    namespace: input.namespace,
+    description: input.description,
+    capabilities: input.capabilities ?? {},
+    file
+  };
+  registerNamespaceConfig(config);
+  return config;
+}
+function serializeNamespace(input) {
+  const { config, tables } = input;
+  const enums = input.enums ?? [];
+  const tablesByName = /* @__PURE__ */ new Map();
+  for (const table of tables) {
+    const existing = tablesByName.get(table.tableName);
+    if (existing) {
+      throw new OrmDefinitionError(
+        `duplicate table "${table.tableName}" (defined in ${describeFile(existing)} and ${describeFile(table)})`,
+        table.file
+      );
+    }
+    tablesByName.set(table.tableName, table);
+  }
+  const enumsByName = /* @__PURE__ */ new Map();
+  for (const ref of enums) {
+    if (enumsByName.has(ref.name)) {
+      throw new OrmDefinitionError(`duplicate enum "${ref.name}"`, config.file);
+    }
+    enumsByName.set(ref.name, ref);
+  }
+  const canonicalTables = tables.map((table) => buildCanonicalTable({ table, tablesByName, enumsByName }));
+  const canonicalEnums = [...enumsByName.values()].map((ref) => ({
+    name: ref.name,
+    values: [...ref.values]
+  }));
+  const candidate = {
+    definition_format: CANONICAL_FORMAT,
+    namespace: config.namespace,
+    enums: canonicalEnums,
+    tables: canonicalTables,
+    capabilities: {
+      ...config.capabilities.roles !== void 0 ? { roles: config.capabilities.roles } : {},
+      uses: [...config.capabilities.uses ?? []]
+    }
+  };
+  if (config.description !== void 0) candidate.description = config.description;
+  let parsed;
+  try {
+    parsed = canonicalDefinitionSchema.parse(candidate);
+  } catch (error) {
+    if (error instanceof zod.z.ZodError) {
+      throw new OrmDefinitionError(`namespace "${config.namespace}": ${formatZodIssues(error)}`, config.file);
+    }
+    throw error;
+  }
+  return normalizeCanonical(parsed);
+}
+function computeCanonicalHash(definition) {
+  return crypto.createHash("sha256").update(HASH_DOMAIN).update(stableJson(definition)).digest("hex");
+}
+function buildCanonicalTable({ table, tablesByName, enumsByName }) {
+  const candidate = {
+    table: table.tableName,
+    columns: [],
+    links: [],
+    indexes: [],
+    policies: {},
+    actions: []
+  };
+  if (table.config.description !== void 0) candidate.description = table.config.description;
+  if (table.config.renamedFrom !== void 0) candidate.renamedFrom = table.config.renamedFrom;
+  if (table.source !== void 0) candidate.source = table.source;
+  const columnLevelPk = [];
+  for (const [propertyName, builder] of Object.entries(table.columns)) {
+    const column = builder.toCanonicalColumn(propertyName);
+    const enumName = builder.enumName;
+    if (enumName !== void 0 && !enumsByName.has(enumName)) {
+      throw new OrmDefinitionError(
+        `table "${table.tableName}": column "${propertyName}" references enum "${enumName}" which is not passed to serializeNamespace \u2014 declare it with defineEnum and include it`,
+        table.file
+      );
+    }
+    if (builder.isPrimaryKey) columnLevelPk.push(column.columnName);
+    candidate.columns?.push(column);
+  }
+  if (table.config.primaryKey !== void 0) {
+    if (columnLevelPk.length > 0) {
+      throw new OrmDefinitionError(
+        `table "${table.tableName}": declare the primary key either with .primaryKey() on columns or with config.primaryKey \u2014 not both`,
+        table.file
+      );
+    }
+    candidate.primaryKey = table.config.primaryKey.map(
+      (ref) => resolveColumnRef({ table, ref, role: "primaryKey" })
+    );
+  } else if (columnLevelPk.length > 0) {
+    candidate.primaryKey = columnLevelPk;
+  }
+  for (const index3 of table.config.indexes ?? []) {
+    const entry = {
+      columns: index3.columns.map((ref) => resolveColumnRef({ table, ref, role: "index" }))
+    };
+    if (index3.unique !== void 0) entry.unique = index3.unique;
+    if (index3.name !== void 0) entry.name = index3.name;
+    candidate.indexes?.push(entry);
+  }
+  for (const [linkName, link] of Object.entries(table.config.links ?? {})) {
+    candidate.links?.push(buildCanonicalLink({ table, linkName, link, tablesByName }));
+  }
+  const policies = {};
+  if (table.config.policies?.read !== void 0) policies.read = toCanonicalPolicy(table.config.policies.read);
+  if (table.config.policies?.write !== void 0) policies.write = toCanonicalPolicy(table.config.policies.write);
+  candidate.policies = policies;
+  for (const action of table.config.actions ?? []) {
+    candidate.actions?.push({
+      name: action.name,
+      ...action.requires !== void 0 ? { requires: action.requires } : {},
+      params: Object.fromEntries(
+        Object.entries(action.params ?? {}).map(([name, param]) => [
+          name,
+          { type: param.type, nullable: param.nullable ?? false }
+        ])
+      ),
+      executes: action.executes,
+      returns: action.returns ?? "rowsAffected",
+      ...action.audit !== void 0 ? { audit: action.audit } : {}
+    });
+  }
+  try {
+    return canonicalTableSchema.parse(candidate);
+  } catch (error) {
+    if (error instanceof zod.z.ZodError) {
+      throw new OrmDefinitionError(`table "${table.tableName}": ${formatZodIssues(error)}`, table.file);
+    }
+    throw error;
+  }
+}
+function buildCanonicalLink({
+  table,
+  linkName,
+  link,
+  tablesByName
+}) {
+  const fail = (message) => {
+    throw new OrmDefinitionError(`table "${table.tableName}": link "${linkName}" ${message}`, table.file);
+  };
+  if (link.enforce && link.linkKind !== "toOne") {
+    return fail("sets enforce: true, which is only supported on toOne links");
+  }
+  if (link.linkKind === "toPlatformUser") {
+    if (link.target !== void 0) return fail("is toPlatformUser and must not declare a target table");
+    return {
+      name: linkName,
+      kind: "toPlatformUser",
+      on: resolveColumnRef({ table, ref: link.on, role: `link "${linkName}" on` }),
+      ...link.references !== void 0 ? { references: deriveColumnName(link.references) } : {},
+      enforce: false,
+      ...link.description !== void 0 ? { description: link.description } : {}
+    };
+  }
+  const target = resolveTableRef({ ref: link.target, fail });
+  if (!tablesByName.has(target.tableName)) {
+    return fail(`targets table "${target.tableName}" which is not part of this namespace`);
+  }
+  const owningSide = link.linkKind === "toOne" ? table : target;
+  return {
+    name: linkName,
+    kind: link.linkKind,
+    target: target.tableName,
+    on: resolveColumnRef({ table: owningSide, ref: link.on, role: `link "${linkName}" on` }),
+    ...link.references !== void 0 ? { references: resolveColumnRef({ table: target, ref: link.references, role: `link "${linkName}" references` }) } : {},
+    enforce: link.enforce,
+    ...link.description !== void 0 ? { description: link.description } : {}
+  };
+}
+function resolveTableRef({ ref, fail }) {
+  if (ref === void 0) return fail("declares no target table");
+  if (typeof ref !== "function") return ref;
+  let resolved;
+  try {
+    resolved = ref();
+  } catch (error) {
+    return fail(
+      `target thunk threw (${error instanceof Error ? error.message : String(error)}) \u2014 lazy refs resolve at serialize time; make sure the target module ran`
+    );
+  }
+  if (!isSeqTable(resolved)) return fail("target thunk did not return a table defined with defineTable");
+  return resolved;
+}
+function resolveColumnRef({ table, ref, role }) {
+  const direct = table.columns[ref];
+  if (direct) return direct.columnNameFor(ref);
+  for (const [propertyName, builder] of Object.entries(table.columns)) {
+    if (builder.columnNameFor(propertyName) === ref) return ref;
+  }
+  const known = Object.keys(table.columns).join(", ");
+  throw new OrmDefinitionError(
+    `table "${table.tableName}": ${role} references unknown column "${ref}" (known columns: ${known || "none"})`,
+    table.file
+  );
+}
+function toCanonicalPolicy(policy) {
+  if (typeof policy === "string") return policy;
+  return {
+    default: policy.default,
+    variants: (policy.variants ?? []).map((variant) => ({
+      when: variant.when,
+      ...variant.allow === true ? { allow: true } : {},
+      ...variant.policy !== void 0 ? { policy: variant.policy } : {}
+    }))
+  };
+}
+function describeFile(table) {
+  return table.file ?? "<unknown file>";
+}
+function formatZodIssues(error) {
+  return error.issues.map((issue) => issue.path.length > 0 ? `${issue.path.join(".")}: ${issue.message}` : issue.message).join("; ");
+}
+var NAMESPACE_CONFIG_FILE = "sequence.config.ts";
+var SCHEMA_DIR = "schema";
+async function loadNamespaceFromDir(dir, options = {}) {
+  const root = await promises.realpath(dir).catch(() => {
+    throw new OrmDefinitionError(`namespace directory not found: ${dir}`);
+  });
+  const configPath = path.join(root, NAMESPACE_CONFIG_FILE);
+  const configStat = await promises.stat(configPath).catch(() => void 0);
+  if (!configStat?.isFile()) {
+    throw new OrmDefinitionError(`${NAMESPACE_CONFIG_FILE} not found in ${dir}`);
+  }
+  const schemaFiles = await listSchemaFiles(root);
+  const files = [NAMESPACE_CONFIG_FILE, ...schemaFiles];
+  purgeModuleCache(root);
+  const jiti$1 = jiti.createJiti((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href)), {
+    interopDefault: true,
+    fsCache: false,
+    ...options.ormModulePath !== void 0 ? { alias: { "@sequenceholdings/orm": options.ormModulePath } } : {}
+  });
+  const context = beginAuthoringContext();
+  try {
+    for (const file of files) {
+      context.currentFile = file;
+      try {
+        await jiti$1.import(path.join(root, file));
+      } catch (error) {
+        if (error instanceof Error && error.name === "OrmDefinitionError") throw error;
+        throw new OrmDefinitionError(
+          `failed to load: ${error instanceof Error ? error.message : String(error)}`,
+          file
+        );
+      }
+    }
+  } finally {
+    context.currentFile = void 0;
+    endAuthoringContext(context);
+  }
+  const configs = [];
+  for (const entry of context.configs) {
+    if (isSeqNamespaceConfig(entry.value)) configs.push({ value: entry.value, file: entry.file });
+  }
+  const configEntry = configs[0];
+  if (!configEntry) {
+    throw new OrmDefinitionError(
+      "no namespace config registered \u2014 sequence.config.ts must call defineNamespace(...) at import time",
+      NAMESPACE_CONFIG_FILE
+    );
+  }
+  if (configs.length > 1) {
+    const where = configs.map((entry) => entry.file ?? "<unknown file>").join(", ");
+    throw new OrmDefinitionError(
+      `defineNamespace called ${configs.length} times (${where}) \u2014 declare exactly one namespace config`
+    );
+  }
+  const tables = [];
+  for (const entry of context.tables) {
+    if (isSeqTable(entry.value)) tables.push(entry.value);
+  }
+  if (tables.length === 0) {
+    throw new OrmDefinitionError(
+      `no tables registered \u2014 ${SCHEMA_DIR}/*.ts modules must call defineTable(...) at import time`
+    );
+  }
+  const enums = [];
+  for (const entry of context.enums) {
+    if (isEnumRef(entry.value)) enums.push(entry.value);
+  }
+  const canonical = serializeNamespace({ config: configEntry.value, tables, enums });
+  return { canonical, hash: computeCanonicalHash(canonical), files };
+}
+async function listSchemaFiles(root) {
+  const schemaDir = path.join(root, SCHEMA_DIR);
+  const entries = await promises.readdir(schemaDir, { withFileTypes: true }).catch(() => []);
+  return entries.filter(
+    (entry) => entry.isFile() && entry.name.endsWith(".ts") && !entry.name.endsWith(".d.ts") && !entry.name.startsWith(".")
