@sequenceholdings/orm 0.1.1 → 0.1.3

package/dist/index.js

@@ -1,11 +1,2031 @@
+import { sql, eq, notExists } from 'drizzle-orm';
+import { pgSchema, uniqueIndex, index, foreignKey, primaryKey, PgDialect, QueryBuilder, getViewConfig, extractUsedTable, jsonb, date, timestamp, boolean, doublePrecision, numeric, bigint, integer, text, uuid } from 'drizzle-orm/pg-core';
+import { createHash } from 'crypto';
 import { z } from 'zod';
+import { createJiti } from 'jiti';
+import { realpath, stat, readdir, readFile, mkdir, writeFile } from 'fs/promises';
+import { createRequire } from 'module';
+import { join, sep, extname } from 'path';
 import { generateDrizzleJson, upPgSnapshot, generateMigration, pushSchema } from 'drizzle-kit/api';
-import { pgSchema, uniqueIndex, index, foreignKey, jsonb, date, timestamp, boolean, doublePrecision, numeric, bigint, integer, text, uuid } from 'drizzle-orm/pg-core';
-import { sql } from 'drizzle-orm';
-import { createHash } from 'crypto';
-import { readFile, readdir, mkdir, writeFile } from 'fs/promises';
-import { join, extname } from 'path';
 import { load } from 'js-yaml';
+import { capabilityPinsSchema, customRolesBlockSchema, validateCapabilityPins } from '@sequenceholdings/custom-roles-manifest';
+export { capabilityPinsSchema, customRolesBlockSchema, customRolesDeclared, parseCapabilityPin, validateCapabilityPins } from '@sequenceholdings/custom-roles-manifest';
+
+// src/authoring/columns.ts
+var COLUMN_BRAND = "seq-column";
+var ENUM_BRAND = "seq-enum";
+function isEnumRef(value) {
+  return typeof value === "object" && value !== null && value.kind === ENUM_BRAND;
+}
+var COLUMN_DEFAULT_FNS = ["gen_random_uuid()", "now()"];
+function deriveColumnName(propertyName) {
+  return propertyName.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1_$2").toLowerCase();
+}
+var ColumnBuilder = class {
+  kind = COLUMN_BRAND;
+  state;
+  constructor(type, columnName) {
+    this.state = {
+      type,
+      columnName,
+      primaryKey: false,
+      notNull: false,
+      unique: false,
+      hasDefault: false,
+      defaultValue: void 0,
+      defaultFn: void 0,
+      description: void 0,
+      renamedFrom: void 0,
+      cast: void 0,
+      deprecated: false
+    };
+  }
+  /** Marks this column as (part of) the primary key. Implies NOT NULL. */
+  primaryKey() {
+    this.state.primaryKey = true;
+    return this;
+  }
+  notNull() {
+    this.state.notNull = true;
+    return this;
+  }
+  unique() {
+    this.state.unique = true;
+    return this;
+  }
+  /**
+   * Column default: a literal, or one of the allowlisted SQL functions
+   * (`'gen_random_uuid()'` / `'now()'`), which serialize as `defaultFn`.
+   */
+  default(value) {
+    if (value === "gen_random_uuid()" || value === "now()") {
+      this.state.defaultFn = value;
+      this.state.hasDefault = false;
+      this.state.defaultValue = void 0;
+      return this;
+    }
+    this.state.hasDefault = true;
+    this.state.defaultValue = value;
+    this.state.defaultFn = void 0;
+    return this;
+  }
+  description(text4) {
+    this.state.description = text4;
+    return this;
+  }
+  /** Migration rename hint: the previous Postgres column name. */
+  renamedFrom(previousColumnName) {
+    this.state.renamedFrom = previousColumnName;
+    return this;
+  }
+  /** Migration cast hint: the `USING` SQL applied when this column changes type. */
+  cast(usingSql) {
+    this.state.cast = usingSql;
+    return this;
+  }
+  /** Emits `@deprecated` in the generated SDL; the column stays queryable. */
+  deprecated() {
+    this.state.deprecated = true;
+    return this;
+  }
+  /** Whether `.primaryKey()` was called — collected into the table-level PK. */
+  get isPrimaryKey() {
+    return this.state.primaryKey;
+  }
+  /** The enum name when this is an enum column, else undefined. */
+  get enumName() {
+    return typeof this.state.type === "object" ? this.state.type.enum : void 0;
+  }
+  /** Postgres column name: explicit override, else snake_case of the property name. */
+  columnNameFor(propertyName) {
+    return this.state.columnName ?? deriveColumnName(propertyName);
+  }
+  /** Serialize to a canonical v2 column. Validation happens in serializeNamespace. */
+  toCanonicalColumn(propertyName) {
+    const column = {
+      name: propertyName,
+      columnName: this.columnNameFor(propertyName),
+      type: typeof this.state.type === "object" ? { enum: this.state.type.enum } : this.state.type,
+      nullable: !(this.state.notNull || this.state.primaryKey),
+      unique: this.state.unique,
+      deprecated: this.state.deprecated
+    };
+    if (this.state.hasDefault) column.default = this.state.defaultValue ?? null;
+    if (this.state.defaultFn !== void 0) column.defaultFn = this.state.defaultFn;
+    if (this.state.description !== void 0) column.description = this.state.description;
+    if (this.state.renamedFrom !== void 0) column.renamedFrom = this.state.renamedFrom;
+    if (this.state.cast !== void 0) column.cast = this.state.cast;
+    return column;
+  }
+};
+function isColumnBuilder(value) {
+  return typeof value === "object" && value !== null && value.kind === COLUMN_BRAND;
+}
+var scalar = (type) => (columnName) => new ColumnBuilder(type, columnName);
+var t = {
+  uuid: scalar("uuid"),
+  text: scalar("text"),
+  integer: scalar("integer"),
+  bigint: scalar("bigint"),
+  numeric: scalar("numeric"),
+  double: scalar("double"),
+  boolean: scalar("boolean"),
+  timestamptz: scalar("timestamptz"),
+  date: scalar("date"),
+  jsonb: scalar("jsonb"),
+  enum: (ref, columnName) => new ColumnBuilder({ enum: ref.name }, columnName)
+};
+
+// src/constants.ts
+var NAMESPACE_PATTERN = /^[a-z][a-z0-9_]{0,40}$/;
+var IDENTIFIER_PATTERN = /^[a-z][a-z0-9_]*$/;
+var MAX_IDENTIFIER_LENGTH = 63;
+var ORM_DATA_TOKEN_HEADER = "x-sequence-data-token";
+var ORM_SERVICE_DATA_TOKEN_HEADER = "x-sequence-data-token-service";
+var CAPABILITY_KEY_PATTERN = /^(?:org\/)?[a-z0-9-]{1,64}$/;
+var CLAIM_KEY_PATTERN = /^[a-z][a-z0-9_]*$/;
+var QUALIFIED_TABLE_PATTERN = /^[a-z][a-z0-9_]*\.[a-z][a-z0-9_]*$/;
+var SYNCED_SOURCE_PATTERN = /^gold\.[a-z][a-z0-9_]*$/;
+var ORM_SCHEMA_PREFIX = "orm_";
+var CONSUMER_ROLE_SUFFIX = "_consumer";
+var ormSchemaName = (namespace) => `${ORM_SCHEMA_PREFIX}${namespace}`;
+var consumerRoleName = (namespace) => `${ORM_SCHEMA_PREFIX}${namespace}${CONSUMER_ROLE_SUFFIX}`;
+var DEFINITION_FILE_EXTENSIONS = [".yml", ".yaml"];
+var NAMESPACE_CONFIG_FILENAMES = /* @__PURE__ */ new Set(["namespace.yaml", "namespace.yml"]);
+var HASH_DOMAIN = "sequence-orm-definitions\0";
+var MAX_DEFINITION_FILE_BYTES = 1024 * 1024;
+var RESERVED_TABLE_NAMES = /* @__PURE__ */ new Set(["actions", "query"]);
+var RESERVED_COLUMN_NAMES = /* @__PURE__ */ new Set(["select", "order", "limit", "offset"]);
+
+// src/errors.ts
+var OrmDefinitionError = class extends Error {
+  constructor(message, file) {
+    super(file ? `${file}: ${message}` : message);
+    this.file = file;
+  }
+  name = "OrmDefinitionError";
+};
+var PredicateParseError = class extends Error {
+  constructor(message, position) {
+    super(`${message} (at position ${position})`);
+    this.position = position;
+  }
+  name = "PredicateParseError";
+};
+
+// src/authoring/registry.ts
+var CONTEXT_STACK_KEY = Symbol.for("sequence.orm.authoring.context-stack.v2");
+function contextStack() {
+  const holder = globalThis;
+  const existing = holder[CONTEXT_STACK_KEY];
+  if (Array.isArray(existing)) {
+    return existing;
+  }
+  const created = [];
+  holder[CONTEXT_STACK_KEY] = created;
+  return created;
+}
+function beginAuthoringContext() {
+  const context = { currentFile: void 0, tables: [], views: [], enums: [], configs: [] };
+  contextStack().push(context);
+  return context;
+}
+function endAuthoringContext(context) {
+  const stack = contextStack();
+  const top = stack[stack.length - 1];
+  if (top !== context) {
+    throw new Error("endAuthoringContext: the given context is not the active one \u2014 begin/end calls are mismatched");
+  }
+  stack.pop();
+}
+function activeAuthoringContext() {
+  const stack = contextStack();
+  return stack[stack.length - 1];
+}
+function register(bucket, value) {
+  const context = activeAuthoringContext();
+  if (!context) return;
+  context[bucket].push({ value, file: context.currentFile });
+}
+function registerTable(value) {
+  register("tables", value);
+}
+function registerView(value) {
+  register("views", value);
+}
+function registerEnum(value) {
+  register("enums", value);
+}
+function registerNamespaceConfig(value) {
+  register("configs", value);
+}
+
+// src/authoring/table.ts
+var TABLE_BRAND = "seq-table";
+var LINK_BRAND = "seq-link";
+function toOne(target, options) {
+  return {
+    kind: LINK_BRAND,
+    linkKind: "toOne",
+    target,
+    on: options.on,
+    references: options.references,
+    enforce: options.enforce ?? false,
+    description: options.description
+  };
+}
+function toMany(target, options) {
+  return {
+    kind: LINK_BRAND,
+    linkKind: "toMany",
+    target,
+    on: options.on,
+    references: options.references,
+    enforce: false,
+    description: options.description
+  };
+}
+function toPlatformUser(options) {
+  return {
+    kind: LINK_BRAND,
+    linkKind: "toPlatformUser",
+    target: void 0,
+    on: options.on,
+    references: options.references,
+    enforce: false,
+    description: options.description
+  };
+}
+function isSeqLink(value) {
+  return typeof value === "object" && value !== null && value.kind === LINK_BRAND;
+}
+function isSeqTable(value) {
+  return typeof value === "object" && value !== null && value.kind === TABLE_BRAND;
+}
+function assertIdentifier({ value, what, file }) {
+  if (!IDENTIFIER_PATTERN.test(value) || value.length > MAX_IDENTIFIER_LENGTH) {
+    throw new OrmDefinitionError(
+      `${what} "${value}" must match ${IDENTIFIER_PATTERN} and be at most ${MAX_IDENTIFIER_LENGTH} characters`,
+      file
+    );
+  }
+}
+function defineTable(name, columns, config = {}) {
+  const file = activeAuthoringContext()?.currentFile;
+  assertIdentifier({ value: name, what: "table name", file });
+  const entries = Object.entries(columns);
+  if (entries.length === 0) {
+    throw new OrmDefinitionError(`table "${name}" declares no columns`, file);
+  }
+  const seenColumnNames = /* @__PURE__ */ new Map();
+  for (const [propertyName, builder] of entries) {
+    if (!isColumnBuilder(builder)) {
+      throw new OrmDefinitionError(
+        `table "${name}": column "${propertyName}" is not a column builder \u2014 use the t.* factories (t.uuid(), t.text(), \u2026)`,
+        file
+      );
+    }
+    const columnName = builder.columnNameFor(propertyName);
+    assertIdentifier({ value: columnName, what: `table "${name}": column "${propertyName}" column name`, file });
+    const existing = seenColumnNames.get(columnName);
+    if (existing !== void 0) {
+      throw new OrmDefinitionError(
+        `table "${name}": columns "${existing}" and "${propertyName}" both map to Postgres column "${columnName}"`,
+        file
+      );
+    }
+    seenColumnNames.set(columnName, propertyName);
+  }
+  const table = { kind: TABLE_BRAND, tableName: name, columns, config, source: void 0, file };
+  registerTable(table);
+  return table;
+}
+function defineSyncedTable(name, columnsOrConfig, maybeConfig) {
+  const file = activeAuthoringContext()?.currentFile;
+  assertIdentifier({ value: name, what: "table name", file });
+  const isTyped = maybeConfig !== void 0;
+  const columns = isTyped ? columnsOrConfig : {};
+  const config = isTyped ? maybeConfig : columnsOrConfig;
+  if (!SYNCED_SOURCE_PATTERN.test(config.source)) {
+    throw new OrmDefinitionError(
+      `synced table "${name}": source "${config.source}" must match ${SYNCED_SOURCE_PATTERN} (gold layer only)`,
+      file
+    );
+  }
+  const entries = Object.entries(columns);
+  const seenColumnNames = /* @__PURE__ */ new Map();
+  const columnLevelPk = [];
+  for (const [propertyName, builder] of entries) {
+    if (!isColumnBuilder(builder)) {
+      throw new OrmDefinitionError(
+        `synced table "${name}": column "${propertyName}" is not a column builder \u2014 use the t.* factories (t.uuid(), t.text(), \u2026)`,
+        file
+      );
+    }
+    const columnName = builder.columnNameFor(propertyName);
+    assertIdentifier({
+      value: columnName,
+      what: `synced table "${name}": column "${propertyName}" column name`,
+      file
+    });
+    const existing = seenColumnNames.get(columnName);
+    if (existing !== void 0) {
+      throw new OrmDefinitionError(
+        `synced table "${name}": columns "${existing}" and "${propertyName}" both map to Postgres column "${columnName}"`,
+        file
+      );
+    }
+    seenColumnNames.set(columnName, propertyName);
+    if (builder.isPrimaryKey) columnLevelPk.push(propertyName);
+  }
+  if (entries.length > 0) {
+    const hasConfigPk = config.primaryKey !== void 0 && config.primaryKey.length > 0;
+    if (columnLevelPk.length === 0 && !hasConfigPk) {
+      throw new OrmDefinitionError(
