@sequenceholdings/orm 0.1.0

package/dist/index.cjs

@@ -0,0 +1,2308 @@
+'use strict';
+
+var zod = require('zod');
+var api = require('drizzle-kit/api');
+var pgCore = require('drizzle-orm/pg-core');
+var drizzleOrm = require('drizzle-orm');
+var crypto = require('crypto');
+var promises = require('fs/promises');
+var path = require('path');
+var jsYaml = require('js-yaml');
+
+// src/codegen/types.ts
+var WIRE_TYPES = {
+  uuid: "string",
+  text: "string",
+  integer: "number",
+  bigint: "string",
+  numeric: "string",
+  double: "number",
+  boolean: "boolean",
+  timestamptz: "string",
+  date: "string",
+  jsonb: "unknown"
+};
+function generateNamespaceTypes(definition) {
+  const lines = [
+    `// Generated by \`seq-studio orm generate\` from the '${definition.namespace}' definitions \u2014 do not edit.`,
+    "",
+    `export type ${typesInterfaceName(definition.namespace)} = {`
+  ];
+  for (const table of definition.tables) {
+    if (table.source) {
+      lines.push(`  /** Synced from ${table.source} \u2014 columns reflect the gold source. */`);
+      lines.push(`  ${table.table}: Record<string, unknown>`);
+      continue;
+    }
+    lines.push(`  ${table.table}: {`);
+    for (const [name, column] of Object.entries(table.columns ?? {})) {
+      if (column.deprecated) continue;
+      lines.push(`    ${name}: ${columnWireType(column)}`);
+    }
+    lines.push("  }");
+  }
+  lines.push("}", "");
+  lines.push(...actionTypeLines(definition));
+  return lines.join("\n");
+}
+function actionTypeLines(definition) {
+  const actions = definition.tables.flatMap((table) => Object.entries(table.actions ?? {}));
+  const lines = [`export type ${actionsInterfaceName(definition.namespace)} = {`];
+  for (const [name, action] of actions.sort(([a], [b]) => a.localeCompare(b))) {
+    lines.push(`  ${name}: { params: ${actionParamsType(action)}; result: ${actionResultType(action)} }`);
+  }
+  lines.push("}", "");
+  return lines;
+}
+function actionParamsType(action) {
+  const entries = Object.entries(action.params ?? {});
+  if (entries.length === 0) return "Record<never, never>";
+  const fields = entries.map(([name, param]) => {
+    const base = WIRE_TYPES[param.type];
+    return param.optional ? `${name}?: ${base} | null` : `${name}: ${base}`;
+  });
+  return `{ ${fields.join("; ")} }`;
+}
+function actionResultType(action) {
+  if (!action.returns) return "{ rowsAffected: number }";
+  const columns = Object.entries(action.returns).map(([name, type]) => {
+    const base = WIRE_TYPES[type];
+    return base === "unknown" ? `${name}: ${base}` : `${name}: ${base} | null`;
+  });
+  return `{ rows: Array<{ ${columns.join("; ")} }> }`;
+}
+function typesInterfaceName(namespace) {
+  return `${pascalCase(namespace)}Tables`;
+}
+function actionsInterfaceName(namespace) {
+  return `${pascalCase(namespace)}Actions`;
+}
+function pascalCase(namespace) {
+  return namespace.split("_").map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join("");
+}
+function columnWireType(column) {
+  const base = WIRE_TYPES[column.type];
+  const notNull = column.primary_key === true || column.nullable === false;
+  return notNull || base === "unknown" ? base : `${base} | null`;
+}
+
+// src/constants.ts
+var NAMESPACE_PATTERN = /^[a-z][a-z0-9_]{0,40}$/;
+var IDENTIFIER_PATTERN = /^[a-z][a-z0-9_]*$/;
+var MAX_IDENTIFIER_LENGTH = 63;
+var ORM_DATA_TOKEN_HEADER = "x-sequence-data-token";
+var ORM_SERVICE_DATA_TOKEN_HEADER = "x-sequence-data-token-service";
+var CAPABILITY_KEY_PATTERN = /^(?:org\/)?[a-z0-9-]{1,64}$/;
+var CLAIM_KEY_PATTERN = /^[a-z][a-z0-9_]*$/;
+var QUALIFIED_TABLE_PATTERN = /^[a-z][a-z0-9_]*\.[a-z][a-z0-9_]*$/;
+var SYNCED_SOURCE_PATTERN = /^gold\.[a-z][a-z0-9_]*$/;
+var ORM_SCHEMA_PREFIX = "orm_";
+var CONSUMER_ROLE_SUFFIX = "_consumer";
+var ormSchemaName = (namespace) => `${ORM_SCHEMA_PREFIX}${namespace}`;
+var consumerRoleName = (namespace) => `${ORM_SCHEMA_PREFIX}${namespace}${CONSUMER_ROLE_SUFFIX}`;
+var DEFINITION_FILE_EXTENSIONS = [".yml", ".yaml"];
+var NAMESPACE_CONFIG_FILENAMES = /* @__PURE__ */ new Set(["namespace.yaml", "namespace.yml"]);
+var HASH_DOMAIN = "sequence-orm-definitions\0";
+var MAX_DEFINITION_FILE_BYTES = 1024 * 1024;
+var RESERVED_TABLE_NAMES = /* @__PURE__ */ new Set(["actions", "query"]);
+var RESERVED_COLUMN_NAMES = /* @__PURE__ */ new Set(["select", "order", "limit", "offset"]);
+
+// src/errors.ts
+var OrmDefinitionError = class extends Error {
+  constructor(message, file) {
+    super(file ? `${file}: ${message}` : message);
+    this.file = file;
+  }
+  name = "OrmDefinitionError";
+};
+var PredicateParseError = class extends Error {
+  constructor(message, position) {
+    super(`${message} (at position ${position})`);
+    this.position = position;
+  }
+  name = "PredicateParseError";
+};
+
+// src/predicate/ast.ts
+var COMPARE_OPS = ["=", "!=", "<", "<=", ">", ">="];
+function walkPredicate(predicate, visit) {
+  visit(predicate);
+  if (predicate.kind === "and" || predicate.kind === "or") {
+    for (const operand of predicate.operands) walkPredicate(operand, visit);
+  }
+  if (predicate.kind === "not") walkPredicate(predicate.operand, visit);
+}
+function predicateOperands(predicate) {
+  const operands = [];
+  walkPredicate(predicate, (node) => {
+    if (node.kind === "compare") operands.push(node.left, node.right);
+  });
+  return operands;
+}
+function referencedColumns(predicate) {
+  const names = predicateOperands(predicate).flatMap(
+    (operand) => operand.kind === "column" ? [operand.name] : []
+  );
+  return [...new Set(names)];
+}
+function referencedCapabilities(predicate) {
+  const keys = [];
+  walkPredicate(predicate, (node) => {
+    if (node.kind === "capability") keys.push(node.key);
+  });
+  return [...new Set(keys)];
+}
+var identifierSchema = zod.z.string().max(MAX_IDENTIFIER_LENGTH).regex(IDENTIFIER_PATTERN, "must be a lowercase identifier (a-z, 0-9, _)");
+var namespaceSchema = zod.z.string().regex(NAMESPACE_PATTERN, "must be lowercase, start with a letter, and be at most 41 characters");
+var tableReferenceSchema = zod.z.string().refine(
+  (value) => IDENTIFIER_PATTERN.test(value) || QUALIFIED_TABLE_PATTERN.test(value),
+  "must be a table name or a schema-qualified table reference"
+);
+var isQualifiedReference = (reference) => reference.includes(".");
+
+// src/schema/columns.ts
+var COLUMN_TYPES = [
+  "uuid",
+  "text",
+  "integer",
+  "bigint",
+  "numeric",
+  "double",
+  "boolean",
+  "timestamptz",
+  "date",
+  "jsonb"
+];
+var columnTypeSchema = zod.z.enum(COLUMN_TYPES);
+var FUNCTION_DEFAULTS = {
+  "gen_random_uuid()": ["uuid"],
+  "now()": ["timestamptz", "date"]
+};
+var CAST_PATTERN = /^([a-z][a-z0-9_]*)::([a-z]+)$/;
+var isFunctionDefault = (value, type) => typeof value === "string" && (FUNCTION_DEFAULTS[value]?.includes(type) ?? false);
+function defaultIssue(value, type) {
+  if (typeof value === "boolean") return type === "boolean" ? null : `boolean default is invalid for type '${type}'`;
+  if (typeof value === "number") {
+    if (!["integer", "bigint", "numeric", "double"].includes(type)) {
+      return `numeric default is invalid for type '${type}'`;
+    }
+    if (["integer", "bigint"].includes(type)) {
+      if (!Number.isInteger(value)) return `default for type '${type}' must be an integer`;
+      if (!Number.isSafeInteger(value)) {
+        return `default for type '${type}' exceeds the safe integer range \u2014 YAML numbers lose precision past 2^53`;
+      }
+    }
+    if (type === "numeric" && Math.abs(value) > Number.MAX_SAFE_INTEGER) {
+      return "numeric default exceeds the safe float range \u2014 write it as a string (e.g. '9007199254740993') to keep exact precision";
+    }
+    return null;
+  }
+  const allowedTypes = FUNCTION_DEFAULTS[value];
+  if (allowedTypes) return allowedTypes.includes(type) ? null : `default '${value}' is invalid for type '${type}'`;
+  return null;
+}
+var columnSchema = zod.z.strictObject({
+  type: columnTypeSchema,
+  primary_key: zod.z.boolean().optional(),
+  nullable: zod.z.boolean().optional(),
+  unique: zod.z.boolean().optional(),
+  default: zod.z.union([zod.z.string(), zod.z.number(), zod.z.boolean()]).optional(),
+  description: zod.z.string().optional(),
+  renamed_from: identifierSchema.optional(),
+  cast: zod.z.string().optional(),
+  deprecated: zod.z.boolean().optional()
+}).superRefine((column, ctx) => {
+  if (column.default !== void 0) {
+    const issue = defaultIssue(column.default, column.type);
+    if (issue) ctx.addIssue({ code: "custom", message: issue, path: ["default"] });
+  }
+  if (column.primary_key && column.nullable) {
+    ctx.addIssue({ code: "custom", message: "a primary key column cannot be nullable", path: ["nullable"] });
+  }
+  if (column.primary_key && column.deprecated) {
+    ctx.addIssue({ code: "custom", message: "a primary key column cannot be deprecated", path: ["deprecated"] });
+  }
+  if (column.cast && !CAST_PATTERN.test(column.cast)) {
+    ctx.addIssue({ code: "custom", message: "cast must have the shape '<column>::<type>'", path: ["cast"] });
+  }
+});
+function castParts(cast) {
+  const match = CAST_PATTERN.exec(cast);
+  if (!match) return null;
+  return { column: match[1], type: match[2] };
+}
+
+// src/predicate/parse.ts
+var KEYWORDS = /* @__PURE__ */ new Set(["and", "or", "not", "true", "false", "null", "claim", "capability"]);
+var OPERATOR_PATTERN = /^(!=|<=|>=|<>|=|<|>)/;
+var IDENTIFIER_START = /[a-z_]/;
+var IDENTIFIER_CHAR = /[a-z0-9_.-]/;
+var NUMBER_PATTERN = /^-?\d+(\.\d+)?/;
+function tokenize(source) {
+  const tokens = [];
+  let position = 0;
+  while (position < source.length) {
+    const char = source[position];
+    if (/\s/.test(char)) {
+      position += 1;
+      continue;
+    }
+    if (char === "(") {
+      tokens.push({ kind: "lparen", value: char, position });
+      position += 1;
+      continue;
+    }
+    if (char === ")") {
+      tokens.push({ kind: "rparen", value: char, position });
+      position += 1;
+      continue;
+    }
+    if (char === ",") {
+      tokens.push({ kind: "comma", value: char, position });
+      position += 1;
+      continue;
+    }
+    if (char === "'") {
+      const { value, end } = readString(source, position);
+      tokens.push({ kind: "string", value, position });
+      position = end;
+      continue;
+    }
+    const operator = OPERATOR_PATTERN.exec(source.slice(position));
+    if (operator) {
+      const value = operator[0] === "<>" ? "!=" : operator[0];
+      tokens.push({ kind: "operator", value, position });
+      position += operator[0].length;
+      continue;
+    }
+    const number = NUMBER_PATTERN.exec(source.slice(position));
+    if (number && !IDENTIFIER_START.test(char)) {
+      tokens.push({ kind: "number", value: number[0], position });
+      position += number[0].length;
+      continue;
+    }
+    if (IDENTIFIER_START.test(char)) {
+      let end = position;
+      while (end < source.length && IDENTIFIER_CHAR.test(source[end])) end += 1;
+      tokens.push({ kind: "identifier", value: source.slice(position, end), position });
+      position = end;
+      continue;
+    }
+    throw new PredicateParseError(`unexpected character '${char}'`, position);
+  }
+  tokens.push({ kind: "end", value: "", position: source.length });
+  return tokens;
+}
+function readString(source, start) {
+  let value = "";
+  let position = start + 1;
+  while (position < source.length) {
+    const char = source[position];
+    if (char !== "'") {
+      value += char;
+      position += 1;
+      continue;
+    }
+    if (source[position + 1] === "'") {
+      value += "'";
+      position += 2;
+      continue;
+    }
+    return { value, end: position + 1 };