+  ).map((entry) => path.join(SCHEMA_DIR, entry.name)).sort();
+}
+function purgeModuleCache(root) {
+  const require2 = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href)));
+  const prefix = root.endsWith(path.sep) ? root : `${root}${path.sep}`;
+  for (const key of Object.keys(require2.cache)) {
+    if (key.startsWith(prefix)) delete require2.cache[key];
+  }
+}
 
 // src/codegen/types.ts
 var WIRE_TYPES = {
@@ -24,7 +876,7 @@ var WIRE_TYPES = {
 };
 function generateNamespaceTypes(definition) {
   const lines = [
-    `// Generated by \`seq-studio orm generate\` from the '${definition.namespace}' definitions \u2014 do not edit.`,
+    `// Generated by \`seq-studio orm apply\` from the '${definition.namespace}' definitions \u2014 do not edit.`,
     "",
     `export type ${typesInterfaceName(definition.namespace)} = {`
   ];
@@ -86,43 +938,6 @@ function columnWireType(column) {
   return notNull || base === "unknown" ? base : `${base} | null`;
 }
 
-// src/constants.ts
-var NAMESPACE_PATTERN = /^[a-z][a-z0-9_]{0,40}$/;
-var IDENTIFIER_PATTERN = /^[a-z][a-z0-9_]*$/;
-var MAX_IDENTIFIER_LENGTH = 63;
-var ORM_DATA_TOKEN_HEADER = "x-sequence-data-token";
-var ORM_SERVICE_DATA_TOKEN_HEADER = "x-sequence-data-token-service";
-var CAPABILITY_KEY_PATTERN = /^(?:org\/)?[a-z0-9-]{1,64}$/;
-var CLAIM_KEY_PATTERN = /^[a-z][a-z0-9_]*$/;
-var QUALIFIED_TABLE_PATTERN = /^[a-z][a-z0-9_]*\.[a-z][a-z0-9_]*$/;
-var SYNCED_SOURCE_PATTERN = /^gold\.[a-z][a-z0-9_]*$/;
-var ORM_SCHEMA_PREFIX = "orm_";
-var CONSUMER_ROLE_SUFFIX = "_consumer";
-var ormSchemaName = (namespace) => `${ORM_SCHEMA_PREFIX}${namespace}`;
-var consumerRoleName = (namespace) => `${ORM_SCHEMA_PREFIX}${namespace}${CONSUMER_ROLE_SUFFIX}`;
-var DEFINITION_FILE_EXTENSIONS = [".yml", ".yaml"];
-var NAMESPACE_CONFIG_FILENAMES = /* @__PURE__ */ new Set(["namespace.yaml", "namespace.yml"]);
-var HASH_DOMAIN = "sequence-orm-definitions\0";
-var MAX_DEFINITION_FILE_BYTES = 1024 * 1024;
-var RESERVED_TABLE_NAMES = /* @__PURE__ */ new Set(["actions", "query"]);
-var RESERVED_COLUMN_NAMES = /* @__PURE__ */ new Set(["select", "order", "limit", "offset"]);
-
-// src/errors.ts
-var OrmDefinitionError = class extends Error {
-  constructor(message, file) {
-    super(file ? `${file}: ${message}` : message);
-    this.file = file;
-  }
-  name = "OrmDefinitionError";
-};
-var PredicateParseError = class extends Error {
-  constructor(message, position) {
-    super(`${message} (at position ${position})`);
-    this.position = position;
-  }
-  name = "PredicateParseError";
-};
-
 // src/predicate/ast.ts
 var COMPARE_OPS = ["=", "!=", "<", "<=", ">", ">="];
 function walkPredicate(predicate, visit) {
@@ -161,7 +976,7 @@ var tableReferenceSchema = zod.z.string().refine(
 var isQualifiedReference = (reference) => reference.includes(".");
 
 // src/schema/columns.ts
-var COLUMN_TYPES = [
+var COLUMN_TYPES2 = [
   "uuid",
   "text",
   "integer",
@@ -173,7 +988,7 @@ var COLUMN_TYPES = [
   "date",
   "jsonb"
 ];
-var columnTypeSchema = zod.z.enum(COLUMN_TYPES);
+var columnTypeSchema2 = zod.z.enum(COLUMN_TYPES2);
 var FUNCTION_DEFAULTS = {
   "gen_random_uuid()": ["uuid"],
   "now()": ["timestamptz", "date"]
@@ -202,7 +1017,7 @@ function defaultIssue(value, type) {
   return null;
 }
 var columnSchema = zod.z.strictObject({
-  type: columnTypeSchema,
+  type: columnTypeSchema2,
   primary_key: zod.z.boolean().optional(),
   nullable: zod.z.boolean().optional(),
   unique: zod.z.boolean().optional(),
@@ -469,7 +1284,7 @@ var NAMED_PARAM_PATTERN = /(?<!:):([a-z][a-z0-9_]*)/g;
 var QUOTED_STRING_PATTERN = /'(?:[^']|'')*'/g;
 var SQL_COMMENT_PATTERN = /--|\/\*/;
 var actionParamSchema = zod.z.strictObject({
-  type: columnTypeSchema,
+  type: columnTypeSchema2,
   optional: zod.z.boolean().optional(),
   description: zod.z.string().optional()
 });
@@ -502,7 +1317,7 @@ var actionSchema = zod.z.strictObject({
   // function returns those rows (typed in the client); absent → the action
   // reports rows_affected only. The column names/types must match the
   // RETURNING list, which Postgres enforces at CREATE FUNCTION.
-  returns: zod.z.record(identifierSchema, columnTypeSchema).optional(),
+  returns: zod.z.record(identifierSchema, columnTypeSchema2).optional(),
   audit: auditSchema.optional()
 }).superRefine((action, ctx) => {
   const params = Object.keys(action.params ?? {});
@@ -519,30 +1334,53 @@ var actionSchema = zod.z.strictObject({
   if (action.returns && Object.keys(action.returns).length === 0) {
     ctx.addIssue({ code: "custom", message: "returns must declare at least one column", path: ["returns"] });
   }
-  for (const [index2, entry] of (action.validates ?? []).entries()) {
+  for (const [index3, entry] of (action.validates ?? []).entries()) {
     if (!params.includes(entry.param)) {
       ctx.addIssue({
         code: "custom",
         message: `validates references undeclared param '${entry.param}'`,
-        path: ["validates", index2]
+        path: ["validates", index3]
       });
     }
   }
 });
-function extractNamedParams(sql2) {
-  const withoutStrings = sql2.replace(QUOTED_STRING_PATTERN, "''");
+function extractNamedParams(sql3) {
+  const withoutStrings = sql3.replace(QUOTED_STRING_PATTERN, "''");
   const names = [...withoutStrings.matchAll(NAMED_PARAM_PATTERN)].map((match) => match[1]);
   return [...new Set(names)];
 }
 function actionStatementSources(executes) {
   return (Array.isArray(executes) ? executes : [executes]).map((statement) => statement.trim());
 }
+var WRITE_TARGET_PATTERNS = [
+  /^insert\s+into\s+(?:"?[a-z_][a-z0-9_]*"?\.)?"?([a-z_][a-z0-9_]*)"?/i,
+  /^update\s+(?:only\s+)?(?:"?[a-z_][a-z0-9_]*"?\.)?"?([a-z_][a-z0-9_]*)"?/i,
+  /^delete\s+from\s+(?:only\s+)?(?:"?[a-z_][a-z0-9_]*"?\.)?"?([a-z_][a-z0-9_]*)"?/i
+];
+function actionWriteTargets(action) {
+  const targets = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const statement of actionStatementSources(action.executes)) {
+    const masked = statement.replace(QUOTED_STRING_PATTERN, "''");
+    for (const pattern of WRITE_TARGET_PATTERNS) {
+      const match = pattern.exec(masked);
+      if (!match) continue;
+      const table = match[1].toLowerCase();
+      if (!seen.has(table)) {
+        seen.add(table);
+        targets.push(table);
+      }
+      break;
+    }
+  }
+  return targets;
+}
 function executesIssues(executes, declaredParams, hasReturns) {
   const issues = [];
   const statements = actionStatementSources(executes);
-  statements.forEach((statement, index2) => {
+  statements.forEach((statement, index3) => {
     const withoutStrings = statement.replace(QUOTED_STRING_PATTERN, "''");
-    const at = statements.length > 1 ? ` (statement ${index2 + 1})` : "";
+    const at = statements.length > 1 ? ` (statement ${index3 + 1})` : "";
     if (!EXECUTES_VERB_PATTERN.test(statement)) issues.push(`executes must be INSERT, UPDATE, or DELETE${at}`);
     if (withoutStrings.replace(/;\s*$/, "").includes(";")) issues.push(`each executes entry must be a single statement${at}`);
     if (SQL_COMMENT_PATTERN.test(withoutStrings)) issues.push(`executes must not contain SQL comments${at}`);
@@ -552,7 +1390,7 @@ function executesIssues(executes, declaredParams, hasReturns) {
     if (BARE_CLAIM_CALL_PATTERN.test(withoutStrings.replace(MASKED_CLAIM_CALL_PATTERN, ""))) {
       issues.push(`executes has a malformed claim()/capability() call \u2014 use e.g. claim('sub')${at}`);
     }
-    if (RETURNING_PATTERN.test(withoutStrings) && !(hasReturns && index2 === statements.length - 1)) {
+    if (RETURNING_PATTERN.test(withoutStrings) && !(hasReturns && index3 === statements.length - 1)) {
       issues.push(
         hasReturns ? `only the last executes statement may use RETURNING${at}` : `executes must not use RETURNING unless the action declares returns${at}`
       );
@@ -662,8 +1500,8 @@ var actionParamArg = (name) => `p_${name}`;
 function compileActionStatements(action, renderParam = actionParamArg) {
   return actionStatementSources(action.executes).map((statement) => compileStatement(statement, renderParam));
 }
-function compileStatement(sql2, renderParam) {
-  const compiled = sql2.replace(TOKEN_PATTERN, (token, claimKey, capabilityKey, paramName) => {
+function compileStatement(sql3, renderParam) {
+  const compiled = sql3.replace(TOKEN_PATTERN, (token, claimKey, capabilityKey, paramName) => {
     if (claimKey !== void 0) {
       if (!CLAIM_KEY_PATTERN.test(claimKey)) throw new OrmDefinitionError(`invalid claim key in executes: ${token}`);
       return claimExpression(claimKey);
@@ -716,9 +1554,9 @@ function actionPrepareChecks(definition) {
     const order = actionParamOrder(action);
     const signature = order.length > 0 ? ` (${order.map((param) => sqlTypeName(action.params[param].type)).join(", ")})` : "";
     const compiled = compileActionStatements(action, (param) => `$${order.indexOf(param) + 1}`);
-    compiled.forEach((sql2, index2) => {
-      const checked = action.returns && index2 === compiled.length - 1 ? returnProjection(action.returns, sql2) : sql2;
-      statements.push(`PREPARE ${quoteIdentifier(`orm_check_${name}_${index2}`)}${signature} AS ${checked}`);
+    compiled.forEach((sql3, index3) => {
+      const checked = action.returns && index3 === compiled.length - 1 ? returnProjection(action.returns, sql3) : sql3;
+      statements.push(`PREPARE ${quoteIdentifier(`orm_check_${name}_${index3}`)}${signature} AS ${checked}`);
     });
   }
   return statements;
@@ -833,7 +1671,7 @@ var indexSchema = zod.z.union([
     unique: zod.z.boolean().optional(),
     name: identifierSchema.optional()
   })
-]).transform((index2) => Array.isArray(index2) ? { columns: index2 } : index2);
+]).transform((index3) => Array.isArray(index3) ? { columns: index3 } : index3);
 var policiesSchema = zod.z.strictObject({
   read: parsedPredicateSchema.optional(),
   write: parsedPredicateSchema.optional()
@@ -937,15 +1775,15 @@ function validateColumnTable(table, ctx) {
       });
     }
   }
-  for (const [position, index2] of (table.indexes ?? []).entries()) {
-    if (new Set(index2.columns).size !== index2.columns.length) {
+  for (const [position, index3] of (table.indexes ?? []).entries()) {
+    if (new Set(index3.columns).size !== index3.columns.length) {