+        `synced table "${name}" declares columns but no primary key \u2014 use .primaryKey() or config.primaryKey`,
+        file
+      );
+    }
+    if (columnLevelPk.length > 0 && hasConfigPk) {
+      throw new OrmDefinitionError(
+        `synced table "${name}": declare the primary key either with .primaryKey() on columns or with config.primaryKey \u2014 not both`,
+        file
+      );
+    }
+  }
+  const tableConfig = {};
+  if (config.description !== void 0) tableConfig.description = config.description;
+  if (config.primaryKey !== void 0) tableConfig.primaryKey = config.primaryKey;
+  if (config.links !== void 0) tableConfig.links = config.links;
+  if (config.policies !== void 0) tableConfig.policies = { read: config.policies.read };
+  const table = {
+    kind: TABLE_BRAND,
+    tableName: name,
+    columns,
+    config: tableConfig,
+    source: config.source,
+    file
+  };
+  registerTable(table);
+  return table;
+}
+function defineEnum(name, values) {
+  const file = activeAuthoringContext()?.currentFile;
+  assertIdentifier({ value: name, what: "enum name", file });
+  if (values.length === 0 || values.length > 100) {
+    throw new OrmDefinitionError(`enum "${name}" must declare between 1 and 100 values`, file);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const value of values) {
+    if (value.length === 0 || value.length > MAX_IDENTIFIER_LENGTH) {
+      throw new OrmDefinitionError(
+        `enum "${name}": value ${JSON.stringify(value)} must be 1-${MAX_IDENTIFIER_LENGTH} characters`,
+        file
+      );
+    }
+    if (seen.has(value)) {
+      throw new OrmDefinitionError(`enum "${name}" declares duplicate value "${value}"`, file);
+    }
+    seen.add(value);
+  }
+  const ref = { kind: ENUM_BRAND, name, values: [...values] };
+  registerEnum(ref);
+  return ref;
+}
+var VIEW_BRAND = "seq-view";
+function isSeqView(value) {
+  return typeof value === "object" && value !== null && value.kind === VIEW_BRAND;
+}
+function defineView(name, columns, config) {
+  const file = activeAuthoringContext()?.currentFile;
+  if (!IDENTIFIER_PATTERN.test(name) || name.length > MAX_IDENTIFIER_LENGTH) {
+    throw new OrmDefinitionError(
+      `view name "${name}" must match ${IDENTIFIER_PATTERN} and be at most ${MAX_IDENTIFIER_LENGTH} characters`,
+      file
+    );
+  }
+  const entries = Object.entries(columns);
+  if (entries.length === 0) throw new OrmDefinitionError(`view "${name}" declares no columns`, file);
+  const seenColumnNames = /* @__PURE__ */ new Map();
+  for (const [propertyName, builder] of entries) {
+    if (!isColumnBuilder(builder)) {
+      throw new OrmDefinitionError(
+        `view "${name}": column "${propertyName}" is not a column builder \u2014 use the t.* factories`,
+        file
+      );
+    }
+    const columnName = builder.columnNameFor(propertyName);
+    if (!IDENTIFIER_PATTERN.test(columnName) || columnName.length > MAX_IDENTIFIER_LENGTH) {
+      throw new OrmDefinitionError(`view "${name}": column "${propertyName}" has invalid column name "${columnName}"`, file);
+    }
+    const existing = seenColumnNames.get(columnName);
+    if (existing !== void 0) {
+      throw new OrmDefinitionError(
+        `view "${name}": columns "${existing}" and "${propertyName}" both map to Postgres column "${columnName}"`,
+        file
+      );
+    }
+    seenColumnNames.set(columnName, propertyName);
+  }
+  const view = { kind: VIEW_BRAND, viewName: name, columns, config, file };
+  registerView(view);
+  return view;
+}
+var QUERY_COLUMN_FACTORIES = {
+  uuid: (name) => uuid(name),
+  text: (name) => text(name),
+  integer: (name) => integer(name),
+  bigint: (name) => bigint(name, { mode: "bigint" }),
+  numeric: (name) => numeric(name),
+  double: (name) => doublePrecision(name),
+  boolean: (name) => boolean(name),
+  timestamptz: (name) => timestamp(name, { withTimezone: true }),
+  date: (name) => date(name),
+  jsonb: (name) => jsonb(name)
+};
+function compileViewQueries(input) {
+  const schemaName = `orm_${input.namespace}`;
+  const schema = pgSchema(schemaName);
+  const enumFactories = /* @__PURE__ */ new Map();
+  for (const entry of input.enums) {
+    const values = entry.values;
+    enumFactories.set(entry.name, schema.enum(entry.name, values));
+  }
+  const handles = /* @__PURE__ */ new Map();
+  const physicalToLogical = /* @__PURE__ */ new Map();
+  const tableByName = new Map(input.tables.map((table) => [table.table, table]));
+  for (const authored of input.authoredTables) {
+    const canonical = tableByName.get(authored.tableName);
+    if (!canonical) continue;
+    const physicalSchema = schemaName;
+    const physicalName = canonical.table;
+    const relationSchema = pgSchema(physicalSchema);
+    const columns = buildQueryColumns(canonical.columns, enumFactories);
+    const handle = relationSchema.table(physicalName, columns);
+    handles.set(authored, handle);
+    physicalToLogical.set(`${physicalSchema}.${physicalName}`, canonical.table);
+  }
+  const viewByName = new Map(input.views.map((view) => [view.view, view]));
+  for (const authored of input.authoredViews) {
+    const canonical = viewByName.get(authored.viewName);
+    if (!canonical) continue;
+    const columns = buildQueryColumns(canonical.columns, enumFactories);
+    const handle = schema.view(canonical.view, columns).existing();
+    handles.set(authored, handle);
+    physicalToLogical.set(`${schemaName}.${canonical.view}`, canonical.view);
+  }
+  const dialect = new PgDialect();
+  const compiled = /* @__PURE__ */ new Map();
+  for (const authored of input.authoredViews) {
+    const expectedFields = Object.keys(authored.columns);
+    const declaredDependencies = /* @__PURE__ */ new Set();
+    const relation = (ref) => {
+      let resolved;
+      try {
+        resolved = typeof ref === "function" ? ref() : ref;
+      } catch (error) {
+        throw new OrmDefinitionError(
+          `view "${authored.viewName}" relation thunk threw: ${error instanceof Error ? error.message : String(error)}`,
+          authored.file
+        );
+      }
+      if (!isSeqTable(resolved) && !isSeqView(resolved)) {
+        throw new OrmDefinitionError(
+          `view "${authored.viewName}" relation() expects a table or view defined by this ORM`,
+          authored.file
+        );
+      }
+      const handle = handles.get(resolved);
+      if (!handle) {
+        const name = isSeqTable(resolved) ? resolved.tableName : resolved.viewName;
+        throw new OrmDefinitionError(
+          `view "${authored.viewName}" references relation "${name}" which is not part of this namespace`,
+          authored.file
+        );
+      }
+      declaredDependencies.add(isSeqTable(resolved) ? resolved.tableName : resolved.viewName);
+      return handle;
+    };
+    let queryBuilder;
+    try {
+      queryBuilder = authored.config.query({ qb: new QueryBuilder(), relation });
+    } catch (error) {
+      if (error instanceof OrmDefinitionError) throw error;
+      throw new OrmDefinitionError(
+        `view "${authored.viewName}" query callback failed: ${error instanceof Error ? error.message : String(error)}`,
+        authored.file
+      );
+    }
+    let config;
+    try {
+      config = getViewConfig(schema.view(authored.viewName).as(queryBuilder));
+    } catch (error) {
+      throw new OrmDefinitionError(
+        `view "${authored.viewName}" query must return a Drizzle select builder: ${error instanceof Error ? error.message : String(error)}`,
+        authored.file
+      );
+    }
+    const selectedFields = Object.keys(config.selectedFields);
+    if (selectedFields.length !== expectedFields.length || selectedFields.some((field, index3) => field !== expectedFields[index3])) {
+      throw new OrmDefinitionError(
+        `view "${authored.viewName}" query selects [${selectedFields.join(", ")}], but declared columns are [${expectedFields.join(", ")}]`,
+        authored.file
+      );
+    }
+    if (!config.query) throw new OrmDefinitionError(`view "${authored.viewName}" produced no query`, authored.file);
+    const tableDependencies = extractUsedTable(config.query).map((physical) => {
+      const logical = physicalToLogical.get(physical);
+      if (!logical) {
+        throw new OrmDefinitionError(
+          `view "${authored.viewName}" query references unmanaged relation "${physical}" \u2014 use relation(...) with a namespace table or view`,
+          authored.file
+        );
+      }
+      return logical;
+    });
+    const renderedQuery = dialect.sqlToQuery(config.query.inlineParams());
+    if (renderedQuery.params.length > 0) {
+      throw new OrmDefinitionError(
+        `view "${authored.viewName}" query produced bind parameters which cannot be persisted in view DDL`,
+        authored.file
+      );
+    }
+    compiled.set(authored.viewName, {
+      query: renderedQuery.sql,
+      dependencies: [.../* @__PURE__ */ new Set([...declaredDependencies, ...tableDependencies])].sort()
+    });
+  }
+  return compiled;
+}
+function buildQueryColumns(columns, enumFactories) {
+  return Object.fromEntries(columns.map((column) => [column.name, buildQueryColumn(column, enumFactories)]));
+}
+function buildQueryColumn(column, enumFactories) {
+  const factory = typeof column.type === "string" ? QUERY_COLUMN_FACTORIES[column.type] : enumFactories.get(column.type.enum);
+  if (!factory) {
+    const type = typeof column.type === "string" ? column.type : column.type.enum;
+    throw new OrmDefinitionError(`view query column '${column.columnName}' references unknown type '${type}'`);
+  }
+  let builder = factory(column.columnName);
+  if (!column.nullable) builder = builder.notNull();
+  return builder;
+}
+function relationName(relation) {
+  return isSeqTable(relation) ? relation.tableName : relation.viewName;
+}
+function relationKind(relation) {
+  return isSeqTable(relation) ? "table" : "view";
+}
+function declaredPrimaryKeyProperties(table) {
+  const fromColumns = Object.entries(table.columns).filter(([, builder]) => builder.isPrimaryKey).map(([propertyName]) => propertyName);
+  if (fromColumns.length > 0) return fromColumns;
+  const configPk = table.config.primaryKey ?? [];
+  const resolved = [];
+  for (const ref of configPk) {
+    if (ref in table.columns) {
+      resolved.push(ref);
+      continue;
+    }
+    const byColumnName = Object.entries(table.columns).find(
+      ([propertyName, builder]) => builder.columnNameFor(propertyName) === ref
+    );
+    if (byColumnName) resolved.push(byColumnName[0]);
+  }
+  return resolved;
+}
+function assertOverlayWinsPrimaryKey({
+  table,
+  pk,
+  role
+}) {
+  if (!(pk in table.columns)) {
+    throw new OrmDefinitionError(
+      `overlayWinsUnion: pk "${pk}" must exist as a property on both overlay and synced tables`
+    );
+  }
+  const declared = declaredPrimaryKeyProperties(table);
+  if (declared.length !== 1 || declared[0] !== pk) {
+    throw new OrmDefinitionError(
+      `overlayWinsUnion: ${role} primary key must be exactly "${pk}" (declared: ${declared.length > 0 ? declared.join(", ") : "none"})`
+    );
+  }
+}
+function formatCanonicalColumnType(type) {
+  return typeof type === "string" ? type : `enum(${type.enum})`;
+}
+function assertOverlayWinsMatchingColumnTypes({
+  overlay,
+  synced,
+  columns
+}) {
+  for (const column of columns) {
+    const overlayType = overlay.columns[column].toCanonicalColumn(column).type;
+    const syncedType = synced.columns[column].toCanonicalColumn(column).type;
+    if (JSON.stringify(overlayType) !== JSON.stringify(syncedType)) {
+      throw new OrmDefinitionError(
+        `overlayWinsUnion: column "${column}" must have the same type on overlay and synced (overlay: ${formatCanonicalColumnType(overlayType)}, synced: ${formatCanonicalColumnType(syncedType)})`
+      );
+    }
+  }
+}
+function overlayWinsUnion(input) {
+  const { overlay, synced, pk, tombstone } = input;
+  return ({ qb, relation }) => {
+    assertOverlayWinsPrimaryKey({ table: overlay, pk, role: "overlay" });
+    assertOverlayWinsPrimaryKey({ table: synced, pk, role: "synced" });
+    const overlayHandle = relation(overlay);
+    const syncedHandle = relation(synced);
+    const overlayCols = overlayHandle;
+    const syncedCols = syncedHandle;
+    const overlayPk = overlayCols[pk];
+    const syncedPk = syncedCols[pk];
+    if (tombstone !== void 0) {
+      const tombstoneBuilder = overlay.columns[tombstone];
+      if (!tombstoneBuilder) {
+        throw new OrmDefinitionError(
+          `overlayWinsUnion: tombstone "${tombstone}" must exist as a property on the overlay table`
+        );
+      }
+      const tombstoneCanonical = tombstoneBuilder.toCanonicalColumn(tombstone);
+      if (tombstoneCanonical.type !== "boolean") {
+        throw new OrmDefinitionError(
+          `overlayWinsUnion: tombstone "${tombstone}" must be a boolean column`
+        );
+      }
+      if (tombstoneCanonical.nullable) {
+        throw new OrmDefinitionError(
+          `overlayWinsUnion: tombstone "${tombstone}" must be notNull \u2014 nullable tombstones silently drop rows`