+  }
+  throw new PredicateParseError("unterminated string literal", start);
+}
+var Parser = class {
+  constructor(tokens) {
+    this.tokens = tokens;
+  }
+  index = 0;
+  parse() {
+    const predicate = this.parseOr();
+    this.expect("end", "end of expression");
+    return predicate;
+  }
+  parseOr() {
+    const operands = [this.parseAnd()];
+    while (this.matchKeyword("or")) operands.push(this.parseAnd());
+    return operands.length === 1 ? operands[0] : { kind: "or", operands };
+  }
+  parseAnd() {
+    const operands = [this.parseNot()];
+    while (this.matchKeyword("and")) operands.push(this.parseNot());
+    return operands.length === 1 ? operands[0] : { kind: "and", operands };
+  }
+  parseNot() {
+    if (this.matchKeyword("not")) return { kind: "not", operand: this.parseNot() };
+    return this.parsePrimary();
+  }
+  parsePrimary() {
+    if (this.peek().kind === "lparen") {
+      this.advance();
+      const inner = this.parseOr();
+      this.expect("rparen", "')'");
+      return inner;
+    }
+    if (this.peekKeyword("capability")) {
+      const capability = this.parseCapability();
+      const next = this.peek();
+      if (next.kind === "operator") {
+        throw new PredicateParseError("capability() is boolean-valued and cannot appear in a comparison", next.position);
+      }
+      return capability;
+    }
+    return this.parseComparison();
+  }
+  parseCapability() {
+    this.advance();
+    const key = this.parseCallArgument("capability");
+    if (!CAPABILITY_KEY_PATTERN.test(key)) {
+      throw new PredicateParseError(`invalid capability key '${key}'`, this.peek().position);
+    }
+    return { kind: "capability", key };
+  }
+  parseComparison() {
+    const left = this.parseOperand();
+    const operator = this.expect("operator", "a comparison operator");
+    if (!COMPARE_OPS.includes(operator.value)) {
+      throw new PredicateParseError(`unsupported operator '${operator.value}'`, operator.position);
+    }
+    const right = this.parseOperand();
+    return { kind: "compare", op: operator.value, left, right };
+  }
+  parseOperand() {
+    const token = this.peek();
+    if (token.kind === "string") {
+      this.advance();
+      return { kind: "literal", value: token.value };
+    }
+    if (token.kind === "number") {
+      this.advance();
+      const value = Number(token.value);
+      if (!Number.isFinite(value) || Number.isInteger(value) && !Number.isSafeInteger(value)) {
+        throw new PredicateParseError(
+          `numeric literal '${token.value}' exceeds safe integer precision \u2014 quote it as a string`,
+          token.position
+        );
+      }
+      return { kind: "literal", value };
+    }
+    if (token.kind !== "identifier") {
+      throw new PredicateParseError(`expected an operand, got '${token.value || "end"}'`, token.position);
+    }
+    this.advance();
+    if (token.value === "true" || token.value === "false") {
+      return { kind: "literal", value: token.value === "true" };
+    }
+    if (token.value === "null") return { kind: "literal", value: null };
+    if (token.value === "claim") {
+      const key = this.parseCallArgument("claim");
+      if (!CLAIM_KEY_PATTERN.test(key)) {
+        throw new PredicateParseError(`invalid claim key '${key}'`, token.position);
+      }
+      return { kind: "claim", key };
+    }
+    if (token.value === "capability") {
+      throw new PredicateParseError("capability() is boolean-valued and cannot appear in a comparison", token.position);
+    }
+    if (KEYWORDS.has(token.value) || !IDENTIFIER_PATTERN.test(token.value)) {
+      throw new PredicateParseError(`invalid column reference '${token.value}'`, token.position);
+    }
+    return { kind: "column", name: token.value };
+  }
+  parseCallArgument(fn) {
+    this.expect("lparen", `'(' after ${fn}`);
+    const argument = this.expect("string", `a quoted key in ${fn}(...)`);
+    this.expect("rparen", `')' after ${fn} key`);
+    return argument.value;
+  }
+  peek() {
+    return this.tokens[this.index];
+  }
+  peekKeyword(keyword) {
+    const token = this.peek();
+    return token.kind === "identifier" && token.value === keyword;
+  }
+  matchKeyword(keyword) {
+    if (!this.peekKeyword(keyword)) return false;
+    this.advance();
+    return true;
+  }
+  advance() {
+    const token = this.peek();
+    if (token.kind !== "end") this.index += 1;
+    return token;
+  }
+  expect(kind, description) {
+    const token = this.peek();
+    if (token.kind !== kind) {
+      throw new PredicateParseError(`expected ${description}, got '${token.value || "end"}'`, token.position);
+    }
+    return this.advance();
+  }
+};
+function parsePredicate(source) {
+  const trimmed = source.trim();
+  if (trimmed.length === 0) throw new PredicateParseError("empty predicate", 0);
+  return { source: trimmed, ast: new Parser(tokenize(trimmed)).parse() };
+}
+
+// src/schema/predicates.ts
+var parsedPredicateSchema = zod.z.string().transform((source, ctx) => {
+  try {
+    return parsePredicate(source);
+  } catch (error) {
+    ctx.addIssue({ code: "custom", message: error instanceof Error ? error.message : String(error) });
+    return zod.z.NEVER;
+  }
+});
+
+// src/schema/actions.ts
+var EXECUTES_VERB_PATTERN = /^\s*(insert|update|delete)\b/i;
+var DOLLAR_QUOTE_PATTERN = /\$[a-zA-Z0-9_]*\$/;
+var RETURNING_PATTERN = /\breturning\b/i;
+var ESCAPE_STRING_PATTERN = /(?<![a-zA-Z0-9_])[Ee]'/;
+var MASKED_CLAIM_CALL_PATTERN = /\b(?:claim|capability)\(\s*''\s*\)/g;
+var BARE_CLAIM_CALL_PATTERN = /\b(?:claim|capability)\s*\(/;
+var EXISTS_ENTRY_PATTERN = /^exists\(\s*'([^']+)'\s*,\s*([a-z][a-z0-9_]*)\s*\)$/;
+var NAMED_PARAM_PATTERN = /(?<!:):([a-z][a-z0-9_]*)/g;
+var QUOTED_STRING_PATTERN = /'(?:[^']|'')*'/g;
+var SQL_COMMENT_PATTERN = /--|\/\*/;
+var actionParamSchema = zod.z.strictObject({
+  type: columnTypeSchema,
+  optional: zod.z.boolean().optional(),
+  description: zod.z.string().optional()
+});
+var validatesEntrySchema = zod.z.string().transform((source, ctx) => {
+  const match = EXISTS_ENTRY_PATTERN.exec(source.trim());
+  if (!match) {
+    ctx.addIssue({ code: "custom", message: "validates entries must have the shape exists('<table>', <param>)" });
+    return zod.z.NEVER;
+  }
+  const table = tableReferenceSchema.safeParse(match[1]);
+  if (!table.success) {
+    ctx.addIssue({ code: "custom", message: `invalid table reference '${match[1]}'` });
+    return zod.z.NEVER;
+  }
+  return { source: source.trim(), table: table.data, param: match[2] };
+});
+var AUDIT_ACTIONS = ["create", "update", "delete"];
+var auditSchema = zod.z.strictObject({
+  action: zod.z.enum(AUDIT_ACTIONS),
+  resource: identifierSchema.optional()
+});
+var actionSchema = zod.z.strictObject({
+  description: zod.z.string().optional(),
+  requires: parsedPredicateSchema.optional(),
+  params: zod.z.record(identifierSchema, actionParamSchema).optional(),
+  validates: zod.z.array(validatesEntrySchema).optional(),
+  // One statement, or an ordered list run atomically in the action function.
+  executes: zod.z.union([zod.z.string().min(1), zod.z.array(zod.z.string().min(1)).min(1)]),
+  // Declares the columns the action's RETURNING yields. Present → the
+  // function returns those rows (typed in the client); absent → the action
+  // reports rows_affected only. The column names/types must match the
+  // RETURNING list, which Postgres enforces at CREATE FUNCTION.
+  returns: zod.z.record(identifierSchema, columnTypeSchema).optional(),
+  audit: auditSchema.optional()
+}).superRefine((action, ctx) => {
+  const params = Object.keys(action.params ?? {});
+  if (action.requires && referencedColumns(action.requires.ast).length > 0) {
+    ctx.addIssue({
+      code: "custom",
+      message: "requires may reference claims and capabilities only, not columns",
+      path: ["requires"]
+    });
+  }
+  for (const issue of executesIssues(action.executes, new Set(params), action.returns !== void 0)) {
+    ctx.addIssue({ code: "custom", message: issue, path: ["executes"] });
+  }
+  if (action.returns && Object.keys(action.returns).length === 0) {
+    ctx.addIssue({ code: "custom", message: "returns must declare at least one column", path: ["returns"] });
+  }
+  for (const [index2, entry] of (action.validates ?? []).entries()) {
+    if (!params.includes(entry.param)) {
+      ctx.addIssue({
+        code: "custom",
+        message: `validates references undeclared param '${entry.param}'`,
+        path: ["validates", index2]
+      });
+    }
+  }
+});
+function extractNamedParams(sql2) {
+  const withoutStrings = sql2.replace(QUOTED_STRING_PATTERN, "''");
+  const names = [...withoutStrings.matchAll(NAMED_PARAM_PATTERN)].map((match) => match[1]);
+  return [...new Set(names)];
+}
+function actionStatementSources(executes) {
+  return (Array.isArray(executes) ? executes : [executes]).map((statement) => statement.trim());
+}
+function executesIssues(executes, declaredParams, hasReturns) {
+  const issues = [];
+  const statements = actionStatementSources(executes);
+  statements.forEach((statement, index2) => {
+    const withoutStrings = statement.replace(QUOTED_STRING_PATTERN, "''");
+    const at = statements.length > 1 ? ` (statement ${index2 + 1})` : "";
+    if (!EXECUTES_VERB_PATTERN.test(statement)) issues.push(`executes must be INSERT, UPDATE, or DELETE${at}`);
+    if (withoutStrings.replace(/;\s*$/, "").includes(";")) issues.push(`each executes entry must be a single statement${at}`);
+    if (SQL_COMMENT_PATTERN.test(withoutStrings)) issues.push(`executes must not contain SQL comments${at}`);
+    if (DOLLAR_QUOTE_PATTERN.test(withoutStrings)) issues.push(`executes must not use dollar-quoted strings${at}`);
+    if (ESCAPE_STRING_PATTERN.test(withoutStrings)) issues.push(`executes must not use escape strings (E'\u2026')${at}`);
+    if (withoutStrings.includes('"')) issues.push(`executes must not use double-quoted identifiers${at}`);
+    if (BARE_CLAIM_CALL_PATTERN.test(withoutStrings.replace(MASKED_CLAIM_CALL_PATTERN, ""))) {
+      issues.push(`executes has a malformed claim()/capability() call \u2014 use e.g. claim('sub')${at}`);
+    }
+    if (RETURNING_PATTERN.test(withoutStrings) && !(hasReturns && index2 === statements.length - 1)) {
+      issues.push(
+        hasReturns ? `only the last executes statement may use RETURNING${at}` : `executes must not use RETURNING unless the action declares returns${at}`
+      );
+    }
+  });
+  const last = statements.at(-1);
+  if (hasReturns && last && !RETURNING_PATTERN.test(last.replace(QUOTED_STRING_PATTERN, "''"))) {
+    issues.push("the last executes statement must use RETURNING to populate the declared returns columns");
+  }
+  const undeclared = extractNamedParams(statements.join("\n")).filter((name) => !declaredParams.has(name));
+  if (undeclared.length > 0) issues.push(`executes references undeclared params: ${undeclared.join(", ")}`);
+  return issues;
+}
+
+// src/engine/types.ts
+var SQL_TYPE_NAMES = {
+  double: "double precision",
+  timestamptz: "timestamp with time zone"
+};
+var sqlTypeName = (type) => SQL_TYPE_NAMES[type] ?? type;
+
+// src/compiler/sql.ts
+var CLAIMS_SETTING = "request.jwt.claims";
+var CAPABILITIES_CLAIM_KEY = "capabilities";
+var quoteIdentifier = (name) => `"${name.replaceAll('"', '""')}"`;
+var quoteLiteral = (value) => `'${value.replaceAll("'", "''")}'`;
+var CLAIMS_SOURCE = `nullif(current_setting('${CLAIMS_SETTING}', true), '')::jsonb`;
+var claimExpression = (key) => `(${CLAIMS_SOURCE} ->> ${quoteLiteral(key)})`;
+var capabilityExpression = (key) => `coalesce(${CLAIMS_SOURCE} -> '${CAPABILITIES_CLAIM_KEY}' ? ${quoteLiteral(key)}, false)`;
+
+// src/compiler/predicates.ts
