@sequenceholdings/orm 0.1.0 → 0.1.2

package/dist/index.js

@@ -1,11 +1,863 @@
+import { createHash } from 'crypto';
 import { z } from 'zod';
+import { createJiti } from 'jiti';
+import { realpath, stat, readdir, readFile, mkdir, writeFile } from 'fs/promises';
+import { createRequire } from 'module';
+import { join, sep, extname } from 'path';
 import { generateDrizzleJson, upPgSnapshot, generateMigration, pushSchema } from 'drizzle-kit/api';
-import { pgSchema, uniqueIndex, index, foreignKey, jsonb, date, timestamp, boolean, doublePrecision, numeric, bigint, integer, text, uuid } from 'drizzle-orm/pg-core';
+import { pgSchema, uniqueIndex, index, foreignKey, primaryKey, jsonb, date, timestamp, boolean, doublePrecision, numeric, bigint, integer, text, uuid } from 'drizzle-orm/pg-core';
 import { sql } from 'drizzle-orm';
-import { createHash } from 'crypto';
-import { readFile, readdir, mkdir, writeFile } from 'fs/promises';
-import { join, extname } from 'path';
 import { load } from 'js-yaml';
+import { capabilityPinsSchema, customRolesBlockSchema, validateCapabilityPins } from '@sequenceholdings/custom-roles-manifest';
+export { capabilityPinsSchema, customRolesBlockSchema, customRolesDeclared, parseCapabilityPin, validateCapabilityPins } from '@sequenceholdings/custom-roles-manifest';
+
+// src/authoring/columns.ts
+var COLUMN_BRAND = "seq-column";
+var ENUM_BRAND = "seq-enum";
+function isEnumRef(value) {
+  return typeof value === "object" && value !== null && value.kind === ENUM_BRAND;
+}
+var COLUMN_DEFAULT_FNS = ["gen_random_uuid()", "now()"];
+function deriveColumnName(propertyName) {
+  return propertyName.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1_$2").toLowerCase();
+}
+var ColumnBuilder = class {
+  kind = COLUMN_BRAND;
+  state;
+  constructor(type, columnName) {
+    this.state = {
+      type,
+      columnName,
+      primaryKey: false,
+      notNull: false,
+      unique: false,
+      hasDefault: false,
+      defaultValue: void 0,
+      defaultFn: void 0,
+      description: void 0,
+      renamedFrom: void 0,
+      cast: void 0,
+      deprecated: false
+    };
+  }
+  /** Marks this column as (part of) the primary key. Implies NOT NULL. */
+  primaryKey() {
+    this.state.primaryKey = true;
+    return this;
+  }
+  notNull() {
+    this.state.notNull = true;
+    return this;
+  }
+  unique() {
+    this.state.unique = true;
+    return this;
+  }
+  /**
+   * Column default: a literal, or one of the allowlisted SQL functions
+   * (`'gen_random_uuid()'` / `'now()'`), which serialize as `defaultFn`.
+   */
+  default(value) {
+    if (value === "gen_random_uuid()" || value === "now()") {
+      this.state.defaultFn = value;
+      this.state.hasDefault = false;
+      this.state.defaultValue = void 0;
+      return this;
+    }
+    this.state.hasDefault = true;
+    this.state.defaultValue = value;
+    this.state.defaultFn = void 0;
+    return this;
+  }
+  description(text3) {
+    this.state.description = text3;
+    return this;
+  }
+  /** Migration rename hint: the previous Postgres column name. */
+  renamedFrom(previousColumnName) {
+    this.state.renamedFrom = previousColumnName;
+    return this;
+  }
+  /** Migration cast hint: the `USING` SQL applied when this column changes type. */
+  cast(usingSql) {
+    this.state.cast = usingSql;
+    return this;
+  }
+  /** Emits `@deprecated` in the generated SDL; the column stays queryable. */
+  deprecated() {
+    this.state.deprecated = true;
+    return this;
+  }
+  /** Whether `.primaryKey()` was called — collected into the table-level PK. */
+  get isPrimaryKey() {
+    return this.state.primaryKey;
+  }
+  /** The enum name when this is an enum column, else undefined. */
+  get enumName() {
+    return typeof this.state.type === "object" ? this.state.type.enum : void 0;
+  }
+  /** Postgres column name: explicit override, else snake_case of the property name. */
+  columnNameFor(propertyName) {
+    return this.state.columnName ?? deriveColumnName(propertyName);
+  }
+  /** Serialize to a canonical v2 column. Validation happens in serializeNamespace. */
+  toCanonicalColumn(propertyName) {
+    const column = {
+      name: propertyName,
+      columnName: this.columnNameFor(propertyName),
+      type: typeof this.state.type === "object" ? { enum: this.state.type.enum } : this.state.type,
+      nullable: !(this.state.notNull || this.state.primaryKey),
+      unique: this.state.unique,
+      deprecated: this.state.deprecated
+    };
+    if (this.state.hasDefault) column.default = this.state.defaultValue ?? null;
+    if (this.state.defaultFn !== void 0) column.defaultFn = this.state.defaultFn;
+    if (this.state.description !== void 0) column.description = this.state.description;
+    if (this.state.renamedFrom !== void 0) column.renamedFrom = this.state.renamedFrom;
+    if (this.state.cast !== void 0) column.cast = this.state.cast;
+    return column;
+  }
+};
+function isColumnBuilder(value) {
+  return typeof value === "object" && value !== null && value.kind === COLUMN_BRAND;
+}
+var scalar = (type) => (columnName) => new ColumnBuilder(type, columnName);
+var t = {
+  uuid: scalar("uuid"),
+  text: scalar("text"),
+  integer: scalar("integer"),
+  bigint: scalar("bigint"),
+  numeric: scalar("numeric"),
+  double: scalar("double"),
+  boolean: scalar("boolean"),
+  timestamptz: scalar("timestamptz"),
+  date: scalar("date"),
+  jsonb: scalar("jsonb"),
+  enum: (ref, columnName) => new ColumnBuilder({ enum: ref.name }, columnName)
+};
+
+// src/constants.ts
+var NAMESPACE_PATTERN = /^[a-z][a-z0-9_]{0,40}$/;
+var IDENTIFIER_PATTERN = /^[a-z][a-z0-9_]*$/;
+var MAX_IDENTIFIER_LENGTH = 63;
+var ORM_DATA_TOKEN_HEADER = "x-sequence-data-token";
+var ORM_SERVICE_DATA_TOKEN_HEADER = "x-sequence-data-token-service";
+var CAPABILITY_KEY_PATTERN = /^(?:org\/)?[a-z0-9-]{1,64}$/;
+var CLAIM_KEY_PATTERN = /^[a-z][a-z0-9_]*$/;
+var QUALIFIED_TABLE_PATTERN = /^[a-z][a-z0-9_]*\.[a-z][a-z0-9_]*$/;
+var SYNCED_SOURCE_PATTERN = /^gold\.[a-z][a-z0-9_]*$/;
+var ORM_SCHEMA_PREFIX = "orm_";
+var CONSUMER_ROLE_SUFFIX = "_consumer";
+var ormSchemaName = (namespace) => `${ORM_SCHEMA_PREFIX}${namespace}`;
+var consumerRoleName = (namespace) => `${ORM_SCHEMA_PREFIX}${namespace}${CONSUMER_ROLE_SUFFIX}`;
+var DEFINITION_FILE_EXTENSIONS = [".yml", ".yaml"];
+var NAMESPACE_CONFIG_FILENAMES = /* @__PURE__ */ new Set(["namespace.yaml", "namespace.yml"]);
+var HASH_DOMAIN = "sequence-orm-definitions\0";
+var MAX_DEFINITION_FILE_BYTES = 1024 * 1024;
+var RESERVED_TABLE_NAMES = /* @__PURE__ */ new Set(["actions", "query"]);
+var RESERVED_COLUMN_NAMES = /* @__PURE__ */ new Set(["select", "order", "limit", "offset"]);
+
+// src/errors.ts
+var OrmDefinitionError = class extends Error {
+  constructor(message, file) {
+    super(file ? `${file}: ${message}` : message);
+    this.file = file;
+  }
+  name = "OrmDefinitionError";
+};
+var PredicateParseError = class extends Error {
+  constructor(message, position) {
+    super(`${message} (at position ${position})`);
+    this.position = position;
+  }
+  name = "PredicateParseError";
+};
+
+// src/authoring/registry.ts
+var CONTEXT_STACK_KEY = Symbol.for("sequence.orm.authoring.context-stack.v2");
+function contextStack() {
+  const holder = globalThis;
+  const existing = holder[CONTEXT_STACK_KEY];
+  if (Array.isArray(existing)) {
+    return existing;
+  }
+  const created = [];
+  holder[CONTEXT_STACK_KEY] = created;
+  return created;
+}
+function beginAuthoringContext() {
+  const context = { currentFile: void 0, tables: [], enums: [], configs: [] };
+  contextStack().push(context);
+  return context;
+}
+function endAuthoringContext(context) {
+  const stack = contextStack();
+  const top = stack[stack.length - 1];
+  if (top !== context) {
+    throw new Error("endAuthoringContext: the given context is not the active one \u2014 begin/end calls are mismatched");
+  }
+  stack.pop();
+}
+function activeAuthoringContext() {
+  const stack = contextStack();
+  return stack[stack.length - 1];
+}
+function register(bucket, value) {
+  const context = activeAuthoringContext();
+  if (!context) return;
+  context[bucket].push({ value, file: context.currentFile });
+}
+function registerTable(value) {
+  register("tables", value);
+}
+function registerEnum(value) {
+  register("enums", value);
+}
+function registerNamespaceConfig(value) {
+  register("configs", value);
+}
+
+// src/authoring/table.ts
+var TABLE_BRAND = "seq-table";
+var LINK_BRAND = "seq-link";
+function toOne(target, options) {
+  return {
+    kind: LINK_BRAND,
+    linkKind: "toOne",
+    target,
+    on: options.on,
+    references: options.references,
+    enforce: options.enforce ?? false,
+    description: options.description
+  };
+}
+function toMany(target, options) {
+  return {
+    kind: LINK_BRAND,
+    linkKind: "toMany",
+    target,
+    on: options.on,
+    references: options.references,
+    enforce: false,
+    description: options.description
+  };
+}
+function toPlatformUser(options) {
+  return {
+    kind: LINK_BRAND,
+    linkKind: "toPlatformUser",
+    target: void 0,
+    on: options.on,
+    references: options.references,
+    enforce: false,
+    description: options.description
+  };
+}
+function isSeqLink(value) {
+  return typeof value === "object" && value !== null && value.kind === LINK_BRAND;
+}
+function isSeqTable(value) {
+  return typeof value === "object" && value !== null && value.kind === TABLE_BRAND;
+}
+function assertIdentifier({ value, what, file }) {
+  if (!IDENTIFIER_PATTERN.test(value) || value.length > MAX_IDENTIFIER_LENGTH) {
+    throw new OrmDefinitionError(
+      `${what} "${value}" must match ${IDENTIFIER_PATTERN} and be at most ${MAX_IDENTIFIER_LENGTH} characters`,
+      file
+    );
+  }
+}
+function defineTable(name, columns, config = {}) {
+  const file = activeAuthoringContext()?.currentFile;
+  assertIdentifier({ value: name, what: "table name", file });
+  const entries = Object.entries(columns);
+  if (entries.length === 0) {
+    throw new OrmDefinitionError(`table "${name}" declares no columns`, file);
+  }
+  const seenColumnNames = /* @__PURE__ */ new Map();
+  for (const [propertyName, builder] of entries) {
+    if (!isColumnBuilder(builder)) {
+      throw new OrmDefinitionError(
+        `table "${name}": column "${propertyName}" is not a column builder \u2014 use the t.* factories (t.uuid(), t.text(), \u2026)`,
+        file
+      );
+    }
+    const columnName = builder.columnNameFor(propertyName);
+    assertIdentifier({ value: columnName, what: `table "${name}": column "${propertyName}" column name`, file });
+    const existing = seenColumnNames.get(columnName);
+    if (existing !== void 0) {
+      throw new OrmDefinitionError(
+        `table "${name}": columns "${existing}" and "${propertyName}" both map to Postgres column "${columnName}"`,
+        file
+      );
+    }
+    seenColumnNames.set(columnName, propertyName);
+  }
+  const table = { kind: TABLE_BRAND, tableName: name, columns, config, source: void 0, file };
+  registerTable(table);
+  return table;
+}
+function defineSyncedTable(name, config) {
+  const file = activeAuthoringContext()?.currentFile;
+  assertIdentifier({ value: name, what: "table name", file });
+  if (!SYNCED_SOURCE_PATTERN.test(config.source)) {
+    throw new OrmDefinitionError(
+      `synced table "${name}": source "${config.source}" must match ${SYNCED_SOURCE_PATTERN} (gold layer only)`,
+      file
+    );
+  }
+  const table = {
+    kind: TABLE_BRAND,
+    tableName: name,
+    columns: {},
+    config: config.description !== void 0 ? { description: config.description } : {},
+    source: config.source,
+    file
+  };
+  registerTable(table);
+  return table;
+}
+function defineEnum(name, values) {
+  const file = activeAuthoringContext()?.currentFile;
+  assertIdentifier({ value: name, what: "enum name", file });
+  if (values.length === 0 || values.length > 100) {
+    throw new OrmDefinitionError(`enum "${name}" must declare between 1 and 100 values`, file);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const value of values) {
+    if (value.length === 0 || value.length > MAX_IDENTIFIER_LENGTH) {