+        );
+      }
+    }
+    const overlayColumns = Object.keys(overlay.columns);
+    const syncedColumns = Object.keys(synced.columns);
+    const sharedColumns = overlayColumns.filter((col) => syncedColumns.includes(col) && col !== pk);
+    assertOverlayWinsMatchingColumnTypes({
+      overlay,
+      synced,
+      columns: [pk, ...sharedColumns]
+    });
+    const overlaySelect = {
+      [pk]: overlayPk,
+      ...Object.fromEntries(sharedColumns.map((col) => [col, overlayCols[col]])),
+      provenance: sql`'overlay'`.as("provenance")
+    };
+    const syncedSelect = {
+      [pk]: syncedPk,
+      ...Object.fromEntries(sharedColumns.map((col) => [col, syncedCols[col]])),
+      provenance: sql`'synced'`.as("provenance")
+    };
+    const overlayFrom = qb.select(overlaySelect).from(overlayHandle);
+    const overlayQuery = tombstone !== void 0 ? overlayFrom.where(eq(overlayCols[tombstone], false)) : overlayFrom;
+    const syncedQuery = qb.select(syncedSelect).from(syncedHandle).where(
+      notExists(
+        qb.select({ one: sql`1` }).from(overlayHandle).where(eq(overlayPk, syncedPk))
+      )
+    );
+    return overlayQuery.unionAll(syncedQuery);
+  };
+}
+
+// src/authoring/cow-mutations.ts
+function overrideRowMutation(input) {
+  const { overlay, synced, pk } = input;
+  const name = input.name ?? `override_${overlay.tableName}`;
+  assertMutationName(name, "overrideRowMutation");
+  assertOverlayPairPrimaryKey({ overlay, synced, pk, helper: "overrideRowMutation" });
+  const sharedProperties = sharedNonPkProperties({ overlay, synced, pk });
+  const setProperties = resolveSetProperties({
+    overlay,
+    synced,
+    pk,
+    set: input.set,
+    sharedProperties,
+    helper: "overrideRowMutation"
+  });
+  assertMatchingColumns({
+    overlay,
+    synced,
+    properties: [pk, ...sharedProperties],
+    helper: "overrideRowMutation"
+  });
+  return {
+    kind: "override",
+    name,
+    synced: synced.tableName,
+    pk,
+    copy: [pk, ...sharedProperties],
+    set: setProperties
+  };
+}
+function revertOverlayMutation(input) {
+  const { overlay, synced, pk } = input;
+  const name = input.name ?? `revert_${overlay.tableName}`;
+  assertMutationName(name, "revertOverlayMutation");
+  assertOverlayPairPrimaryKey({ overlay, synced, pk, helper: "revertOverlayMutation" });
+  assertMatchingColumns({ overlay, synced, properties: [pk], helper: "revertOverlayMutation" });
+  return {
+    kind: "revert",
+    name,
+    synced: synced.tableName,
+    pk,
+    copy: [],
+    set: []
+  };
+}
+function assertMutationName(name, helper) {
+  if (!IDENTIFIER_PATTERN.test(name) || name.length > MAX_IDENTIFIER_LENGTH) {
+    throw new OrmDefinitionError(
+      `${helper}: mutation name "${name}" must match ${IDENTIFIER_PATTERN} and be at most ${MAX_IDENTIFIER_LENGTH} characters`
+    );
+  }
+}
+function assertOverlayPairPrimaryKey({
+  overlay,
+  synced,
+  pk,
+  helper
+}) {
+  assertSinglePrimaryKey({ table: overlay, pk, role: "overlay", helper });
+  assertSinglePrimaryKey({ table: synced, pk, role: "synced", helper });
+}
+function assertSinglePrimaryKey({
+  table,
+  pk,
+  role,
+  helper
+}) {
+  if (!(pk in table.columns)) {
+    throw new OrmDefinitionError(`${helper}: pk "${pk}" must exist as a property on the ${role} table`);
+  }
+  const declared = declaredPrimaryKeyProperties2(table);
+  if (declared.length !== 1 || declared[0] !== pk) {
+    throw new OrmDefinitionError(
+      `${helper}: ${role} primary key must be exactly "${pk}" (declared: ${declared.length > 0 ? declared.join(", ") : "none"})`
+    );
+  }
+}
+function declaredPrimaryKeyProperties2(table) {
+  const fromColumns = Object.entries(table.columns).filter(([, builder]) => builder.isPrimaryKey).map(([propertyName]) => propertyName);
+  if (fromColumns.length > 0) return fromColumns;
+  const configPk = table.config?.primaryKey ?? [];
+  const resolved = [];
+  for (const ref of configPk) {
+    if (ref in table.columns) {
+      resolved.push(ref);
+      continue;
+    }
+    const byColumnName = Object.entries(table.columns).find(
+      ([propertyName, builder]) => builder.columnNameFor(propertyName) === ref
+    );
+    if (byColumnName) resolved.push(byColumnName[0]);
+  }
+  return resolved;
+}
+function sharedNonPkProperties({
+  overlay,
+  synced,
+  pk
+}) {
+  return Object.keys(overlay.columns).filter((property) => property !== pk && property in synced.columns);
+}
+function resolveSetProperties({
+  overlay,
+  synced,
+  pk,
+  set,
+  sharedProperties,
+  helper
+}) {
+  const properties = set !== void 0 ? [...set] : [...sharedProperties];
+  if (properties.length === 0) {
+    throw new OrmDefinitionError(
+      `${helper}: set must declare at least one non-PK column to update after the copy`
+    );
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const property of properties) {
+    if (property === pk) {
+      throw new OrmDefinitionError(`${helper}: set must not include pk "${pk}" \u2014 identity columns are pinned`);
+    }
+    if (!(property in overlay.columns)) {
+      throw new OrmDefinitionError(`${helper}: set column "${property}" must exist on the overlay table`);
+    }
+    if (!(property in synced.columns)) {
+      throw new OrmDefinitionError(
+        `${helper}: set column "${property}" must exist on the synced table (contract columns only)`
+      );
+    }
+    if (seen.has(property)) {
+      throw new OrmDefinitionError(`${helper}: set column "${property}" is duplicated`);
+    }
+    seen.add(property);
+  }
+  return properties;
+}
+function assertMatchingColumns({
+  overlay,
+  synced,
+  properties,
+  helper
+}) {
+  for (const property of properties) {
+    const overlayCanonical = overlay.columns[property].toCanonicalColumn(property);
+    const syncedCanonical = synced.columns[property].toCanonicalColumn(property);
+    const overlayType = scalarColumnType(overlay, property, helper);
+    const syncedType = scalarColumnType(synced, property, helper);
+    if (overlayType !== syncedType) {
+      throw new OrmDefinitionError(
+        `${helper}: column "${property}" must have the same scalar type on overlay and synced (overlay: ${overlayType}, synced: ${syncedType})`
+      );
+    }
+    const overlayColumn = overlay.columns[property].columnNameFor(property);
+    const syncedColumn = synced.columns[property].columnNameFor(property);
+    if (overlayColumn !== syncedColumn) {
+      throw new OrmDefinitionError(
+        `${helper}: column "${property}" maps to different Postgres names on overlay (${overlayColumn}) and synced (${syncedColumn})`
+      );
+    }
+    if (syncedCanonical.nullable && !overlayCanonical.nullable) {
+      throw new OrmDefinitionError(
+        `${helper}: column "${property}" is nullable on synced but NOT NULL on overlay \u2014 a NULL synced value would fail the copy-from-synced insert; make overlay nullable or synced notNull`
+      );
+    }
+  }
+}
+function scalarColumnType(table, property, helper) {
+  const type = table.columns[property].toCanonicalColumn(property).type;
+  if (typeof type !== "string") {
+    throw new OrmDefinitionError(
+      `${helper}: column "${property}" on "${table.tableName}" must be a scalar type (enums are not supported in cow mutation arguments)`
+    );
+  }
+  return type;
+}
+var CANONICAL_FORMAT = 2;
+var IDENTIFIER_RE = /^[a-z][a-z0-9_]*$/;
+var identifier = z.string().min(1).max(63).regex(IDENTIFIER_RE);
+var COLUMN_TYPES = [
+  "uuid",
+  "text",
+  "integer",
+  "bigint",
+  "numeric",
+  "double",
+  "boolean",
+  "timestamptz",
+  "date",
+  "jsonb"
+];
+var columnTypeSchema = z.enum(COLUMN_TYPES);
+var canonicalEnumSchema = z.object({
+  name: identifier,
+  values: z.array(z.string().min(1).max(63)).min(1).max(100)
+});
+var canonicalColumnSchema = z.object({
+  /** Property name in TS (camelCase); columnName is the Postgres name. */
+  name: z.string().min(1).max(63),
+  columnName: identifier,
+  type: z.union([columnTypeSchema, z.object({ enum: identifier })]),
+  nullable: z.boolean().default(true),
+  unique: z.boolean().default(false),
+  /** Literal default, or one of the allowlisted SQL functions. */
+  default: z.union([z.string(), z.number(), z.boolean(), z.null()]).optional(),
+  defaultFn: z.enum(["gen_random_uuid()", "now()"]).optional(),
+  description: z.string().max(500).optional(),
+  /** Migration hints — same semantics as v1. */
+  renamedFrom: identifier.optional(),
+  cast: z.string().max(200).optional(),
+  deprecated: z.boolean().default(false)
+});
+var canonicalLinkSchema = z.object({
+  name: z.string().min(1).max(63),
+  kind: z.enum(["toOne", "toMany", "toPlatformUser"]),
+  /** Target table name (namespace-local). Absent for toPlatformUser. */
+  target: identifier.optional(),
+  /** FK column on the owning side (toOne/toPlatformUser: on this table; toMany: on the target). */
+  on: identifier,
+  /** Referenced column on the target (default: target's PK / platform user `sub`). */
+  references: identifier.optional(),
+  /** enforce: true emits a real FK constraint (same-namespace toOne only). */
+  enforce: z.boolean().default(false),
+  description: z.string().max(500).optional()
+});
+var canonicalIndexSchema = z.object({
+  columns: z.array(identifier).min(1),
+  unique: z.boolean().default(false),
+  name: identifier.optional()
+});
+var policyVariantSchema = z.object({
+  /** Claims-only guard (capability()/role()/claim() comparisons — no columns). */
+  when: z.string().min(1).max(1e3),
+  /** Exactly one of: allow-all bypass, or a row predicate. */
+  allow: z.literal(true).optional(),
+  policy: z.string().min(1).max(2e3).optional()
+}).refine((v) => v.allow === true !== (typeof v.policy === "string"), {
+  message: "A variant declares exactly one of allow: true or policy"
+});
+var policyExpressionSchema = z.union([
+  z.string().min(1).max(2e3),
+  z.object({
+    default: z.string().min(1).max(2e3),
+    variants: z.array(policyVariantSchema).max(10).default([])
+  })
+]);
+var canonicalPoliciesSchema = z.object({
+  read: policyExpressionSchema.optional(),
+  write: policyExpressionSchema.optional(),
+  insert: policyExpressionSchema.optional(),
+  update: policyExpressionSchema.optional()
+});
+function isSingleViewQuerySql(value) {
+  const query = value.trim();
+  if (!/^\(*(?:select|with)\b/i.test(query) || query.includes("\0")) return false;
+  let state = "normal";
+  for (let index3 = 0; index3 < query.length; index3 += 1) {
+    const char = query[index3];
+    const next = query[index3 + 1];
+    if (state === "single") {
+      if (char === "'" && next === "'") index3 += 1;
+      else if (char === "'") state = "normal";
+      continue;
+    }
+    if (state === "double") {
+      if (char === '"' && next === '"') index3 += 1;
+      else if (char === '"') state = "normal";
+      continue;
+    }
+    if (char === "'") state = "single";
+    else if (char === '"') state = "double";
+    else if (char === ";" || char === "-" && next === "-" || char === "/" && next === "*") return false;
+  }
+  return state === "normal" && !/\$[a-z_0-9]*\$/i.test(query);
+}
+var VIEW_QUERY_FUNCTION_ALLOWLIST = [
+  "abs",
+  "age",
+  "array_agg",
+  "array_append",
+  "array_cat",
+  "array_dims",
+  "array_length",
+  "array_lower",
+  "array_ndims",
+  "array_position",
+  "array_positions",
+  "array_prepend",
+  "array_remove",
+  "array_replace",
+  "array_to_string",
+  "array_trim",
+  "array_upper",
+  "ascii",
+  "avg",
+  "bit_and",
+  "bit_or",
+  "bit_xor",
+  "bool_and",
+  "bool_or",
+  "btrim",
+  "cardinality",
+  "cbrt",
+  "ceil",
+  "ceiling",
+  "char_length",
+  "character_length",
+  "chr",
+  "concat",
+  "concat_ws",
+  "count",
+  "cume_dist",
+  "date_bin",
+  "date_part",
+  "date_trunc",
+  "decode",
+  "degrees",
+  "dense_rank",
+  "encode",
+  "enum_first",
+  "enum_last",
+  "enum_range",
+  "every",
+  "exp",
+  "first_value",
+  "floor",
+  "format",
+  "grouping",
+  "initcap",
+  "json_agg",
+  "json_array_length",
+  "json_build_array",
+  "json_build_object",
+  "json_extract_path",
+  "json_extract_path_text",
+  "json_object_agg",
+  "json_object_keys",
+  "json_strip_nulls",
+  "json_typeof",
+  "jsonb_agg",
+  "jsonb_array_length",
+  "jsonb_build_array",
+  "jsonb_build_object",
+  "jsonb_extract_path",
+  "jsonb_extract_path_text",
+  "jsonb_insert",
+  "jsonb_object_agg",
+  "jsonb_object_keys",
+  "jsonb_path_exists",
+  "jsonb_path_match",
+  "jsonb_path_query",
+  "jsonb_path_query_array",
+  "jsonb_path_query_first",
+  "jsonb_pretty",
+  "jsonb_set",
+  "jsonb_set_lax",
+  "jsonb_strip_nulls",
+  "jsonb_typeof",
+  "justify_days",
+  "justify_hours",
+  "justify_interval",
+  "lag",
+  "last_value",
+  "lead",
+  "left",
+  "length",
+  "ln",
+  "log",
+  "lower",
+  "lpad",
+  "ltrim",
+  "make_date",
+  "make_interval",
+  "make_time",
+  "make_timestamp",
+  "make_timestamptz",
+  "max",
+  "md5",
+  "min",
+  "mod",
+  "nth_value",
+  "ntile",
+  "octet_length",
+  "percent_rank",
+  "pi",
+  "power",