+var SQL_COMPARE_OPS = {
+  "=": "=",
+  "!=": "<>",
+  "<": "<",
+  "<=": "<=",
+  ">": ">",
+  ">=": ">="
+};
+function compileOperand(operand, other, columnTypes) {
+  if (operand.kind === "column") return quoteIdentifier(operand.name);
+  if (operand.kind === "claim") {
+    const expression = claimExpression(operand.key);
+    const columnType = other.kind === "column" ? columnTypes?.[other.name] : void 0;
+    return columnType && columnType !== "text" ? `(${expression})::${sqlTypeName(columnType)}` : expression;
+  }
+  const { value } = operand;
+  if (value === null) return "NULL";
+  if (typeof value === "string") return quoteLiteral(value);
+  return String(value);
+}
+function compileComparison(op, left, right, columnTypes) {
+  const nullSide = left.kind === "literal" && left.value === null ? right : right.kind === "literal" && right.value === null ? left : null;
+  if (nullSide && (op === "=" || op === "!=")) {
+    return `${compileOperand(nullSide, nullSide, columnTypes)} IS${op === "!=" ? " NOT" : ""} NULL`;
+  }
+  return `${compileOperand(left, right, columnTypes)} ${SQL_COMPARE_OPS[op]} ${compileOperand(right, left, columnTypes)}`;
+}
+function compilePredicate(predicate, columnTypes) {
+  switch (predicate.kind) {
+    case "and":
+    case "or": {
+      const joined = predicate.operands.map((operand) => compilePredicate(operand, columnTypes)).join(` ${predicate.kind.toUpperCase()} `);
+      return `(${joined})`;
+    }
+    case "not":
+      return `(NOT ${compilePredicate(predicate.operand, columnTypes)})`;
+    case "compare":
+      return `(${compileComparison(predicate.op, predicate.left, predicate.right, columnTypes)})`;
+    case "capability":
+      return `(${capabilityExpression(predicate.key)})`;
+  }
+}
+
+// src/compiler/actions.ts
+var QUOTED_STRING_PATTERN2 = /'(?:[^']|'')*'/g;
+var TOKEN_PATTERN = /\bclaim\(\s*'((?:[^']|'')*)'\s*\)|\bcapability\(\s*'((?:[^']|'')*)'\s*\)|'(?:[^']|'')*'|(?<!:):([a-z][a-z0-9_]*)/g;
+var BARE_CALL_PATTERN = /\b(?:claim|capability)\s*\(/;
+var PARAM_SCHEMAS = {
+  uuid: zod.z.string(),
+  text: zod.z.string(),
+  integer: zod.z.union([zod.z.number(), zod.z.string()]),
+  bigint: zod.z.union([zod.z.number(), zod.z.string()]),
+  numeric: zod.z.union([zod.z.number(), zod.z.string()]),
+  double: zod.z.union([zod.z.number(), zod.z.string()]),
+  boolean: zod.z.union([zod.z.boolean(), zod.z.string()]),
+  timestamptz: zod.z.string(),
+  date: zod.z.string(),
+  jsonb: zod.z.unknown()
+};
+function buildActionParamsSchema(action) {
+  const shape = {};
+  const entries = Object.entries(action.params ?? {});
+  for (const [name, param] of entries) {
+    shape[name] = param.optional ? PARAM_SCHEMAS[param.type].nullish() : PARAM_SCHEMAS[param.type];
+  }
+  return zod.z.strictObject(shape).superRefine((obj, ctx) => {
+    for (const [name, param] of entries) {
+      if (!param.optional && param.type === "jsonb" && obj[name] === void 0) {
+        ctx.addIssue({ code: "custom", message: "Required", path: [name] });
+      }
+    }
+  });
+}
+var actionParamOrder = (action) => Object.keys(action.params ?? {});
+var actionParamArg = (name) => `p_${name}`;
+function compileActionStatements(action, renderParam = actionParamArg) {
+  return actionStatementSources(action.executes).map((statement) => compileStatement(statement, renderParam));
+}
+function compileStatement(sql2, renderParam) {
+  const compiled = sql2.replace(TOKEN_PATTERN, (token, claimKey, capabilityKey, paramName) => {
+    if (claimKey !== void 0) {
+      if (!CLAIM_KEY_PATTERN.test(claimKey)) throw new OrmDefinitionError(`invalid claim key in executes: ${token}`);
+      return claimExpression(claimKey);
+    }
+    if (capabilityKey !== void 0) {
+      if (!CAPABILITY_KEY_PATTERN.test(capabilityKey)) {
+        throw new OrmDefinitionError(`invalid capability key in executes: ${token}`);
+      }
+      return capabilityExpression(capabilityKey);
+    }
+    if (paramName !== void 0) return renderParam(paramName);
+    return token;
+  });
+  if (BARE_CALL_PATTERN.test(compiled.replace(QUOTED_STRING_PATTERN2, "''"))) {
+    throw new OrmDefinitionError("executes contains a claim()/capability() call outside the grammar");
+  }
+  return compiled;
+}
+function compileActionRequires(action) {
+  return action.requires ? compilePredicate(action.requires.ast) : null;
+}
+function referencedExecuteCapabilities(action) {
+  const keys = [];
+  for (const statement of actionStatementSources(action.executes)) {
+    for (const match of statement.matchAll(TOKEN_PATTERN)) {
+      if (match[2] !== void 0) keys.push(match[2]);
+    }
+  }
+  return keys;
+}
+
+// src/engine/actions.ts
+var ACTION_REQUIRES_DENIED_SQLSTATE = "ORMRQ";
+var ACTION_VALIDATES_FAILED_SQLSTATE = "ORMVL";
+var actionFunctionName = (actionName) => `action_${actionName}`;
+function returnProjection(returns, lastStatement) {
+  const projection = Object.keys(returns).map(quoteIdentifier).join(", ");
+  return `WITH orm_returning AS (${lastStatement}) SELECT ${projection} FROM orm_returning`;
+}
+var allActions = (definition) => definition.tables.flatMap((table) => Object.entries(table.actions ?? {}).map(([name, action]) => ({ name, action }))).sort((a, b) => a.name.localeCompare(b.name));
+function actionFunctionStatements(definition) {
+  const schema = ormSchemaName(definition.namespace);
+  return [dropAllActionFunctions(schema), ...allActions(definition).flatMap(({ name, action }) => createActionFunction(definition, name, action))];
+}
+function actionPrepareChecks(definition) {
+  const actions = allActions(definition);
+  if (actions.length === 0) return [];
+  const statements = [`SET LOCAL search_path TO ${quoteIdentifier(ormSchemaName(definition.namespace))}`];
+  for (const { name, action } of actions) {
+    const order = actionParamOrder(action);
+    const signature = order.length > 0 ? ` (${order.map((param) => sqlTypeName(action.params[param].type)).join(", ")})` : "";
+    const compiled = compileActionStatements(action, (param) => `$${order.indexOf(param) + 1}`);
+    compiled.forEach((sql2, index2) => {
+      const checked = action.returns && index2 === compiled.length - 1 ? returnProjection(action.returns, sql2) : sql2;
+      statements.push(`PREPARE ${quoteIdentifier(`orm_check_${name}_${index2}`)}${signature} AS ${checked}`);
+    });
+  }
+  return statements;
+}
+function dropAllActionFunctions(schema) {
+  return `DO $orm_reconcile_actions$
+DECLARE
+  r record;
+BEGIN
+  FOR r IN
+    SELECT p.oid::regprocedure AS sig
+    FROM pg_catalog.pg_proc p
+    JOIN pg_catalog.pg_namespace n ON n.oid = p.pronamespace
+    WHERE n.nspname = ${quoteLiteral(schema)} AND p.proname LIKE 'action\\_%'
+  LOOP
+    EXECUTE 'DROP FUNCTION ' || r.sig;
+  END LOOP;
+END
+$orm_reconcile_actions$`;
+}
+function createActionFunction(definition, name, action) {
+  const schema = quoteIdentifier(ormSchemaName(definition.namespace));
+  const fn = `${schema}.${quoteIdentifier(actionFunctionName(name))}`;
+  const order = actionParamOrder(action);
+  const signature = order.map((paramName) => `${quoteIdentifier(actionParamArg(paramName))} ${sqlTypeName(action.params[paramName].type)}`).join(", ");
+  const argTypes = order.map((paramName) => sqlTypeName(action.params[paramName].type)).join(", ");
+  const role = quoteIdentifier(consumerRoleName(definition.namespace));
+  const statements = compileActionStatements(action);
+  const last = statements[statements.length - 1];
+  const leading = statements.slice(0, -1).map((statement) => `  ${statement};`);
+  const create = action.returns ? (
+    // RETURNS TABLE + RETURN QUERY over the declared-order re-projection.
+    `CREATE FUNCTION ${fn}(${signature})
+RETURNS TABLE(${Object.entries(action.returns).map(([column, type]) => `${quoteIdentifier(column)} ${sqlTypeName(type)}`).join(", ")})
+LANGUAGE plpgsql
+SECURITY INVOKER
+SET search_path = ${schema}
+AS $orm_action$
+-- RETURNS TABLE names OUT params (id, \u2026) that collide with the re-projection's
+-- columns; resolve unqualified names to the column.
+#variable_conflict use_column
+BEGIN
+${[functionGuards(definition, name, action), ...leading, `  RETURN QUERY ${returnProjection(action.returns, last)};`].filter(Boolean).join("\n")}
+END
+$orm_action$`
+  ) : (
+    // No returns: report the last statement's affected count.
+    `CREATE FUNCTION ${fn}(${signature})
+RETURNS bigint
+LANGUAGE plpgsql
+SECURITY INVOKER
+SET search_path = ${schema}
+AS $orm_action$
+DECLARE
+  v_count bigint;
+BEGIN
+${[functionGuards(definition, name, action), ...leading, `  ${last};`].filter(Boolean).join("\n")}
+  GET DIAGNOSTICS v_count = ROW_COUNT;
+  RETURN v_count;
+END
+$orm_action$`
+  );
+  return [
+    create,
+    `REVOKE ALL ON FUNCTION ${fn}(${argTypes}) FROM PUBLIC`,
+    `GRANT EXECUTE ON FUNCTION ${fn}(${argTypes}) TO ${role}`
+  ];
+}
+function functionGuards(definition, name, action) {
+  const lines = [];
+  const requires = compileActionRequires(action);
+  if (requires) {
+    lines.push(
+      `  IF NOT (${requires}) THEN`,
+      `    RAISE EXCEPTION 'action ${name} requires a grant the caller does not hold' USING ERRCODE = ${quoteLiteral(ACTION_REQUIRES_DENIED_SQLSTATE)};`,
+      `  END IF;`
+    );
+  }
+  for (const entry of action.validates ?? []) {
+    const { schema, table, key } = resolveValidatesTarget(definition, entry);
+    const arg = quoteIdentifier(actionParamArg(entry.param));
+    lines.push(
+      `  IF ${arg} IS NOT NULL AND NOT EXISTS (SELECT 1 FROM ${quoteIdentifier(schema)}.${quoteIdentifier(table)} WHERE ${quoteIdentifier(key)} = ${arg} FOR SHARE) THEN`,
+      `    RAISE EXCEPTION 'validates failed: no ${entry.table} row for ${entry.param}' USING ERRCODE = ${quoteLiteral(ACTION_VALIDATES_FAILED_SQLSTATE)};`,
+      `  END IF;`
+    );
+  }
+  return lines.join("\n");
+}
+function resolveValidatesTarget(definition, entry) {
+  if (entry.table.includes(".")) {
+    const [schema, table] = entry.table.split(".");
+    return { schema, table, key: "id" };
+  }
+  const target = definition.tables.find((table) => table.table === entry.table);
+  const key = target && Object.entries(target.columns ?? {}).find(([, column]) => column.primary_key)?.[0];
+  if (!target || !key) {
+    throw new OrmDefinitionError(`action validates target '${entry.table}' is not a local table with a primary key`);
+  }
+  return { schema: ormSchemaName(definition.namespace), table: entry.table, key };
+}
+var linkSchema = zod.z.strictObject({
+  to: tableReferenceSchema,
+  on: identifierSchema,
+  enforce: zod.z.boolean().optional(),
+  description: zod.z.string().optional()
+});
+var indexSchema = zod.z.union([
+  zod.z.array(identifierSchema).min(1),
+  zod.z.strictObject({
+    columns: zod.z.array(identifierSchema).min(1),
+    unique: zod.z.boolean().optional(),
+    name: identifierSchema.optional()
+  })
+]).transform((index2) => Array.isArray(index2) ? { columns: index2 } : index2);
+var policiesSchema = zod.z.strictObject({
+  read: parsedPredicateSchema.optional(),
+  write: parsedPredicateSchema.optional()
+});
+var tableFileSchema = zod.z.strictObject({
+  namespace: namespaceSchema,
+  table: identifierSchema,
+  description: zod.z.string().optional(),
+  columns: zod.z.record(identifierSchema, columnSchema).optional(),
+  source: zod.z.string().regex(SYNCED_SOURCE_PATTERN, "source must reference a gold-layer table").optional(),
+  links: zod.z.record(identifierSchema, linkSchema).optional(),
+  indexes: zod.z.array(indexSchema).optional(),
+  policies: policiesSchema.optional(),
+  actions: zod.z.record(identifierSchema, actionSchema).optional()
+}).superRefine((table, ctx) => {
+  if (RESERVED_TABLE_NAMES.has(table.table)) {