+      throw new OrmDefinitionError(
+        `enum "${name}": value ${JSON.stringify(value)} must be 1-${MAX_IDENTIFIER_LENGTH} characters`,
+        file
+      );
+    }
+    if (seen.has(value)) {
+      throw new OrmDefinitionError(`enum "${name}" declares duplicate value "${value}"`, file);
+    }
+    seen.add(value);
+  }
+  const ref = { kind: ENUM_BRAND, name, values: [...values] };
+  registerEnum(ref);
+  return ref;
+}
+var CANONICAL_FORMAT = 2;
+var IDENTIFIER_RE = /^[a-z][a-z0-9_]*$/;
+var identifier = z.string().min(1).max(63).regex(IDENTIFIER_RE);
+var COLUMN_TYPES = [
+  "uuid",
+  "text",
+  "integer",
+  "bigint",
+  "numeric",
+  "double",
+  "boolean",
+  "timestamptz",
+  "date",
+  "jsonb"
+];
+var columnTypeSchema = z.enum(COLUMN_TYPES);
+var canonicalEnumSchema = z.object({
+  name: identifier,
+  values: z.array(z.string().min(1).max(63)).min(1).max(100)
+});
+var canonicalColumnSchema = z.object({
+  /** Property name in TS (camelCase); columnName is the Postgres name. */
+  name: z.string().min(1).max(63),
+  columnName: identifier,
+  type: z.union([columnTypeSchema, z.object({ enum: identifier })]),
+  nullable: z.boolean().default(true),
+  unique: z.boolean().default(false),
+  /** Literal default, or one of the allowlisted SQL functions. */
+  default: z.union([z.string(), z.number(), z.boolean(), z.null()]).optional(),
+  defaultFn: z.enum(["gen_random_uuid()", "now()"]).optional(),
+  description: z.string().max(500).optional(),
+  /** Migration hints — same semantics as v1. */
+  renamedFrom: identifier.optional(),
+  cast: z.string().max(200).optional(),
+  deprecated: z.boolean().default(false)
+});
+var canonicalLinkSchema = z.object({
+  name: z.string().min(1).max(63),
+  kind: z.enum(["toOne", "toMany", "toPlatformUser"]),
+  /** Target table name (namespace-local). Absent for toPlatformUser. */
+  target: identifier.optional(),
+  /** FK column on the owning side (toOne/toPlatformUser: on this table; toMany: on the target). */
+  on: identifier,
+  /** Referenced column on the target (default: target's PK / platform user `sub`). */
+  references: identifier.optional(),
+  /** enforce: true emits a real FK constraint (same-namespace toOne only). */
+  enforce: z.boolean().default(false),
+  description: z.string().max(500).optional()
+});
+var canonicalIndexSchema = z.object({
+  columns: z.array(identifier).min(1),
+  unique: z.boolean().default(false),
+  name: identifier.optional()
+});
+var policyVariantSchema = z.object({
+  /** Claims-only guard (capability()/role()/claim() comparisons — no columns). */
+  when: z.string().min(1).max(1e3),
+  /** Exactly one of: allow-all bypass, or a row predicate. */
+  allow: z.literal(true).optional(),
+  policy: z.string().min(1).max(2e3).optional()
+}).refine((v) => v.allow === true !== (typeof v.policy === "string"), {
+  message: "A variant declares exactly one of allow: true or policy"
+});
+var policyExpressionSchema = z.union([
+  z.string().min(1).max(2e3),
+  z.object({
+    default: z.string().min(1).max(2e3),
+    variants: z.array(policyVariantSchema).max(10).default([])
+  })
+]);
+var canonicalPoliciesSchema = z.object({
+  read: policyExpressionSchema.optional(),
+  write: policyExpressionSchema.optional()
+});
+var canonicalActionSchema = z.object({
+  name: identifier,
+  requires: z.string().max(1e3).optional(),
+  params: z.record(z.string(), z.object({
+    type: columnTypeSchema,
+    nullable: z.boolean().default(false)
+  })).default({}),
+  executes: z.string().min(1).max(1e4),
+  returns: z.enum(["rows", "rowsAffected", "scalar"]).default("rowsAffected"),
+  audit: z.object({ action: z.string(), resource: z.string() }).optional()
+});
+var canonicalTableSchema = z.object({
+  table: identifier,
+  description: z.string().max(2e3).optional(),
+  /** Table-level rename hint (new in v2). */
+  renamedFrom: identifier.optional(),
+  /** Synced/reflected read-only tables (`source: gold.*`) — v1 semantics. */
+  source: z.string().regex(/^gold\.[a-z][a-z0-9_]*$/).optional(),
+  columns: z.array(canonicalColumnSchema).default([]),
+  primaryKey: z.array(identifier).min(1).max(8).optional(),
+  links: z.array(canonicalLinkSchema).default([]),
+  indexes: z.array(canonicalIndexSchema).default([]),
+  policies: canonicalPoliciesSchema.default({}),
+  actions: z.array(canonicalActionSchema).default([])
+});
+var canonicalDefinitionSchema = z.object({
+  definition_format: z.literal(CANONICAL_FORMAT),
+  namespace: identifier.max(41),
+  description: z.string().max(2e3).optional(),
+  enums: z.array(canonicalEnumSchema).default([]),
+  tables: z.array(canonicalTableSchema).min(0).max(500),
+  /** Verbatim custom-roles grammar (@sequenceholdings/custom-roles-manifest). */
+  capabilities: z.object({
+    roles: z.unknown().optional(),
+    uses: z.array(z.string()).default([])
+  }).default({ uses: [] })
+});
+function normalizeCanonical(definition) {
+  const sortByName = (items) => [...items].sort((a, b) => a.name.localeCompare(b.name));
+  return {
+    ...definition,
+    enums: sortByName(definition.enums),
+    tables: [...definition.tables].sort((a, b) => a.table.localeCompare(b.table)).map((t2) => ({
+      ...t2,
+      links: sortByName(t2.links),
+      indexes: [...t2.indexes].sort((a, b) => (a.name ?? a.columns.join("_")).localeCompare(b.name ?? b.columns.join("_"))),
+      actions: sortByName(t2.actions)
+    }))
+  };
+}
+function stableJson(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+  const entries = Object.entries(value).filter(([, entryValue]) => entryValue !== void 0).sort(([a], [b]) => a < b ? -1 : 1).map(([key, entryValue]) => `${JSON.stringify(key)}:${stableJson(entryValue)}`);
+  return `{${entries.join(",")}}`;
+}
+function emptyToNull(value) {
+  if (value == null) return null;
+  if (Array.isArray(value)) return value.length === 0 ? null : value;
+  if (typeof value === "object" && Object.keys(value).length === 0) return null;
+  return value;
+}
+function canonicalTable(table) {
+  return {
+    table: table.table,
+    description: table.description ?? null,
+    columns: table.columns ?? null,
+    source: table.source ?? null,
+    links: emptyToNull(table.links),
+    indexes: emptyToNull(table.indexes),
+    policies: {
+      read: table.policies?.read?.source ?? null,
+      write: table.policies?.write?.source ?? null
+    },
+    actions: emptyToNull(
+      Object.fromEntries(
+        Object.entries(table.actions ?? {}).map(([name, action]) => [
+          name,
+          {
+            description: action.description ?? null,
+            requires: action.requires?.source ?? null,
+            params: emptyToNull(action.params),
+            validates: emptyToNull(action.validates?.map((entry) => entry.source)),
+            executes: action.executes,
+            returns: emptyToNull(action.returns),
+            audit: action.audit ?? null
+          }
+        ])
+      )
+    )
+  };
+}
+function canonicalCapabilities(capabilities) {
+  const { definitions, capabilities: declared } = capabilities.roles;
+  const isEmpty = Object.keys(definitions).length === 0 && Object.keys(declared).length === 0 && capabilities.uses.length === 0;
+  if (isEmpty) return null;
+  return {
+    roles: {
+      definitions: Object.fromEntries(
+        Object.entries(definitions).map(([key, def]) => [
+          key,
+          {
+            ...def.description !== void 0 ? { description: def.description } : {},
+            default: def.default,
+            inherits: [...def.inherits].sort(),
+            grants: [...def.grants].sort()
+          }
+        ])
+      ),
+      capabilities: Object.fromEntries(
+        Object.entries(declared).map(([key, cap]) => [
+          key,
+          cap.description !== void 0 ? { description: cap.description } : {}
+        ])
+      )
+    },
+    uses: [...capabilities.uses].sort()
+  };
+}
+function canonicalizeDefinition(definition) {
+  return {
+    namespace: definition.namespace,
+    description: definition.description,
+    capabilities: canonicalCapabilities(definition.capabilities),
+    tables: definition.tables.map(canonicalTable)
+  };
+}
+function computeDefinitionHash(definition) {
+  return createHash("sha256").update(HASH_DOMAIN).update(stableJson(canonicalizeDefinition(definition))).digest("hex");
+}
+
+// src/authoring/namespace.ts
+var NAMESPACE_CONFIG_BRAND = "seq-namespace-config";
+function isSeqNamespaceConfig(value) {
+  return typeof value === "object" && value !== null && value.kind === NAMESPACE_CONFIG_BRAND;
+}
+function defineNamespace(input) {
+  const file = activeAuthoringContext()?.currentFile;
+  if (!NAMESPACE_PATTERN.test(input.namespace)) {
+    throw new OrmDefinitionError(`namespace "${input.namespace}" must match ${NAMESPACE_PATTERN}`, file);
+  }
+  const config = {
+    kind: NAMESPACE_CONFIG_BRAND,
+    namespace: input.namespace,
+    description: input.description,
+    capabilities: input.capabilities ?? {},
+    file
+  };
+  registerNamespaceConfig(config);
+  return config;
+}
+function serializeNamespace(input) {
+  const { config, tables } = input;
+  const enums = input.enums ?? [];
+  const tablesByName = /* @__PURE__ */ new Map();
+  for (const table of tables) {
+    const existing = tablesByName.get(table.tableName);
+    if (existing) {
+      throw new OrmDefinitionError(
+        `duplicate table "${table.tableName}" (defined in ${describeFile(existing)} and ${describeFile(table)})`,
+        table.file
+      );
+    }
+    tablesByName.set(table.tableName, table);
+  }
+  const enumsByName = /* @__PURE__ */ new Map();
+  for (const ref of enums) {
+    if (enumsByName.has(ref.name)) {
+      throw new OrmDefinitionError(`duplicate enum "${ref.name}"`, config.file);
+    }
+    enumsByName.set(ref.name, ref);
+  }
+  const canonicalTables = tables.map((table) => buildCanonicalTable({ table, tablesByName, enumsByName }));
+  const canonicalEnums = [...enumsByName.values()].map((ref) => ({
+    name: ref.name,
+    values: [...ref.values]
+  }));
+  const candidate = {
+    definition_format: CANONICAL_FORMAT,
+    namespace: config.namespace,
+    enums: canonicalEnums,
+    tables: canonicalTables,
+    capabilities: {
+      ...config.capabilities.roles !== void 0 ? { roles: config.capabilities.roles } : {},
+      uses: [...config.capabilities.uses ?? []]
+    }
+  };
+  if (config.description !== void 0) candidate.description = config.description;
+  let parsed;
+  try {
+    parsed = canonicalDefinitionSchema.parse(candidate);
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      throw new OrmDefinitionError(`namespace "${config.namespace}": ${formatZodIssues(error)}`, config.file);
+    }
+    throw error;
+  }
+  return normalizeCanonical(parsed);
+}
+function computeCanonicalHash(definition) {
+  return createHash("sha256").update(HASH_DOMAIN).update(stableJson(definition)).digest("hex");
+}
+function buildCanonicalTable({ table, tablesByName, enumsByName }) {
+  const candidate = {
+    table: table.tableName,
+    columns: [],
+    links: [],
+    indexes: [],
+    policies: {},
+    actions: []
+  };
+  if (table.config.description !== void 0) candidate.description = table.config.description;
+  if (table.config.renamedFrom !== void 0) candidate.renamedFrom = table.config.renamedFrom;
+  if (table.source !== void 0) candidate.source = table.source;
+  const columnLevelPk = [];
+  for (const [propertyName, builder] of Object.entries(table.columns)) {
+    const column = builder.toCanonicalColumn(propertyName);
+    const enumName = builder.enumName;
+    if (enumName !== void 0 && !enumsByName.has(enumName)) {
+      throw new OrmDefinitionError(
+        `table "${table.tableName}": column "${propertyName}" references enum "${enumName}" which is not passed to serializeNamespace \u2014 declare it with defineEnum and include it`,
+        table.file
+      );
+    }
+    if (builder.isPrimaryKey) columnLevelPk.push(column.columnName);
+    candidate.columns?.push(column);
+  }
+  if (table.config.primaryKey !== void 0) {
+    if (columnLevelPk.length > 0) {
+      throw new OrmDefinitionError(
+        `table "${table.tableName}": declare the primary key either with .primaryKey() on columns or with config.primaryKey \u2014 not both`,