+  "quote_ident",
+  "quote_literal",
+  "quote_nullable",
+  "radians",
+  "rank",
+  "regexp_count",
+  "regexp_instr",
+  "regexp_like",
+  "regexp_match",
+  "regexp_matches",
+  "regexp_replace",
+  "regexp_split_to_array",
+  "regexp_split_to_table",
+  "repeat",
+  "replace",
+  "reverse",
+  "right",
+  "round",
+  "row_number",
+  "rpad",
+  "rtrim",
+  "sign",
+  "split_part",
+  "sqrt",
+  "starts_with",
+  "string_agg",
+  "string_to_array",
+  "strpos",
+  "substr",
+  "substring",
+  "sum",
+  "timezone",
+  "to_ascii",
+  "to_char",
+  "to_date",
+  "to_hex",
+  "to_json",
+  "to_jsonb",
+  "to_number",
+  "to_timestamp",
+  "translate",
+  "trunc",
+  "unnest",
+  "upper",
+  "width_bucket"
+];
+var canonicalActionSchema = z.object({
+  name: identifier,
+  requires: z.string().max(1e3).optional(),
+  params: z.record(z.string(), z.object({
+    type: columnTypeSchema,
+    nullable: z.boolean().default(false)
+  })).default({}),
+  executes: z.string().min(1).max(1e4),
+  returns: z.enum(["rows", "rowsAffected", "scalar"]).default("rowsAffected"),
+  audit: z.object({ action: z.string(), resource: z.string() }).optional()
+});
+var canonicalCowMutationSchema = z.object({
+  kind: z.enum(["override", "revert"]),
+  name: identifier,
+  /** Synced table (same namespace) the overlay copies from / falls back to. */
+  synced: identifier,
+  /** Single-column primary key PROPERTY (TS camelCase, like column `name`) shared by overlay and synced. */
+  pk: z.string().min(1).max(63),
+  /** Override: contract properties copied INSERT…SELECT from synced (pk included). Empty for revert. */
+  copy: z.array(z.string().min(1).max(63)).default([]),
+  /** Override: overlay properties written by the UPDATE (never the pk). Empty for revert. */
+  set: z.array(z.string().min(1).max(63)).default([])
+}).superRefine((mutation, ctx) => {
+  if (mutation.kind === "override") {
+    if (mutation.set.length === 0) {
+      ctx.addIssue({ code: "custom", path: ["set"], message: "override mutations must set at least one column" });
+    }
+    if (!mutation.copy.includes(mutation.pk)) {
+      ctx.addIssue({ code: "custom", path: ["copy"], message: "override copy list must include the pk" });
+    }
+  } else if (mutation.set.length > 0 || mutation.copy.length > 0) {
+    ctx.addIssue({ code: "custom", path: ["set"], message: "revert mutations take no copy/set columns" });
+  }
+  if (mutation.set.includes(mutation.pk)) {
+    ctx.addIssue({ code: "custom", path: ["set"], message: "set must not include the pk \u2014 identity columns are pinned" });
+  }
+  for (const [field, values] of [["copy", mutation.copy], ["set", mutation.set]]) {
+    if (new Set(values).size !== values.length) {
+      ctx.addIssue({ code: "custom", path: [field], message: `${field} must not contain duplicate columns` });
+    }
+  }
+});
+var canonicalTableSchema = z.object({
+  table: identifier,
+  description: z.string().max(2e3).optional(),
+  /** Table-level rename hint (new in v2). */
+  renamedFrom: identifier.optional(),
+  /** Synced/reflected read-only tables (`source: gold.*`) — v1 semantics. */
+  source: z.string().regex(/^gold\.[a-z][a-z0-9_]*$/).optional(),
+  columns: z.array(canonicalColumnSchema).default([]),
+  primaryKey: z.array(identifier).min(1).max(8).optional(),
+  links: z.array(canonicalLinkSchema).default([]),
+  indexes: z.array(canonicalIndexSchema).default([]),
+  policies: canonicalPoliciesSchema.default({}),
+  /**
+   * v1-conversion carry-over only. v2 has no action surface — the runtime
+   * neither compiles nor executes these; writes are mutations. Kept parseable
+   * so stored definitions and their content hashes stay stable.
+   */
+  actions: z.array(canonicalActionSchema).default([]),
+  /** Optional (not defaulted) so pre-CoW canonical documents keep byte-identical hashes. */
+  cowMutations: z.array(canonicalCowMutationSchema).optional()
+});
+var canonicalViewSchema = z.object({
+  view: identifier,
+  description: z.string().max(2e3).optional(),
+  columns: z.array(canonicalColumnSchema).min(1),
+  /** Logical identity for GraphQL only; PostgreSQL views have no PK constraint. */
+  primaryKey: z.array(identifier).min(1).max(8).optional(),
+  links: z.array(canonicalLinkSchema).default([]),
+  policies: z.object({ read: policyExpressionSchema }).strict(),
+  query: z.string().min(1).max(1e5).refine(isSingleViewQuerySql, {
+    message: "view query must be one SELECT/WITH statement without comments or dollar-quoted bodies"
+  }),
+  /** Namespace-local logical relation names, sorted for deterministic hashing. */
+  dependencies: z.array(identifier).max(500)
+}).superRefine((view, ctx) => {
+  for (const [index3, column] of view.columns.entries()) {
+    if (column.default !== void 0 || column.defaultFn !== void 0) {
+      ctx.addIssue({ code: "custom", path: ["columns", index3], message: `view column '${column.name}' cannot declare a default` });
+    }
+    if (column.unique) {
+      ctx.addIssue({ code: "custom", path: ["columns", index3], message: `view column '${column.name}' cannot declare unique` });
+    }
+    if (column.renamedFrom !== void 0 || column.cast !== void 0) {
+      ctx.addIssue({ code: "custom", path: ["columns", index3], message: `view column '${column.name}' cannot declare migration hints` });
+    }
+  }
+  for (const [index3, link] of view.links.entries()) {
+    if (link.enforce) {
+      ctx.addIssue({ code: "custom", path: ["links", index3, "enforce"], message: `view link '${link.name}' cannot enforce a foreign key` });
+    }
+  }
+});
+var canonicalDefinitionSchema = z.object({
+  definition_format: z.literal(CANONICAL_FORMAT),
+  namespace: identifier.max(41),
+  description: z.string().max(2e3).optional(),
+  enums: z.array(canonicalEnumSchema).default([]),
+  tables: z.array(canonicalTableSchema).min(0).max(500),
+  /** Optional to preserve byte-identical hashes for pre-view canonical v2 documents. */
+  views: z.array(canonicalViewSchema).max(500).optional(),
+  /** Verbatim custom-roles grammar (@sequenceholdings/custom-roles-manifest). */
+  capabilities: z.object({
+    roles: z.unknown().optional(),
+    uses: z.array(z.string()).default([])
+  }).default({ uses: [] })
+}).superRefine((definition, ctx) => {
+  const seen = /* @__PURE__ */ new Set();
+  for (const [index3, table] of definition.tables.entries()) {
+    if (seen.has(table.table)) {
+      ctx.addIssue({ code: "custom", path: ["tables", index3, "table"], message: `duplicate relation '${table.table}'` });
+    }
+    seen.add(table.table);
+  }
+  const tableByName = new Map(definition.tables.map((table) => [table.table, table]));
+  for (const [tableIndex, table] of definition.tables.entries()) {
+    const cowMutations = table.cowMutations ?? [];
+    if (cowMutations.length === 0) continue;
+    const path = (index3, ...rest) => ["tables", tableIndex, "cowMutations", index3, ...rest];
+    if (table.source !== void 0) {
+      ctx.addIssue({ code: "custom", path: path(0), message: `synced table '${table.table}' cannot declare cow mutations \u2014 it is read-only` });
+      continue;
+    }
+    for (const [index3, mutation] of cowMutations.entries()) {
+      const synced = tableByName.get(mutation.synced);
+      if (!synced || synced.source === void 0) {
+        ctx.addIssue({
+          code: "custom",
+          path: path(index3, "synced"),
+          message: `cow mutation '${mutation.name}' references '${mutation.synced}', which is not a synced table in this namespace`
+        });
+        continue;
+      }
+      const overlayColumnsByName = new Map(table.columns.map((column) => [column.name, column]));
+      const syncedColumnsByName = new Map(synced.columns.map((column) => [column.name, column]));
+      let columnsExist = true;
+      for (const property of [mutation.pk, ...mutation.copy, ...mutation.set]) {
+        if (!overlayColumnsByName.has(property)) {
+          columnsExist = false;
+          ctx.addIssue({ code: "custom", path: path(index3), message: `cow mutation '${mutation.name}': column '${property}' does not exist on overlay '${table.table}'` });
+        }
+      }
+      for (const property of [mutation.pk, ...mutation.copy]) {
+        if (!syncedColumnsByName.has(property)) {
+          columnsExist = false;
+          ctx.addIssue({ code: "custom", path: path(index3), message: `cow mutation '${mutation.name}': column '${property}' does not exist on synced '${mutation.synced}'` });
+        }
+      }
+      if (!columnsExist) continue;
+      const overlayPk = table.primaryKey ?? [];
+      const syncedPk = synced.primaryKey ?? [];
+      if (overlayPk.length !== 1 || overlayPk[0] !== mutation.pk || syncedPk.length !== 1 || syncedPk[0] !== mutation.pk) {
+        ctx.addIssue({
+          code: "custom",
+          path: path(index3, "pk"),
+          message: `cow mutation '${mutation.name}': pk '${mutation.pk}' must be the single-column primary key on both '${table.table}' and '${mutation.synced}'`
+        });
+      }
+      for (const property of [mutation.pk, ...mutation.copy]) {
+        const overlayColumn = overlayColumnsByName.get(property);
+        const syncedColumn = syncedColumnsByName.get(property);
+        if (!overlayColumn || !syncedColumn) continue;
+        if (JSON.stringify(overlayColumn.type) !== JSON.stringify(syncedColumn.type)) {
+          ctx.addIssue({
+            code: "custom",
+            path: path(index3),
+            message: `cow mutation '${mutation.name}': column '${property}' must have the same type on overlay and synced`
+          });
+        }
+        if (overlayColumn.columnName !== syncedColumn.columnName) {
+          ctx.addIssue({
+            code: "custom",
+            path: path(index3),
+            message: `cow mutation '${mutation.name}': column '${property}' maps to different Postgres names on overlay ('${overlayColumn.columnName}') and synced ('${syncedColumn.columnName}')`
+          });
+        }
+        if (syncedColumn.nullable !== false && overlayColumn.nullable === false) {
+          ctx.addIssue({
+            code: "custom",
+            path: path(index3),
+            message: `cow mutation '${mutation.name}': column '${property}' is nullable on synced but NOT NULL on overlay \u2014 a NULL synced value would fail the copy`
+          });
+        }
+      }
+    }
+  }
+  for (const [index3, view] of (definition.views ?? []).entries()) {
+    if (seen.has(view.view)) {
+      ctx.addIssue({ code: "custom", path: ["views", index3, "view"], message: `duplicate relation '${view.view}'` });
+    }
+    seen.add(view.view);
+  }
+  const views = definition.views ?? [];
+  const viewByName = new Map(views.map((view) => [view.view, view]));
+  for (const [viewIndex, view] of views.entries()) {
+    for (const [dependencyIndex, dependency] of view.dependencies.entries()) {
+      if (!seen.has(dependency)) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["views", viewIndex, "dependencies", dependencyIndex],
+          message: `view '${view.view}' depends on unknown relation '${dependency}'`
+        });
+      }
+    }
+  }
+  const visiting = /* @__PURE__ */ new Set();
+  const visited = /* @__PURE__ */ new Set();
+  let cycleReported = false;
+  const visit = (name, path) => {
+    if (visited.has(name) || cycleReported) return;
+    if (visiting.has(name)) {
+      cycleReported = true;
+      ctx.addIssue({
+        code: "custom",
+        path: ["views"],
+        message: `view dependencies form a cycle: ${[...path, name].join(" -> ")}`
+      });
+      return;
+    }
+    visiting.add(name);
+    const view = viewByName.get(name);
+    for (const dependency of view?.dependencies ?? []) {
+      if (viewByName.has(dependency)) visit(dependency, [...path, name]);
+    }
+    visiting.delete(name);
+    visited.add(name);
+  };
+  for (const view of views) visit(view.view, []);
+});
+function canonicalRelations(definition) {
+  const views = (definition.views ?? []).map((view) => ({
+    table: view.view,
+    ...view.description !== void 0 ? { description: view.description } : {},
+    columns: view.columns,
+    ...view.primaryKey !== void 0 ? { primaryKey: view.primaryKey } : {},
+    links: view.links,
+    indexes: [],
+    policies: { read: view.policies.read },
+    actions: []
+  }));
+  return [...definition.tables, ...views].sort((a, b) => a.table.localeCompare(b.table));
+}
+function normalizeCanonical(definition) {
+  const sortByName = (items) => [...items].sort((a, b) => a.name.localeCompare(b.name));
+  const normalized = {
+    ...definition,
+    enums: sortByName(definition.enums),
+    tables: [...definition.tables].sort((a, b) => a.table.localeCompare(b.table)).map((t2) => {
+      const { cowMutations, ...rest } = t2;
+      return {
+        ...rest,
+        links: sortByName(t2.links),
+        indexes: [...t2.indexes].sort((a, b) => (a.name ?? a.columns.join("_")).localeCompare(b.name ?? b.columns.join("_"))),
+        actions: sortByName(t2.actions),
+        // Omitted entirely when absent/empty so pre-CoW documents hash unchanged.