       ctx.addIssue({
         code: "custom",
         message: "index names a column more than once",
         path: ["indexes", position]
       });
     }
-    for (const column of index2.columns) {
+    for (const column of index3.columns) {
       if (!names.includes(column)) {
         ctx.addIssue({
           code: "custom",
@@ -987,8 +1825,8 @@ function validateDerivedNameLengths(table, ctx) {
       path: ["table"]
     });
   }
-  for (const [position, index2] of (table.indexes ?? []).entries()) {
-    const name = indexName(table.table, index2);
+  for (const [position, index3] of (table.indexes ?? []).entries()) {
+    const name = indexName(table.table, index3);
     if (name.length > MAX_IDENTIFIER_LENGTH) {
       ctx.addIssue({
         code: "custom",
@@ -1228,9 +2066,9 @@ function sortByEnforcedLinks(tables) {
 var enforcedTargets = (table) => Object.values(table.links ?? {}).filter((link) => link.enforce && !isQualifiedReference(link.to) && link.to !== table.table).map((link) => link.to);
 
 // src/engine/snapshot.ts
-function generateSnapshot(definition, previousId2) {
+function generateSnapshot(definition, previousId3) {
   const { imports, schemaName } = buildDrizzleEntities(definition);
-  return api.generateDrizzleJson(imports, previousId2, [schemaName]);
+  return api.generateDrizzleJson(imports, previousId3, [schemaName]);
 }
 var emptySnapshot = (namespace) => api.generateDrizzleJson({}, void 0, [ormSchemaName(namespace)]);
 var CURRENT_SNAPSHOT_VERSION = api.generateDrizzleJson({}).version;
@@ -1387,259 +2225,591 @@ async function guardedRun(run) {
 var STATEMENT_KINDS = ["hint", "ddl", "security", "function"];
 async function planMigration({
   definition,
-  previousSnapshot
-}) {
-  const schema = ormSchemaName(definition.namespace);
-  const previous = previousSnapshot ? normalizeSnapshot(previousSnapshot) : emptySnapshot(definition.namespace);
-  const hints = applyMigrationHints(previous, definition);
-  const snapshot = generateSnapshot(definition, previousId(previous));
-  const ddl = await diffStatements(hints.adjusted, snapshot);
-  const policyDrops = policyDropStatements(schema, snapshotTableNames(previous, schema));
-  const statements = [
-    ...policyDrops.map((sql2) => ({ kind: "security", sql: sql2 })),
-    ...hints.statements.map((sql2) => ({ kind: "hint", sql: sql2 })),
-    ...ddl.map((sql2) => ({ kind: "ddl", sql: sql2.replace(/;\s*$/, "") })),
-    ...securityStatements(definition).map((sql2) => ({ kind: "security", sql: sql2 })),
-    // PREPARE each action's executes first (plpgsql bodies don't check columns
-    // at CREATE), then create the functions. Both reference the tables the DDL
-    // above creates, so they close the plan.
-    ...actionPrepareChecks(definition).map((sql2) => ({ kind: "function", sql: sql2 })),
-    ...actionFunctionStatements(definition).map((sql2) => ({ kind: "function", sql: sql2 }))
-  ];
-  return { namespace: definition.namespace, schema, statements, snapshot };
-}
-var compileNamespace = (definition) => planMigration({ definition });
-var previousId = (snapshot) => snapshot.id;
-function stableJson(value) {
-  if (value === null || typeof value !== "object") return JSON.stringify(value);
-  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
-  const entries = Object.entries(value).filter(([, entryValue]) => entryValue !== void 0).sort(([a], [b]) => a < b ? -1 : 1).map(([key, entryValue]) => `${JSON.stringify(key)}:${stableJson(entryValue)}`);
-  return `{${entries.join(",")}}`;
-}
-function emptyToNull(value) {
-  if (value == null) return null;
-  if (Array.isArray(value)) return value.length === 0 ? null : value;
-  if (typeof value === "object" && Object.keys(value).length === 0) return null;
-  return value;
-}
-function canonicalTable(table) {
-  return {
-    table: table.table,
-    description: table.description ?? null,
-    columns: table.columns ?? null,
-    source: table.source ?? null,
-    links: emptyToNull(table.links),
-    indexes: emptyToNull(table.indexes),
-    policies: {
-      read: table.policies?.read?.source ?? null,
-      write: table.policies?.write?.source ?? null
-    },
-    actions: emptyToNull(
-      Object.fromEntries(
-        Object.entries(table.actions ?? {}).map(([name, action]) => [
-          name,
-          {
-            description: action.description ?? null,
-            requires: action.requires?.source ?? null,
-            params: emptyToNull(action.params),
-            validates: emptyToNull(action.validates?.map((entry) => entry.source)),
-            executes: action.executes,
-            returns: emptyToNull(action.returns),
-            audit: action.audit ?? null
-          }
-        ])
-      )
-    )
-  };
-}
-function canonicalCapabilities(capabilities) {
-  const { definitions, capabilities: declared } = capabilities.roles;
-  const isEmpty = Object.keys(definitions).length === 0 && Object.keys(declared).length === 0 && capabilities.uses.length === 0;
-  if (isEmpty) return null;
-  return {
-    roles: {
-      definitions: Object.fromEntries(
-        Object.entries(definitions).map(([key, def]) => [
-          key,
-          {
-            ...def.description !== void 0 ? { description: def.description } : {},
-            default: def.default,
-            inherits: [...def.inherits].sort(),
-            grants: [...def.grants].sort()
-          }
-        ])
-      ),
-      capabilities: Object.fromEntries(
-        Object.entries(declared).map(([key, cap]) => [
-          key,
-          cap.description !== void 0 ? { description: cap.description } : {}
-        ])
-      )
-    },
-    uses: [...capabilities.uses].sort()
-  };
+  previousSnapshot
+}) {
+  const schema = ormSchemaName(definition.namespace);
+  const previous = previousSnapshot ? normalizeSnapshot(previousSnapshot) : emptySnapshot(definition.namespace);
+  const hints = applyMigrationHints(previous, definition);
+  const snapshot = generateSnapshot(definition, previousId(previous));
+  const ddl = await diffStatements(hints.adjusted, snapshot);
+  const policyDrops = policyDropStatements(schema, snapshotTableNames(previous, schema));
+  const statements = [
+    ...policyDrops.map((sql3) => ({ kind: "security", sql: sql3 })),
+    ...hints.statements.map((sql3) => ({ kind: "hint", sql: sql3 })),
+    ...ddl.map((sql3) => ({ kind: "ddl", sql: sql3.replace(/;\s*$/, "") })),
+    ...securityStatements(definition).map((sql3) => ({ kind: "security", sql: sql3 })),
+    // PREPARE each action's executes first (plpgsql bodies don't check columns
+    // at CREATE), then create the functions. Both reference the tables the DDL
+    // above creates, so they close the plan.
+    ...actionPrepareChecks(definition).map((sql3) => ({ kind: "function", sql: sql3 })),
+    ...actionFunctionStatements(definition).map((sql3) => ({ kind: "function", sql: sql3 }))
+  ];
+  return { namespace: definition.namespace, schema, statements, snapshot };
 }
-function canonicalizeDefinition(definition) {
-  return {
-    namespace: definition.namespace,
-    description: definition.description,
-    capabilities: canonicalCapabilities(definition.capabilities),
-    tables: definition.tables.map(canonicalTable)
-  };
+var compileNamespace = (definition) => planMigration({ definition });
+var previousId = (snapshot) => snapshot.id;
+var FACTORIES2 = {
+  uuid: (name) => pgCore.uuid(name),
+  text: (name) => pgCore.text(name),
+  integer: (name) => pgCore.integer(name),
+  // Mode 'bigint' keeps int8 lossless — mode 'number' silently rounds past
+  // 2^53. The read executor serializes BigInt to string for JSON.
+  bigint: (name) => pgCore.bigint(name, { mode: "bigint" }),
+  numeric: (name) => pgCore.numeric(name),
+  double: (name) => pgCore.doublePrecision(name),
+  boolean: (name) => pgCore.boolean(name),
+  timestamptz: (name) => pgCore.timestamp(name, { withTimezone: true }),
+  date: (name) => pgCore.date(name),
+  jsonb: (name) => pgCore.jsonb(name)
+};
+var SCHEMA_IMPORT_KEY2 = "$schema";
+var enumImportKey = (name) => `$enum_${name}`;
+var columnTablesV2 = (definition) => definition.tables.filter((table) => !table.source);
+function buildDrizzleEntitiesV2(definition) {
+  const schemaName = ormSchemaName(definition.namespace);
+  const schema = pgCore.pgSchema(schemaName);
+  const imports = { [SCHEMA_IMPORT_KEY2]: schema };
+  const tables = {};
+  const built = /* @__PURE__ */ new Map();
+  const enums = /* @__PURE__ */ new Map();
+  for (const enumDefinition of definition.enums) {
+    const values = enumDefinition.values;
+    const builtEnum = schema.enum(enumDefinition.name, values);
+    enums.set(enumDefinition.name, builtEnum);
+    imports[enumImportKey(enumDefinition.name)] = builtEnum;
+  }
+  const byName = new Map(definition.tables.map((table) => [table.table, table]));
+  for (const table of sortByEnforcedLinks2(columnTablesV2(definition))) {
+    const drizzleTable = buildTable2(schema, table, built, enums, byName);
+    built.set(table.table, drizzleTable);
+    imports[table.table] = drizzleTable;
+    tables[table.table] = drizzleTable;
+  }
+  return { imports, tables, schemaName };
 }
-function computeDefinitionHash(definition) {
-  return crypto.createHash("sha256").update(HASH_DOMAIN).update(stableJson(canonicalizeDefinition(definition))).digest("hex");
+function generateSnapshotV2(definition, previousId3) {
+  const { imports, schemaName } = buildDrizzleEntitiesV2(definition);
+  return api.generateDrizzleJson(imports, previousId3, [schemaName]);
 }
-var CUSTOM_ROLE_KEY_RE = /^[a-z0-9-]+$/;
-var customRoleKeySchema = zod.z.string().min(1).max(64).regex(
-  CUSTOM_ROLE_KEY_RE,
-  "Role and capability keys must match [a-z0-9-]+"
-);
-var MAX_CUSTOM_ROLE_DEFINITIONS = 50;
-var MAX_CUSTOM_ROLE_CAPABILITIES = 100;
-var customRoleCapabilityDeclarationSchema = zod.z.object({
-  description: zod.z.string().max(500).optional()
-});
-var customRoleDefinitionSchema = zod.z.object({
-  description: zod.z.string().max(500).optional(),
-  /**
-   * Grants this role to the host's entire runtime audience. Resolved at the
-   * app layer at claim time — every caller who passes the host floor
-   * (`end_user`) holds the default roles; no tuple is written for it.