+        table.file
+      );
+    }
+    candidate.primaryKey = table.config.primaryKey.map(
+      (ref) => resolveColumnRef({ table, ref, role: "primaryKey" })
+    );
+  } else if (columnLevelPk.length > 0) {
+    candidate.primaryKey = columnLevelPk;
+  }
+  for (const index3 of table.config.indexes ?? []) {
+    const entry = {
+      columns: index3.columns.map((ref) => resolveColumnRef({ table, ref, role: "index" }))
+    };
+    if (index3.unique !== void 0) entry.unique = index3.unique;
+    if (index3.name !== void 0) entry.name = index3.name;
+    candidate.indexes?.push(entry);
+  }
+  for (const [linkName, link] of Object.entries(table.config.links ?? {})) {
+    candidate.links?.push(buildCanonicalLink({ table, linkName, link, tablesByName }));
+  }
+  const policies = {};
+  if (table.config.policies?.read !== void 0) policies.read = toCanonicalPolicy(table.config.policies.read);
+  if (table.config.policies?.write !== void 0) policies.write = toCanonicalPolicy(table.config.policies.write);
+  candidate.policies = policies;
+  for (const action of table.config.actions ?? []) {
+    candidate.actions?.push({
+      name: action.name,
+      ...action.requires !== void 0 ? { requires: action.requires } : {},
+      params: Object.fromEntries(
+        Object.entries(action.params ?? {}).map(([name, param]) => [
+          name,
+          { type: param.type, nullable: param.nullable ?? false }
+        ])
+      ),
+      executes: action.executes,
+      returns: action.returns ?? "rowsAffected",
+      ...action.audit !== void 0 ? { audit: action.audit } : {}
+    });
+  }
+  try {
+    return canonicalTableSchema.parse(candidate);
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      throw new OrmDefinitionError(`table "${table.tableName}": ${formatZodIssues(error)}`, table.file);
+    }
+    throw error;
+  }
+}
+function buildCanonicalLink({
+  table,
+  linkName,
+  link,
+  tablesByName
+}) {
+  const fail = (message) => {
+    throw new OrmDefinitionError(`table "${table.tableName}": link "${linkName}" ${message}`, table.file);
+  };
+  if (link.enforce && link.linkKind !== "toOne") {
+    return fail("sets enforce: true, which is only supported on toOne links");
+  }
+  if (link.linkKind === "toPlatformUser") {
+    if (link.target !== void 0) return fail("is toPlatformUser and must not declare a target table");
+    return {
+      name: linkName,
+      kind: "toPlatformUser",
+      on: resolveColumnRef({ table, ref: link.on, role: `link "${linkName}" on` }),
+      ...link.references !== void 0 ? { references: deriveColumnName(link.references) } : {},
+      enforce: false,
+      ...link.description !== void 0 ? { description: link.description } : {}
+    };
+  }
+  const target = resolveTableRef({ ref: link.target, fail });
+  if (!tablesByName.has(target.tableName)) {
+    return fail(`targets table "${target.tableName}" which is not part of this namespace`);
+  }
+  const owningSide = link.linkKind === "toOne" ? table : target;
+  return {
+    name: linkName,
+    kind: link.linkKind,
+    target: target.tableName,
+    on: resolveColumnRef({ table: owningSide, ref: link.on, role: `link "${linkName}" on` }),
+    ...link.references !== void 0 ? { references: resolveColumnRef({ table: target, ref: link.references, role: `link "${linkName}" references` }) } : {},
+    enforce: link.enforce,
+    ...link.description !== void 0 ? { description: link.description } : {}
+  };
+}
+function resolveTableRef({ ref, fail }) {
+  if (ref === void 0) return fail("declares no target table");
+  if (typeof ref !== "function") return ref;
+  let resolved;
+  try {
+    resolved = ref();
+  } catch (error) {
+    return fail(
+      `target thunk threw (${error instanceof Error ? error.message : String(error)}) \u2014 lazy refs resolve at serialize time; make sure the target module ran`
+    );
+  }
+  if (!isSeqTable(resolved)) return fail("target thunk did not return a table defined with defineTable");
+  return resolved;
+}
+function resolveColumnRef({ table, ref, role }) {
+  const direct = table.columns[ref];
+  if (direct) return direct.columnNameFor(ref);
+  for (const [propertyName, builder] of Object.entries(table.columns)) {
+    if (builder.columnNameFor(propertyName) === ref) return ref;
+  }
+  const known = Object.keys(table.columns).join(", ");
+  throw new OrmDefinitionError(
+    `table "${table.tableName}": ${role} references unknown column "${ref}" (known columns: ${known || "none"})`,
+    table.file
+  );
+}
+function toCanonicalPolicy(policy) {
+  if (typeof policy === "string") return policy;
+  return {
+    default: policy.default,
+    variants: (policy.variants ?? []).map((variant) => ({
+      when: variant.when,
+      ...variant.allow === true ? { allow: true } : {},
+      ...variant.policy !== void 0 ? { policy: variant.policy } : {}
+    }))
+  };
+}
+function describeFile(table) {
+  return table.file ?? "<unknown file>";
+}
+function formatZodIssues(error) {
+  return error.issues.map((issue) => issue.path.length > 0 ? `${issue.path.join(".")}: ${issue.message}` : issue.message).join("; ");
+}
+var NAMESPACE_CONFIG_FILE = "sequence.config.ts";
+var SCHEMA_DIR = "schema";
+async function loadNamespaceFromDir(dir, options = {}) {
+  const root = await realpath(dir).catch(() => {
+    throw new OrmDefinitionError(`namespace directory not found: ${dir}`);
+  });
+  const configPath = join(root, NAMESPACE_CONFIG_FILE);
+  const configStat = await stat(configPath).catch(() => void 0);
+  if (!configStat?.isFile()) {
+    throw new OrmDefinitionError(`${NAMESPACE_CONFIG_FILE} not found in ${dir}`);
+  }
+  const schemaFiles = await listSchemaFiles(root);
+  const files = [NAMESPACE_CONFIG_FILE, ...schemaFiles];
+  purgeModuleCache(root);
+  const jiti = createJiti(import.meta.url, {
+    interopDefault: true,
+    fsCache: false,
+    ...options.ormModulePath !== void 0 ? { alias: { "@sequenceholdings/orm": options.ormModulePath } } : {}
+  });
+  const context = beginAuthoringContext();
+  try {
+    for (const file of files) {
+      context.currentFile = file;
+      try {
+        await jiti.import(join(root, file));
+      } catch (error) {
+        if (error instanceof Error && error.name === "OrmDefinitionError") throw error;
+        throw new OrmDefinitionError(
+          `failed to load: ${error instanceof Error ? error.message : String(error)}`,
+          file
+        );
+      }
+    }
+  } finally {
+    context.currentFile = void 0;
+    endAuthoringContext(context);
+  }
+  const configs = [];
+  for (const entry of context.configs) {
+    if (isSeqNamespaceConfig(entry.value)) configs.push({ value: entry.value, file: entry.file });
+  }
+  const configEntry = configs[0];
+  if (!configEntry) {
+    throw new OrmDefinitionError(
+      "no namespace config registered \u2014 sequence.config.ts must call defineNamespace(...) at import time",
+      NAMESPACE_CONFIG_FILE
+    );
+  }
+  if (configs.length > 1) {
+    const where = configs.map((entry) => entry.file ?? "<unknown file>").join(", ");
+    throw new OrmDefinitionError(
+      `defineNamespace called ${configs.length} times (${where}) \u2014 declare exactly one namespace config`
+    );
+  }
+  const tables = [];
+  for (const entry of context.tables) {
+    if (isSeqTable(entry.value)) tables.push(entry.value);
+  }
+  if (tables.length === 0) {
+    throw new OrmDefinitionError(
+      `no tables registered \u2014 ${SCHEMA_DIR}/*.ts modules must call defineTable(...) at import time`
+    );
+  }
+  const enums = [];
+  for (const entry of context.enums) {
+    if (isEnumRef(entry.value)) enums.push(entry.value);
+  }
+  const canonical = serializeNamespace({ config: configEntry.value, tables, enums });
+  return { canonical, hash: computeCanonicalHash(canonical), files };
+}
+async function listSchemaFiles(root) {
+  const schemaDir = join(root, SCHEMA_DIR);
+  const entries = await readdir(schemaDir, { withFileTypes: true }).catch(() => []);
+  return entries.filter(
+    (entry) => entry.isFile() && entry.name.endsWith(".ts") && !entry.name.endsWith(".d.ts") && !entry.name.startsWith(".")
+  ).map((entry) => join(SCHEMA_DIR, entry.name)).sort();
+}
+function purgeModuleCache(root) {
+  const require2 = createRequire(import.meta.url);
+  const prefix = root.endsWith(sep) ? root : `${root}${sep}`;
+  for (const key of Object.keys(require2.cache)) {
+    if (key.startsWith(prefix)) delete require2.cache[key];
+  }
+}
 
 // src/codegen/types.ts
 var WIRE_TYPES = {
@@ -22,7 +874,7 @@ var WIRE_TYPES = {
 };
 function generateNamespaceTypes(definition) {
   const lines = [
-    `// Generated by \`seq-studio orm generate\` from the '${definition.namespace}' definitions \u2014 do not edit.`,
+    `// Generated by \`seq-studio orm apply\` from the '${definition.namespace}' definitions \u2014 do not edit.`,
     "",
     `export type ${typesInterfaceName(definition.namespace)} = {`
   ];
@@ -84,43 +936,6 @@ function columnWireType(column) {
   return notNull || base === "unknown" ? base : `${base} | null`;
 }
 
-// src/constants.ts
-var NAMESPACE_PATTERN = /^[a-z][a-z0-9_]{0,40}$/;
-var IDENTIFIER_PATTERN = /^[a-z][a-z0-9_]*$/;
-var MAX_IDENTIFIER_LENGTH = 63;
-var ORM_DATA_TOKEN_HEADER = "x-sequence-data-token";
-var ORM_SERVICE_DATA_TOKEN_HEADER = "x-sequence-data-token-service";
-var CAPABILITY_KEY_PATTERN = /^(?:org\/)?[a-z0-9-]{1,64}$/;
-var CLAIM_KEY_PATTERN = /^[a-z][a-z0-9_]*$/;
-var QUALIFIED_TABLE_PATTERN = /^[a-z][a-z0-9_]*\.[a-z][a-z0-9_]*$/;
-var SYNCED_SOURCE_PATTERN = /^gold\.[a-z][a-z0-9_]*$/;
-var ORM_SCHEMA_PREFIX = "orm_";
-var CONSUMER_ROLE_SUFFIX = "_consumer";
-var ormSchemaName = (namespace) => `${ORM_SCHEMA_PREFIX}${namespace}`;
-var consumerRoleName = (namespace) => `${ORM_SCHEMA_PREFIX}${namespace}${CONSUMER_ROLE_SUFFIX}`;
-var DEFINITION_FILE_EXTENSIONS = [".yml", ".yaml"];
-var NAMESPACE_CONFIG_FILENAMES = /* @__PURE__ */ new Set(["namespace.yaml", "namespace.yml"]);
-var HASH_DOMAIN = "sequence-orm-definitions\0";
-var MAX_DEFINITION_FILE_BYTES = 1024 * 1024;
-var RESERVED_TABLE_NAMES = /* @__PURE__ */ new Set(["actions", "query"]);
-var RESERVED_COLUMN_NAMES = /* @__PURE__ */ new Set(["select", "order", "limit", "offset"]);
-
-// src/errors.ts
-var OrmDefinitionError = class extends Error {
-  constructor(message, file) {
-    super(file ? `${file}: ${message}` : message);
-    this.file = file;
-  }
-  name = "OrmDefinitionError";
-};
-var PredicateParseError = class extends Error {
-  constructor(message, position) {
-    super(`${message} (at position ${position})`);
-    this.position = position;
-  }
-  name = "PredicateParseError";
-};
-
 // src/predicate/ast.ts
 var COMPARE_OPS = ["=", "!=", "<", "<=", ">", ">="];
 function walkPredicate(predicate, visit) {
@@ -159,7 +974,7 @@ var tableReferenceSchema = z.string().refine(
 var isQualifiedReference = (reference) => reference.includes(".");
 
 // src/schema/columns.ts
-var COLUMN_TYPES = [
+var COLUMN_TYPES2 = [
   "uuid",
   "text",
   "integer",
@@ -171,7 +986,7 @@ var COLUMN_TYPES = [
   "date",
   "jsonb"
 ];
-var columnTypeSchema = z.enum(COLUMN_TYPES);
+var columnTypeSchema2 = z.enum(COLUMN_TYPES2);
 var FUNCTION_DEFAULTS = {
   "gen_random_uuid()": ["uuid"],
   "now()": ["timestamptz", "date"]
@@ -200,7 +1015,7 @@ function defaultIssue(value, type) {
   return null;
 }
 var columnSchema = z.strictObject({
-  type: columnTypeSchema,
+  type: columnTypeSchema2,
   primary_key: z.boolean().optional(),
   nullable: z.boolean().optional(),
   unique: z.boolean().optional(),
@@ -467,7 +1282,7 @@ var NAMED_PARAM_PATTERN = /(?<!:):([a-z][a-z0-9_]*)/g;
 var QUOTED_STRING_PATTERN = /'(?:[^']|'')*'/g;
 var SQL_COMMENT_PATTERN = /--|\/\*/;
 var actionParamSchema = z.strictObject({
-  type: columnTypeSchema,
+  type: columnTypeSchema2,
   optional: z.boolean().optional(),
   description: z.string().optional()
 });
@@ -500,7 +1315,7 @@ var actionSchema = z.strictObject({
   // function returns those rows (typed in the client); absent → the action
   // reports rows_affected only. The column names/types must match the
   // RETURNING list, which Postgres enforces at CREATE FUNCTION.