+        ...cowMutations !== void 0 && cowMutations.length > 0 ? { cowMutations: sortByName(cowMutations) } : {}
+      };
+    })
+  };
+  if (definition.views !== void 0) {
+    normalized.views = [...definition.views].sort((a, b) => a.view.localeCompare(b.view)).map((view) => ({
+      ...view,
+      links: sortByName(view.links),
+      dependencies: [...view.dependencies].sort()
+    }));
+  }
+  return normalized;
+}
+function stableJson(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+  const entries = Object.entries(value).filter(([, entryValue]) => entryValue !== void 0).sort(([a], [b]) => a < b ? -1 : 1).map(([key, entryValue]) => `${JSON.stringify(key)}:${stableJson(entryValue)}`);
+  return `{${entries.join(",")}}`;
+}
+function emptyToNull(value) {
+  if (value == null) return null;
+  if (Array.isArray(value)) return value.length === 0 ? null : value;
+  if (typeof value === "object" && Object.keys(value).length === 0) return null;
+  return value;
+}
+function canonicalTable(table) {
+  return {
+    table: table.table,
+    description: table.description ?? null,
+    columns: table.columns ?? null,
+    source: table.source ?? null,
+    links: emptyToNull(table.links),
+    indexes: emptyToNull(table.indexes),
+    // insert/update are omitted rather than nulled when absent, so definitions
+    // predating split policies keep the hash they were registered under.
+    policies: {
+      read: table.policies?.read?.source ?? null,
+      write: table.policies?.write?.source ?? null,
+      ...table.policies?.insert !== void 0 ? { insert: table.policies.insert.source } : {},
+      ...table.policies?.update !== void 0 ? { update: table.policies.update.source } : {}
+    },
+    actions: emptyToNull(
+      Object.fromEntries(
+        Object.entries(table.actions ?? {}).map(([name, action]) => [
+          name,
+          {
+            description: action.description ?? null,
+            requires: action.requires?.source ?? null,
+            params: emptyToNull(action.params),
+            validates: emptyToNull(action.validates?.map((entry) => entry.source)),
+            executes: action.executes,
+            returns: emptyToNull(action.returns),
+            audit: action.audit ?? null
+          }
+        ])
+      )
+    )
+  };
+}
+function canonicalCapabilities(capabilities) {
+  const { definitions, capabilities: declared } = capabilities.roles;
+  const isEmpty = Object.keys(definitions).length === 0 && Object.keys(declared).length === 0 && capabilities.uses.length === 0;
+  if (isEmpty) return null;
+  return {
+    roles: {
+      definitions: Object.fromEntries(
+        Object.entries(definitions).map(([key, def]) => [
+          key,
+          {
+            ...def.description !== void 0 ? { description: def.description } : {},
+            default: def.default,
+            inherits: [...def.inherits].sort(),
+            grants: [...def.grants].sort()
+          }
+        ])
+      ),
+      capabilities: Object.fromEntries(
+        Object.entries(declared).map(([key, cap]) => [
+          key,
+          cap.description !== void 0 ? { description: cap.description } : {}
+        ])
+      )
+    },
+    uses: [...capabilities.uses].sort()
+  };
+}
+function canonicalizeDefinition(definition) {
+  return {
+    namespace: definition.namespace,
+    description: definition.description,
+    capabilities: canonicalCapabilities(definition.capabilities),
+    tables: definition.tables.map(canonicalTable)
+  };
+}
+function computeDefinitionHash(definition) {
+  return createHash("sha256").update(HASH_DOMAIN).update(stableJson(canonicalizeDefinition(definition))).digest("hex");
+}
+
+// src/authoring/namespace.ts
+var NAMESPACE_CONFIG_BRAND = "seq-namespace-config";
+function isSeqNamespaceConfig(value) {
+  return typeof value === "object" && value !== null && value.kind === NAMESPACE_CONFIG_BRAND;
+}
+function defineNamespace(input) {
+  const file = activeAuthoringContext()?.currentFile;
+  if (!NAMESPACE_PATTERN.test(input.namespace)) {
+    throw new OrmDefinitionError(`namespace "${input.namespace}" must match ${NAMESPACE_PATTERN}`, file);
+  }
+  const config = {
+    kind: NAMESPACE_CONFIG_BRAND,
+    namespace: input.namespace,
+    description: input.description,
+    capabilities: input.capabilities ?? {},
+    file
+  };
+  registerNamespaceConfig(config);
+  return config;
+}
+function serializeNamespace(input) {
+  const { config, tables } = input;
+  const views = input.views ?? [];
+  const enums = input.enums ?? [];
+  const tablesByName = /* @__PURE__ */ new Map();
+  for (const table of tables) {
+    const existing = tablesByName.get(table.tableName);
+    if (existing) {
+      throw new OrmDefinitionError(
+        `duplicate table "${table.tableName}" (defined in ${describeFile(existing)} and ${describeFile(table)})`,
+        table.file
+      );
+    }
+    tablesByName.set(table.tableName, table);
+  }
+  const viewsByName = /* @__PURE__ */ new Map();
+  for (const view of views) {
+    const existing = viewsByName.get(view.viewName);
+    if (existing) {
+      throw new OrmDefinitionError(
+        `duplicate view "${view.viewName}" (defined in ${describeFile(existing)} and ${describeFile(view)})`,
+        view.file
+      );
+    }
+    viewsByName.set(view.viewName, view);
+  }
+  const relationsByName = /* @__PURE__ */ new Map();
+  for (const relation of [...tables, ...views]) {
+    const name = relationName(relation);
+    const existing = relationsByName.get(name);
+    if (existing) {
+      throw new OrmDefinitionError(
+        `duplicate relation "${name}" (defined as ${relationKind(existing)} in ${describeFile(existing)} and ${relationKind(relation)} in ${describeFile(relation)})`,
+        relation.file
+      );
+    }
+    relationsByName.set(name, relation);
+  }
+  const enumsByName = /* @__PURE__ */ new Map();
+  for (const ref of enums) {
+    if (enumsByName.has(ref.name)) {
+      throw new OrmDefinitionError(`duplicate enum "${ref.name}"`, config.file);
+    }
+    enumsByName.set(ref.name, ref);
+  }
+  const canonicalTables = tables.map((table) => buildCanonicalTable({ table, relationsByName, enumsByName }));
+  const canonicalEnums = [...enumsByName.values()].map((ref) => ({
+    name: ref.name,
+    values: [...ref.values]
+  }));
+  const viewDrafts = views.map((view) => buildCanonicalView({ view, relationsByName, enumsByName }));
+  const compiledViews = compileViewQueries({
+    namespace: config.namespace,
+    tables: canonicalTables,
+    views: viewDrafts,
+    enums: canonicalEnums,
+    authoredTables: tables,
+    authoredViews: views
+  });
+  const canonicalViews = viewDrafts.map((draft) => {
+    const compiled = compiledViews.get(draft.view);
+    if (!compiled) throw new OrmDefinitionError(`view "${draft.view}" did not compile`, viewsByName.get(draft.view)?.file);
+    return canonicalViewSchema.parse({ ...draft, ...compiled });
+  });
+  assertAcyclicViewDependencies(canonicalViews);
+  const candidate = {
+    definition_format: CANONICAL_FORMAT,
+    namespace: config.namespace,
+    enums: canonicalEnums,
+    tables: canonicalTables,
+    capabilities: {
+      ...config.capabilities.roles !== void 0 ? { roles: config.capabilities.roles } : {},
+      uses: [...config.capabilities.uses ?? []]
+    }
+  };
+  if (config.description !== void 0) candidate.description = config.description;
+  if (canonicalViews.length > 0) candidate.views = canonicalViews;
+  let parsed;
+  try {
+    parsed = canonicalDefinitionSchema.parse(candidate);
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      throw new OrmDefinitionError(`namespace "${config.namespace}": ${formatZodIssues(error)}`, config.file);
+    }
+    throw error;
+  }
+  return normalizeCanonical(parsed);
+}
+function computeCanonicalHash(definition) {
+  return createHash("sha256").update(HASH_DOMAIN).update(stableJson(definition)).digest("hex");
+}
+function buildCanonicalTable({ table, relationsByName, enumsByName }) {
+  const candidate = {
+    table: table.tableName,
+    columns: [],
+    links: [],
+    indexes: [],
+    policies: {},
+    actions: []
+  };
+  if (table.config.description !== void 0) candidate.description = table.config.description;
+  if (table.config.renamedFrom !== void 0) candidate.renamedFrom = table.config.renamedFrom;
+  if (table.source !== void 0) candidate.source = table.source;
+  if (table.source !== void 0) {
+    if (table.config.indexes !== void 0 && table.config.indexes.length > 0) {
+      throw new OrmDefinitionError(
+        `synced table "${table.tableName}" is system-owned; indexes are not allowed`,
+        table.file
+      );
+    }
+    if (table.config.cowMutations !== void 0 && table.config.cowMutations.length > 0) {
+      throw new OrmDefinitionError(
+        `synced table "${table.tableName}" is read-only; cow mutations belong on the overlay table`,
+        table.file
+      );
+    }
+    if (table.config.policies?.write !== void 0 || table.config.policies?.insert !== void 0 || table.config.policies?.update !== void 0) {
+      throw new OrmDefinitionError(`synced table "${table.tableName}" is read-only`, table.file);
+    }
+    for (const [linkName, link] of Object.entries(table.config.links ?? {})) {
+      if (link.enforce) {
+        throw new OrmDefinitionError(
+          `synced table "${table.tableName}": link "${linkName}" cannot enforce foreign keys \u2014 its DDL is owned by the sync`,
+          table.file
+        );
+      }
+    }
+  }
+  const columnLevelPk = [];
+  for (const [propertyName, builder] of Object.entries(table.columns)) {
+    const column = builder.toCanonicalColumn(propertyName);
+    const enumName = builder.enumName;
+    if (enumName !== void 0 && !enumsByName.has(enumName)) {
+      throw new OrmDefinitionError(
+        `table "${table.tableName}": column "${propertyName}" references enum "${enumName}" which is not passed to serializeNamespace \u2014 declare it with defineEnum and include it`,
+        table.file
+      );
+    }
+    if (builder.isPrimaryKey) columnLevelPk.push(column.columnName);
+    candidate.columns?.push(column);
+  }
+  if (table.config.primaryKey !== void 0) {
+    if (columnLevelPk.length > 0) {
+      throw new OrmDefinitionError(
+        `table "${table.tableName}": declare the primary key either with .primaryKey() on columns or with config.primaryKey \u2014 not both`,
+        table.file
+      );
+    }
+    candidate.primaryKey = table.config.primaryKey.map(
+      (ref) => resolveColumnRef({ relation: table, ref, role: "primaryKey" })
+    );
+  } else if (columnLevelPk.length > 0) {
+    candidate.primaryKey = columnLevelPk;
+  }
+  for (const index3 of table.config.indexes ?? []) {
+    const entry = {
+      columns: index3.columns.map((ref) => resolveColumnRef({ relation: table, ref, role: "index" }))
+    };
+    if (index3.unique !== void 0) entry.unique = index3.unique;
+    if (index3.name !== void 0) entry.name = index3.name;
+    candidate.indexes?.push(entry);
+  }
+  for (const [linkName, link] of Object.entries(table.config.links ?? {})) {
+    candidate.links?.push(buildCanonicalLink({ relation: table, linkName, link, relationsByName }));
+  }
+  const policies = {};
+  if (table.config.policies?.read !== void 0) policies.read = toCanonicalPolicy(table.config.policies.read);
+  if (table.config.policies?.write !== void 0) policies.write = toCanonicalPolicy(table.config.policies.write);
+  if (table.config.policies?.insert !== void 0) policies.insert = toCanonicalPolicy(table.config.policies.insert);
+  if (table.config.policies?.update !== void 0) policies.update = toCanonicalPolicy(table.config.policies.update);
+  candidate.policies = policies;
+  const cowMutations = table.config.cowMutations ?? [];
+  if (cowMutations.length > 0) {
+    candidate.cowMutations = cowMutations.map((mutation) => ({
+      kind: mutation.kind,
+      name: mutation.name,
+      synced: mutation.synced,
+      pk: mutation.pk,
+      copy: [...mutation.copy],
+      set: [...mutation.set]
+    }));
+  }
+  try {
+    return canonicalTableSchema.parse(candidate);
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      throw new OrmDefinitionError(`table "${table.tableName}": ${formatZodIssues(error)}`, table.file);
+    }
+    throw error;
+  }
+}
+function buildCanonicalView({
+  view,
+  relationsByName,
+  enumsByName
+}) {
+  if (view.config.policies?.read === void 0) {
+    throw new OrmDefinitionError(`view "${view.viewName}" must declare policies.read`, view.file);
+  }
+  const columns = [];
+  const columnLevelPk = [];
+  for (const [propertyName, builder] of Object.entries(view.columns)) {