-   */
-  default: zod.z.boolean().default(false),
-  /** Role keys whose grants this role also receives (privilege waterfall). */
-  inherits: zod.z.array(customRoleKeySchema).default([]),
-  /** Capability keys this role grants directly. */
-  grants: zod.z.array(customRoleKeySchema).default([])
-});
-var customRolesBlockSchema = zod.z.object({
-  /** Roles grantable to principals, keyed by role key. */
-  definitions: zod.z.record(customRoleKeySchema, customRoleDefinitionSchema).default({}),
-  /** Leaf capability keys the host's code checks, keyed by capability key. */
-  capabilities: zod.z.record(customRoleKeySchema, customRoleCapabilityDeclarationSchema).default({})
-}).superRefine((block, ctx) => {
-  const roleKeys = Object.keys(block.definitions);
-  const capabilityKeys = new Set(Object.keys(block.capabilities));
-  if (roleKeys.length > MAX_CUSTOM_ROLE_DEFINITIONS) {
-    ctx.addIssue({
-      code: "custom",
-      message: `At most ${MAX_CUSTOM_ROLE_DEFINITIONS} role definitions are allowed`,
-      path: ["definitions"]
-    });
+function buildTable2(schema, table, built, enums, byName) {
+  const primaryKeyColumns = table.primaryKey ?? [];
+  if (primaryKeyColumns.length === 0) {
+    throw new OrmDefinitionError(`table '${table.table}' declares no primaryKey`);
   }
-  if (capabilityKeys.size > MAX_CUSTOM_ROLE_CAPABILITIES) {
-    ctx.addIssue({
-      code: "custom",
-      message: `At most ${MAX_CUSTOM_ROLE_CAPABILITIES} capabilities are allowed`,
-      path: ["capabilities"]
-    });
+  const columnNames = new Set(table.columns.map((column) => column.columnName));
+  for (const name of primaryKeyColumns) {
+    if (!columnNames.has(name)) {
+      throw new OrmDefinitionError(`primaryKey of '${table.table}' references unknown column '${name}'`);
+    }
   }
-  for (const key of roleKeys) {
-    if (capabilityKeys.has(key)) {
-      ctx.addIssue({
-        code: "custom",
-        message: `Key "${key}" is declared as both a role and a capability`,
-        path: ["definitions", key]
-      });
+  const singlePrimaryKey = primaryKeyColumns.length === 1 ? primaryKeyColumns[0] : void 0;
+  const compositeMembers = new Set(singlePrimaryKey === void 0 ? primaryKeyColumns : []);
+  const columns = Object.fromEntries(
+    table.columns.map((column) => [
+      column.columnName,
+      buildColumnV2({ table: table.table, column, singlePrimaryKey, compositeMembers, enums })
+    ])
+  );
+  const drizzleTable = schema.table(table.table, columns, (self) => [
+    ...buildCompositePrimaryKey(table, primaryKeyColumns, self),
+    ...buildIndexes2(table, self),
+    ...buildForeignKeys2(table, self, built, byName)
+  ]);
+  return drizzleTable.enableRLS();
+}
+function resolveColumnFactory(table, column, enums) {
+  if (typeof column.type === "string") return FACTORIES2[column.type];
+  const enumFactory = enums.get(column.type.enum);
+  if (!enumFactory) {
+    throw new OrmDefinitionError(`column '${table}.${column.columnName}' references undeclared enum '${column.type.enum}'`);
+  }
+  return enumFactory;
+}
+function buildColumnV2({
+  table,
+  column,
+  singlePrimaryKey,
+  compositeMembers,
+  enums
+}) {
+  const factory = resolveColumnFactory(table, column, enums);
+  let builder = factory(column.columnName);
+  const isSinglePrimaryKey = column.columnName === singlePrimaryKey;
+  if (isSinglePrimaryKey) builder = builder.primaryKey();
+  if ((column.nullable === false || compositeMembers.has(column.columnName)) && !isSinglePrimaryKey) {
+    builder = builder.notNull();
+  }
+  if (column.unique && !isSinglePrimaryKey) builder = builder.unique();
+  if (column.defaultFn !== void 0 && column.default !== void 0) {
+    throw new OrmDefinitionError(`column '${table}.${column.columnName}' declares both default and defaultFn`);
+  }
+  if (column.defaultFn !== void 0) {
+    if (typeof column.type !== "string" || !isFunctionDefault(column.defaultFn, column.type)) {
+      throw new OrmDefinitionError(
+        `column '${table}.${column.columnName}' declares defaultFn '${column.defaultFn}' which is invalid for its type`
+      );
     }
+    builder = builder.default(drizzleOrm.sql.raw(column.defaultFn));
+  } else if (column.default !== void 0 && column.default !== null) {
+    builder = builder.default(column.default);
   }
-  const roleKeySet = new Set(roleKeys);
-  for (const [roleKey, definition] of Object.entries(block.definitions)) {
-    const seenInherits = /* @__PURE__ */ new Set();
-    for (const inherited of definition.inherits) {
-      if (seenInherits.has(inherited)) {
-        ctx.addIssue({
-          code: "custom",
-          message: `Role "${roleKey}" lists "${inherited}" in inherits more than once`,
-          path: ["definitions", roleKey, "inherits"]
-        });
-      }
-      seenInherits.add(inherited);
-      if (!roleKeySet.has(inherited)) {
-        ctx.addIssue({
-          code: "custom",
-          message: `Role "${roleKey}" inherits unknown role "${inherited}"`,
-          path: ["definitions", roleKey, "inherits"]
-        });
+  return builder;
+}
+function buildCompositePrimaryKey(table, primaryKeyColumns, self) {
+  if (primaryKeyColumns.length < 2) return [];
+  return [
+    pgCore.primaryKey({
+      name: `${table.table}_pkey`,
+      columns: primaryKeyColumns.map((column) => self[column])
+    })
+  ];
+}
+function buildIndexes2(table, self) {
+  return table.indexes.map((definition) => {
+    for (const column of definition.columns) {
+      if (!(column in self)) {
+        throw new OrmDefinitionError(`index on '${table.table}' references unknown column '${column}'`);
       }
     }
-    const seenGrants = /* @__PURE__ */ new Set();
-    for (const granted of definition.grants) {
-      if (seenGrants.has(granted)) {
-        ctx.addIssue({
-          code: "custom",
-          message: `Role "${roleKey}" lists "${granted}" in grants more than once`,
-          path: ["definitions", roleKey, "grants"]
-        });
-      }
-      seenGrants.add(granted);
-      if (!capabilityKeys.has(granted)) {
-        ctx.addIssue({
-          code: "custom",
-          message: `Role "${roleKey}" grants unknown capability "${granted}"`,
-          path: ["definitions", roleKey, "grants"]
-        });
-      }
+    const name = indexName(table.table, definition);
+    const factory = definition.unique ? pgCore.uniqueIndex(name) : pgCore.index(name);
+    const columns = definition.columns.map((column) => self[column]);
+    return factory.on(...columns);
+  });
+}
+function buildForeignKeys2(table, self, built, byName) {
+  return table.links.filter((link) => link.enforce).map((link) => {
+    if (link.kind !== "toOne" || !link.target) {
+      throw new OrmDefinitionError(
+        `enforced link '${link.name}' on '${table.table}' must be a toOne link with a namespace-local target`
+      );
     }
-  }
-  const state = /* @__PURE__ */ new Map();
-  const visit = (key, path) => {
-    if (state.get(key) === "done") return null;
-    if (state.get(key) === "visiting") return [...path, key];
-    state.set(key, "visiting");
-    const definition = block.definitions[key];
-    for (const inherited of definition?.inherits ?? []) {
-      if (!roleKeySet.has(inherited)) continue;
-      const cycle = visit(inherited, [...path, key]);
-      if (cycle) return cycle;
+    const targetTable = byName.get(link.target);
+    const target = link.target === table.table ? self : built.get(link.target);
+    if (!targetTable || !target) {
+      throw new OrmDefinitionError(`enforced link '${link.name}' on '${table.table}' has no built target '${link.target}'`);
     }
-    state.set(key, "done");
-    return null;
-  };
-  for (const roleKey of roleKeys) {
-    const cycle = visit(roleKey, []);
-    if (cycle) {
-      ctx.addIssue({
-        code: "custom",
-        message: `Role inheritance cycle: ${cycle.join(" -> ")}`,
-        path: ["definitions"]
-      });
-      break;
+    const referencedColumn = link.references ?? singlePrimaryKeyOf(targetTable);
+    if (!referencedColumn) {
+      throw new OrmDefinitionError(
+        `enforced link '${link.name}' on '${table.table}' targets '${link.target}' whose primary key is composite \u2014 declare 'references'`
+      );
+    }
+    const targetColumn = target[referencedColumn];
+    const sourceColumn = self[link.on];
+    if (!targetColumn || !sourceColumn) {
+      throw new OrmDefinitionError(
+        `enforced link '${link.name}' on '${table.table}' references unknown column '${targetColumn ? link.on : referencedColumn}'`
+      );
+    }
+    return pgCore.foreignKey({
+      name: foreignKeyName(table.table, link.name),
+      columns: [sourceColumn],
+      foreignColumns: [targetColumn]
+    });
+  });
+}
+var singlePrimaryKeyOf = (table) => table.primaryKey?.length === 1 ? table.primaryKey[0] : void 0;
+function sortByEnforcedLinks2(tables) {
+  const remaining = new Map(tables.map((table) => [table.table, table]));
+  const sorted = [];
+  const placed = /* @__PURE__ */ new Set();
+  while (remaining.size > 0) {
+    const ready = [...remaining.values()].filter(
+      (table) => enforcedTargets2(table).every((target) => placed.has(target) || !remaining.has(target))
+    );
+    if (ready.length === 0) {
+      throw new OrmDefinitionError(`enforced links form a cycle among: ${[...remaining.keys()].join(", ")}`);
+    }
+    for (const table of ready) {
+      sorted.push(table);
+      placed.add(table.table);
+      remaining.delete(table.table);
     }
   }
-});
-function customRolesDeclared(block) {
-  if (!block) return false;
-  return Object.keys(block.definitions).length > 0 || Object.keys(block.capabilities).length > 0;
-}
-var CUSTOM_CAPABILITY_PIN_RE = /^(?:org\/)?[a-z0-9-]+$/;
-var MAX_CAPABILITY_PINS = 100;
-var capabilityPinsSchema = zod.z.array(
-  zod.z.string().min(1).max(68).regex(
-    CUSTOM_CAPABILITY_PIN_RE,
-    'Pins must be "org/<key>" or a bare "<key>" matching [a-z0-9-]+'
+  return sorted;
+}
+var enforcedTargets2 = (table) => table.links.flatMap(
+  (link) => (
+    // A self-target is not an ordering dependency — the FK builds inline.