-  returns: z.record(identifierSchema, columnTypeSchema).optional(),
+  returns: z.record(identifierSchema, columnTypeSchema2).optional(),
   audit: auditSchema.optional()
 }).superRefine((action, ctx) => {
   const params = Object.keys(action.params ?? {});
@@ -517,30 +1332,53 @@ var actionSchema = z.strictObject({
   if (action.returns && Object.keys(action.returns).length === 0) {
     ctx.addIssue({ code: "custom", message: "returns must declare at least one column", path: ["returns"] });
   }
-  for (const [index2, entry] of (action.validates ?? []).entries()) {
+  for (const [index3, entry] of (action.validates ?? []).entries()) {
     if (!params.includes(entry.param)) {
       ctx.addIssue({
         code: "custom",
         message: `validates references undeclared param '${entry.param}'`,
-        path: ["validates", index2]
+        path: ["validates", index3]
       });
     }
   }
 });
-function extractNamedParams(sql2) {
-  const withoutStrings = sql2.replace(QUOTED_STRING_PATTERN, "''");
+function extractNamedParams(sql3) {
+  const withoutStrings = sql3.replace(QUOTED_STRING_PATTERN, "''");
   const names = [...withoutStrings.matchAll(NAMED_PARAM_PATTERN)].map((match) => match[1]);
   return [...new Set(names)];
 }
 function actionStatementSources(executes) {
   return (Array.isArray(executes) ? executes : [executes]).map((statement) => statement.trim());
 }
+var WRITE_TARGET_PATTERNS = [
+  /^insert\s+into\s+(?:"?[a-z_][a-z0-9_]*"?\.)?"?([a-z_][a-z0-9_]*)"?/i,
+  /^update\s+(?:only\s+)?(?:"?[a-z_][a-z0-9_]*"?\.)?"?([a-z_][a-z0-9_]*)"?/i,
+  /^delete\s+from\s+(?:only\s+)?(?:"?[a-z_][a-z0-9_]*"?\.)?"?([a-z_][a-z0-9_]*)"?/i
+];
+function actionWriteTargets(action) {
+  const targets = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const statement of actionStatementSources(action.executes)) {
+    const masked = statement.replace(QUOTED_STRING_PATTERN, "''");
+    for (const pattern of WRITE_TARGET_PATTERNS) {
+      const match = pattern.exec(masked);
+      if (!match) continue;
+      const table = match[1].toLowerCase();
+      if (!seen.has(table)) {
+        seen.add(table);
+        targets.push(table);
+      }
+      break;
+    }
+  }
+  return targets;
+}
 function executesIssues(executes, declaredParams, hasReturns) {
   const issues = [];
   const statements = actionStatementSources(executes);
-  statements.forEach((statement, index2) => {
+  statements.forEach((statement, index3) => {
     const withoutStrings = statement.replace(QUOTED_STRING_PATTERN, "''");
-    const at = statements.length > 1 ? ` (statement ${index2 + 1})` : "";
+    const at = statements.length > 1 ? ` (statement ${index3 + 1})` : "";
     if (!EXECUTES_VERB_PATTERN.test(statement)) issues.push(`executes must be INSERT, UPDATE, or DELETE${at}`);
     if (withoutStrings.replace(/;\s*$/, "").includes(";")) issues.push(`each executes entry must be a single statement${at}`);
     if (SQL_COMMENT_PATTERN.test(withoutStrings)) issues.push(`executes must not contain SQL comments${at}`);
@@ -550,7 +1388,7 @@ function executesIssues(executes, declaredParams, hasReturns) {
     if (BARE_CLAIM_CALL_PATTERN.test(withoutStrings.replace(MASKED_CLAIM_CALL_PATTERN, ""))) {
       issues.push(`executes has a malformed claim()/capability() call \u2014 use e.g. claim('sub')${at}`);
     }
-    if (RETURNING_PATTERN.test(withoutStrings) && !(hasReturns && index2 === statements.length - 1)) {
+    if (RETURNING_PATTERN.test(withoutStrings) && !(hasReturns && index3 === statements.length - 1)) {
       issues.push(
         hasReturns ? `only the last executes statement may use RETURNING${at}` : `executes must not use RETURNING unless the action declares returns${at}`
       );
@@ -660,8 +1498,8 @@ var actionParamArg = (name) => `p_${name}`;
 function compileActionStatements(action, renderParam = actionParamArg) {
   return actionStatementSources(action.executes).map((statement) => compileStatement(statement, renderParam));
 }
-function compileStatement(sql2, renderParam) {
-  const compiled = sql2.replace(TOKEN_PATTERN, (token, claimKey, capabilityKey, paramName) => {
+function compileStatement(sql3, renderParam) {
+  const compiled = sql3.replace(TOKEN_PATTERN, (token, claimKey, capabilityKey, paramName) => {
     if (claimKey !== void 0) {
       if (!CLAIM_KEY_PATTERN.test(claimKey)) throw new OrmDefinitionError(`invalid claim key in executes: ${token}`);
       return claimExpression(claimKey);
@@ -714,9 +1552,9 @@ function actionPrepareChecks(definition) {
     const order = actionParamOrder(action);
     const signature = order.length > 0 ? ` (${order.map((param) => sqlTypeName(action.params[param].type)).join(", ")})` : "";
     const compiled = compileActionStatements(action, (param) => `$${order.indexOf(param) + 1}`);
-    compiled.forEach((sql2, index2) => {
-      const checked = action.returns && index2 === compiled.length - 1 ? returnProjection(action.returns, sql2) : sql2;
-      statements.push(`PREPARE ${quoteIdentifier(`orm_check_${name}_${index2}`)}${signature} AS ${checked}`);
+    compiled.forEach((sql3, index3) => {
+      const checked = action.returns && index3 === compiled.length - 1 ? returnProjection(action.returns, sql3) : sql3;
+      statements.push(`PREPARE ${quoteIdentifier(`orm_check_${name}_${index3}`)}${signature} AS ${checked}`);
     });
   }
   return statements;
@@ -831,7 +1669,7 @@ var indexSchema = z.union([
     unique: z.boolean().optional(),
     name: identifierSchema.optional()
   })
-]).transform((index2) => Array.isArray(index2) ? { columns: index2 } : index2);
+]).transform((index3) => Array.isArray(index3) ? { columns: index3 } : index3);
 var policiesSchema = z.strictObject({
   read: parsedPredicateSchema.optional(),
   write: parsedPredicateSchema.optional()
@@ -935,15 +1773,15 @@ function validateColumnTable(table, ctx) {
       });
     }
   }
-  for (const [position, index2] of (table.indexes ?? []).entries()) {
-    if (new Set(index2.columns).size !== index2.columns.length) {
+  for (const [position, index3] of (table.indexes ?? []).entries()) {
+    if (new Set(index3.columns).size !== index3.columns.length) {
       ctx.addIssue({
         code: "custom",
         message: "index names a column more than once",
         path: ["indexes", position]
       });
     }
-    for (const column of index2.columns) {
+    for (const column of index3.columns) {
       if (!names.includes(column)) {
         ctx.addIssue({
           code: "custom",
@@ -985,8 +1823,8 @@ function validateDerivedNameLengths(table, ctx) {
       path: ["table"]
     });
   }
-  for (const [position, index2] of (table.indexes ?? []).entries()) {
-    const name = indexName(table.table, index2);
+  for (const [position, index3] of (table.indexes ?? []).entries()) {
+    const name = indexName(table.table, index3);
     if (name.length > MAX_IDENTIFIER_LENGTH) {
       ctx.addIssue({
         code: "custom",
@@ -1226,9 +2064,9 @@ function sortByEnforcedLinks(tables) {
 var enforcedTargets = (table) => Object.values(table.links ?? {}).filter((link) => link.enforce && !isQualifiedReference(link.to) && link.to !== table.table).map((link) => link.to);
 
 // src/engine/snapshot.ts
-function generateSnapshot(definition, previousId2) {
+function generateSnapshot(definition, previousId3) {
   const { imports, schemaName } = buildDrizzleEntities(definition);
-  return generateDrizzleJson(imports, previousId2, [schemaName]);
+  return generateDrizzleJson(imports, previousId3, [schemaName]);
 }
 var emptySnapshot = (namespace) => generateDrizzleJson({}, void 0, [ormSchemaName(namespace)]);
 var CURRENT_SNAPSHOT_VERSION = generateDrizzleJson({}).version;
@@ -1380,264 +2218,596 @@ async function guardedRun(run) {
     process.exit = originalExit;
   }
 }
-
-// src/engine/index.ts
-var STATEMENT_KINDS = ["hint", "ddl", "security", "function"];
-async function planMigration({
-  definition,
-  previousSnapshot
-}) {
-  const schema = ormSchemaName(definition.namespace);
-  const previous = previousSnapshot ? normalizeSnapshot(previousSnapshot) : emptySnapshot(definition.namespace);
-  const hints = applyMigrationHints(previous, definition);
-  const snapshot = generateSnapshot(definition, previousId(previous));
-  const ddl = await diffStatements(hints.adjusted, snapshot);
-  const policyDrops = policyDropStatements(schema, snapshotTableNames(previous, schema));
-  const statements = [
-    ...policyDrops.map((sql2) => ({ kind: "security", sql: sql2 })),
-    ...hints.statements.map((sql2) => ({ kind: "hint", sql: sql2 })),
-    ...ddl.map((sql2) => ({ kind: "ddl", sql: sql2.replace(/;\s*$/, "") })),
-    ...securityStatements(definition).map((sql2) => ({ kind: "security", sql: sql2 })),
-    // PREPARE each action's executes first (plpgsql bodies don't check columns
-    // at CREATE), then create the functions. Both reference the tables the DDL
-    // above creates, so they close the plan.
-    ...actionPrepareChecks(definition).map((sql2) => ({ kind: "function", sql: sql2 })),
-    ...actionFunctionStatements(definition).map((sql2) => ({ kind: "function", sql: sql2 }))
-  ];
-  return { namespace: definition.namespace, schema, statements, snapshot };
-}
-var compileNamespace = (definition) => planMigration({ definition });
-var previousId = (snapshot) => snapshot.id;
-function stableJson(value) {
-  if (value === null || typeof value !== "object") return JSON.stringify(value);
-  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
-  const entries = Object.entries(value).filter(([, entryValue]) => entryValue !== void 0).sort(([a], [b]) => a < b ? -1 : 1).map(([key, entryValue]) => `${JSON.stringify(key)}:${stableJson(entryValue)}`);
-  return `{${entries.join(",")}}`;
-}
-function emptyToNull(value) {
-  if (value == null) return null;
-  if (Array.isArray(value)) return value.length === 0 ? null : value;
-  if (typeof value === "object" && Object.keys(value).length === 0) return null;
-  return value;
-}
-function canonicalTable(table) {
-  return {
-    table: table.table,
-    description: table.description ?? null,
-    columns: table.columns ?? null,
-    source: table.source ?? null,
-    links: emptyToNull(table.links),
-    indexes: emptyToNull(table.indexes),
-    policies: {
-      read: table.policies?.read?.source ?? null,
-      write: table.policies?.write?.source ?? null
-    },
-    actions: emptyToNull(
-      Object.fromEntries(
-        Object.entries(table.actions ?? {}).map(([name, action]) => [
-          name,
-          {
-            description: action.description ?? null,
-            requires: action.requires?.source ?? null,
-            params: emptyToNull(action.params),
-            validates: emptyToNull(action.validates?.map((entry) => entry.source)),
-            executes: action.executes,
-            returns: emptyToNull(action.returns),
-            audit: action.audit ?? null
-          }
-        ])
-      )
-    )
-  };
-}
-function canonicalCapabilities(capabilities) {
-  const { definitions, capabilities: declared } = capabilities.roles;
-  const isEmpty = Object.keys(definitions).length === 0 && Object.keys(declared).length === 0 && capabilities.uses.length === 0;
-  if (isEmpty) return null;
-  return {
-    roles: {
-      definitions: Object.fromEntries(
-        Object.entries(definitions).map(([key, def]) => [
-          key,
-          {
-            ...def.description !== void 0 ? { description: def.description } : {},
-            default: def.default,
-            inherits: [...def.inherits].sort(),
-            grants: [...def.grants].sort()
-          }
-        ])
-      ),
-      capabilities: Object.fromEntries(
-        Object.entries(declared).map(([key, cap]) => [
-          key,
-          cap.description !== void 0 ? { description: cap.description } : {}
-        ])
-      )
-    },
-    uses: [...capabilities.uses].sort()
-  };
+
+// src/engine/index.ts
+var STATEMENT_KINDS = ["hint", "ddl", "security", "function"];
+async function planMigration({
+  definition,
+  previousSnapshot
+}) {
+  const schema = ormSchemaName(definition.namespace);
+  const previous = previousSnapshot ? normalizeSnapshot(previousSnapshot) : emptySnapshot(definition.namespace);
+  const hints = applyMigrationHints(previous, definition);
+  const snapshot = generateSnapshot(definition, previousId(previous));
+  const ddl = await diffStatements(hints.adjusted, snapshot);
+  const policyDrops = policyDropStatements(schema, snapshotTableNames(previous, schema));
+  const statements = [
+    ...policyDrops.map((sql3) => ({ kind: "security", sql: sql3 })),
+    ...hints.statements.map((sql3) => ({ kind: "hint", sql: sql3 })),
+    ...ddl.map((sql3) => ({ kind: "ddl", sql: sql3.replace(/;\s*$/, "") })),
+    ...securityStatements(definition).map((sql3) => ({ kind: "security", sql: sql3 })),
+    // PREPARE each action's executes first (plpgsql bodies don't check columns
+    // at CREATE), then create the functions. Both reference the tables the DDL
+    // above creates, so they close the plan.