+    const column = builder.toCanonicalColumn(propertyName);
+    if (column.default !== void 0 || column.defaultFn !== void 0) {
+      throw new OrmDefinitionError(`view "${view.viewName}": column "${propertyName}" cannot declare a default`, view.file);
+    }
+    if (column.unique) {
+      throw new OrmDefinitionError(`view "${view.viewName}": column "${propertyName}" cannot declare unique`, view.file);
+    }
+    if (column.renamedFrom !== void 0 || column.cast !== void 0) {
+      throw new OrmDefinitionError(`view "${view.viewName}": column "${propertyName}" cannot declare migration hints`, view.file);
+    }
+    const enumName = builder.enumName;
+    if (enumName !== void 0 && !enumsByName.has(enumName)) {
+      throw new OrmDefinitionError(
+        `view "${view.viewName}": column "${propertyName}" references enum "${enumName}" which is not part of this namespace`,
+        view.file
+      );
+    }
+    if (builder.isPrimaryKey) columnLevelPk.push(column.columnName);
+    columns.push(column);
+  }
+  let primaryKey2;
+  if (view.config.primaryKey !== void 0) {
+    if (columnLevelPk.length > 0) {
+      throw new OrmDefinitionError(
+        `view "${view.viewName}": declare the logical primary key either on columns or with config.primaryKey \u2014 not both`,
+        view.file
+      );
+    }
+    primaryKey2 = view.config.primaryKey.map((ref) => resolveColumnRef({ relation: view, ref, role: "primaryKey" }));
+  } else if (columnLevelPk.length > 0) {
+    primaryKey2 = columnLevelPk;
+  }
+  const links = Object.entries(view.config.links ?? {}).map(
+    ([linkName, link]) => buildCanonicalLink({ relation: view, linkName, link, relationsByName })
+  );
+  return {
+    view: view.viewName,
+    ...view.config.description !== void 0 ? { description: view.config.description } : {},
+    columns,
+    ...primaryKey2 !== void 0 ? { primaryKey: primaryKey2 } : {},
+    links,
+    policies: { read: toCanonicalPolicy(view.config.policies.read) }
+  };
+}
+function buildCanonicalLink({
+  relation,
+  linkName,
+  link,
+  relationsByName
+}) {
+  const ownerKind = relationKind(relation);
+  const ownerName = relationName(relation);
+  const fail = (message) => {
+    throw new OrmDefinitionError(`${ownerKind} "${ownerName}": link "${linkName}" ${message}`, relation.file);
+  };
+  if (link.enforce && link.linkKind !== "toOne") {
+    return fail("sets enforce: true, which is only supported on toOne links");
+  }
+  if (link.linkKind === "toPlatformUser") {
+    if (link.target !== void 0) return fail("is toPlatformUser and must not declare a target table");
+    return {
+      name: linkName,
+      kind: "toPlatformUser",
+      on: resolveColumnRef({ relation, ref: link.on, role: `link "${linkName}" on` }),
+      ...link.references !== void 0 ? { references: deriveColumnName(link.references) } : {},
+      enforce: false,
+      ...link.description !== void 0 ? { description: link.description } : {}
+    };
+  }
+  const target = resolveRelationRef({ ref: link.target, fail });
+  const targetName = relationName(target);
+  if (!relationsByName.has(targetName)) {
+    return fail(`targets ${relationKind(target)} "${targetName}" which is not part of this namespace`);
+  }
+  if (link.enforce && (!isSeqTable(relation) || !isSeqTable(target))) {
+    return fail("cannot enforce a PostgreSQL foreign key involving a view");
+  }
+  const owningSide = link.linkKind === "toOne" ? relation : target;
+  const referencedSide = link.linkKind === "toOne" ? target : relation;
+  return {
+    name: linkName,
+    kind: link.linkKind,
+    target: targetName,
+    on: resolveColumnRef({ relation: owningSide, ref: link.on, role: `link "${linkName}" on` }),
+    ...link.references !== void 0 ? { references: resolveColumnRef({ relation: referencedSide, ref: link.references, role: `link "${linkName}" references` }) } : {},
+    enforce: link.enforce,
+    ...link.description !== void 0 ? { description: link.description } : {}
+  };
+}
+function resolveRelationRef({ ref, fail }) {
+  if (ref === void 0) return fail("declares no target relation");
+  if (typeof ref !== "function") return ref;
+  let resolved;
+  try {
+    resolved = ref();
+  } catch (error) {
+    return fail(
+      `target thunk threw (${error instanceof Error ? error.message : String(error)}) \u2014 lazy refs resolve at serialize time; make sure the target module ran`
+    );
+  }
+  if (!isSeqTable(resolved) && !isSeqView(resolved)) {
+    return fail("target thunk did not return a relation defined with defineTable/defineView");
+  }
+  return resolved;
+}
+function resolveColumnRef({ relation, ref, role }) {
+  const direct = relation.columns[ref];
+  if (direct) return direct.columnNameFor(ref);
+  for (const [propertyName, builder] of Object.entries(relation.columns)) {
+    if (builder.columnNameFor(propertyName) === ref) return ref;
+  }
+  const known = Object.keys(relation.columns).join(", ");
+  throw new OrmDefinitionError(
+    `${relationKind(relation)} "${relationName(relation)}": ${role} references unknown column "${ref}" (known columns: ${known || "none"})`,
+    relation.file
+  );
+}
+function assertAcyclicViewDependencies(views) {
+  const viewNames = new Set(views.map((view) => view.view));
+  const remaining = new Map(
+    views.map((view) => [view.view, new Set(view.dependencies.filter((dependency) => viewNames.has(dependency)))])
+  );
+  while (remaining.size > 0) {
+    const ready = [...remaining.entries()].filter(([, dependencies]) => [...dependencies].every((dependency) => !remaining.has(dependency))).map(([name]) => name);
+    if (ready.length === 0) {
+      throw new OrmDefinitionError(`view dependencies form a cycle among: ${[...remaining.keys()].sort().join(", ")}`);
+    }
+    for (const name of ready) remaining.delete(name);
+  }
+}
+function toCanonicalPolicy(policy) {
+  if (typeof policy === "string") return policy;
+  return {
+    default: policy.default,
+    variants: (policy.variants ?? []).map((variant) => ({
+      when: variant.when,
+      ...variant.allow === true ? { allow: true } : {},
+      ...variant.policy !== void 0 ? { policy: variant.policy } : {}
+    }))
+  };
+}
+function describeFile(relation) {
+  return relation.file ?? "<unknown file>";
+}
+function formatZodIssues(error) {
+  return error.issues.map((issue) => issue.path.length > 0 ? `${issue.path.join(".")}: ${issue.message}` : issue.message).join("; ");
+}
+var SYNCED_CONTRACT_HASH_DOMAIN = "sequence-orm-synced-contract\0";
+var ORM_TO_PIPELINE_TYPE = {
+  uuid: "uuid",
+  text: "string",
+  integer: "int",
+  bigint: "long",
+  numeric: "numeric",
+  double: "double",
+  boolean: "boolean",
+  timestamptz: "timestamp",
+  date: "date",
+  jsonb: "json"
+};
+function isColumnType(value) {
+  return typeof value === "string" && value in ORM_TO_PIPELINE_TYPE;
+}
+function syncedContractSurface({
+  namespace,
+  table,
+  columns,
+  primary_key
+}) {
+  return {
+    namespace,
+    table,
+    columns: Object.fromEntries(
+      Object.entries(columns).map(([name, column]) => [
+        name,
+        { type: column.type, nullable: column.nullable, key: column.key }
+      ])
+    ),
+    primary_key: [...primary_key]
+  };
+}
+function computeSyncedContractHash(surface) {
+  return createHash("sha256").update(SYNCED_CONTRACT_HASH_DOMAIN).update(stableJson(surface)).digest("hex");
+}
+function extractOrmSyncedTableContract({
+  namespace,
+  table
+}) {
+  if (!NAMESPACE_PATTERN.test(namespace)) {
+    throw new OrmDefinitionError(
+      `namespace "${namespace}" must match ${NAMESPACE_PATTERN}`
+    );
+  }
+  if (table.source === void 0) {
+    throw new OrmDefinitionError(
+      `table "${table.table}" is not a synced table \u2014 extractOrmSyncedTableContract requires source: gold.*`
+    );
+  }
+  if (table.columns.length === 0) {
+    throw new OrmDefinitionError(
+      `synced table "${table.table}" has no typed columns \u2014 declare a typed defineSyncedTable contract before exporting`
+    );
+  }
+  const primaryKey2 = table.primaryKey;
+  if (primaryKey2 === void 0 || primaryKey2.length === 0) {
+    throw new OrmDefinitionError(
+      `synced table "${table.table}" has no primary key \u2014 typed synced contracts require a primary key`
+    );
+  }
+  const pkSet = new Set(primaryKey2);
+  const columns = {};
+  for (const column of table.columns) {
+    if (!isColumnType(column.type)) {
+      const enumName = typeof column.type === "object" && column.type !== null && "enum" in column.type ? column.type.enum : String(column.type);
+      throw new OrmDefinitionError(
+        `synced table "${table.table}": column "${column.columnName}" has enum/type '${enumName}', which has no pipeline-type mapping \u2014 use an ORM-mappable scalar`
+      );
+    }
+    columns[column.columnName] = {
+      type: ORM_TO_PIPELINE_TYPE[column.type],
+      nullable: column.nullable,
+      key: pkSet.has(column.columnName)
+    };
+  }
+  for (const key of primaryKey2) {
+    if (!(key in columns)) {
+      throw new OrmDefinitionError(
+        `synced table "${table.table}": primary key column "${key}" is not declared in columns`
+      );
+    }
+  }
+  const surface = syncedContractSurface({
+    namespace,
+    table: table.table,
+    columns,
+    primary_key: primaryKey2
+  });
+  return {
+    namespace,
+    table: table.table,
+    columns,
+    primary_key: [...primaryKey2],
+    content_hash: computeSyncedContractHash(surface)
+  };
+}
+var NAMESPACE_CONFIG_FILE = "sequence.config.ts";
+var SCHEMA_DIR = "schema";
+async function loadNamespaceFromDir(dir, options = {}) {
+  const root = await realpath(dir).catch(() => {
+    throw new OrmDefinitionError(`namespace directory not found: ${dir}`);
+  });
+  const configPath = join(root, NAMESPACE_CONFIG_FILE);
+  const configStat = await stat(configPath).catch(() => void 0);
+  if (!configStat?.isFile()) {
+    throw new OrmDefinitionError(`${NAMESPACE_CONFIG_FILE} not found in ${dir}`);
+  }
+  const schemaFiles = await listSchemaFiles(root);
+  const files = [NAMESPACE_CONFIG_FILE, ...schemaFiles];
+  purgeModuleCache(root);
+  const jiti = createJiti(import.meta.url, {
+    interopDefault: true,
+    fsCache: false,
+    ...options.ormModulePath !== void 0 ? { alias: { "@sequenceholdings/orm": options.ormModulePath } } : {}
+  });
+  const context = beginAuthoringContext();
+  try {
+    for (const file of files) {
+      context.currentFile = file;
+      try {
+        await jiti.import(join(root, file));
+      } catch (error) {
+        if (error instanceof Error && error.name === "OrmDefinitionError") throw error;
+        throw new OrmDefinitionError(
+          `failed to load: ${error instanceof Error ? error.message : String(error)}`,
+          file
+        );
+      }
+    }
+  } finally {
+    context.currentFile = void 0;
+    endAuthoringContext(context);
+  }
+  const configs = [];
+  for (const entry of context.configs) {
+    if (isSeqNamespaceConfig(entry.value)) configs.push({ value: entry.value, file: entry.file });
+  }
+  const configEntry = configs[0];
+  if (!configEntry) {
+    throw new OrmDefinitionError(
+      "no namespace config registered \u2014 sequence.config.ts must call defineNamespace(...) at import time",
+      NAMESPACE_CONFIG_FILE
+    );
+  }
+  if (configs.length > 1) {
+    const where = configs.map((entry) => entry.file ?? "<unknown file>").join(", ");
+    throw new OrmDefinitionError(
+      `defineNamespace called ${configs.length} times (${where}) \u2014 declare exactly one namespace config`
+    );
+  }
+  const tables = [];
+  for (const entry of context.tables) {
+    if (isSeqTable(entry.value)) tables.push(entry.value);
+  }
+  const views = [];
+  for (const entry of context.views) {
+    if (isSeqView(entry.value)) views.push(entry.value);
+  }
+  if (tables.length === 0 && views.length === 0) {
+    throw new OrmDefinitionError(
+      `no relations registered \u2014 ${SCHEMA_DIR}/*.ts modules must call defineTable(...) or defineView(...) at import time`
+    );
+  }
+  const enums = [];
+  for (const entry of context.enums) {
+    if (isEnumRef(entry.value)) enums.push(entry.value);
+  }
+  const canonical = serializeNamespace({ config: configEntry.value, tables, views, enums });
+  return { canonical, hash: computeCanonicalHash(canonical), files };
+}
+async function listSchemaFiles(root) {
+  const schemaDir = join(root, SCHEMA_DIR);
+  const entries = await readdir(schemaDir, { withFileTypes: true }).catch(() => []);
+  return entries.filter(
+    (entry) => entry.isFile() && entry.name.endsWith(".ts") && !entry.name.endsWith(".d.ts") && !entry.name.startsWith(".")