+    ctx.addIssue({ code: "custom", message: `'${table.table}' is a reserved table name`, path: ["table"] });
+  }
+  for (const name of Object.keys(table.columns ?? {})) {
+    if (RESERVED_COLUMN_NAMES.has(name)) {
+      ctx.addIssue({
+        code: "custom",
+        message: `column '${name}' collides with the Data API's reserved query parameters (select, order, limit, offset) \u2014 it could never be filtered`,
+        path: ["columns", name]
+      });
+    }
+  }
+  if (table.source) validateSyncedTable(table, ctx);
+  else validateColumnTable(table, ctx);
+  validateLinks(table, ctx);
+  validatePolicyColumns(table, ctx);
+  validateDerivedNameLengths(table, ctx);
+});
+var indexName = (table, definition) => definition.name ?? `ix_${table}_${definition.columns.join("_")}`;
+var policyName = (table, suffix) => `${table}_${suffix}`;
+var foreignKeyName = (table, link) => `fk_${table}_${link}`;
+function validateSyncedTable(table, ctx) {
+  const forbidden = [
+    ["columns", "synced tables reflect their source; columns are not declared"],
+    ["actions", "synced tables are read-only; actions are not allowed"],
+    ["indexes", "synced tables are system-owned; indexes are not allowed"]
+  ];
+  for (const [field, message] of forbidden) {
+    if (table[field] !== void 0) ctx.addIssue({ code: "custom", message, path: [field] });
+  }
+  if (table.policies?.write) {
+    ctx.addIssue({ code: "custom", message: "synced tables are read-only", path: ["policies", "write"] });
+  }
+}
+function validateRenames(columns, names, ctx) {
+  const renameSources = /* @__PURE__ */ new Map();
+  for (const name of names) {
+    const renamedFrom = columns[name]?.renamed_from;
+    if (!renamedFrom) continue;
+    if (renamedFrom === name || names.includes(renamedFrom)) {
+      ctx.addIssue({
+        code: "custom",
+        message: "renamed_from must name a column that no longer exists",
+        path: ["columns", name, "renamed_from"]
+      });
+    }
+    const claimed = renameSources.get(renamedFrom);
+    if (claimed) {
+      ctx.addIssue({
+        code: "custom",
+        message: `renamed_from '${renamedFrom}' is already claimed by '${claimed}'`,
+        path: ["columns", name, "renamed_from"]
+      });
+    }
+    renameSources.set(renamedFrom, name);
+  }
+}
+function validateColumnTable(table, ctx) {
+  const columns = table.columns ?? {};
+  const names = Object.keys(columns);
+  if (names.length === 0) {
+    ctx.addIssue({ code: "custom", message: "a table must declare columns or a source", path: ["columns"] });
+    return;
+  }
+  const primaryKeys = names.filter((name) => columns[name]?.primary_key);
+  if (primaryKeys.length !== 1) {
+    ctx.addIssue({ code: "custom", message: "exactly one column must be primary_key", path: ["columns"] });
+  }
+  validateRenames(columns, names, ctx);
+  for (const name of names) {
+    const column = columns[name];
+    if (!column) continue;
+    const cast = column.cast ? castParts(column.cast) : null;
+    if (column.cast && cast?.column !== name) {
+      ctx.addIssue({
+        code: "custom",
+        message: "cast must reference the column it is declared on",
+        path: ["columns", name, "cast"]
+      });
+    }
+    if (cast && cast.type !== column.type) {
+      ctx.addIssue({
+        code: "custom",
+        message: `cast target '${cast.type}' must match the declared type '${column.type}'`,
+        path: ["columns", name, "cast"]
+      });
+    }
+  }
+  for (const [position, index2] of (table.indexes ?? []).entries()) {
+    if (new Set(index2.columns).size !== index2.columns.length) {
+      ctx.addIssue({
+        code: "custom",
+        message: "index names a column more than once",
+        path: ["indexes", position]
+      });
+    }
+    for (const column of index2.columns) {
+      if (!names.includes(column)) {
+        ctx.addIssue({
+          code: "custom",
+          message: `index references unknown column '${column}'`,
+          path: ["indexes", position]
+        });
+      }
+    }
+  }
+}
+function validateLinks(table, ctx) {
+  const columnNames = Object.keys(table.columns ?? {});
+  for (const [name, link] of Object.entries(table.links ?? {})) {
+    if (!table.source && !columnNames.includes(link.on)) {
+      ctx.addIssue({ code: "custom", message: `link references unknown column '${link.on}'`, path: ["links", name, "on"] });
+    }
+    if (link.enforce && link.to.includes(".")) {
+      ctx.addIssue({
+        code: "custom",
+        message: "enforce is only valid for links inside the namespace; cross-boundary links stay soft",
+        path: ["links", name, "enforce"]
+      });
+    }
+    if (link.enforce && table.source) {
+      ctx.addIssue({
+        code: "custom",
+        message: "a synced table cannot enforce foreign keys \u2014 its DDL is owned by the sync",
+        path: ["links", name, "enforce"]
+      });
+    }
+  }
+}
+function validateDerivedNameLengths(table, ctx) {
+  const worstPolicy = policyName(table.table, "insert");
+  if (!table.source && worstPolicy.length > MAX_IDENTIFIER_LENGTH) {
+    ctx.addIssue({
+      code: "custom",
+      message: `table name is too long \u2014 the derived policy name '${worstPolicy}' exceeds Postgres's ${MAX_IDENTIFIER_LENGTH}-byte identifier limit`,
+      path: ["table"]
+    });
+  }
+  for (const [position, index2] of (table.indexes ?? []).entries()) {
+    const name = indexName(table.table, index2);
+    if (name.length > MAX_IDENTIFIER_LENGTH) {
+      ctx.addIssue({
+        code: "custom",
+        message: `derived index name '${name}' exceeds Postgres's ${MAX_IDENTIFIER_LENGTH}-byte identifier limit \u2014 set a shorter explicit name`,
+        path: ["indexes", position]
+      });
+    }
+  }
+  for (const [name, link] of Object.entries(table.links ?? {})) {
+    const constraint = foreignKeyName(table.table, name);
+    if (link.enforce && constraint.length > MAX_IDENTIFIER_LENGTH) {
+      ctx.addIssue({
+        code: "custom",
+        message: `derived foreign-key name '${constraint}' exceeds Postgres's ${MAX_IDENTIFIER_LENGTH}-byte identifier limit \u2014 shorten the link or table name`,
+        path: ["links", name]
+      });
+    }
+  }
+  for (const name of Object.keys(table.actions ?? {})) {
+    const fnName = `action_${name}`;
+    if (fnName.length > MAX_IDENTIFIER_LENGTH) {
+      ctx.addIssue({
+        code: "custom",
+        message: `derived action function name '${fnName}' exceeds Postgres's ${MAX_IDENTIFIER_LENGTH}-byte identifier limit \u2014 shorten the action name`,
+        path: ["actions", name]
+      });
+    }
+  }
+}
+var TYPE_GROUPS = {
+  integer: "numeric",
+  bigint: "numeric",
+  numeric: "numeric",
+  double: "numeric",
+  text: "text",
+  uuid: "uuid",
+  date: "temporal",
+  timestamptz: "temporal",
+  boolean: "boolean",
+  jsonb: "jsonb"
+};
+var columnTypeGroup = (type) => TYPE_GROUPS[type];
+function validatePolicyColumns(table, ctx) {
+  if (table.source) return;
+  const columns = table.columns ?? {};
+  const columnNames = Object.keys(columns);
+  for (const kind of ["read", "write"]) {
+    const predicate = table.policies?.[kind];
+    if (!predicate) continue;
+    for (const column of referencedColumns(predicate.ast)) {
+      if (!columnNames.includes(column)) {
+        ctx.addIssue({
+          code: "custom",
+          message: `policy references unknown column '${column}'`,
+          path: ["policies", kind]
+        });
+      }
+    }
+    walkPredicate(predicate.ast, (node) => {
+      if (node.kind !== "compare") return;
+      const issue = comparisonTypeIssue(node.left, node.right, columns);
+      if (issue) ctx.addIssue({ code: "custom", message: issue, path: ["policies", kind] });
+    });
+  }
+}
+function comparisonTypeIssue(left, right, columns) {
+  const groupOf = (operand) => operand.kind === "column" ? columns[operand.name] ? TYPE_GROUPS[columns[operand.name].type] : null : null;
+  if (left.kind === "column" && right.kind === "column") {
+    const leftGroup = groupOf(left);
+    const rightGroup = groupOf(right);
+    if (leftGroup && rightGroup && leftGroup !== rightGroup) {
+      return `policy compares '${left.name}' (${columns[left.name].type}) with '${right.name}' (${columns[right.name].type}) \u2014 incomparable types`;
+    }
+    return null;
+  }
+  const column = left.kind === "column" ? left : right.kind === "column" ? right : null;
+  const literal = left.kind === "literal" ? left : right.kind === "literal" ? right : null;
+  if (!column || !literal || literal.value === null) return null;
+  const columnGroup = groupOf(column);
+  if (!columnGroup) return null;
+  if (typeof literal.value === "string") return null;
+  const literalGroup = typeof literal.value === "number" ? "numeric" : "boolean";
+  if (literalGroup !== columnGroup) {
+    return `policy compares '${column.name}' (${columns[column.name].type}) with a ${typeof literal.value} literal \u2014 incomparable types`;
+  }
+  return null;
+}
+
+// src/engine/security.ts
+var CONSUMER_TABLE_PRIVILEGES = ["SELECT", "INSERT", "UPDATE", "DELETE"];
+var POLICY_SUFFIXES = ["read", "insert", "update", "delete", "write"];
+function securityStatements(definition) {
+  const schema = quoteIdentifier(ormSchemaName(definition.namespace));
+  const role = quoteIdentifier(consumerRoleName(definition.namespace));
+  const tables = columnTables(definition);
+  const force = tables.map(
+    (table) => `ALTER TABLE ${schema}.${quoteIdentifier(table.table)} FORCE ROW LEVEL SECURITY`
+  );
+  const policies = tables.flatMap((table) => policyStatements(schema, table));
+  const grants = tables.map(
+    (table) => `GRANT ${CONSUMER_TABLE_PRIVILEGES.join(", ")} ON ${schema}.${quoteIdentifier(table.table)} TO ${role}`
+  );
+  return [...force, ...policies, `GRANT USAGE ON SCHEMA ${schema} TO ${role}`, ...grants];
+}
+function policyDropStatements(schemaName, tables) {
+  const schema = quoteIdentifier(schemaName);
+  return tables.flatMap(
+    (table) => POLICY_SUFFIXES.map(
+      (suffix) => `DROP POLICY IF EXISTS ${quoteIdentifier(policyName(table, suffix))} ON ${schema}.${quoteIdentifier(table)}`
+    )
+  );
+}
+function policyStatements(schema, table) {
+  const qualified = `${schema}.${quoteIdentifier(table.table)}`;
+  const policyName2 = (suffix) => quoteIdentifier(policyName(table.table, suffix));
+  const statements = POLICY_SUFFIXES.map((suffix) => `DROP POLICY IF EXISTS ${policyName2(suffix)} ON ${qualified}`);
+  const columnTypes = Object.fromEntries(
+    Object.entries(table.columns ?? {}).map(([name, column]) => [name, column.type])
+  );
+  const read = table.policies?.read;
+  if (read) {
+    statements.push(`CREATE POLICY ${policyName2("read")} ON ${qualified} FOR SELECT USING (${compilePredicate(read.ast, columnTypes)})`);
+  }
+  const write = table.policies?.write;
+  if (write) {
+    const predicate = compilePredicate(write.ast, columnTypes);
+    statements.push(`CREATE POLICY ${policyName2("insert")} ON ${qualified} FOR INSERT WITH CHECK (${predicate})`);
+    statements.push(
+      `CREATE POLICY ${policyName2("update")} ON ${qualified} FOR UPDATE USING (${predicate}) WITH CHECK (${predicate})`
+    );
+    statements.push(`CREATE POLICY ${policyName2("delete")} ON ${qualified} FOR DELETE USING (${predicate})`);
+  }
+  return statements;
+}
+var columnTables = (definition) => definition.tables.filter((table) => !table.source);
+var FACTORIES = {
+  uuid: (name) => pgCore.uuid(name),
+  text: (name) => pgCore.text(name),
+  integer: (name) => pgCore.integer(name),
+  // Mode 'bigint' keeps int8 lossless — mode 'number' silently rounds past
+  // 2^53. The read executor serializes BigInt to string for JSON.