+    ...actionPrepareChecks(definition).map((sql3) => ({ kind: "function", sql: sql3 })),
+    ...actionFunctionStatements(definition).map((sql3) => ({ kind: "function", sql: sql3 }))
+  ];
+  return { namespace: definition.namespace, schema, statements, snapshot };
 }
-function canonicalizeDefinition(definition) {
-  return {
-    namespace: definition.namespace,
-    description: definition.description,
-    capabilities: canonicalCapabilities(definition.capabilities),
-    tables: definition.tables.map(canonicalTable)
-  };
+var compileNamespace = (definition) => planMigration({ definition });
+var previousId = (snapshot) => snapshot.id;
+var FACTORIES2 = {
+  uuid: (name) => uuid(name),
+  text: (name) => text(name),
+  integer: (name) => integer(name),
+  // Mode 'bigint' keeps int8 lossless — mode 'number' silently rounds past
+  // 2^53. The read executor serializes BigInt to string for JSON.
+  bigint: (name) => bigint(name, { mode: "bigint" }),
+  numeric: (name) => numeric(name),
+  double: (name) => doublePrecision(name),
+  boolean: (name) => boolean(name),
+  timestamptz: (name) => timestamp(name, { withTimezone: true }),
+  date: (name) => date(name),
+  jsonb: (name) => jsonb(name)
+};
+var SCHEMA_IMPORT_KEY2 = "$schema";
+var enumImportKey = (name) => `$enum_${name}`;
+var columnTablesV2 = (definition) => definition.tables.filter((table) => !table.source);
+function buildDrizzleEntitiesV2(definition) {
+  const schemaName = ormSchemaName(definition.namespace);
+  const schema = pgSchema(schemaName);
+  const imports = { [SCHEMA_IMPORT_KEY2]: schema };
+  const tables = {};
+  const built = /* @__PURE__ */ new Map();
+  const enums = /* @__PURE__ */ new Map();
+  for (const enumDefinition of definition.enums) {
+    const values = enumDefinition.values;
+    const builtEnum = schema.enum(enumDefinition.name, values);
+    enums.set(enumDefinition.name, builtEnum);
+    imports[enumImportKey(enumDefinition.name)] = builtEnum;
+  }
+  const byName = new Map(definition.tables.map((table) => [table.table, table]));
+  for (const table of sortByEnforcedLinks2(columnTablesV2(definition))) {
+    const drizzleTable = buildTable2(schema, table, built, enums, byName);
+    built.set(table.table, drizzleTable);
+    imports[table.table] = drizzleTable;
+    tables[table.table] = drizzleTable;
+  }
+  return { imports, tables, schemaName };
 }
-function computeDefinitionHash(definition) {
-  return createHash("sha256").update(HASH_DOMAIN).update(stableJson(canonicalizeDefinition(definition))).digest("hex");
+function generateSnapshotV2(definition, previousId3) {
+  const { imports, schemaName } = buildDrizzleEntitiesV2(definition);
+  return generateDrizzleJson(imports, previousId3, [schemaName]);
 }
-var CUSTOM_ROLE_KEY_RE = /^[a-z0-9-]+$/;
-var customRoleKeySchema = z.string().min(1).max(64).regex(
-  CUSTOM_ROLE_KEY_RE,
-  "Role and capability keys must match [a-z0-9-]+"
-);
-var MAX_CUSTOM_ROLE_DEFINITIONS = 50;
-var MAX_CUSTOM_ROLE_CAPABILITIES = 100;
-var customRoleCapabilityDeclarationSchema = z.object({
-  description: z.string().max(500).optional()
-});
-var customRoleDefinitionSchema = z.object({
-  description: z.string().max(500).optional(),
-  /**
-   * Grants this role to the host's entire runtime audience. Resolved at the
-   * app layer at claim time — every caller who passes the host floor
-   * (`end_user`) holds the default roles; no tuple is written for it.
-   */
-  default: z.boolean().default(false),
-  /** Role keys whose grants this role also receives (privilege waterfall). */
-  inherits: z.array(customRoleKeySchema).default([]),
-  /** Capability keys this role grants directly. */
-  grants: z.array(customRoleKeySchema).default([])
-});
-var customRolesBlockSchema = z.object({
-  /** Roles grantable to principals, keyed by role key. */
-  definitions: z.record(customRoleKeySchema, customRoleDefinitionSchema).default({}),
-  /** Leaf capability keys the host's code checks, keyed by capability key. */
-  capabilities: z.record(customRoleKeySchema, customRoleCapabilityDeclarationSchema).default({})
-}).superRefine((block, ctx) => {
-  const roleKeys = Object.keys(block.definitions);
-  const capabilityKeys = new Set(Object.keys(block.capabilities));
-  if (roleKeys.length > MAX_CUSTOM_ROLE_DEFINITIONS) {
-    ctx.addIssue({
-      code: "custom",
-      message: `At most ${MAX_CUSTOM_ROLE_DEFINITIONS} role definitions are allowed`,
-      path: ["definitions"]
-    });
+function buildTable2(schema, table, built, enums, byName) {
+  const primaryKeyColumns = table.primaryKey ?? [];
+  if (primaryKeyColumns.length === 0) {
+    throw new OrmDefinitionError(`table '${table.table}' declares no primaryKey`);
   }
-  if (capabilityKeys.size > MAX_CUSTOM_ROLE_CAPABILITIES) {
-    ctx.addIssue({
-      code: "custom",
-      message: `At most ${MAX_CUSTOM_ROLE_CAPABILITIES} capabilities are allowed`,
-      path: ["capabilities"]
-    });
+  const columnNames = new Set(table.columns.map((column) => column.columnName));
+  for (const name of primaryKeyColumns) {
+    if (!columnNames.has(name)) {
+      throw new OrmDefinitionError(`primaryKey of '${table.table}' references unknown column '${name}'`);
+    }
   }
-  for (const key of roleKeys) {
-    if (capabilityKeys.has(key)) {
-      ctx.addIssue({
-        code: "custom",
-        message: `Key "${key}" is declared as both a role and a capability`,
-        path: ["definitions", key]
-      });
+  const singlePrimaryKey = primaryKeyColumns.length === 1 ? primaryKeyColumns[0] : void 0;
+  const compositeMembers = new Set(singlePrimaryKey === void 0 ? primaryKeyColumns : []);
+  const columns = Object.fromEntries(
+    table.columns.map((column) => [
+      column.columnName,
+      buildColumnV2({ table: table.table, column, singlePrimaryKey, compositeMembers, enums })
+    ])
+  );
+  const drizzleTable = schema.table(table.table, columns, (self) => [
+    ...buildCompositePrimaryKey(table, primaryKeyColumns, self),
+    ...buildIndexes2(table, self),
+    ...buildForeignKeys2(table, self, built, byName)
+  ]);
+  return drizzleTable.enableRLS();
+}
+function resolveColumnFactory(table, column, enums) {
+  if (typeof column.type === "string") return FACTORIES2[column.type];
+  const enumFactory = enums.get(column.type.enum);
+  if (!enumFactory) {
+    throw new OrmDefinitionError(`column '${table}.${column.columnName}' references undeclared enum '${column.type.enum}'`);
+  }
+  return enumFactory;
+}
+function buildColumnV2({
+  table,
+  column,
+  singlePrimaryKey,
+  compositeMembers,
+  enums
+}) {
+  const factory = resolveColumnFactory(table, column, enums);
+  let builder = factory(column.columnName);
+  const isSinglePrimaryKey = column.columnName === singlePrimaryKey;
+  if (isSinglePrimaryKey) builder = builder.primaryKey();
+  if ((column.nullable === false || compositeMembers.has(column.columnName)) && !isSinglePrimaryKey) {
+    builder = builder.notNull();
+  }
+  if (column.unique && !isSinglePrimaryKey) builder = builder.unique();
+  if (column.defaultFn !== void 0 && column.default !== void 0) {
+    throw new OrmDefinitionError(`column '${table}.${column.columnName}' declares both default and defaultFn`);
+  }
+  if (column.defaultFn !== void 0) {
+    if (typeof column.type !== "string" || !isFunctionDefault(column.defaultFn, column.type)) {
+      throw new OrmDefinitionError(
+        `column '${table}.${column.columnName}' declares defaultFn '${column.defaultFn}' which is invalid for its type`
+      );
     }
+    builder = builder.default(sql.raw(column.defaultFn));
+  } else if (column.default !== void 0 && column.default !== null) {
+    builder = builder.default(column.default);
   }
-  const roleKeySet = new Set(roleKeys);
-  for (const [roleKey, definition] of Object.entries(block.definitions)) {
-    const seenInherits = /* @__PURE__ */ new Set();
-    for (const inherited of definition.inherits) {
-      if (seenInherits.has(inherited)) {
-        ctx.addIssue({
-          code: "custom",
-          message: `Role "${roleKey}" lists "${inherited}" in inherits more than once`,
-          path: ["definitions", roleKey, "inherits"]
-        });
-      }
-      seenInherits.add(inherited);
-      if (!roleKeySet.has(inherited)) {
-        ctx.addIssue({
-          code: "custom",
-          message: `Role "${roleKey}" inherits unknown role "${inherited}"`,
-          path: ["definitions", roleKey, "inherits"]
-        });
+  return builder;
+}
+function buildCompositePrimaryKey(table, primaryKeyColumns, self) {
+  if (primaryKeyColumns.length < 2) return [];
+  return [
+    primaryKey({
+      name: `${table.table}_pkey`,
+      columns: primaryKeyColumns.map((column) => self[column])
+    })
+  ];
+}
+function buildIndexes2(table, self) {
+  return table.indexes.map((definition) => {
+    for (const column of definition.columns) {
+      if (!(column in self)) {
+        throw new OrmDefinitionError(`index on '${table.table}' references unknown column '${column}'`);
       }
     }
-    const seenGrants = /* @__PURE__ */ new Set();
-    for (const granted of definition.grants) {
-      if (seenGrants.has(granted)) {
-        ctx.addIssue({
-          code: "custom",
-          message: `Role "${roleKey}" lists "${granted}" in grants more than once`,
-          path: ["definitions", roleKey, "grants"]
-        });
-      }
-      seenGrants.add(granted);
-      if (!capabilityKeys.has(granted)) {
-        ctx.addIssue({
-          code: "custom",
-          message: `Role "${roleKey}" grants unknown capability "${granted}"`,
-          path: ["definitions", roleKey, "grants"]
-        });
-      }
+    const name = indexName(table.table, definition);
+    const factory = definition.unique ? uniqueIndex(name) : index(name);
+    const columns = definition.columns.map((column) => self[column]);
+    return factory.on(...columns);
+  });
+}
+function buildForeignKeys2(table, self, built, byName) {
+  return table.links.filter((link) => link.enforce).map((link) => {
+    if (link.kind !== "toOne" || !link.target) {
+      throw new OrmDefinitionError(
+        `enforced link '${link.name}' on '${table.table}' must be a toOne link with a namespace-local target`
+      );
     }
-  }
-  const state = /* @__PURE__ */ new Map();
-  const visit = (key, path) => {
-    if (state.get(key) === "done") return null;
-    if (state.get(key) === "visiting") return [...path, key];
-    state.set(key, "visiting");
-    const definition = block.definitions[key];
-    for (const inherited of definition?.inherits ?? []) {
-      if (!roleKeySet.has(inherited)) continue;
-      const cycle = visit(inherited, [...path, key]);
-      if (cycle) return cycle;
+    const targetTable = byName.get(link.target);
+    const target = link.target === table.table ? self : built.get(link.target);
+    if (!targetTable || !target) {
+      throw new OrmDefinitionError(`enforced link '${link.name}' on '${table.table}' has no built target '${link.target}'`);
     }
-    state.set(key, "done");
-    return null;
-  };
-  for (const roleKey of roleKeys) {
-    const cycle = visit(roleKey, []);
-    if (cycle) {
-      ctx.addIssue({
-        code: "custom",
-        message: `Role inheritance cycle: ${cycle.join(" -> ")}`,
-        path: ["definitions"]
-      });
-      break;
+    const referencedColumn = link.references ?? singlePrimaryKeyOf(targetTable);
+    if (!referencedColumn) {
+      throw new OrmDefinitionError(
+        `enforced link '${link.name}' on '${table.table}' targets '${link.target}' whose primary key is composite \u2014 declare 'references'`
+      );
+    }
+    const targetColumn = target[referencedColumn];
+    const sourceColumn = self[link.on];
+    if (!targetColumn || !sourceColumn) {
+      throw new OrmDefinitionError(
+        `enforced link '${link.name}' on '${table.table}' references unknown column '${targetColumn ? link.on : referencedColumn}'`
+      );
+    }
+    return foreignKey({
+      name: foreignKeyName(table.table, link.name),
+      columns: [sourceColumn],
+      foreignColumns: [targetColumn]
+    });
+  });
+}
+var singlePrimaryKeyOf = (table) => table.primaryKey?.length === 1 ? table.primaryKey[0] : void 0;
+function sortByEnforcedLinks2(tables) {
+  const remaining = new Map(tables.map((table) => [table.table, table]));
+  const sorted = [];
+  const placed = /* @__PURE__ */ new Set();
+  while (remaining.size > 0) {
+    const ready = [...remaining.values()].filter(
+      (table) => enforcedTargets2(table).every((target) => placed.has(target) || !remaining.has(target))
+    );
+    if (ready.length === 0) {
+      throw new OrmDefinitionError(`enforced links form a cycle among: ${[...remaining.keys()].join(", ")}`);
+    }
+    for (const table of ready) {
+      sorted.push(table);
+      placed.add(table.table);
+      remaining.delete(table.table);
     }
   }
-});
-function customRolesDeclared(block) {
-  if (!block) return false;
-  return Object.keys(block.definitions).length > 0 || Object.keys(block.capabilities).length > 0;
-}
-var CUSTOM_CAPABILITY_PIN_RE = /^(?:org\/)?[a-z0-9-]+$/;
-var MAX_CAPABILITY_PINS = 100;
-var capabilityPinsSchema = z.array(
-  z.string().min(1).max(68).regex(
-    CUSTOM_CAPABILITY_PIN_RE,
-    'Pins must be "org/<key>" or a bare "<key>" matching [a-z0-9-]+'
+  return sorted;
+}
+var enforcedTargets2 = (table) => table.links.flatMap(
+  (link) => (
+    // A self-target is not an ordering dependency — the FK builds inline.