+    link.enforce && link.target !== void 0 && link.target !== table.table ? [link.target] : []
   )
-).max(MAX_CAPABILITY_PINS).default([]);
-function parseCapabilityPin(pin) {
-  return pin.startsWith("org/") ? { scope: "org", key: pin.slice("org/".length) } : { scope: "host", key: pin };
+);
+function applyMigrationHintsV2(previous, definition) {
+  const adjusted = structuredClone(previous);
+  const statements = [];
+  const schemaName = ormSchemaName(definition.namespace);
+  const qualified = (table) => `${quoteIdentifier(schemaName)}.${quoteIdentifier(table)}`;
+  const enumsByName = new Map(definition.enums.map((entry) => [entry.name, entry]));
+  for (const table of columnTablesV2(definition)) {
+    if (table.renamedFrom) {
+      applyTableRename({ adjusted, schemaName, table, renamedFrom: table.renamedFrom, statements, qualified });
+    }
+    const snapshotTable = findTable2(adjusted, schemaName, table.table);
+    if (!snapshotTable) continue;
+    for (const column of table.columns) {
+      const name = column.columnName;
+      if (column.renamedFrom) {
+        const previousColumn = snapshotTable.columns[column.renamedFrom];
+        if (previousColumn && snapshotTable.columns[name]) {
+          throw new OrmDefinitionError(
+            `'${table.table}.${name}' declares renamedFrom '${column.renamedFrom}', but both columns exist in the previous schema \u2014 a rename cannot overwrite a live column`
+          );
+        }
+        if (previousColumn) {
+          statements.push(
+            `ALTER TABLE ${qualified(table.table)} RENAME COLUMN ${quoteIdentifier(column.renamedFrom)} TO ${quoteIdentifier(name)}`
+          );
+          delete snapshotTable.columns[column.renamedFrom];
+          snapshotTable.columns[name] = { ...previousColumn, name };
+        } else if (!snapshotTable.columns[name]) {
+          throw new OrmDefinitionError(
+            `'${table.table}.${name}' declares renamedFrom '${column.renamedFrom}', but the previous schema has neither column \u2014 check the declared source name`
+          );
+        }
+      }
+      const cast = column.cast ? castParts(column.cast) : null;
+      if (cast) {
+        const current = snapshotTable.columns[name];
+        const { snapshotType, sqlType } = castTargetTypes(column, enumsByName, schemaName, table.table);
+        if (current && current.type !== snapshotType) {
+          statements.push(
+            `ALTER TABLE ${qualified(table.table)} ALTER COLUMN ${quoteIdentifier(name)} TYPE ${sqlType} USING ${quoteIdentifier(name)}::${sqlType}`
+          );
+          current.type = snapshotType;
+        }
+      }
+    }
+  }
+  return { statements, adjusted };
+}
+function castTargetTypes(column, enums, schemaName, table) {
+  if (typeof column.type === "string") {
+    const name = sqlTypeName(column.type);
+    return { snapshotType: name, sqlType: name };
+  }
+  const enumName = column.type.enum;
+  if (!enums.has(enumName)) {
+    throw new OrmDefinitionError(`column '${table}.${column.columnName}' casts to undeclared enum '${enumName}'`);
+  }
+  return { snapshotType: enumName, sqlType: `${quoteIdentifier(schemaName)}.${quoteIdentifier(enumName)}` };
 }
-function validateCapabilityPins({
-  uses,
-  roles
+function applyTableRename({
+  adjusted,
+  schemaName,
+  table,
+  renamedFrom,
+  statements,
+  qualified
 }) {
-  const errors = [];
-  const seen = /* @__PURE__ */ new Set();
-  const roleKeys = new Set(Object.keys(roles?.definitions ?? {}));
-  for (const pin of uses) {
-    if (seen.has(pin)) errors.push(`Pin "${pin}" is listed more than once`);
-    seen.add(pin);
-    const parsed = parseCapabilityPin(pin);
-    if (parsed.scope === "host" && roleKeys.has(parsed.key)) {
-      errors.push(`Pin "${pin}" references a role \u2014 roles are never pinned`);
-    }
+  const tables = adjusted.tables ?? {};
+  const previousEntry = Object.entries(tables).find(
+    ([, entry]) => entry.schema === schemaName && entry.name === renamedFrom
+  );
+  const currentTable = findTable2(adjusted, schemaName, table.table);
+  if (previousEntry && currentTable) {
+    throw new OrmDefinitionError(
+      `'${table.table}' declares renamedFrom '${renamedFrom}', but both tables exist in the previous schema \u2014 a rename cannot overwrite a live table`
+    );
+  }
+  if (!previousEntry) {
+    if (currentTable) return;
+    throw new OrmDefinitionError(
+      `'${table.table}' declares renamedFrom '${renamedFrom}', but the previous schema has neither table \u2014 check the declared source name`
+    );
+  }
+  statements.push(`ALTER TABLE ${qualified(renamedFrom)} RENAME TO ${quoteIdentifier(table.table)}`);
+  const [previousKey, previousTable] = previousEntry;
+  delete tables[previousKey];
+  tables[`${schemaName}.${table.table}`] = { ...previousTable, name: table.table };
+}
+function findTable2(snapshot, schema, table) {
+  const tables = snapshot.tables ?? {};
+  return Object.values(tables).find((entry) => entry.schema === schema && entry.name === table);
+}
+async function planMigrationV2({
+  canonical,
+  previousSnapshot
+}) {
+  const schema = ormSchemaName(canonical.namespace);
+  const previous = previousSnapshot ? normalizeSnapshot(previousSnapshot) : emptySnapshot(canonical.namespace);
+  const hints = applyMigrationHintsV2(previous, canonical);
+  const snapshot = generateSnapshotV2(canonical, previousId2(previous));
+  const ddl = await diffStatements(hints.adjusted, snapshot);
+  const statements = [
+    ...hints.statements.map((statement) => ({ kind: "hint", sql: statement })),
+    ...ddl.map((statement) => ({ kind: "ddl", sql: statement.replace(/;\s*$/, "") }))
+  ];
+  return { namespace: canonical.namespace, schema, statements, snapshot };
+}
+var previousId2 = (snapshot) => snapshot.id;
+var IR_VERSION = 1;
+var CLAIMS_CONTRACT = {
+  sub: "string",
+  org: "string?",
+  roles: "string[]",
+  capabilities: "string[]"
+};
+var scalarLiteral = zod.z.union([zod.z.string(), zod.z.number(), zod.z.boolean(), zod.z.null()]);
+var valueIrSchema = zod.z.discriminatedUnion("kind", [
+  zod.z.object({ kind: zod.z.literal("literal"), value: zod.z.union([scalarLiteral, zod.z.array(scalarLiteral)]) }),
+  zod.z.object({ kind: zod.z.literal("variable"), name: zod.z.string() }),
+  zod.z.object({ kind: zod.z.literal("claim"), key: zod.z.enum(["sub", "org"]) })
+]);
+var CMP_OPS = [
+  "eq",
+  "neq",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "in",
+  "nin",
+  "like",
+  "ilike",
+  "isNull",
+  "contains",
+  "hasKey"
+];
+var predIrSchema = zod.z.lazy(
+  () => zod.z.discriminatedUnion("kind", [
+    zod.z.object({ kind: zod.z.literal("and"), operands: zod.z.array(predIrSchema).min(1) }),
+    zod.z.object({ kind: zod.z.literal("or"), operands: zod.z.array(predIrSchema).min(1) }),
+    zod.z.object({ kind: zod.z.literal("not"), operand: predIrSchema }),
+    zod.z.object({ kind: zod.z.literal("cmp"), op: zod.z.enum(CMP_OPS), column: zod.z.string(), value: valueIrSchema }),
+    zod.z.object({ kind: zod.z.literal("exists"), link: zod.z.string(), where: predIrSchema }),
+    zod.z.object({
+      kind: zod.z.literal("aggPredicate"),
+      link: zod.z.string(),
+      fn: zod.z.literal("count"),
+      op: zod.z.enum(["eq", "neq", "gt", "gte", "lt", "lte"]),
+      value: zod.z.number(),
+      where: predIrSchema.optional()
+    }),
+    zod.z.object({ kind: zod.z.literal("capability"), key: zod.z.string() }),
+    zod.z.object({ kind: zod.z.literal("role"), key: zod.z.string() }),
+    zod.z.object({ kind: zod.z.literal("dynamicFilter"), slot: zod.z.string() }),
+    zod.z.object({ kind: zod.z.literal("const"), value: zod.z.boolean() })
+  ])
+);
+var orderIrSchema = zod.z.discriminatedUnion("kind", [
+  zod.z.object({
+    kind: zod.z.literal("column"),
+    column: zod.z.string(),
+    /** Order through a to-one link: `link` is set and `column` is on the target. */
+    link: zod.z.string().optional(),
+    direction: zod.z.enum(["asc", "desc"]),
+    nulls: zod.z.enum(["first", "last"]).optional()
+  }),
+  /** §4f: `$orderBy: [FooOrderBy!]` variable — validated + lowered at runtime. */
+  zod.z.object({ kind: zod.z.literal("dynamic"), slot: zod.z.string() })
+]);
+var limitIrSchema = zod.z.object({
+  /** Fixed value or a variable, clamped to [1, max]; absent → default. */
+  variable: zod.z.string().optional(),
+  value: zod.z.number().int().positive().optional(),
+  default: zod.z.number().int().positive(),
+  max: zod.z.number().int().positive()
+});
+var selectionIrSchema = zod.z.lazy(
+  () => zod.z.object({
+    typename: zod.z.string(),
+    columns: zod.z.array(zod.z.object({ alias: zod.z.string(), column: zod.z.string() })),
+    relations: zod.z.array(zod.z.object({
+      alias: zod.z.string(),
+      link: zod.z.string(),
+      selection: selectionIrSchema,
+      where: predIrSchema.optional(),
+      orderBy: zod.z.array(orderIrSchema).optional(),
+      limit: limitIrSchema.optional(),
+      offset: zod.z.object({ variable: zod.z.string().optional(), value: zod.z.number().int().optional() }).optional()
+    })),
+    aggregates: zod.z.array(zod.z.object({
+      alias: zod.z.string(),
+      link: zod.z.string().optional(),
+      where: predIrSchema.optional(),
+      count: zod.z.object({ columns: zod.z.array(zod.z.string()).optional(), distinct: zod.z.boolean().optional() }).optional(),
+      sum: zod.z.array(zod.z.string()).optional(),
+      avg: zod.z.array(zod.z.string()).optional(),
+      nodes: selectionIrSchema.optional()
+    }))
+  })
+);