+  bigint: (name) => pgCore.bigint(name, { mode: "bigint" }),
+  numeric: (name) => pgCore.numeric(name),
+  double: (name) => pgCore.doublePrecision(name),
+  boolean: (name) => pgCore.boolean(name),
+  timestamptz: (name) => pgCore.timestamp(name, { withTimezone: true }),
+  date: (name) => pgCore.date(name),
+  jsonb: (name) => pgCore.jsonb(name)
+};
+function buildColumn(name, definition) {
+  let column = FACTORIES[definition.type](name);
+  if (definition.primary_key) column = column.primaryKey();
+  if (definition.nullable === false && !definition.primary_key) column = column.notNull();
+  if (definition.unique && !definition.primary_key) column = column.unique();
+  if (definition.default !== void 0) {
+    const value = definition.default;
+    column = column.default(
+      typeof value === "string" && isFunctionDefault(value, definition.type) ? drizzleOrm.sql.raw(value) : value
+    );
+  }
+  return column;
+}
+
+// src/engine/tables.ts
+var SCHEMA_IMPORT_KEY = "$schema";
+function buildDrizzleEntities(definition) {
+  const schemaName = ormSchemaName(definition.namespace);
+  const schema = pgCore.pgSchema(schemaName);
+  const imports = { [SCHEMA_IMPORT_KEY]: schema };
+  const tables = {};
+  const built = /* @__PURE__ */ new Map();
+  for (const table of sortByEnforcedLinks(columnTables(definition))) {
+    const drizzleTable = buildTable(schema, table, built);
+    built.set(table.table, drizzleTable);
+    imports[table.table] = drizzleTable;
+    tables[table.table] = drizzleTable;
+  }
+  return { imports, tables, schemaName };
+}
+function buildTable(schema, table, built) {
+  const columns = Object.fromEntries(
+    Object.entries(table.columns ?? {}).map(([name, column]) => [name, buildColumn(name, column)])
+  );
+  const drizzleTable = schema.table(table.table, columns, (self) => [
+    ...buildIndexes(table, self),
+    ...buildForeignKeys(table, self, built)
+  ]);
+  return drizzleTable.enableRLS();
+}
+function buildIndexes(table, self) {
+  return (table.indexes ?? []).map((definition) => {
+    const name = indexName(table.table, definition);
+    const factory = definition.unique ? pgCore.uniqueIndex(name) : pgCore.index(name);
+    const columns = definition.columns.map((column) => self[column]);
+    return factory.on(...columns);
+  });
+}
+function buildForeignKeys(table, self, built) {
+  return Object.entries(table.links ?? {}).filter(([, link]) => link.enforce).map(([name, link]) => {
+    const target = link.to === table.table ? self : built.get(link.to);
+    const targetColumn = target && findPrimaryKeyColumn(target);
+    if (!target || !targetColumn) {
+      throw new OrmDefinitionError(`enforced link '${name}' on '${table.table}' has no built target '${link.to}'`);
+    }
+    return pgCore.foreignKey({
+      name: foreignKeyName(table.table, name),
+      columns: [self[link.on]],
+      foreignColumns: [targetColumn]
+    });
+  });
+}
+function findPrimaryKeyColumn(target) {
+  const columns = Object.values(target).filter(
+    (value) => value !== null && typeof value === "object" && "primary" in value
+  );
+  return columns.find((column) => column.primary);
+}
+function sortByEnforcedLinks(tables) {
+  const remaining = new Map(tables.map((table) => [table.table, table]));
+  const sorted = [];
+  const placed = /* @__PURE__ */ new Set();
+  while (remaining.size > 0) {
+    const ready = [...remaining.values()].filter(
+      (table) => enforcedTargets(table).every((target) => placed.has(target) || !remaining.has(target))
+    );
+    if (ready.length === 0) {
+      throw new OrmDefinitionError(`enforced links form a cycle among: ${[...remaining.keys()].join(", ")}`);
+    }
+    for (const table of ready) {
+      sorted.push(table);
+      placed.add(table.table);
+      remaining.delete(table.table);
+    }
+  }
+  return sorted;
+}
+var enforcedTargets = (table) => Object.values(table.links ?? {}).filter((link) => link.enforce && !isQualifiedReference(link.to) && link.to !== table.table).map((link) => link.to);
+
+// src/engine/snapshot.ts
+function generateSnapshot(definition, previousId2) {
+  const { imports, schemaName } = buildDrizzleEntities(definition);
+  return api.generateDrizzleJson(imports, previousId2, [schemaName]);
+}
+var emptySnapshot = (namespace) => api.generateDrizzleJson({}, void 0, [ormSchemaName(namespace)]);
+var CURRENT_SNAPSHOT_VERSION = api.generateDrizzleJson({}).version;
+function normalizeSnapshot(snapshot) {
+  const upgraded = api.upPgSnapshot(snapshot);
+  const version = upgraded.version;
+  if (version !== CURRENT_SNAPSHOT_VERSION) {
+    throw new OrmDefinitionError(
+      `snapshot format '${String(version)}' is not supported by this drizzle-kit (expected '${CURRENT_SNAPSHOT_VERSION}') \u2014 upgrade @sequenceholdings/orm`
+    );
+  }
+  return upgraded;
+}
+function diffStatements(previous, current) {
+  assertUnambiguousDiff(previous, current);
+  return api.generateMigration(previous, current);
+}
+function assertUnambiguousDiff(previous, current) {
+  const previousTables = tablesOf(previous);
+  const currentTables = tablesOf(current);
+  const removedTables = [...previousTables.keys()].filter((name) => !currentTables.has(name));
+  const addedTables = [...currentTables.keys()].filter((name) => !previousTables.has(name));
+  if (removedTables.length > 0 && addedTables.length > 0) {
+    throw new OrmDefinitionError(
+      `ambiguous diff: table(s) added (${addedTables.join(", ")}) and removed (${removedTables.join(", ")}) in the same change \u2014 ship the add and the drop as separate changes`
+    );
+  }
+  for (const [name, previousColumns] of previousTables) {
+    const currentColumns = currentTables.get(name);
+    if (!currentColumns) continue;
+    const removed = [...previousColumns].filter((column) => !currentColumns.has(column));
+    const added = [...currentColumns].filter((column) => !previousColumns.has(column));
+    if (removed.length > 0 && added.length > 0) {
+      throw new OrmDefinitionError(
+        `ambiguous diff on '${name}': column(s) added (${added.join(", ")}) and removed (${removed.join(", ")}) in the same change \u2014 declare \`renamed_from\` for a rename, or ship the add and the drop as separate changes`
+      );
+    }
+  }
+}
+function tablesOf(snapshot) {
+  const tables = snapshot.tables ?? {};
+  return new Map(
+    Object.values(tables).map((table) => [`${table.schema}.${table.name}`, new Set(Object.keys(table.columns))])
+  );
+}
+function applyMigrationHints(previous, definition) {
+  const adjusted = structuredClone(previous);
+  const statements = [];
+  const schemaName = ormSchemaName(definition.namespace);
+  const qualified = (table) => `${quoteIdentifier(schemaName)}.${quoteIdentifier(table)}`;
+  for (const table of columnTables(definition)) {
+    const snapshotTable = findTable(adjusted, schemaName, table.table);
+    if (!snapshotTable) continue;
+    for (const [name, column] of Object.entries(table.columns ?? {})) {
+      if (column.renamed_from) {
+        const previousColumn = snapshotTable.columns[column.renamed_from];
+        if (previousColumn && snapshotTable.columns[name]) {
+          throw new OrmDefinitionError(
+            `'${table.table}.${name}' declares renamed_from '${column.renamed_from}', but both columns exist in the previous schema \u2014 a rename cannot overwrite a live column`
+          );
+        }
+        if (previousColumn) {
+          statements.push(
+            `ALTER TABLE ${qualified(table.table)} RENAME COLUMN ${quoteIdentifier(column.renamed_from)} TO ${quoteIdentifier(name)}`
+          );
+          delete snapshotTable.columns[column.renamed_from];
+          snapshotTable.columns[name] = { ...previousColumn, name };
+        } else if (!snapshotTable.columns[name]) {
+          throw new OrmDefinitionError(
+            `'${table.table}.${name}' declares renamed_from '${column.renamed_from}', but the previous schema has neither column \u2014 check the declared source name`
+          );
+        }
+      }
+      const cast = column.cast ? castParts(column.cast) : null;
+      if (cast) {
+        const current = snapshotTable.columns[name];
+        const targetType = sqlTypeName(column.type);
+        if (current && current.type !== targetType) {
+          statements.push(
+            `ALTER TABLE ${qualified(table.table)} ALTER COLUMN ${quoteIdentifier(name)} TYPE ${targetType} USING ${quoteIdentifier(name)}::${targetType}`
+          );
+          current.type = targetType;
+        }
+      }
+    }
+  }
+  return { statements, adjusted };
+}
+function findTable(snapshot, schema, table) {
+  const tables = snapshot.tables ?? {};
+  return Object.values(tables).find((entry) => entry.schema === schema && entry.name === table);
+}
+function snapshotTableNames(snapshot, schema) {
+  const tables = snapshot.tables ?? {};
+  return Object.values(tables).filter((entry) => entry.schema === schema).map((entry) => entry.name);
+}
+var OWNED_STATEMENT = new RegExp(
+  [
+    String.raw`^\s*(CREATE|DROP)\s+POLICY\b`,
+    String.raw`^\s*(GRANT|REVOKE)\b`,
+    String.raw`^\s*(CREATE|DROP|ALTER)\s+ROLE\b`,
+    String.raw`^\s*(CREATE|DROP)\s+(OR\s+REPLACE\s+)?VIEW\b`,
+    // Only ever appears in an RLS toggle (ALTER TABLE … [ENABLE|FORCE] ROW LEVEL
+    // SECURITY) — a three-word phrase, never an identifier.
+    String.raw`\bROW LEVEL SECURITY\b`
+  ].join("|"),
+  "i"
+);
+function isOwnedStatement(statement) {
+  return OWNED_STATEMENT.test(statement);
+}
+async function pendingKitStatements({
+  definition,
+  db
+}) {
+  const { imports, schemaName } = buildDrizzleEntities(definition);
+  const { statementsToExecute } = await withExitGuard(
+    () => api.pushSchema(imports, shimExecute(db), [schemaName])
+  );
+  return statementsToExecute.filter((statement) => !OWNED_STATEMENT.test(statement));
+}
+function shimExecute(db) {
+  const execute = db.execute.bind(db);
+  return {
+    execute: async (query) => {
+      const result = await execute(query);
+      if (result && typeof result === "object" && "rows" in result) return result;
+      return { rows: result };
+    }
+  };
+}
+var exitGuardChain = Promise.resolve();
+function withExitGuard(run) {
+  const next = exitGuardChain.then(() => guardedRun(run));
+  exitGuardChain = next.then(
+    () => void 0,
+    () => void 0
+  );
+  return next;
+}
+async function guardedRun(run) {
+  const originalExit = process.exit;
+  process.exit = ((code) => {
+    throw new Error(`drizzle-kit attempted process.exit(${code ?? 0}) during pushSchema introspection`);
+  });
+  try {
+    return await run();
+  } finally {
+    process.exit = originalExit;
+  }
+}
+
+// src/engine/index.ts
+var STATEMENT_KINDS = ["hint", "ddl", "security", "function"];
+async function planMigration({
+  definition,
+  previousSnapshot
+}) {
+  const schema = ormSchemaName(definition.namespace);
+  const previous = previousSnapshot ? normalizeSnapshot(previousSnapshot) : emptySnapshot(definition.namespace);
+  const hints = applyMigrationHints(previous, definition);
+  const snapshot = generateSnapshot(definition, previousId(previous));
+  const ddl = await diffStatements(hints.adjusted, snapshot);
+  const policyDrops = policyDropStatements(schema, snapshotTableNames(previous, schema));
+  const statements = [
+    ...policyDrops.map((sql2) => ({ kind: "security", sql: sql2 })),
+    ...hints.statements.map((sql2) => ({ kind: "hint", sql: sql2 })),
+    ...ddl.map((sql2) => ({ kind: "ddl", sql: sql2.replace(/;\s*$/, "") })),
+    ...securityStatements(definition).map((sql2) => ({ kind: "security", sql: sql2 })),
+    // PREPARE each action's executes first (plpgsql bodies don't check columns
+    // at CREATE), then create the functions. Both reference the tables the DDL
+    // above creates, so they close the plan.
+    ...actionPrepareChecks(definition).map((sql2) => ({ kind: "function", sql: sql2 })),
+    ...actionFunctionStatements(definition).map((sql2) => ({ kind: "function", sql: sql2 }))
+  ];
+  return { namespace: definition.namespace, schema, statements, snapshot };
+}
+var compileNamespace = (definition) => planMigration({ definition });
+var previousId = (snapshot) => snapshot.id;
+function stableJson(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+  const entries = Object.entries(value).filter(([, entryValue]) => entryValue !== void 0).sort(([a], [b]) => a < b ? -1 : 1).map(([key, entryValue]) => `${JSON.stringify(key)}:${stableJson(entryValue)}`);
+  return `{${entries.join(",")}}`;
+}
+function emptyToNull(value) {
+  if (value == null) return null;
+  if (Array.isArray(value)) return value.length === 0 ? null : value;
+  if (typeof value === "object" && Object.keys(value).length === 0) return null;
+  return value;
+}
+function canonicalTable(table) {
+  return {
+    table: table.table,
+    description: table.description ?? null,
+    columns: table.columns ?? null,
+    source: table.source ?? null,
+    links: emptyToNull(table.links),
+    indexes: emptyToNull(table.indexes),
+    policies: {
+      read: table.policies?.read?.source ?? null,
+      write: table.policies?.write?.source ?? null
+    },
+    actions: emptyToNull(
+      Object.fromEntries(
+        Object.entries(table.actions ?? {}).map(([name, action]) => [
+          name,
+          {
+            description: action.description ?? null,
+            requires: action.requires?.source ?? null,
+            params: emptyToNull(action.params),
+            validates: emptyToNull(action.validates?.map((entry) => entry.source)),
+            executes: action.executes,
+            returns: emptyToNull(action.returns),
+            audit: action.audit ?? null
+          }
+        ])
+      )
+    )
+  };
+}
+function canonicalCapabilities(capabilities) {
+  const { definitions, capabilities: declared } = capabilities.roles;
+  const isEmpty = Object.keys(definitions).length === 0 && Object.keys(declared).length === 0 && capabilities.uses.length === 0;
+  if (isEmpty) return null;
+  return {
+    roles: {
+      definitions: Object.fromEntries(
+        Object.entries(definitions).map(([key, def]) => [
+          key,
+          {
+            ...def.description !== void 0 ? { description: def.description } : {},
+            default: def.default,
+            inherits: [...def.inherits].sort(),
+            grants: [...def.grants].sort()
+          }
+        ])
+      ),
+      capabilities: Object.fromEntries(
+        Object.entries(declared).map(([key, cap]) => [
+          key,
+          cap.description !== void 0 ? { description: cap.description } : {}
+        ])
+      )
+    },
+    uses: [...capabilities.uses].sort()
+  };
+}
+function canonicalizeDefinition(definition) {
+  return {
+    namespace: definition.namespace,
+    description: definition.description,
+    capabilities: canonicalCapabilities(definition.capabilities),
+    tables: definition.tables.map(canonicalTable)
+  };
+}
+function computeDefinitionHash(definition) {
+  return crypto.createHash("sha256").update(HASH_DOMAIN).update(stableJson(canonicalizeDefinition(definition))).digest("hex");
+}
+var CUSTOM_ROLE_KEY_RE = /^[a-z0-9-]+$/;
+var customRoleKeySchema = zod.z.string().min(1).max(64).regex(
+  CUSTOM_ROLE_KEY_RE,
+  "Role and capability keys must match [a-z0-9-]+"
+);
+var MAX_CUSTOM_ROLE_DEFINITIONS = 50;
+var MAX_CUSTOM_ROLE_CAPABILITIES = 100;
+var customRoleCapabilityDeclarationSchema = zod.z.object({
+  description: zod.z.string().max(500).optional()
+});
+var customRoleDefinitionSchema = zod.z.object({
+  description: zod.z.string().max(500).optional(),
+  /**
+   * Grants this role to the host's entire runtime audience. Resolved at the
+   * app layer at claim time — every caller who passes the host floor
+   * (`end_user`) holds the default roles; no tuple is written for it.