+    link.enforce && link.target !== void 0 && link.target !== table.table ? [link.target] : []
   )
-).max(MAX_CAPABILITY_PINS).default([]);
-function parseCapabilityPin(pin) {
-  return pin.startsWith("org/") ? { scope: "org", key: pin.slice("org/".length) } : { scope: "host", key: pin };
+);
+function applyMigrationHintsV2(previous, definition) {
+  const adjusted = structuredClone(previous);
+  const statements = [];
+  const schemaName = ormSchemaName(definition.namespace);
+  const qualified = (table) => `${quoteIdentifier(schemaName)}.${quoteIdentifier(table)}`;
+  const enumsByName = new Map(definition.enums.map((entry) => [entry.name, entry]));
+  for (const table of columnTablesV2(definition)) {
+    if (table.renamedFrom) {
+      applyTableRename({ adjusted, schemaName, table, renamedFrom: table.renamedFrom, statements, qualified });
+    }
+    const snapshotTable = findTable2(adjusted, schemaName, table.table);
+    if (!snapshotTable) continue;
+    for (const column of table.columns) {
+      const name = column.columnName;
+      if (column.renamedFrom) {
+        const previousColumn = snapshotTable.columns[column.renamedFrom];
+        if (previousColumn && snapshotTable.columns[name]) {
+          throw new OrmDefinitionError(
+            `'${table.table}.${name}' declares renamedFrom '${column.renamedFrom}', but both columns exist in the previous schema \u2014 a rename cannot overwrite a live column`
+          );
+        }
+        if (previousColumn) {
+          statements.push(
+            `ALTER TABLE ${qualified(table.table)} RENAME COLUMN ${quoteIdentifier(column.renamedFrom)} TO ${quoteIdentifier(name)}`
+          );
+          delete snapshotTable.columns[column.renamedFrom];
+          snapshotTable.columns[name] = { ...previousColumn, name };
+        } else if (!snapshotTable.columns[name]) {
+          throw new OrmDefinitionError(
+            `'${table.table}.${name}' declares renamedFrom '${column.renamedFrom}', but the previous schema has neither column \u2014 check the declared source name`
+          );
+        }
+      }
+      const cast = column.cast ? castParts(column.cast) : null;
+      if (cast) {
+        const current = snapshotTable.columns[name];
+        const { snapshotType, sqlType } = castTargetTypes(column, enumsByName, schemaName, table.table);
+        if (current && current.type !== snapshotType) {
+          statements.push(
+            `ALTER TABLE ${qualified(table.table)} ALTER COLUMN ${quoteIdentifier(name)} TYPE ${sqlType} USING ${quoteIdentifier(name)}::${sqlType}`
+          );
+          current.type = snapshotType;
+        }
+      }
+    }
+  }
+  return { statements, adjusted };
 }
-function validateCapabilityPins({
-  uses,
-  roles
+function castTargetTypes(column, enums, schemaName, table) {
+  if (typeof column.type === "string") {
+    const name = sqlTypeName(column.type);
+    return { snapshotType: name, sqlType: name };
+  }
+  const enumName = column.type.enum;
+  if (!enums.has(enumName)) {
+    throw new OrmDefinitionError(`column '${table}.${column.columnName}' casts to undeclared enum '${enumName}'`);
+  }
+  return { snapshotType: enumName, sqlType: `${quoteIdentifier(schemaName)}.${quoteIdentifier(enumName)}` };
+}
+function applyTableRename({
+  adjusted,
+  schemaName,
+  table,
+  renamedFrom,
+  statements,
+  qualified
 }) {
-  const errors = [];
-  const seen = /* @__PURE__ */ new Set();
-  const roleKeys = new Set(Object.keys(roles?.definitions ?? {}));
-  for (const pin of uses) {
-    if (seen.has(pin)) errors.push(`Pin "${pin}" is listed more than once`);
-    seen.add(pin);
-    const parsed = parseCapabilityPin(pin);
-    if (parsed.scope === "host" && roleKeys.has(parsed.key)) {
-      errors.push(`Pin "${pin}" references a role \u2014 roles are never pinned`);
-    }
+  const tables = adjusted.tables ?? {};
+  const previousEntry = Object.entries(tables).find(
+    ([, entry]) => entry.schema === schemaName && entry.name === renamedFrom
+  );
+  const currentTable = findTable2(adjusted, schemaName, table.table);
+  if (previousEntry && currentTable) {
+    throw new OrmDefinitionError(
+      `'${table.table}' declares renamedFrom '${renamedFrom}', but both tables exist in the previous schema \u2014 a rename cannot overwrite a live table`
+    );
+  }
+  if (!previousEntry) {
+    if (currentTable) return;
+    throw new OrmDefinitionError(
+      `'${table.table}' declares renamedFrom '${renamedFrom}', but the previous schema has neither table \u2014 check the declared source name`
+    );
+  }
+  statements.push(`ALTER TABLE ${qualified(renamedFrom)} RENAME TO ${quoteIdentifier(table.table)}`);
+  const [previousKey, previousTable] = previousEntry;
+  delete tables[previousKey];
+  tables[`${schemaName}.${table.table}`] = { ...previousTable, name: table.table };
+}
+function findTable2(snapshot, schema, table) {
+  const tables = snapshot.tables ?? {};
+  return Object.values(tables).find((entry) => entry.schema === schema && entry.name === table);
+}
+async function planMigrationV2({
+  canonical,
+  previousSnapshot
+}) {
+  const schema = ormSchemaName(canonical.namespace);
+  const previous = previousSnapshot ? normalizeSnapshot(previousSnapshot) : emptySnapshot(canonical.namespace);
+  const hints = applyMigrationHintsV2(previous, canonical);
+  const snapshot = generateSnapshotV2(canonical, previousId2(previous));
+  const ddl = await diffStatements(hints.adjusted, snapshot);
+  const statements = [
+    ...hints.statements.map((statement) => ({ kind: "hint", sql: statement })),
+    ...ddl.map((statement) => ({ kind: "ddl", sql: statement.replace(/;\s*$/, "") }))
+  ];
+  return { namespace: canonical.namespace, schema, statements, snapshot };
+}
+var previousId2 = (snapshot) => snapshot.id;
+var IR_VERSION = 1;
+var CLAIMS_CONTRACT = {
+  sub: "string",
+  org: "string?",
+  roles: "string[]",
+  capabilities: "string[]"
+};
+var scalarLiteral = z.union([z.string(), z.number(), z.boolean(), z.null()]);
+var valueIrSchema = z.discriminatedUnion("kind", [
+  z.object({ kind: z.literal("literal"), value: z.union([scalarLiteral, z.array(scalarLiteral)]) }),
+  z.object({ kind: z.literal("variable"), name: z.string() }),
+  z.object({ kind: z.literal("claim"), key: z.enum(["sub", "org"]) })
+]);
+var CMP_OPS = [
+  "eq",
+  "neq",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "in",
+  "nin",
+  "like",
+  "ilike",
+  "isNull",
+  "contains",
+  "hasKey"
+];
+var predIrSchema = z.lazy(
+  () => z.discriminatedUnion("kind", [
+    z.object({ kind: z.literal("and"), operands: z.array(predIrSchema).min(1) }),
+    z.object({ kind: z.literal("or"), operands: z.array(predIrSchema).min(1) }),
+    z.object({ kind: z.literal("not"), operand: predIrSchema }),
+    z.object({ kind: z.literal("cmp"), op: z.enum(CMP_OPS), column: z.string(), value: valueIrSchema }),
+    z.object({ kind: z.literal("exists"), link: z.string(), where: predIrSchema }),
+    z.object({
+      kind: z.literal("aggPredicate"),
+      link: z.string(),
+      fn: z.literal("count"),
+      op: z.enum(["eq", "neq", "gt", "gte", "lt", "lte"]),
+      value: z.number(),
+      where: predIrSchema.optional()
+    }),
+    z.object({ kind: z.literal("capability"), key: z.string() }),
+    z.object({ kind: z.literal("role"), key: z.string() }),
+    z.object({ kind: z.literal("dynamicFilter"), slot: z.string() }),
+    z.object({ kind: z.literal("const"), value: z.boolean() })
+  ])
+);
+var orderIrSchema = z.discriminatedUnion("kind", [
+  z.object({
+    kind: z.literal("column"),
+    column: z.string(),
+    /** Order through a to-one link: `link` is set and `column` is on the target. */
+    link: z.string().optional(),
+    direction: z.enum(["asc", "desc"]),
+    nulls: z.enum(["first", "last"]).optional()
+  }),
+  /** §4f: `$orderBy: [FooOrderBy!]` variable — validated + lowered at runtime. */
+  z.object({ kind: z.literal("dynamic"), slot: z.string() })
+]);
+var limitIrSchema = z.object({
+  /** Fixed value or a variable, clamped to [1, max]; absent → default. */
+  variable: z.string().optional(),
+  value: z.number().int().positive().optional(),
+  default: z.number().int().positive(),
+  max: z.number().int().positive()
+});
+var selectionIrSchema = z.lazy(
+  () => z.object({
+    typename: z.string(),
+    columns: z.array(z.object({ alias: z.string(), column: z.string() })),
+    relations: z.array(z.object({
+      alias: z.string(),
+      link: z.string(),
+      selection: selectionIrSchema,
+      where: predIrSchema.optional(),
+      orderBy: z.array(orderIrSchema).optional(),
+      limit: limitIrSchema.optional(),
+      offset: z.object({ variable: z.string().optional(), value: z.number().int().optional() }).optional()
+    })),
+    aggregates: z.array(z.object({
+      alias: z.string(),
+      link: z.string().optional(),
+      where: predIrSchema.optional(),
+      count: z.object({ columns: z.array(z.string()).optional(), distinct: z.boolean().optional() }).optional(),
+      sum: z.array(z.string()).optional(),
+      avg: z.array(z.string()).optional(),
+      nodes: selectionIrSchema.optional()
+    }))
+  })
+);
+var includeIfSchema = z.object({ variable: z.string(), negated: z.boolean() });
+var selectRootSchema = z.object({
+  kind: z.literal("select"),
+  alias: z.string(),
+  table: z.string(),
+  selection: selectionIrSchema,
+  /** Composed at compile time: AND(policy, documentWhere?, dynamicFilter?). */
+  where: predIrSchema,
+  orderBy: z.array(orderIrSchema).default([]),
+  distinctOn: z.union([z.array(z.string()), z.object({ slot: z.string() })]).optional(),
+  limit: limitIrSchema,
+  offset: z.object({ variable: z.string().optional(), value: z.number().int().optional() }).optional(),
+  includeIf: includeIfSchema.optional()
+});
+var byPkRootSchema = z.object({
+  kind: z.literal("byPk"),
+  alias: z.string(),
+  table: z.string(),
+  selection: selectionIrSchema,
+  pk: z.array(z.object({ column: z.string(), value: valueIrSchema })).min(1),
+  /** Policy predicate — ANDed with the PK match. */
+  where: predIrSchema,
+  includeIf: includeIfSchema.optional()
+});
+var aggregateRootSchema = z.object({
+  kind: z.literal("aggregate"),
+  alias: z.string(),
+  table: z.string(),
+  where: predIrSchema,
+  count: z.object({ columns: z.array(z.string()).optional(), distinct: z.boolean().optional() }).optional(),
+  sum: z.array(z.string()).optional(),
+  avg: z.array(z.string()).optional(),
+  nodes: selectionIrSchema.optional(),
+  includeIf: includeIfSchema.optional()
+});