+var includeIfSchema = zod.z.object({ variable: zod.z.string(), negated: zod.z.boolean() });
+var selectRootSchema = zod.z.object({
+  kind: zod.z.literal("select"),
+  alias: zod.z.string(),
+  table: zod.z.string(),
+  selection: selectionIrSchema,
+  /** Composed at compile time: AND(policy, documentWhere?, dynamicFilter?). */
+  where: predIrSchema,
+  orderBy: zod.z.array(orderIrSchema).default([]),
+  distinctOn: zod.z.union([zod.z.array(zod.z.string()), zod.z.object({ slot: zod.z.string() })]).optional(),
+  limit: limitIrSchema,
+  offset: zod.z.object({ variable: zod.z.string().optional(), value: zod.z.number().int().optional() }).optional(),
+  includeIf: includeIfSchema.optional()
+});
+var byPkRootSchema = zod.z.object({
+  kind: zod.z.literal("byPk"),
+  alias: zod.z.string(),
+  table: zod.z.string(),
+  selection: selectionIrSchema,
+  pk: zod.z.array(zod.z.object({ column: zod.z.string(), value: valueIrSchema })).min(1),
+  /** Policy predicate — ANDed with the PK match. */
+  where: predIrSchema,
+  includeIf: includeIfSchema.optional()
+});
+var aggregateRootSchema = zod.z.object({
+  kind: zod.z.literal("aggregate"),
+  alias: zod.z.string(),
+  table: zod.z.string(),
+  where: predIrSchema,
+  count: zod.z.object({ columns: zod.z.array(zod.z.string()).optional(), distinct: zod.z.boolean().optional() }).optional(),
+  sum: zod.z.array(zod.z.string()).optional(),
+  avg: zod.z.array(zod.z.string()).optional(),
+  nodes: selectionIrSchema.optional(),
+  includeIf: includeIfSchema.optional()
+});
+var writeValuesSchema = zod.z.union([
+  zod.z.object({ slot: zod.z.string() }),
+  zod.z.object({ entries: zod.z.array(zod.z.object({ column: zod.z.string(), value: valueIrSchema })) })
+]);
+var onConflictIrSchema = zod.z.union([
+  zod.z.object({ slot: zod.z.string() }),
+  zod.z.object({ constraint: zod.z.string(), updateColumns: zod.z.array(zod.z.string()) })
+]);
+var mutationRootSchema = zod.z.object({
+  kind: zod.z.literal("mutation"),
+  op: zod.z.enum(["insert", "insertOne", "update", "updateByPk", "delete", "deleteByPk"]),
+  alias: zod.z.string(),
+  table: zod.z.string(),
+  /** insert/insertOne: rows come from a slot ($object/$objects) or literals. */
+  objects: zod.z.union([
+    zod.z.object({ slot: zod.z.string() }),
+    zod.z.object({ rows: zod.z.array(zod.z.array(zod.z.object({ column: zod.z.string(), value: valueIrSchema }))) })
+  ]).optional(),
+  /** Server-pinned columns (e.g. author_sub ← claim('sub')) merged into every inserted row. */
+  pinnedColumns: zod.z.array(zod.z.object({ column: zod.z.string(), value: valueIrSchema })).default([]),
+  onConflict: onConflictIrSchema.optional(),
+  set: writeValuesSchema.optional(),
+  append: writeValuesSchema.optional(),
+  inc: writeValuesSchema.optional(),
+  /** update/delete row filter: AND(writePolicy, documentWhere/pk, dynamicFilter?). */
+  where: predIrSchema.optional(),
+  pk: zod.z.array(zod.z.object({ column: zod.z.string(), value: valueIrSchema })).optional(),
+  /** WITH CHECK analogue evaluated against NEW row values (insert/update). */
+  insertCheck: predIrSchema.optional(),
+  returning: selectionIrSchema.nullable(),
+  affectedRows: zod.z.boolean().default(false),
+  includeIf: includeIfSchema.optional()
+});
+var actionRootSchema = zod.z.object({
+  kind: zod.z.literal("action"),
+  alias: zod.z.string(),
+  name: zod.z.string(),
+  params: zod.z.array(zod.z.object({ name: zod.z.string(), value: valueIrSchema })),
+  returns: zod.z.enum(["rows", "rowsAffected", "scalar"])
+});
+var rootIrSchema = zod.z.discriminatedUnion("kind", [
+  selectRootSchema,
+  byPkRootSchema,
+  aggregateRootSchema,
+  mutationRootSchema,
+  actionRootSchema
+]);
+var INPUT_REF_KINDS = [
+  "boolExp",
+  "orderBy",
+  "selectColumn",
+  "insertInput",
+  "setInput",
+  "appendInput",
+  "onConflict"
+];
+var variableDefaultIrSchema = zod.z.object({
+  value: zod.z.union([scalarLiteral, zod.z.array(scalarLiteral)])
+});
+var variableIrSchema = zod.z.object({
+  name: zod.z.string(),
+  type: zod.z.union([
+    zod.z.object({ kind: zod.z.literal("scalar"), scalar: zod.z.enum(COLUMN_TYPES) }),
+    /** `values` is the declared membership whitelist — the executor validates against it. */
+    zod.z.object({ kind: zod.z.literal("enum"), name: zod.z.string(), values: zod.z.array(zod.z.string()).min(1) }),
+    /** §4f dynamic slot: validated against `tables[table]` whitelists at runtime. */
+    zod.z.object({ kind: zod.z.literal("inputRef"), input: zod.z.enum(INPUT_REF_KINDS), table: zod.z.string() })
+  ]),
+  nullable: zod.z.boolean(),
+  list: zod.z.boolean(),
+  /** Absent = no default declared; see {@link variableDefaultIrSchema}. */
+  defaultValue: variableDefaultIrSchema.optional()
+});
+var compiledOperationSchema = zod.z.object({
+  irVersion: zod.z.literal(IR_VERSION),
+  name: zod.z.string(),
+  opHash: zod.z.string().regex(/^sha256:[0-9a-f]{64}$/),
+  kind: zod.z.enum(["query", "mutation", "action"]),
+  requires: zod.z.object({
+    capability: zod.z.string().optional(),
+    role: zod.z.string().optional()
+  }).nullable(),
+  variables: zod.z.array(variableIrSchema),
+  /** Every table the op touches — data-token scoping + audit. */
+  tableSet: zod.z.array(zod.z.string()).min(1),
+  roots: zod.z.array(rootIrSchema).min(1)
+});
+var tableMetaIrSchema = zod.z.object({
+  table: zod.z.string(),
+  schema: zod.z.string(),
+  typename: zod.z.string(),
+  columns: zod.z.array(zod.z.object({
+    name: zod.z.string(),
+    columnName: zod.z.string(),
+    type: zod.z.union([zod.z.enum(COLUMN_TYPES), zod.z.object({ enum: zod.z.string(), values: zod.z.array(zod.z.string()) })]),
+    nullable: zod.z.boolean()
+  })),
+  primaryKey: zod.z.array(zod.z.string()).min(1),
+  links: zod.z.array(zod.z.object({
+    name: zod.z.string(),
+    kind: zod.z.enum(["toOne", "toMany", "toPlatformUser"]),
+    target: zod.z.string(),
+    on: zod.z.string(),
+    references: zod.z.string()
+  })),
+  /** §4f whitelists: what dynamic inputs may reference. */
+  filterable: zod.z.array(zod.z.string()),
+  orderable: zod.z.array(zod.z.string()),
+  insertable: zod.z.array(zod.z.string()),
+  settable: zod.z.array(zod.z.string()),
+  appendable: zod.z.array(zod.z.string()),
+  constraints: zod.z.array(zod.z.object({ name: zod.z.string(), columns: zod.z.array(zod.z.string()) })),
+  /** Depth/node caps for dynamic filter trees on this table. */
+  dynamicFilterMaxDepth: zod.z.number().int().positive().default(6),
+  dynamicFilterMaxNodes: zod.z.number().int().positive().default(64)
+});
+var compiledArtifactSchema = zod.z.object({
+  irVersion: zod.z.literal(IR_VERSION),
+  namespace: zod.z.string(),
+  schemaHash: zod.z.string(),
+  opsHash: zod.z.string(),
+  tables: zod.z.record(zod.z.string(), tableMetaIrSchema),
+  operations: zod.z.record(zod.z.string(), compiledOperationSchema)
+});
+var IrVersionError = class extends Error {
+  constructor(found) {
+    super(`Unsupported IR version ${String(found)} \u2014 this executor supports up to ${IR_VERSION}. Upgrade @sequenceholdings/orm or re-push the namespace.`);
+    this.name = "IrVersionError";
   }
-  return errors;
+};
+function normalizeIr(raw) {
+  if (!raw || typeof raw !== "object") throw new IrVersionError(void 0);
+  const version = raw.irVersion;
+  if (version !== IR_VERSION) throw new IrVersionError(version);
+  return compiledArtifactSchema.parse(raw);
+}
+function indexByHash(artifact) {
+  const map = /* @__PURE__ */ new Map();
+  for (const op of Object.values(artifact.operations)) map.set(op.opHash, op);
+  return map;
 }
 
 // src/schema/namespace.ts
@@ -1673,7 +2843,7 @@ function buildNamespaceDefinition(files, config) {
     }
   }
   const capabilities = config?.capabilities ? { roles: config.capabilities.roles ?? EMPTY_CAPABILITIES.roles, uses: config.capabilities.uses ?? [] } : EMPTY_CAPABILITIES;
-  const pinIssues = validateCapabilityPins({ uses: capabilities.uses, roles: capabilities.roles });
+  const pinIssues = customRolesManifest.validateCapabilityPins({ uses: capabilities.uses, roles: capabilities.roles });
   if (pinIssues.length > 0) throw new OrmDefinitionError(pinIssues.join("; "), "namespace.yaml");
   const tables = files.map(({ table }) => table).sort((a, b) => a.table.localeCompare(b.table));
   const byName = new Map(tables.map((table) => [table.table, table]));
@@ -1783,8 +2953,8 @@ var namespaceConfigSchema = zod.z.strictObject({
   namespace: namespaceSchema,
   description: zod.z.string().optional(),
   capabilities: zod.z.strictObject({
-    roles: customRolesBlockSchema.optional(),
-    uses: capabilityPinsSchema.optional()
+    roles: customRolesManifest.customRolesBlockSchema.optional(),
+    uses: customRolesManifest.capabilityPinsSchema.optional()
   }).optional()
 });
 
@@ -1897,8 +3067,8 @@ async function readMigrationWorkspace(dir, namespace) {
       journalPath
     );
   }
-  parsed.data.entries.forEach((entry, index2) => {
-    if (entry.ordinal !== index2 + 1) {
+  parsed.data.entries.forEach((entry, index3) => {
+    if (entry.ordinal !== index3 + 1) {
       throw new OrmDefinitionError(`migration journal entries must be contiguous from 1 (found ${entry.name})`, journalPath);
     }
   });
@@ -1921,7 +3091,7 @@ async function readMigrationSql(dir, entry) {
     throw new OrmDefinitionError("missing migration file", path$1);
   });
 }
-var checksumOf = (text2) => crypto.createHash("sha256").update(text2).digest("hex");
+var checksumOf = (text3) => crypto.createHash("sha256").update(text3).digest("hex");