+  ).map((entry) => join(SCHEMA_DIR, entry.name)).sort();
+}
+function purgeModuleCache(root) {
+  const require2 = createRequire(import.meta.url);
+  const prefix = root.endsWith(sep) ? root : `${root}${sep}`;
+  for (const key of Object.keys(require2.cache)) {
+    if (key.startsWith(prefix)) delete require2.cache[key];
+  }
+}
 
 // src/codegen/types.ts
 var WIRE_TYPES = {
@@ -27,13 +2047,17 @@ function generateNamespaceTypes(definition) {
     `export type ${typesInterfaceName(definition.namespace)} = {`
   ];
   for (const table of definition.tables) {
-    if (table.source) {
+    const columns = Object.entries(table.columns ?? {});
+    if (table.source && columns.length === 0) {
       lines.push(`  /** Synced from ${table.source} \u2014 columns reflect the gold source. */`);
       lines.push(`  ${table.table}: Record<string, unknown>`);
       continue;
     }
+    if (table.source) {
+      lines.push(`  /** Synced from ${table.source} \u2014 read-only typed contract. */`);
+    }
     lines.push(`  ${table.table}: {`);
-    for (const [name, column] of Object.entries(table.columns ?? {})) {
+    for (const [name, column] of columns) {
       if (column.deprecated) continue;
       lines.push(`    ${name}: ${columnWireType(column)}`);
     }
@@ -84,43 +2108,6 @@ function columnWireType(column) {
   return notNull || base === "unknown" ? base : `${base} | null`;
 }
 
-// src/constants.ts
-var NAMESPACE_PATTERN = /^[a-z][a-z0-9_]{0,40}$/;
-var IDENTIFIER_PATTERN = /^[a-z][a-z0-9_]*$/;
-var MAX_IDENTIFIER_LENGTH = 63;
-var ORM_DATA_TOKEN_HEADER = "x-sequence-data-token";
-var ORM_SERVICE_DATA_TOKEN_HEADER = "x-sequence-data-token-service";
-var CAPABILITY_KEY_PATTERN = /^(?:org\/)?[a-z0-9-]{1,64}$/;
-var CLAIM_KEY_PATTERN = /^[a-z][a-z0-9_]*$/;
-var QUALIFIED_TABLE_PATTERN = /^[a-z][a-z0-9_]*\.[a-z][a-z0-9_]*$/;
-var SYNCED_SOURCE_PATTERN = /^gold\.[a-z][a-z0-9_]*$/;
-var ORM_SCHEMA_PREFIX = "orm_";
-var CONSUMER_ROLE_SUFFIX = "_consumer";
-var ormSchemaName = (namespace) => `${ORM_SCHEMA_PREFIX}${namespace}`;
-var consumerRoleName = (namespace) => `${ORM_SCHEMA_PREFIX}${namespace}${CONSUMER_ROLE_SUFFIX}`;
-var DEFINITION_FILE_EXTENSIONS = [".yml", ".yaml"];
-var NAMESPACE_CONFIG_FILENAMES = /* @__PURE__ */ new Set(["namespace.yaml", "namespace.yml"]);
-var HASH_DOMAIN = "sequence-orm-definitions\0";
-var MAX_DEFINITION_FILE_BYTES = 1024 * 1024;
-var RESERVED_TABLE_NAMES = /* @__PURE__ */ new Set(["actions", "query"]);
-var RESERVED_COLUMN_NAMES = /* @__PURE__ */ new Set(["select", "order", "limit", "offset"]);
-
-// src/errors.ts
-var OrmDefinitionError = class extends Error {
-  constructor(message, file) {
-    super(file ? `${file}: ${message}` : message);
-    this.file = file;
-  }
-  name = "OrmDefinitionError";
-};
-var PredicateParseError = class extends Error {
-  constructor(message, position) {
-    super(`${message} (at position ${position})`);
-    this.position = position;
-  }
-  name = "PredicateParseError";
-};
-
 // src/predicate/ast.ts
 var COMPARE_OPS = ["=", "!=", "<", "<=", ">", ">="];
 function walkPredicate(predicate, visit) {
@@ -159,7 +2146,7 @@ var tableReferenceSchema = z.string().refine(
 var isQualifiedReference = (reference) => reference.includes(".");
 
 // src/schema/columns.ts
-var COLUMN_TYPES = [
+var COLUMN_TYPES2 = [
   "uuid",
   "text",
   "integer",
@@ -171,7 +2158,7 @@ var COLUMN_TYPES = [
   "date",
   "jsonb"
 ];
-var columnTypeSchema = z.enum(COLUMN_TYPES);
+var columnTypeSchema2 = z.enum(COLUMN_TYPES2);
 var FUNCTION_DEFAULTS = {
   "gen_random_uuid()": ["uuid"],
   "now()": ["timestamptz", "date"]
@@ -200,7 +2187,7 @@ function defaultIssue(value, type) {
   return null;
 }
 var columnSchema = z.strictObject({
-  type: columnTypeSchema,
+  type: columnTypeSchema2,
   primary_key: z.boolean().optional(),
   nullable: z.boolean().optional(),
   unique: z.boolean().optional(),
@@ -467,7 +2454,7 @@ var NAMED_PARAM_PATTERN = /(?<!:):([a-z][a-z0-9_]*)/g;
 var QUOTED_STRING_PATTERN = /'(?:[^']|'')*'/g;
 var SQL_COMMENT_PATTERN = /--|\/\*/;
 var actionParamSchema = z.strictObject({
-  type: columnTypeSchema,
+  type: columnTypeSchema2,
   optional: z.boolean().optional(),
   description: z.string().optional()
 });
@@ -500,7 +2487,7 @@ var actionSchema = z.strictObject({
   // function returns those rows (typed in the client); absent → the action
   // reports rows_affected only. The column names/types must match the
   // RETURNING list, which Postgres enforces at CREATE FUNCTION.
-  returns: z.record(identifierSchema, columnTypeSchema).optional(),
+  returns: z.record(identifierSchema, columnTypeSchema2).optional(),
   audit: auditSchema.optional()
 }).superRefine((action, ctx) => {
   const params = Object.keys(action.params ?? {});
@@ -517,18 +2504,18 @@ var actionSchema = z.strictObject({
   if (action.returns && Object.keys(action.returns).length === 0) {
     ctx.addIssue({ code: "custom", message: "returns must declare at least one column", path: ["returns"] });
   }
-  for (const [index2, entry] of (action.validates ?? []).entries()) {
+  for (const [index3, entry] of (action.validates ?? []).entries()) {
     if (!params.includes(entry.param)) {
       ctx.addIssue({
         code: "custom",
         message: `validates references undeclared param '${entry.param}'`,
-        path: ["validates", index2]
+        path: ["validates", index3]
       });
     }
   }
 });
-function extractNamedParams(sql2) {
-  const withoutStrings = sql2.replace(QUOTED_STRING_PATTERN, "''");
+function extractNamedParams(sql4) {
+  const withoutStrings = sql4.replace(QUOTED_STRING_PATTERN, "''");
   const names = [...withoutStrings.matchAll(NAMED_PARAM_PATTERN)].map((match) => match[1]);
   return [...new Set(names)];
 }
@@ -561,9 +2548,9 @@ function actionWriteTargets(action) {
 function executesIssues(executes, declaredParams, hasReturns) {
   const issues = [];
   const statements = actionStatementSources(executes);
-  statements.forEach((statement, index2) => {
+  statements.forEach((statement, index3) => {
     const withoutStrings = statement.replace(QUOTED_STRING_PATTERN, "''");
-    const at = statements.length > 1 ? ` (statement ${index2 + 1})` : "";
+    const at = statements.length > 1 ? ` (statement ${index3 + 1})` : "";
     if (!EXECUTES_VERB_PATTERN.test(statement)) issues.push(`executes must be INSERT, UPDATE, or DELETE${at}`);
     if (withoutStrings.replace(/;\s*$/, "").includes(";")) issues.push(`each executes entry must be a single statement${at}`);
     if (SQL_COMMENT_PATTERN.test(withoutStrings)) issues.push(`executes must not contain SQL comments${at}`);
@@ -573,7 +2560,7 @@ function executesIssues(executes, declaredParams, hasReturns) {
     if (BARE_CLAIM_CALL_PATTERN.test(withoutStrings.replace(MASKED_CLAIM_CALL_PATTERN, ""))) {
       issues.push(`executes has a malformed claim()/capability() call \u2014 use e.g. claim('sub')${at}`);
     }
-    if (RETURNING_PATTERN.test(withoutStrings) && !(hasReturns && index2 === statements.length - 1)) {
+    if (RETURNING_PATTERN.test(withoutStrings) && !(hasReturns && index3 === statements.length - 1)) {
       issues.push(
         hasReturns ? `only the last executes statement may use RETURNING${at}` : `executes must not use RETURNING unless the action declares returns${at}`
       );
@@ -598,11 +2585,13 @@ var sqlTypeName = (type) => SQL_TYPE_NAMES[type] ?? type;
 // src/compiler/sql.ts
 var CLAIMS_SETTING = "request.jwt.claims";
 var CAPABILITIES_CLAIM_KEY = "capabilities";
+var ROLES_CLAIM_KEY = "roles";
 var quoteIdentifier = (name) => `"${name.replaceAll('"', '""')}"`;
 var quoteLiteral = (value) => `'${value.replaceAll("'", "''")}'`;
 var CLAIMS_SOURCE = `nullif(current_setting('${CLAIMS_SETTING}', true), '')::jsonb`;
 var claimExpression = (key) => `(${CLAIMS_SOURCE} ->> ${quoteLiteral(key)})`;
 var capabilityExpression = (key) => `coalesce(${CLAIMS_SOURCE} -> '${CAPABILITIES_CLAIM_KEY}' ? ${quoteLiteral(key)}, false)`;
+var roleExpression = (key) => `coalesce(${CLAIMS_SOURCE} -> '${ROLES_CLAIM_KEY}' ? ${quoteLiteral(key)}, false)`;
 
 // src/compiler/predicates.ts
 var SQL_COMPARE_OPS = {
@@ -683,8 +2672,8 @@ var actionParamArg = (name) => `p_${name}`;
 function compileActionStatements(action, renderParam = actionParamArg) {
   return actionStatementSources(action.executes).map((statement) => compileStatement(statement, renderParam));
 }
-function compileStatement(sql2, renderParam) {
-  const compiled = sql2.replace(TOKEN_PATTERN, (token, claimKey, capabilityKey, paramName) => {
+function compileStatement(sql4, renderParam) {
+  const compiled = sql4.replace(TOKEN_PATTERN, (token, claimKey, capabilityKey, paramName) => {
     if (claimKey !== void 0) {
       if (!CLAIM_KEY_PATTERN.test(claimKey)) throw new OrmDefinitionError(`invalid claim key in executes: ${token}`);
       return claimExpression(claimKey);
@@ -716,6 +2705,118 @@ function referencedExecuteCapabilities(action) {
   return keys;
 }
 
+// src/compiler/pred-ir-sql.ts
+function compilePredIrToSql(pred, options = {}) {
+  switch (pred.kind) {
+    case "const":
+      return pred.value ? "TRUE" : "FALSE";
+    case "and":
+      return `(${pred.operands.map((operand) => compilePredIrToSql(operand, options)).join(" AND ")})`;
+    case "or":
+      return `(${pred.operands.map((operand) => compilePredIrToSql(operand, options)).join(" OR ")})`;
+    case "not":
+      return `(NOT ${compilePredIrToSql(pred.operand, options)})`;
+    case "cmp":
+      return compileCmp(pred.op, pred.column, pred.value, options);
+    case "capability":
+      return `(${capabilityExpression(pred.key)})`;
+    case "role":
+      return `(${roleExpression(pred.key)})`;
+    case "exists":
+    case "aggPredicate":
+    case "dynamicFilter":
+      throw new OrmDefinitionError(
+        `synced view read policy cannot use '${pred.kind}' \u2014 use row filters and claim/capability/role checks only`
+      );
+    default: {
+      const exhausted = pred;
+      throw new OrmDefinitionError(`unsupported synced view predicate kind '${String(exhausted)}'`);
+    }
+  }
+}
+function physicalColumn(logical, options) {
+  return options.columnNames?.[logical] ?? logical;
+}
+function compileCmp(op, column, value, options) {
+  const physical = physicalColumn(column, options);
+  const declared = options.columnTypes?.[physical] ?? options.columnTypes?.[column];
+  const isEnum = typeof declared === "object" && declared !== null;
+  const col = isEnum ? `${quoteIdentifier(physical)}::text` : quoteIdentifier(physical);
+  const columnType = isEnum ? "text" : declared;
+  switch (op) {
+    case "eq":
+      return compileEquality(col, value, columnType, false);
+    case "neq":
+      return compileEquality(col, value, columnType, true);
+    case "gt":
+      return `${col} > ${compileValue(value, columnType)}`;
+    case "gte":
+      return `${col} >= ${compileValue(value, columnType)}`;
+    case "lt":
+      return `${col} < ${compileValue(value, columnType)}`;
+    case "lte":
+      return `${col} <= ${compileValue(value, columnType)}`;
+    case "in":
+      return `${col} = ANY(${compileArrayValue(value, columnType)})`;
+    case "nin":
+      return `${col} <> ALL(${compileArrayValue(value, columnType)})`;
+    case "like":
+      return `${col} LIKE ${compileValue(value, columnType)}`;
+    case "ilike":
+      return `${col} ILIKE ${compileValue(value, columnType)}`;
+    case "isNull":
+      return value.kind === "literal" && value.value === true ? `${col} IS NULL` : `${col} IS NOT NULL`;
+    case "contains":
+    case "hasKey":
+      throw new OrmDefinitionError(`synced view read policy cannot use json operator '${op}'`);
+    default: {
+      const exhausted = op;