+var writeValuesSchema = z.union([
+  z.object({ slot: z.string() }),
+  z.object({ entries: z.array(z.object({ column: z.string(), value: valueIrSchema })) })
+]);
+var onConflictIrSchema = z.union([
+  z.object({ slot: z.string() }),
+  z.object({ constraint: z.string(), updateColumns: z.array(z.string()) })
+]);
+var mutationRootSchema = z.object({
+  kind: z.literal("mutation"),
+  op: z.enum(["insert", "insertOne", "update", "updateByPk", "delete", "deleteByPk"]),
+  alias: z.string(),
+  table: z.string(),
+  /** insert/insertOne: rows come from a slot ($object/$objects) or literals. */
+  objects: z.union([
+    z.object({ slot: z.string() }),
+    z.object({ rows: z.array(z.array(z.object({ column: z.string(), value: valueIrSchema }))) })
+  ]).optional(),
+  /** Server-pinned columns (e.g. author_sub ← claim('sub')) merged into every inserted row. */
+  pinnedColumns: z.array(z.object({ column: z.string(), value: valueIrSchema })).default([]),
+  onConflict: onConflictIrSchema.optional(),
+  set: writeValuesSchema.optional(),
+  append: writeValuesSchema.optional(),
+  inc: writeValuesSchema.optional(),
+  /** update/delete row filter: AND(writePolicy, documentWhere/pk, dynamicFilter?). */
+  where: predIrSchema.optional(),
+  pk: z.array(z.object({ column: z.string(), value: valueIrSchema })).optional(),
+  /** WITH CHECK analogue evaluated against NEW row values (insert/update). */
+  insertCheck: predIrSchema.optional(),
+  returning: selectionIrSchema.nullable(),
+  affectedRows: z.boolean().default(false),
+  includeIf: includeIfSchema.optional()
+});
+var actionRootSchema = z.object({
+  kind: z.literal("action"),
+  alias: z.string(),
+  name: z.string(),
+  params: z.array(z.object({ name: z.string(), value: valueIrSchema })),
+  returns: z.enum(["rows", "rowsAffected", "scalar"])
+});
+var rootIrSchema = z.discriminatedUnion("kind", [
+  selectRootSchema,
+  byPkRootSchema,
+  aggregateRootSchema,
+  mutationRootSchema,
+  actionRootSchema
+]);
+var INPUT_REF_KINDS = [
+  "boolExp",
+  "orderBy",
+  "selectColumn",
+  "insertInput",
+  "setInput",
+  "appendInput",
+  "onConflict"
+];
+var variableDefaultIrSchema = z.object({
+  value: z.union([scalarLiteral, z.array(scalarLiteral)])
+});
+var variableIrSchema = z.object({
+  name: z.string(),
+  type: z.union([
+    z.object({ kind: z.literal("scalar"), scalar: z.enum(COLUMN_TYPES) }),
+    /** `values` is the declared membership whitelist — the executor validates against it. */
+    z.object({ kind: z.literal("enum"), name: z.string(), values: z.array(z.string()).min(1) }),
+    /** §4f dynamic slot: validated against `tables[table]` whitelists at runtime. */
+    z.object({ kind: z.literal("inputRef"), input: z.enum(INPUT_REF_KINDS), table: z.string() })
+  ]),
+  nullable: z.boolean(),
+  list: z.boolean(),
+  /** Absent = no default declared; see {@link variableDefaultIrSchema}. */
+  defaultValue: variableDefaultIrSchema.optional()
+});
+var compiledOperationSchema = z.object({
+  irVersion: z.literal(IR_VERSION),
+  name: z.string(),
+  opHash: z.string().regex(/^sha256:[0-9a-f]{64}$/),
+  kind: z.enum(["query", "mutation", "action"]),
+  requires: z.object({
+    capability: z.string().optional(),
+    role: z.string().optional()
+  }).nullable(),
+  variables: z.array(variableIrSchema),
+  /** Every table the op touches — data-token scoping + audit. */
+  tableSet: z.array(z.string()).min(1),
+  roots: z.array(rootIrSchema).min(1)
+});
+var tableMetaIrSchema = z.object({
+  table: z.string(),
+  schema: z.string(),
+  typename: z.string(),
+  columns: z.array(z.object({
+    name: z.string(),
+    columnName: z.string(),
+    type: z.union([z.enum(COLUMN_TYPES), z.object({ enum: z.string(), values: z.array(z.string()) })]),
+    nullable: z.boolean()
+  })),
+  primaryKey: z.array(z.string()).min(1),
+  links: z.array(z.object({
+    name: z.string(),
+    kind: z.enum(["toOne", "toMany", "toPlatformUser"]),
+    target: z.string(),
+    on: z.string(),
+    references: z.string()
+  })),
+  /** §4f whitelists: what dynamic inputs may reference. */
+  filterable: z.array(z.string()),
+  orderable: z.array(z.string()),
+  insertable: z.array(z.string()),
+  settable: z.array(z.string()),
+  appendable: z.array(z.string()),
+  constraints: z.array(z.object({ name: z.string(), columns: z.array(z.string()) })),
+  /** Depth/node caps for dynamic filter trees on this table. */
+  dynamicFilterMaxDepth: z.number().int().positive().default(6),
+  dynamicFilterMaxNodes: z.number().int().positive().default(64)
+});
+var compiledArtifactSchema = z.object({
+  irVersion: z.literal(IR_VERSION),
+  namespace: z.string(),
+  schemaHash: z.string(),
+  opsHash: z.string(),
+  tables: z.record(z.string(), tableMetaIrSchema),
+  operations: z.record(z.string(), compiledOperationSchema)
+});
+var IrVersionError = class extends Error {
+  constructor(found) {
+    super(`Unsupported IR version ${String(found)} \u2014 this executor supports up to ${IR_VERSION}. Upgrade @sequenceholdings/orm or re-push the namespace.`);
+    this.name = "IrVersionError";
   }
-  return errors;
+};
+function normalizeIr(raw) {
+  if (!raw || typeof raw !== "object") throw new IrVersionError(void 0);
+  const version = raw.irVersion;
+  if (version !== IR_VERSION) throw new IrVersionError(version);
+  return compiledArtifactSchema.parse(raw);
+}
+function indexByHash(artifact) {
+  const map = /* @__PURE__ */ new Map();
+  for (const op of Object.values(artifact.operations)) map.set(op.opHash, op);
+  return map;
 }
 
 // src/schema/namespace.ts
@@ -1895,8 +3065,8 @@ async function readMigrationWorkspace(dir, namespace) {
       journalPath
     );
   }
-  parsed.data.entries.forEach((entry, index2) => {
-    if (entry.ordinal !== index2 + 1) {
+  parsed.data.entries.forEach((entry, index3) => {
+    if (entry.ordinal !== index3 + 1) {
       throw new OrmDefinitionError(`migration journal entries must be contiguous from 1 (found ${entry.name})`, journalPath);
     }
   });
@@ -1919,7 +3089,7 @@ async function readMigrationSql(dir, entry) {
     throw new OrmDefinitionError("missing migration file", path);
   });
 }
-var checksumOf = (text2) => createHash("sha256").update(text2).digest("hex");
+var checksumOf = (text3) => createHash("sha256").update(text3).digest("hex");
 var migrationName = (ordinal, contentHash) => `${pad(ordinal)}_${contentHash.slice(0, 12)}`;
 function renderMigrationSql({
   name,
@@ -1945,12 +3115,12 @@ async function writeMigration({
   const tip = workspace.journal.entries.at(-1);
   const ordinal = (tip?.ordinal ?? 0) + 1;
   const name = migrationName(ordinal, contentHash);
-  const sql2 = renderMigrationSql({ name, namespace: workspace.journal.namespace, contentHash, plan });
+  const sql3 = renderMigrationSql({ name, namespace: workspace.journal.namespace, contentHash, plan });
   const metaDir = join(dir, MIGRATIONS_DIRNAME, META_DIRNAME);
   await mkdir(metaDir, { recursive: true });
   const snapshotText = `${JSON.stringify(plan.snapshot, null, 2)}
 `;
-  await writeFile(join(dir, MIGRATIONS_DIRNAME, `${name}.sql`), sql2);
+  await writeFile(join(dir, MIGRATIONS_DIRNAME, `${name}.sql`), sql3);
   await writeFile(join(metaDir, `${pad(ordinal)}.snapshot.json`), snapshotText);
   const journal = {
     ...workspace.journal,
@@ -1961,7 +3131,7 @@ async function writeMigration({
         name,
         content_hash: contentHash,
         previous_content_hash: tip?.content_hash ?? null,
-        checksum: checksumOf(sql2),
+        checksum: checksumOf(sql3),
         snapshot_checksum: checksumOf(snapshotText),
         destructive
       }
@@ -2073,11 +3243,11 @@ async function checkWorkspace({
     log(`no committed migrations for '${loaded.definition.namespace}' \u2014 run \`seq-studio orm diff\` and commit the result`);
     return 1;
   }
-  let previousId2;
+  let previousId3;
   let previousHash = null;
   for (const entry of workspace.journal.entries) {
-    const sql2 = await readMigrationSql(dir, entry);
-    if (checksumOf(sql2) !== entry.checksum) {
+    const sql3 = await readMigrationSql(dir, entry);
+    if (checksumOf(sql3) !== entry.checksum) {
       log(`${MIGRATIONS_DIRNAME}/${entry.name}.sql does not match its journal checksum \u2014 committed migrations must not be edited`);
       return 1;
     }
@@ -2087,7 +3257,7 @@ async function checkWorkspace({
       return 1;
     }
     const snapshot = JSON.parse(snapshotText);
-    if (entry.ordinal > 1 && snapshot.prevId !== previousId2) {
+    if (entry.ordinal > 1 && snapshot.prevId !== previousId3) {
       log(`snapshot chain broken at ${entry.name} \u2014 regenerate the workspace with \`seq-studio orm diff\``);
       return 1;
     }
@@ -2095,7 +3265,7 @@ async function checkWorkspace({
       log(`content-hash chain broken at ${entry.name} \u2014 migrations must be appended in order by \`seq-studio orm diff\``);
       return 1;
     }
-    previousId2 = snapshot.id;
+    previousId3 = snapshot.id;
     previousHash = entry.content_hash;
   }
   if (tip.content_hash !== loaded.contentHash) {
@@ -2117,12 +3287,161 @@ async function checkWorkspace({
   log(`migrations in sync \u2014 ${workspace.journal.entries.length} committed, tip ${tip.name}`);
   return 0;
 }
-var firstLine = (sql2) => sql2.split("\n")[0] ?? sql2;
+var firstLine = (sql3) => sql3.split("\n")[0] ?? sql3;
+
+// src/migrations/from-yaml.ts
+function convertV1DefinitionToCanonical(definition) {
+  const raw = {
+    definition_format: CANONICAL_FORMAT,
+    namespace: definition.namespace,
+    description: definition.description ?? void 0,
+    enums: [],
+    tables: definition.tables.map(convertTable),
+    capabilities: {
+      roles: definition.capabilities.roles,
+      uses: [...definition.capabilities.uses]
+    }
+  };
+  const parsed = canonicalDefinitionSchema.safeParse(raw);
+  if (!parsed.success) {
+    const issue = parsed.error.issues[0];
+    throw new OrmDefinitionError(
+      `converted definition is not valid canonical v2: ${issue ? `${issue.path.join(".")}: ${issue.message}` : "unknown issue"}`
+    );
+  }
+  return normalizeCanonical(parsed.data);
+}
+function convertTable(table) {
+  const columns = Object.entries(table.columns ?? {});
+  const primaryKey2 = columns.filter(([, column]) => column.primary_key).map(([name]) => name);
+  return {
+    table: table.table,
+    description: table.description,
+    source: table.source,
+    columns: columns.map(([name, column]) => convertColumn(name, column)),
+    // Synced tables reflect their source — no columns, no primary key.