 var migrationName = (ordinal, contentHash) => `${pad(ordinal)}_${contentHash.slice(0, 12)}`;
 function renderMigrationSql({
   name,
@@ -1947,12 +3117,12 @@ async function writeMigration({
   const tip = workspace.journal.entries.at(-1);
   const ordinal = (tip?.ordinal ?? 0) + 1;
   const name = migrationName(ordinal, contentHash);
-  const sql2 = renderMigrationSql({ name, namespace: workspace.journal.namespace, contentHash, plan });
+  const sql3 = renderMigrationSql({ name, namespace: workspace.journal.namespace, contentHash, plan });
   const metaDir = path.join(dir, MIGRATIONS_DIRNAME, META_DIRNAME);
   await promises.mkdir(metaDir, { recursive: true });
   const snapshotText = `${JSON.stringify(plan.snapshot, null, 2)}
 `;
-  await promises.writeFile(path.join(dir, MIGRATIONS_DIRNAME, `${name}.sql`), sql2);
+  await promises.writeFile(path.join(dir, MIGRATIONS_DIRNAME, `${name}.sql`), sql3);
   await promises.writeFile(path.join(metaDir, `${pad(ordinal)}.snapshot.json`), snapshotText);
   const journal = {
     ...workspace.journal,
@@ -1963,7 +3133,7 @@ async function writeMigration({
         name,
         content_hash: contentHash,
         previous_content_hash: tip?.content_hash ?? null,
-        checksum: checksumOf(sql2),
+        checksum: checksumOf(sql3),
         snapshot_checksum: checksumOf(snapshotText),
         destructive
       }
@@ -2075,11 +3245,11 @@ async function checkWorkspace({
     log(`no committed migrations for '${loaded.definition.namespace}' \u2014 run \`seq-studio orm diff\` and commit the result`);
     return 1;
   }
-  let previousId2;
+  let previousId3;
   let previousHash = null;
   for (const entry of workspace.journal.entries) {
-    const sql2 = await readMigrationSql(dir, entry);
-    if (checksumOf(sql2) !== entry.checksum) {
+    const sql3 = await readMigrationSql(dir, entry);
+    if (checksumOf(sql3) !== entry.checksum) {
       log(`${MIGRATIONS_DIRNAME}/${entry.name}.sql does not match its journal checksum \u2014 committed migrations must not be edited`);
       return 1;
     }
@@ -2089,7 +3259,7 @@ async function checkWorkspace({
       return 1;
     }
     const snapshot = JSON.parse(snapshotText);
-    if (entry.ordinal > 1 && snapshot.prevId !== previousId2) {
+    if (entry.ordinal > 1 && snapshot.prevId !== previousId3) {
       log(`snapshot chain broken at ${entry.name} \u2014 regenerate the workspace with \`seq-studio orm diff\``);
       return 1;
     }
@@ -2097,7 +3267,7 @@ async function checkWorkspace({
       log(`content-hash chain broken at ${entry.name} \u2014 migrations must be appended in order by \`seq-studio orm diff\``);
       return 1;
     }
-    previousId2 = snapshot.id;
+    previousId3 = snapshot.id;
     previousHash = entry.content_hash;
   }
   if (tip.content_hash !== loaded.contentHash) {
@@ -2119,12 +3289,161 @@ async function checkWorkspace({
   log(`migrations in sync \u2014 ${workspace.journal.entries.length} committed, tip ${tip.name}`);
   return 0;
 }
-var firstLine = (sql2) => sql2.split("\n")[0] ?? sql2;
+var firstLine = (sql3) => sql3.split("\n")[0] ?? sql3;
+
+// src/migrations/from-yaml.ts
+function convertV1DefinitionToCanonical(definition) {
+  const raw = {
+    definition_format: CANONICAL_FORMAT,
+    namespace: definition.namespace,
+    description: definition.description ?? void 0,
+    enums: [],
+    tables: definition.tables.map(convertTable),
+    capabilities: {
+      roles: definition.capabilities.roles,
+      uses: [...definition.capabilities.uses]
+    }
+  };
+  const parsed = canonicalDefinitionSchema.safeParse(raw);
+  if (!parsed.success) {
+    const issue = parsed.error.issues[0];
+    throw new OrmDefinitionError(
+      `converted definition is not valid canonical v2: ${issue ? `${issue.path.join(".")}: ${issue.message}` : "unknown issue"}`
+    );
+  }
+  return normalizeCanonical(parsed.data);
+}
+function convertTable(table) {
+  const columns = Object.entries(table.columns ?? {});
+  const primaryKey2 = columns.filter(([, column]) => column.primary_key).map(([name]) => name);
+  return {
+    table: table.table,
+    description: table.description,
+    source: table.source,
+    columns: columns.map(([name, column]) => convertColumn(name, column)),
+    // Synced tables reflect their source — no columns, no primary key.
+    primaryKey: primaryKey2.length > 0 ? primaryKey2 : void 0,
+    links: Object.entries(table.links ?? {}).map(([name, link]) => convertLink(table.table, name, link)),
+    indexes: (table.indexes ?? []).map((index3) => ({
+      columns: [...index3.columns],
+      unique: index3.unique ?? false,
+      name: index3.name
+    })),
+    policies: {
+      // Verbatim DSL source strings — the parsed v1 AST is derived state.
+      read: table.policies?.read?.source,
+      write: table.policies?.write?.source
+    },
+    actions: Object.entries(table.actions ?? {}).map(([name, action]) => convertAction(table.table, name, action))
+  };
+}
+function convertColumn(name, column) {
+  const isDefaultFn = column.default !== void 0 && isFunctionDefault(column.default, column.type);
+  return {
+    name,
+    columnName: name,
+    type: column.type,
+    nullable: column.primary_key ? false : column.nullable !== false,
+    unique: column.unique === true,
+    default: isDefaultFn ? void 0 : column.default,
+    // isFunctionDefault guarantees one of the two allowlisted functions; the
+    // canonicalDefinitionSchema parse below re-checks the enum.
+    defaultFn: isDefaultFn ? column.default : void 0,
+    description: column.description,
+    renamedFrom: column.renamed_from,
+    cast: column.cast,
+    deprecated: column.deprecated === true
+  };
+}
+function convertLink(table, name, link) {
+  if (link.to.includes(".")) {
+    throw new OrmDefinitionError(
+      `link '${name}' on '${table}' targets '${link.to}' \u2014 cross-namespace links have no canonical v2 representation (links are namespace-local in v2)`
+    );
+  }
+  return {
+    name,
+    kind: "toOne",
+    target: link.to,
+    on: link.on,
+    enforce: link.enforce === true,
+    description: link.description
+  };
+}
+function convertAction(table, name, action) {
+  return {
+    name,
+    requires: action.requires?.source,
+    params: Object.fromEntries(
+      Object.entries(action.params ?? {}).map(([param, definition]) => [
+        param,
+        { type: definition.type, nullable: definition.optional === true }
+      ])
+    ),
+    // The v2 contract carries one SQL string; statement boundaries survive as
+    // `;\n` (v1 validation guarantees no bare `;` inside a single statement).
+    executes: actionStatementSources(action.executes).join(";\n"),
+    // v1 declared the RETURNING columns inline; v2 types them at compile time,
+    // so the shape collapses to rows-vs-rowsAffected.
+    returns: action.returns ? "rows" : "rowsAffected",
+    audit: action.audit ? { action: action.audit.action, resource: action.audit.resource ?? table } : void 0
+  };
+}
+
+// src/migrations/v2.ts
+var SHA256_HEX = /^[0-9a-f]{64}$/;
+function rebaseViolations(statements, options) {
+  const allowSecurity = options?.allowSecurityReemission ?? false;
+  return statements.filter((statement) => !(statement.kind === "security" && allowSecurity));
+}
+var verifyRebaseIsNoop = (plan, options) => rebaseViolations(plan.statements, options).length === 0;
+function buildRebaseJournalEntry({ namespace, previousHash, newHash, ordinal, snapshot }) {
+  if (!SHA256_HEX.test(previousHash)) {
+    throw new OrmDefinitionError(`rebase previousHash is not a sha256 hex digest: '${previousHash}'`);
+  }
+  if (!SHA256_HEX.test(newHash)) {
+    throw new OrmDefinitionError(`rebase newHash is not a sha256 hex digest: '${newHash}'`);
+  }
+  if (previousHash === newHash) {
+    throw new OrmDefinitionError("rebase previousHash and newHash are identical \u2014 nothing to rebase");
+  }
+  if (!Number.isInteger(ordinal) || ordinal < 2) {
+    throw new OrmDefinitionError(`rebase ordinal must be an integer \u2265 2 (a rebase sits on an existing journal tip); got ${ordinal}`);
+  }
+  const name = migrationName(ordinal, newHash);
+  const sql3 = renderRebaseMigrationSql({ name, namespace, previousHash, newHash });
+  const snapshotText = `${JSON.stringify(snapshot, null, 2)}
+`;
+  const entry = {
+    ordinal,
+    name,
+    content_hash: newHash,
+    previous_content_hash: previousHash,
+    checksum: checksumOf(sql3),
+    snapshot_checksum: checksumOf(snapshotText),
+    destructive: false
+  };
+  return { name, entry, sql: sql3, snapshotText };
+}
+function renderRebaseMigrationSql({
+  name,
+  namespace,
+  previousHash,
+  newHash
+}) {
+  return [
+    `-- ${name}`,
+    `-- namespace: ${namespace}`,
+    `-- content hash: ${newHash}`,
+    `-- rebase: v1 definitions (${previousHash}) converted to canonical v2 \u2014 verified no-op, zero statements`,
+    "-- generated by `seq-studio orm diff --rebase` \u2014 review and commit, do not edit"
+  ].join("\n") + "\n";
+}
 
 // src/schema/canonical.ts
 function parseCanonicalDefinition(value) {
   const canonical = asCanonicalShape(value);
-  const files = canonical.tables.map((table, index2) => {
+  const files = canonical.tables.map((table, index3) => {
     const input = {
       namespace: canonical.namespace,
       table: table["table"],
@@ -2141,10 +3460,10 @@ function parseCanonicalDefinition(value) {
       const issue = parsed.error.issues[0];
       throw new OrmDefinitionError(
         `stored definition for table ${String(table["table"])} is invalid: ${issue?.message ?? "unknown issue"}`,