+   */
+  default: zod.z.boolean().default(false),
+  /** Role keys whose grants this role also receives (privilege waterfall). */
+  inherits: zod.z.array(customRoleKeySchema).default([]),
+  /** Capability keys this role grants directly. */
+  grants: zod.z.array(customRoleKeySchema).default([])
+});
+var customRolesBlockSchema = zod.z.object({
+  /** Roles grantable to principals, keyed by role key. */
+  definitions: zod.z.record(customRoleKeySchema, customRoleDefinitionSchema).default({}),
+  /** Leaf capability keys the host's code checks, keyed by capability key. */
+  capabilities: zod.z.record(customRoleKeySchema, customRoleCapabilityDeclarationSchema).default({})
+}).superRefine((block, ctx) => {
+  const roleKeys = Object.keys(block.definitions);
+  const capabilityKeys = new Set(Object.keys(block.capabilities));
+  if (roleKeys.length > MAX_CUSTOM_ROLE_DEFINITIONS) {
+    ctx.addIssue({
+      code: "custom",
+      message: `At most ${MAX_CUSTOM_ROLE_DEFINITIONS} role definitions are allowed`,
+      path: ["definitions"]
+    });
+  }
+  if (capabilityKeys.size > MAX_CUSTOM_ROLE_CAPABILITIES) {
+    ctx.addIssue({
+      code: "custom",
+      message: `At most ${MAX_CUSTOM_ROLE_CAPABILITIES} capabilities are allowed`,
+      path: ["capabilities"]
+    });
+  }
+  for (const key of roleKeys) {
+    if (capabilityKeys.has(key)) {
+      ctx.addIssue({
+        code: "custom",
+        message: `Key "${key}" is declared as both a role and a capability`,
+        path: ["definitions", key]
+      });
+    }
+  }
+  const roleKeySet = new Set(roleKeys);
+  for (const [roleKey, definition] of Object.entries(block.definitions)) {
+    const seenInherits = /* @__PURE__ */ new Set();
+    for (const inherited of definition.inherits) {
+      if (seenInherits.has(inherited)) {
+        ctx.addIssue({
+          code: "custom",
+          message: `Role "${roleKey}" lists "${inherited}" in inherits more than once`,
+          path: ["definitions", roleKey, "inherits"]
+        });
+      }
+      seenInherits.add(inherited);
+      if (!roleKeySet.has(inherited)) {
+        ctx.addIssue({
+          code: "custom",
+          message: `Role "${roleKey}" inherits unknown role "${inherited}"`,
+          path: ["definitions", roleKey, "inherits"]
+        });
+      }
+    }
+    const seenGrants = /* @__PURE__ */ new Set();
+    for (const granted of definition.grants) {
+      if (seenGrants.has(granted)) {
+        ctx.addIssue({
+          code: "custom",
+          message: `Role "${roleKey}" lists "${granted}" in grants more than once`,
+          path: ["definitions", roleKey, "grants"]
+        });
+      }
+      seenGrants.add(granted);
+      if (!capabilityKeys.has(granted)) {
+        ctx.addIssue({
+          code: "custom",
+          message: `Role "${roleKey}" grants unknown capability "${granted}"`,
+          path: ["definitions", roleKey, "grants"]
+        });
+      }
+    }
+  }
+  const state = /* @__PURE__ */ new Map();
+  const visit = (key, path) => {
+    if (state.get(key) === "done") return null;
+    if (state.get(key) === "visiting") return [...path, key];
+    state.set(key, "visiting");
+    const definition = block.definitions[key];
+    for (const inherited of definition?.inherits ?? []) {
+      if (!roleKeySet.has(inherited)) continue;
+      const cycle = visit(inherited, [...path, key]);
+      if (cycle) return cycle;
+    }
+    state.set(key, "done");
+    return null;
+  };
+  for (const roleKey of roleKeys) {
+    const cycle = visit(roleKey, []);
+    if (cycle) {
+      ctx.addIssue({
+        code: "custom",
+        message: `Role inheritance cycle: ${cycle.join(" -> ")}`,
+        path: ["definitions"]
+      });
+      break;
+    }
+  }
+});
+function customRolesDeclared(block) {
+  if (!block) return false;
+  return Object.keys(block.definitions).length > 0 || Object.keys(block.capabilities).length > 0;
+}
+var CUSTOM_CAPABILITY_PIN_RE = /^(?:org\/)?[a-z0-9-]+$/;
+var MAX_CAPABILITY_PINS = 100;
+var capabilityPinsSchema = zod.z.array(
+  zod.z.string().min(1).max(68).regex(
+    CUSTOM_CAPABILITY_PIN_RE,
+    'Pins must be "org/<key>" or a bare "<key>" matching [a-z0-9-]+'
+  )
+).max(MAX_CAPABILITY_PINS).default([]);
+function parseCapabilityPin(pin) {
+  return pin.startsWith("org/") ? { scope: "org", key: pin.slice("org/".length) } : { scope: "host", key: pin };
+}
+function validateCapabilityPins({
+  uses,
+  roles
+}) {
+  const errors = [];
+  const seen = /* @__PURE__ */ new Set();
+  const roleKeys = new Set(Object.keys(roles?.definitions ?? {}));
+  for (const pin of uses) {
+    if (seen.has(pin)) errors.push(`Pin "${pin}" is listed more than once`);
+    seen.add(pin);
+    const parsed = parseCapabilityPin(pin);
+    if (parsed.scope === "host" && roleKeys.has(parsed.key)) {
+      errors.push(`Pin "${pin}" references a role \u2014 roles are never pinned`);
+    }
+  }
+  return errors;
+}
+
+// src/schema/namespace.ts
+var EMPTY_CAPABILITIES = { roles: { definitions: {}, capabilities: {} }, uses: [] };
+function declaredCapabilityKeys(capabilities) {
+  return /* @__PURE__ */ new Set([...Object.keys(capabilities.roles.capabilities), ...capabilities.uses]);
+}
+function buildNamespaceDefinition(files, config) {
+  if (files.length === 0) throw new OrmDefinitionError("no table definitions found");
+  const namespace = files[0].table.namespace;
+  if (config && config.namespace !== namespace) {
+    throw new OrmDefinitionError(`namespace '${config.namespace}' conflicts with '${namespace}'`, "namespace.yaml");
+  }
+  for (const { file, table } of files) {
+    if (table.namespace !== namespace) {
+      throw new OrmDefinitionError(`namespace '${table.namespace}' conflicts with '${namespace}'`, file);
+    }
+  }
+  const seen = /* @__PURE__ */ new Map();
+  for (const { file, table } of files) {
+    const existing = seen.get(table.table);
+    if (existing) throw new OrmDefinitionError(`table '${table.table}' is already defined in ${existing}`, file);
+    seen.set(table.table, file);
+  }
+  const actionsSeen = /* @__PURE__ */ new Map();
+  for (const { file, table } of files) {
+    for (const name of Object.keys(table.actions ?? {})) {
+      const existing = actionsSeen.get(name);
+      if (existing) throw new OrmDefinitionError(`action '${name}' is already defined in ${existing}`, file);
+      actionsSeen.set(name, file);
+    }
+  }
+  const capabilities = config?.capabilities ? { roles: config.capabilities.roles ?? EMPTY_CAPABILITIES.roles, uses: config.capabilities.uses ?? [] } : EMPTY_CAPABILITIES;
+  const pinIssues = validateCapabilityPins({ uses: capabilities.uses, roles: capabilities.roles });
+  if (pinIssues.length > 0) throw new OrmDefinitionError(pinIssues.join("; "), "namespace.yaml");
+  const tables = files.map(({ table }) => table).sort((a, b) => a.table.localeCompare(b.table));
+  const byName = new Map(tables.map((table) => [table.table, table]));
+  validateLocalLinks(files, byName);
+  validateActionValidates(files, byName);
+  validateIndexNames(files);
+  validateCapabilityRefs(files, declaredCapabilityKeys(capabilities));
+  return { namespace, description: config?.description ?? null, capabilities, tables };
+}
+function validateActionValidates(files, byName) {
+  for (const { file, table } of files) {
+    for (const [actionName, action] of Object.entries(table.actions ?? {})) {
+      for (const entry of action.validates ?? []) {
+        if (entry.table.includes(".")) continue;
+        const target = byName.get(entry.table);
+        if (!target) {
+          throw new OrmDefinitionError(`action '${actionName}' validates against unknown table '${entry.table}'`, file);
+        }
+        if (target.source) {
+          throw new OrmDefinitionError(
+            `action '${actionName}' validates against synced table '${entry.table}' \u2014 synced tables can't be validates targets`,
+            file
+          );
+        }
+        const paramType = action.params?.[entry.param]?.type;
+        const targetPrimaryKey = Object.values(target.columns ?? {}).find((column) => column.primary_key);
+        if (paramType && targetPrimaryKey && columnTypeGroup(paramType) !== columnTypeGroup(targetPrimaryKey.type)) {
+          throw new OrmDefinitionError(
+            `action '${actionName}' validates '${entry.param}' (${paramType}) against '${entry.table}' whose primary key is ${targetPrimaryKey.type}`,
+            file
+          );
+        }
+      }
+    }
+  }
+}
+function validateIndexNames(files) {
+  const seen = /* @__PURE__ */ new Map();
+  const claim = (name, label, file) => {
+    const existing = seen.get(name);
+    if (existing) {
+      throw new OrmDefinitionError(`relation name '${name}' (${label}) collides with ${existing}`, file);
+    }
+    seen.set(name, `${label} (${file})`);
+  };
+  for (const { file, table } of files) {
+    claim(table.table, `table '${table.table}'`, file);
+  }
+  for (const { file, table } of files) {
+    if (table.source) continue;
+    claim(`${table.table}_pkey`, `implicit primary-key index of '${table.table}'`, file);
+    for (const [name, column] of Object.entries(table.columns ?? {})) {
+      if (column.unique && !column.primary_key) {
+        claim(`${table.table}_${name}_unique`, `implicit unique constraint of '${table.table}.${name}'`, file);
+      }
+    }
+  }
+  for (const { file, table } of files) {
+    for (const definition of table.indexes ?? []) {
+      claim(indexName(table.table, definition), `index on '${table.table}'`, file);
+    }
+  }
+}
+function validateLocalLinks(files, byName) {
+  for (const { file, table } of files) {
+    for (const [name, link] of Object.entries(table.links ?? {})) {
+      if (isQualifiedReference(link.to)) continue;
+      const target = byName.get(link.to);
+      if (!target) {
+        throw new OrmDefinitionError(`link '${name}' references unknown table '${link.to}'`, file);
+      }
+      if (link.enforce && target.source) {
+        throw new OrmDefinitionError(`link '${name}' cannot enforce a foreign key onto a synced table`, file);
+      }
+      const sourceType = table.columns?.[link.on]?.type;
+      const targetPrimaryKey = Object.values(target.columns ?? {}).find((column) => column.primary_key);
+      if (sourceType && targetPrimaryKey && columnTypeGroup(sourceType) !== columnTypeGroup(targetPrimaryKey.type)) {
+        throw new OrmDefinitionError(
+          `link '${name}' can never join: '${link.on}' is ${sourceType} but '${link.to}' has a ${targetPrimaryKey.type} primary key`,
+          file
+        );
+      }
+    }
+  }
+}
+function validateCapabilityRefs(files, declared) {
+  for (const { file, table } of files) {
+    const referenced = [
+      ...table.policies?.read ? referencedCapabilities(table.policies.read.ast) : [],
+      ...table.policies?.write ? referencedCapabilities(table.policies.write.ast) : [],
+      ...Object.values(table.actions ?? {}).flatMap((action) => [
+        ...action.requires ? referencedCapabilities(action.requires.ast) : [],
+        ...referencedExecuteCapabilities(action)
+      ])
+    ];
+    for (const key of referenced) {
+      if (!declared.has(key)) {
+        throw new OrmDefinitionError(
+          `capability('${key}') is not declared \u2014 add it under capabilities.roles.capabilities or capabilities.uses in namespace.yaml`,
+          file
+        );
+      }
+    }
+  }
+}