+    primaryKey: primaryKey2.length > 0 ? primaryKey2 : void 0,
+    links: Object.entries(table.links ?? {}).map(([name, link]) => convertLink(table.table, name, link)),
+    indexes: (table.indexes ?? []).map((index3) => ({
+      columns: [...index3.columns],
+      unique: index3.unique ?? false,
+      name: index3.name
+    })),
+    policies: {
+      // Verbatim DSL source strings — the parsed v1 AST is derived state.
+      read: table.policies?.read?.source,
+      write: table.policies?.write?.source
+    },
+    actions: Object.entries(table.actions ?? {}).map(([name, action]) => convertAction(table.table, name, action))
+  };
+}
+function convertColumn(name, column) {
+  const isDefaultFn = column.default !== void 0 && isFunctionDefault(column.default, column.type);
+  return {
+    name,
+    columnName: name,
+    type: column.type,
+    nullable: column.primary_key ? false : column.nullable !== false,
+    unique: column.unique === true,
+    default: isDefaultFn ? void 0 : column.default,
+    // isFunctionDefault guarantees one of the two allowlisted functions; the
+    // canonicalDefinitionSchema parse below re-checks the enum.
+    defaultFn: isDefaultFn ? column.default : void 0,
+    description: column.description,
+    renamedFrom: column.renamed_from,
+    cast: column.cast,
+    deprecated: column.deprecated === true
+  };
+}
+function convertLink(table, name, link) {
+  if (link.to.includes(".")) {
+    throw new OrmDefinitionError(
+      `link '${name}' on '${table}' targets '${link.to}' \u2014 cross-namespace links have no canonical v2 representation (links are namespace-local in v2)`
+    );
+  }
+  return {
+    name,
+    kind: "toOne",
+    target: link.to,
+    on: link.on,
+    enforce: link.enforce === true,
+    description: link.description
+  };
+}
+function convertAction(table, name, action) {
+  return {
+    name,
+    requires: action.requires?.source,
+    params: Object.fromEntries(
+      Object.entries(action.params ?? {}).map(([param, definition]) => [
+        param,
+        { type: definition.type, nullable: definition.optional === true }
+      ])
+    ),
+    // The v2 contract carries one SQL string; statement boundaries survive as
+    // `;\n` (v1 validation guarantees no bare `;` inside a single statement).
+    executes: actionStatementSources(action.executes).join(";\n"),
+    // v1 declared the RETURNING columns inline; v2 types them at compile time,
+    // so the shape collapses to rows-vs-rowsAffected.
+    returns: action.returns ? "rows" : "rowsAffected",
+    audit: action.audit ? { action: action.audit.action, resource: action.audit.resource ?? table } : void 0
+  };
+}
+
+// src/migrations/v2.ts
+var SHA256_HEX = /^[0-9a-f]{64}$/;
+function rebaseViolations(statements, options) {
+  const allowSecurity = options?.allowSecurityReemission ?? false;
+  return statements.filter((statement) => !(statement.kind === "security" && allowSecurity));
+}
+var verifyRebaseIsNoop = (plan, options) => rebaseViolations(plan.statements, options).length === 0;
+function buildRebaseJournalEntry({ namespace, previousHash, newHash, ordinal, snapshot }) {
+  if (!SHA256_HEX.test(previousHash)) {
+    throw new OrmDefinitionError(`rebase previousHash is not a sha256 hex digest: '${previousHash}'`);
+  }
+  if (!SHA256_HEX.test(newHash)) {
+    throw new OrmDefinitionError(`rebase newHash is not a sha256 hex digest: '${newHash}'`);
+  }
+  if (previousHash === newHash) {
+    throw new OrmDefinitionError("rebase previousHash and newHash are identical \u2014 nothing to rebase");
+  }
+  if (!Number.isInteger(ordinal) || ordinal < 2) {
+    throw new OrmDefinitionError(`rebase ordinal must be an integer \u2265 2 (a rebase sits on an existing journal tip); got ${ordinal}`);
+  }
+  const name = migrationName(ordinal, newHash);
+  const sql3 = renderRebaseMigrationSql({ name, namespace, previousHash, newHash });
+  const snapshotText = `${JSON.stringify(snapshot, null, 2)}
+`;
+  const entry = {
+    ordinal,
+    name,
+    content_hash: newHash,
+    previous_content_hash: previousHash,
+    checksum: checksumOf(sql3),
+    snapshot_checksum: checksumOf(snapshotText),
+    destructive: false
+  };
+  return { name, entry, sql: sql3, snapshotText };
+}
+function renderRebaseMigrationSql({
+  name,
+  namespace,
+  previousHash,
+  newHash
+}) {
+  return [
+    `-- ${name}`,
+    `-- namespace: ${namespace}`,
+    `-- content hash: ${newHash}`,
+    `-- rebase: v1 definitions (${previousHash}) converted to canonical v2 \u2014 verified no-op, zero statements`,
+    "-- generated by `seq-studio orm diff --rebase` \u2014 review and commit, do not edit"
+  ].join("\n") + "\n";
+}
 
 // src/schema/canonical.ts
 function parseCanonicalDefinition(value) {
   const canonical = asCanonicalShape(value);
-  const files = canonical.tables.map((table, index2) => {
+  const files = canonical.tables.map((table, index3) => {
     const input = {
       namespace: canonical.namespace,
       table: table["table"],
@@ -2139,10 +3458,10 @@ function parseCanonicalDefinition(value) {
       const issue = parsed.error.issues[0];
       throw new OrmDefinitionError(
         `stored definition for table ${String(table["table"])} is invalid: ${issue?.message ?? "unknown issue"}`,
-        `canonical[${index2}]`
+        `canonical[${index3}]`
       );
     }
-    return { file: `canonical[${index2}]`, table: parsed.data };
+    return { file: `canonical[${index3}]`, table: parsed.data };
   });
   const config = namespaceConfigSchema.safeParse({
     namespace: canonical.namespace,
@@ -2199,6 +3518,6 @@ function canonicalActions(value) {
   );
 }
 
-export { ACTION_REQUIRES_DENIED_SQLSTATE, ACTION_VALIDATES_FAILED_SQLSTATE, AUDIT_ACTIONS, CAPABILITIES_CLAIM_KEY, CAPABILITY_KEY_PATTERN, CLAIMS_SETTING, CLAIM_KEY_PATTERN, COLUMN_TYPES, COMPARE_OPS, CONSUMER_ROLE_SUFFIX, DEFINITION_FILE_EXTENSIONS, HASH_DOMAIN, IDENTIFIER_PATTERN, MAX_DEFINITION_FILE_BYTES, MAX_IDENTIFIER_LENGTH, MIGRATIONS_DIRNAME, NAMESPACE_CONFIG_FILENAMES, NAMESPACE_PATTERN, ORM_DATA_TOKEN_HEADER, ORM_SCHEMA_PREFIX, ORM_SERVICE_DATA_TOKEN_HEADER, OrmDefinitionError, PredicateParseError, QUALIFIED_TABLE_PATTERN, RESERVED_COLUMN_NAMES, RESERVED_TABLE_NAMES, STATEMENT_KINDS, SYNCED_SOURCE_PATTERN, actionFunctionName, actionFunctionStatements, actionParamArg, actionParamOrder, actionParamSchema, actionPrepareChecks, actionSchema, actionsInterfaceName, applyMigrationHints, buildActionParamsSchema, buildDrizzleEntities, buildNamespaceDefinition, canonicalizeDefinition, capabilityExpression, capabilityPinsSchema, castParts, checksumOf, claimExpression, classifyDestructive, columnSchema, columnTypeSchema, compileActionRequires, compileActionStatements, compileNamespace, compilePredicate, computeDefinitionHash, consumerRoleName, customRolesBlockSchema, customRolesDeclared, declaredCapabilityKeys, diffCommand, diffStatements, emptyJournal, emptySnapshot, extractNamedParams, generateNamespaceTypes, generateSnapshot, identifierSchema, isFunctionDefault, isOwnedStatement, isQualifiedReference, loadCommittedMigrations, loadCommittedTipMigration, loadNamespaceDefinition, migrationName, namespaceConfigSchema, namespaceSchema, normalizeSnapshot, ormSchemaName, parseCanonicalDefinition, parseCapabilityPin, parseDefinitionSources, parsePredicate, parseTableFile, parsedPredicateSchema, pendingKitStatements, planMigration, predicateOperands, quoteIdentifier, quoteLiteral, readMigrationSql, readMigrationWorkspace, readSnapshot, referencedCapabilities, referencedColumns, renderMigrationSql, securityStatements, sqlTypeName, stableJson, tableFileSchema, tableReferenceSchema, typesInterfaceName, validateCapabilityPins, walkPredicate, writeMigration };
+export { ACTION_REQUIRES_DENIED_SQLSTATE, ACTION_VALIDATES_FAILED_SQLSTATE, AUDIT_ACTIONS, CANONICAL_FORMAT, CAPABILITIES_CLAIM_KEY, CAPABILITY_KEY_PATTERN, CLAIMS_CONTRACT, CLAIMS_SETTING, CLAIM_KEY_PATTERN, CMP_OPS, COLUMN_BRAND, COLUMN_DEFAULT_FNS, COLUMN_TYPES2 as COLUMN_TYPES, COMPARE_OPS, CONSUMER_ROLE_SUFFIX, ColumnBuilder, DEFINITION_FILE_EXTENSIONS, ENUM_BRAND, HASH_DOMAIN, IDENTIFIER_PATTERN, IDENTIFIER_RE, INPUT_REF_KINDS, IR_VERSION, IrVersionError, LINK_BRAND, MAX_DEFINITION_FILE_BYTES, MAX_IDENTIFIER_LENGTH, MIGRATIONS_DIRNAME, NAMESPACE_CONFIG_BRAND, NAMESPACE_CONFIG_FILE, NAMESPACE_CONFIG_FILENAMES, NAMESPACE_PATTERN, ORM_DATA_TOKEN_HEADER, ORM_SCHEMA_PREFIX, ORM_SERVICE_DATA_TOKEN_HEADER, OrmDefinitionError, PredicateParseError, QUALIFIED_TABLE_PATTERN, RESERVED_COLUMN_NAMES, RESERVED_TABLE_NAMES, SCHEMA_DIR, STATEMENT_KINDS, SYNCED_SOURCE_PATTERN, TABLE_BRAND, actionFunctionName, actionFunctionStatements, actionParamArg, actionParamOrder, actionParamSchema, actionPrepareChecks, actionSchema, actionWriteTargets, actionsInterfaceName, activeAuthoringContext, applyMigrationHints, applyMigrationHintsV2, beginAuthoringContext, buildActionParamsSchema, buildDrizzleEntities, buildDrizzleEntitiesV2, buildNamespaceDefinition, buildRebaseJournalEntry, canonicalActionSchema, canonicalColumnSchema, canonicalDefinitionSchema, canonicalEnumSchema, canonicalIndexSchema, canonicalLinkSchema, canonicalPoliciesSchema, canonicalTableSchema, canonicalizeDefinition, capabilityExpression, castParts, checksumOf, claimExpression, classifyDestructive, columnSchema, columnTypeSchema2 as columnTypeSchema, compileActionRequires, compileActionStatements, compileNamespace, compilePredicate, compiledArtifactSchema, compiledOperationSchema, computeCanonicalHash, computeDefinitionHash, consumerRoleName, convertV1DefinitionToCanonical, declaredCapabilityKeys, defineEnum, defineNamespace, defineSyncedTable, defineTable, deriveColumnName, diffCommand, diffStatements, emptyJournal, emptySnapshot, endAuthoringContext, extractNamedParams, generateNamespaceTypes, generateSnapshot, generateSnapshotV2, identifierSchema, indexByHash, isColumnBuilder, isEnumRef, isFunctionDefault, isOwnedStatement, isQualifiedReference, isSeqLink, isSeqNamespaceConfig, isSeqTable, limitIrSchema, loadCommittedMigrations, loadCommittedTipMigration, loadNamespaceDefinition, loadNamespaceFromDir, migrationName, namespaceConfigSchema, namespaceSchema, normalizeCanonical, normalizeIr, normalizeSnapshot, orderIrSchema, ormSchemaName, parseCanonicalDefinition, parseDefinitionSources, parsePredicate, parseTableFile, parsedPredicateSchema, pendingKitStatements, planMigration, planMigrationV2, policyExpressionSchema, policyVariantSchema, predIrSchema, predicateOperands, quoteIdentifier, quoteLiteral, readMigrationSql, readMigrationWorkspace, readSnapshot, rebaseViolations, referencedCapabilities, referencedColumns, renderMigrationSql, rootIrSchema, securityStatements, selectionIrSchema, serializeNamespace, sqlTypeName, stableJson, t, tableFileSchema, tableMetaIrSchema, tableReferenceSchema, toMany, toOne, toPlatformUser, typesInterfaceName, valueIrSchema, variableDefaultIrSchema, variableIrSchema, verifyRebaseIsNoop, walkPredicate, writeMigration };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map