-        `canonical[${index2}]`
+        `canonical[${index3}]`
       );
     }
-    return { file: `canonical[${index2}]`, table: parsed.data };
+    return { file: `canonical[${index3}]`, table: parsed.data };
   });
   const config = namespaceConfigSchema.safeParse({
     namespace: canonical.namespace,
@@ -2201,22 +3520,56 @@ function canonicalActions(value) {
   );
 }
 
+Object.defineProperty(exports, "capabilityPinsSchema", {
+  enumerable: true,
+  get: function () { return customRolesManifest.capabilityPinsSchema; }
+});
+Object.defineProperty(exports, "customRolesBlockSchema", {
+  enumerable: true,
+  get: function () { return customRolesManifest.customRolesBlockSchema; }
+});
+Object.defineProperty(exports, "customRolesDeclared", {
+  enumerable: true,
+  get: function () { return customRolesManifest.customRolesDeclared; }
+});
+Object.defineProperty(exports, "parseCapabilityPin", {
+  enumerable: true,
+  get: function () { return customRolesManifest.parseCapabilityPin; }
+});
+Object.defineProperty(exports, "validateCapabilityPins", {
+  enumerable: true,
+  get: function () { return customRolesManifest.validateCapabilityPins; }
+});
 exports.ACTION_REQUIRES_DENIED_SQLSTATE = ACTION_REQUIRES_DENIED_SQLSTATE;
 exports.ACTION_VALIDATES_FAILED_SQLSTATE = ACTION_VALIDATES_FAILED_SQLSTATE;
 exports.AUDIT_ACTIONS = AUDIT_ACTIONS;
+exports.CANONICAL_FORMAT = CANONICAL_FORMAT;
 exports.CAPABILITIES_CLAIM_KEY = CAPABILITIES_CLAIM_KEY;
 exports.CAPABILITY_KEY_PATTERN = CAPABILITY_KEY_PATTERN;
+exports.CLAIMS_CONTRACT = CLAIMS_CONTRACT;
 exports.CLAIMS_SETTING = CLAIMS_SETTING;
 exports.CLAIM_KEY_PATTERN = CLAIM_KEY_PATTERN;
-exports.COLUMN_TYPES = COLUMN_TYPES;
+exports.CMP_OPS = CMP_OPS;
+exports.COLUMN_BRAND = COLUMN_BRAND;
+exports.COLUMN_DEFAULT_FNS = COLUMN_DEFAULT_FNS;
+exports.COLUMN_TYPES = COLUMN_TYPES2;
 exports.COMPARE_OPS = COMPARE_OPS;
 exports.CONSUMER_ROLE_SUFFIX = CONSUMER_ROLE_SUFFIX;
+exports.ColumnBuilder = ColumnBuilder;
 exports.DEFINITION_FILE_EXTENSIONS = DEFINITION_FILE_EXTENSIONS;
+exports.ENUM_BRAND = ENUM_BRAND;
 exports.HASH_DOMAIN = HASH_DOMAIN;
 exports.IDENTIFIER_PATTERN = IDENTIFIER_PATTERN;
+exports.IDENTIFIER_RE = IDENTIFIER_RE;
+exports.INPUT_REF_KINDS = INPUT_REF_KINDS;
+exports.IR_VERSION = IR_VERSION;
+exports.IrVersionError = IrVersionError;
+exports.LINK_BRAND = LINK_BRAND;
 exports.MAX_DEFINITION_FILE_BYTES = MAX_DEFINITION_FILE_BYTES;
 exports.MAX_IDENTIFIER_LENGTH = MAX_IDENTIFIER_LENGTH;
 exports.MIGRATIONS_DIRNAME = MIGRATIONS_DIRNAME;
+exports.NAMESPACE_CONFIG_BRAND = NAMESPACE_CONFIG_BRAND;
+exports.NAMESPACE_CONFIG_FILE = NAMESPACE_CONFIG_FILE;
 exports.NAMESPACE_CONFIG_FILENAMES = NAMESPACE_CONFIG_FILENAMES;
 exports.NAMESPACE_PATTERN = NAMESPACE_PATTERN;
 exports.ORM_DATA_TOKEN_HEADER = ORM_DATA_TOKEN_HEADER;
@@ -2227,8 +3580,10 @@ exports.PredicateParseError = PredicateParseError;
 exports.QUALIFIED_TABLE_PATTERN = QUALIFIED_TABLE_PATTERN;
 exports.RESERVED_COLUMN_NAMES = RESERVED_COLUMN_NAMES;
 exports.RESERVED_TABLE_NAMES = RESERVED_TABLE_NAMES;
+exports.SCHEMA_DIR = SCHEMA_DIR;
 exports.STATEMENT_KINDS = STATEMENT_KINDS;
 exports.SYNCED_SOURCE_PATTERN = SYNCED_SOURCE_PATTERN;
+exports.TABLE_BRAND = TABLE_BRAND;
 exports.actionFunctionName = actionFunctionName;
 exports.actionFunctionStatements = actionFunctionStatements;
 exports.actionParamArg = actionParamArg;
@@ -2236,72 +3591,120 @@ exports.actionParamOrder = actionParamOrder;
 exports.actionParamSchema = actionParamSchema;
 exports.actionPrepareChecks = actionPrepareChecks;
 exports.actionSchema = actionSchema;
+exports.actionWriteTargets = actionWriteTargets;
 exports.actionsInterfaceName = actionsInterfaceName;
+exports.activeAuthoringContext = activeAuthoringContext;
 exports.applyMigrationHints = applyMigrationHints;
+exports.applyMigrationHintsV2 = applyMigrationHintsV2;
+exports.beginAuthoringContext = beginAuthoringContext;
 exports.buildActionParamsSchema = buildActionParamsSchema;
 exports.buildDrizzleEntities = buildDrizzleEntities;
+exports.buildDrizzleEntitiesV2 = buildDrizzleEntitiesV2;
 exports.buildNamespaceDefinition = buildNamespaceDefinition;
+exports.buildRebaseJournalEntry = buildRebaseJournalEntry;
+exports.canonicalActionSchema = canonicalActionSchema;
+exports.canonicalColumnSchema = canonicalColumnSchema;
+exports.canonicalDefinitionSchema = canonicalDefinitionSchema;
+exports.canonicalEnumSchema = canonicalEnumSchema;
+exports.canonicalIndexSchema = canonicalIndexSchema;
+exports.canonicalLinkSchema = canonicalLinkSchema;
+exports.canonicalPoliciesSchema = canonicalPoliciesSchema;
+exports.canonicalTableSchema = canonicalTableSchema;
 exports.canonicalizeDefinition = canonicalizeDefinition;
 exports.capabilityExpression = capabilityExpression;
-exports.capabilityPinsSchema = capabilityPinsSchema;
 exports.castParts = castParts;
 exports.checksumOf = checksumOf;
 exports.claimExpression = claimExpression;
 exports.classifyDestructive = classifyDestructive;
 exports.columnSchema = columnSchema;
-exports.columnTypeSchema = columnTypeSchema;
+exports.columnTypeSchema = columnTypeSchema2;
 exports.compileActionRequires = compileActionRequires;
 exports.compileActionStatements = compileActionStatements;
 exports.compileNamespace = compileNamespace;
 exports.compilePredicate = compilePredicate;
+exports.compiledArtifactSchema = compiledArtifactSchema;
+exports.compiledOperationSchema = compiledOperationSchema;
+exports.computeCanonicalHash = computeCanonicalHash;
 exports.computeDefinitionHash = computeDefinitionHash;
 exports.consumerRoleName = consumerRoleName;
-exports.customRolesBlockSchema = customRolesBlockSchema;
-exports.customRolesDeclared = customRolesDeclared;
+exports.convertV1DefinitionToCanonical = convertV1DefinitionToCanonical;
 exports.declaredCapabilityKeys = declaredCapabilityKeys;
+exports.defineEnum = defineEnum;
+exports.defineNamespace = defineNamespace;
+exports.defineSyncedTable = defineSyncedTable;
+exports.defineTable = defineTable;
+exports.deriveColumnName = deriveColumnName;
 exports.diffCommand = diffCommand;
 exports.diffStatements = diffStatements;
 exports.emptyJournal = emptyJournal;
 exports.emptySnapshot = emptySnapshot;
+exports.endAuthoringContext = endAuthoringContext;
 exports.extractNamedParams = extractNamedParams;
 exports.generateNamespaceTypes = generateNamespaceTypes;
 exports.generateSnapshot = generateSnapshot;
+exports.generateSnapshotV2 = generateSnapshotV2;
 exports.identifierSchema = identifierSchema;
+exports.indexByHash = indexByHash;
+exports.isColumnBuilder = isColumnBuilder;
+exports.isEnumRef = isEnumRef;
 exports.isFunctionDefault = isFunctionDefault;
 exports.isOwnedStatement = isOwnedStatement;
 exports.isQualifiedReference = isQualifiedReference;
+exports.isSeqLink = isSeqLink;
+exports.isSeqNamespaceConfig = isSeqNamespaceConfig;
+exports.isSeqTable = isSeqTable;
+exports.limitIrSchema = limitIrSchema;
 exports.loadCommittedMigrations = loadCommittedMigrations;
 exports.loadCommittedTipMigration = loadCommittedTipMigration;
 exports.loadNamespaceDefinition = loadNamespaceDefinition;
+exports.loadNamespaceFromDir = loadNamespaceFromDir;
 exports.migrationName = migrationName;
 exports.namespaceConfigSchema = namespaceConfigSchema;
 exports.namespaceSchema = namespaceSchema;
+exports.normalizeCanonical = normalizeCanonical;
+exports.normalizeIr = normalizeIr;
 exports.normalizeSnapshot = normalizeSnapshot;
+exports.orderIrSchema = orderIrSchema;
 exports.ormSchemaName = ormSchemaName;
 exports.parseCanonicalDefinition = parseCanonicalDefinition;
-exports.parseCapabilityPin = parseCapabilityPin;
 exports.parseDefinitionSources = parseDefinitionSources;
 exports.parsePredicate = parsePredicate;
 exports.parseTableFile = parseTableFile;
 exports.parsedPredicateSchema = parsedPredicateSchema;
 exports.pendingKitStatements = pendingKitStatements;
 exports.planMigration = planMigration;
+exports.planMigrationV2 = planMigrationV2;
+exports.policyExpressionSchema = policyExpressionSchema;
+exports.policyVariantSchema = policyVariantSchema;
+exports.predIrSchema = predIrSchema;
 exports.predicateOperands = predicateOperands;
 exports.quoteIdentifier = quoteIdentifier;
 exports.quoteLiteral = quoteLiteral;
 exports.readMigrationSql = readMigrationSql;
 exports.readMigrationWorkspace = readMigrationWorkspace;
 exports.readSnapshot = readSnapshot;
+exports.rebaseViolations = rebaseViolations;
 exports.referencedCapabilities = referencedCapabilities;
 exports.referencedColumns = referencedColumns;
 exports.renderMigrationSql = renderMigrationSql;
+exports.rootIrSchema = rootIrSchema;
 exports.securityStatements = securityStatements;
+exports.selectionIrSchema = selectionIrSchema;
+exports.serializeNamespace = serializeNamespace;
 exports.sqlTypeName = sqlTypeName;
 exports.stableJson = stableJson;
+exports.t = t;
 exports.tableFileSchema = tableFileSchema;
+exports.tableMetaIrSchema = tableMetaIrSchema;
 exports.tableReferenceSchema = tableReferenceSchema;
+exports.toMany = toMany;
+exports.toOne = toOne;
+exports.toPlatformUser = toPlatformUser;
 exports.typesInterfaceName = typesInterfaceName;
-exports.validateCapabilityPins = validateCapabilityPins;
+exports.valueIrSchema = valueIrSchema;
+exports.variableDefaultIrSchema = variableDefaultIrSchema;
+exports.variableIrSchema = variableIrSchema;
+exports.verifyRebaseIsNoop = verifyRebaseIsNoop;
 exports.walkPredicate = walkPredicate;
 exports.writeMigration = writeMigration;
 //# sourceMappingURL=index.cjs.map