+var namespaceConfigSchema = zod.z.strictObject({
+  namespace: namespaceSchema,
+  description: zod.z.string().optional(),
+  capabilities: zod.z.strictObject({
+    roles: customRolesBlockSchema.optional(),
+    uses: capabilityPinsSchema.optional()
+  }).optional()
+});
+
+// src/loader.ts
+function parseTableFile(file, contents) {
+  const parsed = tableFileSchema.safeParse(parseYaml(file, contents));
+  if (!parsed.success) throw new OrmDefinitionError(formatIssues(parsed.error), file);
+  return { file, table: parsed.data };
+}
+function parseDefinitionSources(sources) {
+  let config;
+  const tables = [];
+  for (const source of sources) {
+    if (NAMESPACE_CONFIG_FILENAMES.has(source.path)) {
+      if (config) throw new OrmDefinitionError("duplicate namespace config file", source.path);
+      const parsed = namespaceConfigSchema.safeParse(parseYaml(source.path, source.contents));
+      if (!parsed.success) throw new OrmDefinitionError(formatIssues(parsed.error), source.path);
+      config = parsed.data;
+      continue;
+    }
+    tables.push(parseTableFile(source.path, source.contents));
+  }
+  return buildNamespaceDefinition(tables, config);
+}
+async function loadNamespaceDefinition(dir) {
+  const files = await listDefinitionFiles(dir);
+  if (files.length === 0) throw new OrmDefinitionError(`no ${DEFINITION_FILE_EXTENSIONS.join("/")} files in ${dir}`);
+  const sources = [];
+  for (const file of files) {
+    const contents = await promises.readFile(path.join(dir, file), "utf8");
+    if (Buffer.byteLength(contents, "utf8") > MAX_DEFINITION_FILE_BYTES) {
+      throw new OrmDefinitionError(`exceeds the maximum definition file size of ${MAX_DEFINITION_FILE_BYTES} bytes`, file);
+    }
+    sources.push({ path: file, contents });
+  }
+  const definition = parseDefinitionSources(sources);
+  return { definition, contentHash: computeDefinitionHash(definition), files };
+}
+function parseYaml(file, contents) {
+  try {
+    return jsYaml.load(contents);
+  } catch (error) {
+    throw new OrmDefinitionError(error instanceof Error ? error.message : "invalid YAML", file);
+  }
+}
+var isDefinitionFile = (name) => DEFINITION_FILE_EXTENSIONS.some((extension) => path.extname(name) === extension);
+async function listDefinitionFiles(dir) {
+  const entries = await promises.readdir(dir, { withFileTypes: true });
+  return entries.filter((entry) => entry.isFile() && isDefinitionFile(entry.name)).map((entry) => entry.name).sort();
+}
+function formatIssues(error) {
+  return error.issues.map((issue) => issue.path.length > 0 ? `${issue.path.join(".")}: ${issue.message}` : issue.message).join("; ");
+}
+
+// src/migrations/classify.ts
+var TYPE_CHANGE = /\bALTER\s+COLUMN\s+"?[a-z_][a-z0-9_]*"?\s+(?:SET\s+DATA\s+)?TYPE\b/i;
+var RULES = [
+  { pattern: /^\s*DROP\s+SCHEMA\b/i, reason: "drops the namespace schema and everything in it" },
+  { pattern: /^\s*DROP\s+TABLE\b/i, reason: "drops a table and all of its rows" },
+  { pattern: /^\s*TRUNCATE\b/i, reason: "deletes every row" },
+  { pattern: /\bDROP\s+COLUMN\b/i, reason: "drops a column and its data" },
+  {
+    pattern: TYPE_CHANGE,
+    reason: "changes a column type without a declared cast (add `cast: '<column>::<type>'` to make the conversion explicit)"
+  }
+];
+function classifyDestructive(statements) {
+  const flagged = [];
+  for (const statement of statements) {
+    if (statement.kind === "ddl") {
+      const rule = RULES.find(({ pattern }) => pattern.test(statement.sql));
+      if (rule) flagged.push({ sql: statement.sql, reason: rule.reason });
+    } else if (statement.kind === "hint" && TYPE_CHANGE.test(statement.sql)) {
+      flagged.push({ sql: statement.sql, reason: "a declared cast changes a column type and can lose data (numeric\u2192integer rounds, a narrowing cast truncates)" });
+    }
+  }
+  return flagged;
+}
+var MIGRATIONS_DIRNAME = "migrations";
+var META_DIRNAME = "meta";
+var JOURNAL_FILENAME = "journal.json";
+var journalEntrySchema = zod.z.object({
+  ordinal: zod.z.number().int().positive(),
+  name: zod.z.string().min(1),
+  content_hash: zod.z.string().length(64),
+  /** Definitions hash the migration was diffed FROM — null on the first. Replay checks an environment sits at this base. */
+  previous_content_hash: zod.z.string().length(64).nullable(),
+  checksum: zod.z.string().length(64),
+  /** sha256 of the snapshot FILE — the next diff builds on this snapshot, so a hand-edit must fail `--check` too. */
+  snapshot_checksum: zod.z.string().length(64),
+  destructive: zod.z.boolean()
+});
+var journalSchema = zod.z.object({
+  version: zod.z.literal(1),
+  namespace: zod.z.string().min(1),
+  entries: zod.z.array(journalEntrySchema)
+});
+var emptyJournal = (namespace) => ({ version: 1, namespace, entries: [] });
+async function readMigrationWorkspace(dir, namespace) {
+  const journalPath = path.join(dir, MIGRATIONS_DIRNAME, META_DIRNAME, JOURNAL_FILENAME);
+  const raw = await promises.readFile(journalPath, "utf8").catch(() => null);
+  if (raw === null) return { journal: emptyJournal(namespace), tipSnapshot: void 0 };
+  const parsed = journalSchema.safeParse(parseJson(journalPath, raw));
+  if (!parsed.success) {
+    throw new OrmDefinitionError(`invalid migration journal: ${parsed.error.issues[0]?.message ?? "unreadable"}`, journalPath);
+  }
+  if (parsed.data.namespace !== namespace) {
+    throw new OrmDefinitionError(
+      `migration journal belongs to namespace '${parsed.data.namespace}', definitions are '${namespace}'`,
+      journalPath
+    );
+  }
+  parsed.data.entries.forEach((entry, index2) => {
+    if (entry.ordinal !== index2 + 1) {
+      throw new OrmDefinitionError(`migration journal entries must be contiguous from 1 (found ${entry.name})`, journalPath);
+    }
+  });
+  const tip = parsed.data.entries.at(-1);
+  return { journal: parsed.data, tipSnapshot: tip ? await readSnapshot(dir, tip.ordinal) : void 0 };
+}
+async function readSnapshotText(dir, ordinal) {
+  const path$1 = path.join(dir, MIGRATIONS_DIRNAME, META_DIRNAME, `${pad(ordinal)}.snapshot.json`);
+  return promises.readFile(path$1, "utf8").catch(() => {
+    throw new OrmDefinitionError("missing migration snapshot", path$1);
+  });
+}
+async function readSnapshot(dir, ordinal) {
+  const path$1 = path.join(dir, MIGRATIONS_DIRNAME, META_DIRNAME, `${pad(ordinal)}.snapshot.json`);
+  return parseJson(path$1, await readSnapshotText(dir, ordinal));
+}
+async function readMigrationSql(dir, entry) {
+  const path$1 = path.join(dir, MIGRATIONS_DIRNAME, `${entry.name}.sql`);
+  return promises.readFile(path$1, "utf8").catch(() => {
+    throw new OrmDefinitionError("missing migration file", path$1);
+  });
+}
+var checksumOf = (text2) => crypto.createHash("sha256").update(text2).digest("hex");
+var migrationName = (ordinal, contentHash) => `${pad(ordinal)}_${contentHash.slice(0, 12)}`;
+function renderMigrationSql({
+  name,
+  namespace,
+  contentHash,
+  plan
+}) {
+  const header = [
+    `-- ${name}`,
+    `-- namespace: ${namespace}`,
+    `-- content hash: ${contentHash}`,
+    "-- generated by `seq-studio orm diff` \u2014 review and commit, do not edit"
+  ].join("\n");
+  return [header, ...plan.statements.map((statement) => `${statement.sql};`)].join("\n\n") + "\n";
+}
+async function writeMigration({
+  dir,
+  workspace,
+  plan,
+  contentHash,
+  destructive
+}) {
+  const tip = workspace.journal.entries.at(-1);
+  const ordinal = (tip?.ordinal ?? 0) + 1;
+  const name = migrationName(ordinal, contentHash);
+  const sql2 = renderMigrationSql({ name, namespace: workspace.journal.namespace, contentHash, plan });
+  const metaDir = path.join(dir, MIGRATIONS_DIRNAME, META_DIRNAME);
+  await promises.mkdir(metaDir, { recursive: true });
+  const snapshotText = `${JSON.stringify(plan.snapshot, null, 2)}
+`;
+  await promises.writeFile(path.join(dir, MIGRATIONS_DIRNAME, `${name}.sql`), sql2);
+  await promises.writeFile(path.join(metaDir, `${pad(ordinal)}.snapshot.json`), snapshotText);
+  const journal = {
+    ...workspace.journal,
+    entries: [
+      ...workspace.journal.entries,
+      {
+        ordinal,
+        name,
+        content_hash: contentHash,
+        previous_content_hash: tip?.content_hash ?? null,
+        checksum: checksumOf(sql2),
+        snapshot_checksum: checksumOf(snapshotText),
+        destructive
+      }
+    ]
+  };
+  await promises.writeFile(path.join(metaDir, JOURNAL_FILENAME), `${JSON.stringify(journal, null, 2)}
+`);
+  return { name, ordinal, destructive };
+}
+var pad = (ordinal) => String(ordinal).padStart(4, "0");
+function parseJson(path, raw) {
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw new OrmDefinitionError("not valid JSON", path);
+  }
+}
+
+// src/migrations/committed.ts
+async function loadCommittedTipMigration(dir, loaded) {
+  const workspace = await readMigrationWorkspace(dir, loaded.definition.namespace);
+  const tip = workspace.journal.entries.at(-1);
+  if (!tip) return null;
+  if (tip.content_hash !== loaded.contentHash) {
+    throw new OrmDefinitionError(
+      `definitions changed since ${tip.name} \u2014 run \`seq-studio orm diff\` and commit the new migration`,
+      `${MIGRATIONS_DIRNAME}/meta/journal.json`
+    );
+  }
+  const previousSnapshot = tip.ordinal > 1 ? await readSnapshot(dir, tip.ordinal - 1) : void 0;
+  const plan = await planMigration({ definition: loaded.definition, previousSnapshot });
+  const regenerated = renderMigrationSql({
+    name: tip.name,
+    namespace: loaded.definition.namespace,
+    contentHash: loaded.contentHash,
+    plan
+  });
+  if (regenerated !== await readMigrationSql(dir, tip)) {
+    throw new OrmDefinitionError(
+      `${tip.name}.sql does not regenerate from the definitions \u2014 run \`seq-studio orm diff --check\``,
+      MIGRATIONS_DIRNAME
+    );
+  }
+  return {
+    name: tip.name,
+    ordinal: tip.ordinal,
+    previous_content_hash: tip.previous_content_hash,
+    destructive: tip.destructive,
+    checksum: tip.checksum,
+    statements: plan.statements
+  };
+}
+async function loadCommittedMigrations(dir, loaded) {
+  const workspace = await readMigrationWorkspace(dir, loaded.definition.namespace);
+  const entries = workspace.journal.entries;
+  const tip = entries.at(-1);
+  if (!tip) return [];
+  if (tip.content_hash !== loaded.contentHash) {
+    throw new OrmDefinitionError(
+      `definitions changed since ${tip.name} \u2014 run \`seq-studio orm diff\` and commit the new migration`,
+      `${MIGRATIONS_DIRNAME}/meta/journal.json`
+    );
+  }
+  return entries.map((entry) => ({
+    name: entry.name,
+    contentHash: entry.content_hash,
+    previousContentHash: entry.previous_content_hash
+  }));
+}
+
+// src/migrations/diff.ts
+async function diffCommand({ dir, allowDestructive, check, log }) {
+  const loaded = await loadNamespaceDefinition(dir);
+  const workspace = await readMigrationWorkspace(dir, loaded.definition.namespace);
+  const tip = workspace.journal.entries.at(-1);
+  if (check) return checkWorkspace({ dir, loaded, workspace, tip, log });
+  if (tip?.content_hash === loaded.contentHash) {
+    log(`no changes \u2014 ${MIGRATIONS_DIRNAME}/${tip.name}.sql already matches the definitions`);
+    return 0;
+  }
+  const plan = await planMigration({ definition: loaded.definition, previousSnapshot: workspace.tipSnapshot });
+  const destructive = classifyDestructive(plan.statements);
+  if (destructive.length > 0 && !allowDestructive) {
+    log("destructive migration blocked \u2014 these statements lose data:");
+    for (const statement of destructive) log(`  ${firstLine(statement.sql)}  -- ${statement.reason}`);
+    log("retire columns in two phases (`deprecated: true` first, drop later), declare type changes as `cast:`, or re-run with --allow-destructive to consent");
+    return 1;
+  }
+  const written = await writeMigration({
+    dir,
+    workspace,
+    plan,
+    contentHash: loaded.contentHash,
+    destructive: destructive.length > 0
+  });
+  log(
+    `wrote ${MIGRATIONS_DIRNAME}/${written.name}.sql \u2014 ${plan.statements.length} statement(s)` + (written.destructive ? " (DESTRUCTIVE \u2014 consented via --allow-destructive)" : "")
+  );
+  return 0;
+}
+async function checkWorkspace({
+  dir,
+  loaded,
+  workspace,
+  tip,
+  log
+}) {
+  if (!tip) {
+    log(`no committed migrations for '${loaded.definition.namespace}' \u2014 run \`seq-studio orm diff\` and commit the result`);
+    return 1;
+  }
+  let previousId2;
+  let previousHash = null;
+  for (const entry of workspace.journal.entries) {
+    const sql2 = await readMigrationSql(dir, entry);
+    if (checksumOf(sql2) !== entry.checksum) {
+      log(`${MIGRATIONS_DIRNAME}/${entry.name}.sql does not match its journal checksum \u2014 committed migrations must not be edited`);
+      return 1;
+    }
+    const snapshotText = await readSnapshotText(dir, entry.ordinal);
+    if (checksumOf(snapshotText) !== entry.snapshot_checksum) {
+      log(`the snapshot for ${entry.name} does not match its journal checksum \u2014 committed snapshots must not be edited (the next diff builds on it)`);
+      return 1;
+    }
+    const snapshot = JSON.parse(snapshotText);
+    if (entry.ordinal > 1 && snapshot.prevId !== previousId2) {
+      log(`snapshot chain broken at ${entry.name} \u2014 regenerate the workspace with \`seq-studio orm diff\``);
+      return 1;
+    }
+    if (entry.previous_content_hash !== previousHash) {
+      log(`content-hash chain broken at ${entry.name} \u2014 migrations must be appended in order by \`seq-studio orm diff\``);
+      return 1;
+    }
+    previousId2 = snapshot.id;
+    previousHash = entry.content_hash;
+  }
+  if (tip.content_hash !== loaded.contentHash) {
+    log(`definitions changed since ${tip.name} \u2014 run \`seq-studio orm diff\` and commit the new migration`);
+    return 1;
+  }
+  const previousSnapshot = tip.ordinal > 1 ? await readSnapshot(dir, tip.ordinal - 1) : void 0;
+  const plan = await planMigration({ definition: loaded.definition, previousSnapshot });
+  const regenerated = renderMigrationSql({
+    name: tip.name,
+    namespace: loaded.definition.namespace,
+    contentHash: loaded.contentHash,
+    plan
+  });
+  if (regenerated !== await readMigrationSql(dir, tip)) {
+    log(`${MIGRATIONS_DIRNAME}/${tip.name}.sql does not regenerate from the definitions \u2014 re-run \`seq-studio orm diff\``);
+    return 1;
+  }
+  log(`migrations in sync \u2014 ${workspace.journal.entries.length} committed, tip ${tip.name}`);
+  return 0;
+}
+var firstLine = (sql2) => sql2.split("\n")[0] ?? sql2;
+
+// src/schema/canonical.ts
+function parseCanonicalDefinition(value) {
+  const canonical = asCanonicalShape(value);
+  const files = canonical.tables.map((table, index2) => {
+    const input = {
+      namespace: canonical.namespace,
+      table: table["table"],
+      description: table["description"] ?? void 0,
+      columns: table["columns"] ?? void 0,
+      source: table["source"] ?? void 0,
+      links: table["links"] ?? void 0,
+      indexes: table["indexes"] ?? void 0,
+      policies: canonicalPolicies(table["policies"]),
+      actions: canonicalActions(table["actions"])
+    };
+    const parsed = tableFileSchema.safeParse(input);
+    if (!parsed.success) {
+      const issue = parsed.error.issues[0];
+      throw new OrmDefinitionError(
+        `stored definition for table ${String(table["table"])} is invalid: ${issue?.message ?? "unknown issue"}`,
+        `canonical[${index2}]`
+      );
+    }
+    return { file: `canonical[${index2}]`, table: parsed.data };
+  });
+  const config = namespaceConfigSchema.safeParse({
+    namespace: canonical.namespace,
+    description: canonical.description ?? void 0,
+    capabilities: canonical.capabilities ?? void 0
+  });
+  if (!config.success) {
+    const issue = config.error.issues[0];
+    throw new OrmDefinitionError(`stored namespace config is invalid: ${issue?.message ?? "unknown issue"}`, "canonical");
+  }
+  return buildNamespaceDefinition(files, config.data);
+}
+function asCanonicalShape(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new OrmDefinitionError("stored definition is not an object");
+  }
+  const record = value;
+  if (typeof record["namespace"] !== "string" || !Array.isArray(record["tables"])) {
+    throw new OrmDefinitionError("stored definition is missing namespace/tables");
+  }
+  return {
+    namespace: record["namespace"],
+    // Pre-capabilities rows lack both fields — rehydrate as unset.
+    description: typeof record["description"] === "string" ? record["description"] : null,
+    capabilities: record["capabilities"] ?? void 0,
+    tables: record["tables"]
+  };
+}
+function canonicalPolicies(value) {
+  if (value === null || typeof value !== "object") return void 0;
+  const record = value;
+  const policies = {};
+  if (typeof record["read"] === "string") policies["read"] = record["read"];
+  if (typeof record["write"] === "string") policies["write"] = record["write"];
+  return Object.keys(policies).length > 0 ? policies : void 0;
+}
+function canonicalActions(value) {
+  if (value === null || typeof value !== "object") return void 0;
+  const entries = Object.entries(value);
+  if (entries.length === 0) return void 0;
+  return Object.fromEntries(
+    entries.map(([name, action]) => [
+      name,
+      {
+        description: action["description"] ?? void 0,
+        requires: action["requires"] ?? void 0,
+        params: action["params"] ?? void 0,
+        validates: action["validates"] ?? void 0,
+        executes: action["executes"],
+        returns: action["returns"] ?? void 0,
+        audit: action["audit"] ?? void 0
+      }
+    ])
+  );
+}
+
+exports.ACTION_REQUIRES_DENIED_SQLSTATE = ACTION_REQUIRES_DENIED_SQLSTATE;
+exports.ACTION_VALIDATES_FAILED_SQLSTATE = ACTION_VALIDATES_FAILED_SQLSTATE;
+exports.AUDIT_ACTIONS = AUDIT_ACTIONS;
+exports.CAPABILITIES_CLAIM_KEY = CAPABILITIES_CLAIM_KEY;
+exports.CAPABILITY_KEY_PATTERN = CAPABILITY_KEY_PATTERN;
+exports.CLAIMS_SETTING = CLAIMS_SETTING;
+exports.CLAIM_KEY_PATTERN = CLAIM_KEY_PATTERN;
+exports.COLUMN_TYPES = COLUMN_TYPES;
+exports.COMPARE_OPS = COMPARE_OPS;
+exports.CONSUMER_ROLE_SUFFIX = CONSUMER_ROLE_SUFFIX;
+exports.DEFINITION_FILE_EXTENSIONS = DEFINITION_FILE_EXTENSIONS;
+exports.HASH_DOMAIN = HASH_DOMAIN;
+exports.IDENTIFIER_PATTERN = IDENTIFIER_PATTERN;
+exports.MAX_DEFINITION_FILE_BYTES = MAX_DEFINITION_FILE_BYTES;
+exports.MAX_IDENTIFIER_LENGTH = MAX_IDENTIFIER_LENGTH;
+exports.MIGRATIONS_DIRNAME = MIGRATIONS_DIRNAME;
+exports.NAMESPACE_CONFIG_FILENAMES = NAMESPACE_CONFIG_FILENAMES;
+exports.NAMESPACE_PATTERN = NAMESPACE_PATTERN;
+exports.ORM_DATA_TOKEN_HEADER = ORM_DATA_TOKEN_HEADER;
+exports.ORM_SCHEMA_PREFIX = ORM_SCHEMA_PREFIX;
+exports.ORM_SERVICE_DATA_TOKEN_HEADER = ORM_SERVICE_DATA_TOKEN_HEADER;
+exports.OrmDefinitionError = OrmDefinitionError;
+exports.PredicateParseError = PredicateParseError;
+exports.QUALIFIED_TABLE_PATTERN = QUALIFIED_TABLE_PATTERN;
+exports.RESERVED_COLUMN_NAMES = RESERVED_COLUMN_NAMES;
+exports.RESERVED_TABLE_NAMES = RESERVED_TABLE_NAMES;
+exports.STATEMENT_KINDS = STATEMENT_KINDS;
+exports.SYNCED_SOURCE_PATTERN = SYNCED_SOURCE_PATTERN;
+exports.actionFunctionName = actionFunctionName;
+exports.actionFunctionStatements = actionFunctionStatements;
+exports.actionParamArg = actionParamArg;
+exports.actionParamOrder = actionParamOrder;
+exports.actionParamSchema = actionParamSchema;
+exports.actionPrepareChecks = actionPrepareChecks;
+exports.actionSchema = actionSchema;
+exports.actionsInterfaceName = actionsInterfaceName;
+exports.applyMigrationHints = applyMigrationHints;
+exports.buildActionParamsSchema = buildActionParamsSchema;
+exports.buildDrizzleEntities = buildDrizzleEntities;
+exports.buildNamespaceDefinition = buildNamespaceDefinition;
+exports.canonicalizeDefinition = canonicalizeDefinition;
+exports.capabilityExpression = capabilityExpression;
+exports.capabilityPinsSchema = capabilityPinsSchema;
+exports.castParts = castParts;
+exports.checksumOf = checksumOf;
+exports.claimExpression = claimExpression;
+exports.classifyDestructive = classifyDestructive;
+exports.columnSchema = columnSchema;
+exports.columnTypeSchema = columnTypeSchema;
+exports.compileActionRequires = compileActionRequires;
+exports.compileActionStatements = compileActionStatements;
+exports.compileNamespace = compileNamespace;
+exports.compilePredicate = compilePredicate;
+exports.computeDefinitionHash = computeDefinitionHash;
+exports.consumerRoleName = consumerRoleName;
+exports.customRolesBlockSchema = customRolesBlockSchema;
+exports.customRolesDeclared = customRolesDeclared;
+exports.declaredCapabilityKeys = declaredCapabilityKeys;
+exports.diffCommand = diffCommand;
+exports.diffStatements = diffStatements;
+exports.emptyJournal = emptyJournal;
+exports.emptySnapshot = emptySnapshot;
+exports.extractNamedParams = extractNamedParams;
+exports.generateNamespaceTypes = generateNamespaceTypes;
+exports.generateSnapshot = generateSnapshot;
+exports.identifierSchema = identifierSchema;
+exports.isFunctionDefault = isFunctionDefault;
+exports.isOwnedStatement = isOwnedStatement;
+exports.isQualifiedReference = isQualifiedReference;
+exports.loadCommittedMigrations = loadCommittedMigrations;
+exports.loadCommittedTipMigration = loadCommittedTipMigration;
+exports.loadNamespaceDefinition = loadNamespaceDefinition;
+exports.migrationName = migrationName;
+exports.namespaceConfigSchema = namespaceConfigSchema;
+exports.namespaceSchema = namespaceSchema;
+exports.normalizeSnapshot = normalizeSnapshot;
+exports.ormSchemaName = ormSchemaName;
+exports.parseCanonicalDefinition = parseCanonicalDefinition;
+exports.parseCapabilityPin = parseCapabilityPin;
+exports.parseDefinitionSources = parseDefinitionSources;
+exports.parsePredicate = parsePredicate;
+exports.parseTableFile = parseTableFile;
+exports.parsedPredicateSchema = parsedPredicateSchema;
+exports.pendingKitStatements = pendingKitStatements;
+exports.planMigration = planMigration;
+exports.predicateOperands = predicateOperands;
+exports.quoteIdentifier = quoteIdentifier;
+exports.quoteLiteral = quoteLiteral;
+exports.readMigrationSql = readMigrationSql;
+exports.readMigrationWorkspace = readMigrationWorkspace;
+exports.readSnapshot = readSnapshot;
+exports.referencedCapabilities = referencedCapabilities;
+exports.referencedColumns = referencedColumns;
+exports.renderMigrationSql = renderMigrationSql;
+exports.securityStatements = securityStatements;
+exports.sqlTypeName = sqlTypeName;
+exports.stableJson = stableJson;
+exports.tableFileSchema = tableFileSchema;
+exports.tableReferenceSchema = tableReferenceSchema;
+exports.typesInterfaceName = typesInterfaceName;
+exports.validateCapabilityPins = validateCapabilityPins;
+exports.walkPredicate = walkPredicate;
+exports.writeMigration = writeMigration;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map