+      throw new OrmDefinitionError(`unsupported synced view comparison '${String(exhausted)}'`);
+    }
+  }
+}
+function compileEquality(col, value, columnType, negated, options) {
+  if (value.kind === "literal" && value.value === null) {
+    return negated ? `${col} IS NOT NULL` : `${col} IS NULL`;
+  }
+  const rhs = compileValue(value, columnType);
+  return negated ? `${col} <> ${rhs}` : `${col} = ${rhs}`;
+}
+function compileValue(value, columnType, _options) {
+  switch (value.kind) {
+    case "literal": {
+      const literal = value.value;
+      if (literal === null) return "NULL";
+      if (typeof literal === "string") return quoteLiteral(literal);
+      if (typeof literal === "boolean") return literal ? "TRUE" : "FALSE";
+      return String(literal);
+    }
+    case "claim": {
+      const expression = claimExpression(value.key);
+      return columnType && columnType !== "text" ? `(${expression})::${sqlTypeName(columnType)}` : expression;
+    }
+    case "variable":
+      throw new OrmDefinitionError("synced view read policy cannot reference operation variables");
+    default: {
+      const exhausted = value;
+      throw new OrmDefinitionError(`unsupported synced view value kind '${String(exhausted)}'`);
+    }
+  }
+}
+function compileArrayValue(value, columnType, _options) {
+  if (value.kind !== "literal" || !Array.isArray(value.value)) {
+    throw new OrmDefinitionError("synced view IN/NIN comparisons require literal arrays");
+  }
+  const entries = value.value.map((entry) => {
+    if (entry === null) return "NULL";
+    if (typeof entry === "string") return quoteLiteral(entry);
+    if (typeof entry === "boolean") return entry ? "TRUE" : "FALSE";
+    return String(entry);
+  });
+  const array = `ARRAY[${entries.join(", ")}]`;
+  return columnType ? `${array}::${sqlTypeName(columnType)}[]` : array;
+}
+
 // src/engine/actions.ts
 var ACTION_REQUIRES_DENIED_SQLSTATE = "ORMRQ";
 var ACTION_VALIDATES_FAILED_SQLSTATE = "ORMVL";
@@ -737,9 +2838,9 @@ function actionPrepareChecks(definition) {
     const order = actionParamOrder(action);
     const signature = order.length > 0 ? ` (${order.map((param) => sqlTypeName(action.params[param].type)).join(", ")})` : "";
     const compiled = compileActionStatements(action, (param) => `$${order.indexOf(param) + 1}`);
-    compiled.forEach((sql2, index2) => {
-      const checked = action.returns && index2 === compiled.length - 1 ? returnProjection(action.returns, sql2) : sql2;
-      statements.push(`PREPARE ${quoteIdentifier(`orm_check_${name}_${index2}`)}${signature} AS ${checked}`);
+    compiled.forEach((sql4, index3) => {
+      const checked = action.returns && index3 === compiled.length - 1 ? returnProjection(action.returns, sql4) : sql4;
+      statements.push(`PREPARE ${quoteIdentifier(`orm_check_${name}_${index3}`)}${signature} AS ${checked}`);
     });
   }
   return statements;
@@ -854,10 +2955,12 @@ var indexSchema = z.union([
     unique: z.boolean().optional(),
     name: identifierSchema.optional()
   })
-]).transform((index2) => Array.isArray(index2) ? { columns: index2 } : index2);
+]).transform((index3) => Array.isArray(index3) ? { columns: index3 } : index3);
 var policiesSchema = z.strictObject({
   read: parsedPredicateSchema.optional(),
-  write: parsedPredicateSchema.optional()
+  write: parsedPredicateSchema.optional(),
+  insert: parsedPredicateSchema.optional(),
+  update: parsedPredicateSchema.optional()
 });
 var tableFileSchema = z.strictObject({
   namespace: namespaceSchema,
@@ -877,32 +2980,64 @@ var tableFileSchema = z.strictObject({
     if (RESERVED_COLUMN_NAMES.has(name)) {
       ctx.addIssue({
         code: "custom",
-        message: `column '${name}' collides with the Data API's reserved query parameters (select, order, limit, offset) \u2014 it could never be filtered`,
-        path: ["columns", name]
+        message: `column '${name}' collides with the Data API's reserved query parameters (select, order, limit, offset) \u2014 it could never be filtered`,
+        path: ["columns", name]
+      });
+    }
+  }
+  if (table.source) validateSyncedTable(table, ctx);
+  else validateColumnTable(table, ctx);
+  validateLinks(table, ctx);
+  validatePolicyColumns(table, ctx);
+  validateDerivedNameLengths(table, ctx);
+});
+var indexName = (table, definition) => definition.name ?? `ix_${table}_${definition.columns.join("_")}`;
+var policyName = (table, suffix) => `${table}_${suffix}`;
+var foreignKeyName = (table, link) => `fk_${table}_${link}`;
+function validateSyncedTable(table, ctx) {
+  const forbidden = [
+    ["actions", "synced tables are read-only; actions are not allowed"],
+    ["indexes", "synced tables are system-owned; indexes are not allowed"]
+  ];
+  for (const [field, message] of forbidden) {
+    if (table[field] !== void 0) ctx.addIssue({ code: "custom", message, path: [field] });
+  }
+  if (table.policies?.write) {
+    ctx.addIssue({ code: "custom", message: "synced tables are read-only", path: ["policies", "write"] });
+  }
+  if (table.policies?.insert) {
+    ctx.addIssue({ code: "custom", message: "synced tables are read-only", path: ["policies", "insert"] });
+  }
+  if (table.policies?.update) {
+    ctx.addIssue({ code: "custom", message: "synced tables are read-only", path: ["policies", "update"] });
+  }
+  const columns = table.columns ?? {};
+  const names = Object.keys(columns);
+  if (names.length === 0) return;
+  const primaryKeys = names.filter((name) => columns[name]?.primary_key);
+  if (primaryKeys.length !== 1) {
+    ctx.addIssue({ code: "custom", message: "exactly one column must be primary_key", path: ["columns"] });
+  }
+  validateRenames(columns, names, ctx);
+  for (const name of names) {
+    const column = columns[name];
+    if (!column) continue;
+    const cast = column.cast ? castParts(column.cast) : null;
+    if (column.cast && cast?.column !== name) {
+      ctx.addIssue({
+        code: "custom",
+        message: "cast must reference the column it is declared on",
+        path: ["columns", name, "cast"]
+      });
+    }
+    if (cast && cast.type !== column.type) {
+      ctx.addIssue({
+        code: "custom",
+        message: `cast target '${cast.type}' must match the declared type '${column.type}'`,
+        path: ["columns", name, "cast"]
       });
     }
   }
-  if (table.source) validateSyncedTable(table, ctx);
-  else validateColumnTable(table, ctx);
-  validateLinks(table, ctx);
-  validatePolicyColumns(table, ctx);
-  validateDerivedNameLengths(table, ctx);
-});
-var indexName = (table, definition) => definition.name ?? `ix_${table}_${definition.columns.join("_")}`;
-var policyName = (table, suffix) => `${table}_${suffix}`;
-var foreignKeyName = (table, link) => `fk_${table}_${link}`;
-function validateSyncedTable(table, ctx) {
-  const forbidden = [
-    ["columns", "synced tables reflect their source; columns are not declared"],
-    ["actions", "synced tables are read-only; actions are not allowed"],
-    ["indexes", "synced tables are system-owned; indexes are not allowed"]
-  ];
-  for (const [field, message] of forbidden) {
-    if (table[field] !== void 0) ctx.addIssue({ code: "custom", message, path: [field] });
-  }
-  if (table.policies?.write) {
-    ctx.addIssue({ code: "custom", message: "synced tables are read-only", path: ["policies", "write"] });
-  }
 }
 function validateRenames(columns, names, ctx) {
   const renameSources = /* @__PURE__ */ new Map();
@@ -958,15 +3093,15 @@ function validateColumnTable(table, ctx) {
       });
     }
   }
-  for (const [position, index2] of (table.indexes ?? []).entries()) {
-    if (new Set(index2.columns).size !== index2.columns.length) {
+  for (const [position, index3] of (table.indexes ?? []).entries()) {
+    if (new Set(index3.columns).size !== index3.columns.length) {
       ctx.addIssue({
         code: "custom",
         message: "index names a column more than once",
         path: ["indexes", position]
       });
     }
-    for (const column of index2.columns) {
+    for (const column of index3.columns) {
       if (!names.includes(column)) {
         ctx.addIssue({
           code: "custom",
@@ -980,7 +3115,7 @@ function validateColumnTable(table, ctx) {
 function validateLinks(table, ctx) {
   const columnNames = Object.keys(table.columns ?? {});
   for (const [name, link] of Object.entries(table.links ?? {})) {
-    if (!table.source && !columnNames.includes(link.on)) {
+    if (columnNames.length > 0 && !columnNames.includes(link.on)) {
       ctx.addIssue({ code: "custom", message: `link references unknown column '${link.on}'`, path: ["links", name, "on"] });
     }
     if (link.enforce && link.to.includes(".")) {
@@ -1008,8 +3143,8 @@ function validateDerivedNameLengths(table, ctx) {
       path: ["table"]
     });
   }
-  for (const [position, index2] of (table.indexes ?? []).entries()) {
-    const name = indexName(table.table, index2);
+  for (const [position, index3] of (table.indexes ?? []).entries()) {
+    const name = indexName(table.table, index3);
     if (name.length > MAX_IDENTIFIER_LENGTH) {
       ctx.addIssue({
         code: "custom",
@@ -1053,10 +3188,10 @@ var TYPE_GROUPS = {
 };
 var columnTypeGroup = (type) => TYPE_GROUPS[type];
 function validatePolicyColumns(table, ctx) {
-  if (table.source) return;
   const columns = table.columns ?? {};
   const columnNames = Object.keys(columns);
-  for (const kind of ["read", "write"]) {
+  if (columnNames.length === 0) return;
+  for (const kind of ["read", "write", "insert", "update"]) {
     const predicate = table.policies?.[kind];
     if (!predicate) continue;
     for (const column of referencedColumns(predicate.ast)) {
@@ -1133,19 +3268,339 @@ function policyStatements(schema, table) {
   if (read) {
     statements.push(`CREATE POLICY ${policyName2("read")} ON ${qualified} FOR SELECT USING (${compilePredicate(read.ast, columnTypes)})`);
   }
-  const write = table.policies?.write;
-  if (write) {
-    const predicate = compilePredicate(write.ast, columnTypes);
-    statements.push(`CREATE POLICY ${policyName2("insert")} ON ${qualified} FOR INSERT WITH CHECK (${predicate})`);
+  const insertPolicy = table.policies?.insert ?? table.policies?.write;
+  const updatePolicy = table.policies?.update ?? table.policies?.write;
+  if (insertPolicy) {
+    statements.push(
+      `CREATE POLICY ${policyName2("insert")} ON ${qualified} FOR INSERT WITH CHECK (${compilePredicate(insertPolicy.ast, columnTypes)})`
+    );
+  }
+  if (updatePolicy) {
+    const predicate = compilePredicate(updatePolicy.ast, columnTypes);
     statements.push(
       `CREATE POLICY ${policyName2("update")} ON ${qualified} FOR UPDATE USING (${predicate}) WITH CHECK (${predicate})`
     );
     statements.push(`CREATE POLICY ${policyName2("delete")} ON ${qualified} FOR DELETE USING (${predicate})`);
   }
-  return statements;
+  return statements;
+}
+var columnTables = (definition) => definition.tables.filter((table) => !table.source);
+var syncedTables = (definition) => definition.tables.filter((table) => !!table.source);
+var SYNCED_VIEW_EXECUTION_OWNER_ROLE = "orm_exec";
+function syncedViewStatements({
+  definition,
+  backings,
+  readPolicyIrByTable,
+  columnNamesByTable,
+  columnTypesByTable,
+  executionOwnerRole = SYNCED_VIEW_EXECUTION_OWNER_ROLE
+}) {
+  const schema = quoteIdentifier(ormSchemaName(definition.namespace));
+  const role = quoteIdentifier(consumerRoleName(definition.namespace));
+  const owner = quoteIdentifier(executionOwnerRole);
+  const backingMap = /* @__PURE__ */ new Map();
+  for (const backing of backings) {
+    const existing = backingMap.get(backing.table);
+    if (existing) {
+      throw new OrmDefinitionError(
+        `duplicate synced backing for table "${backing.table}" ('${existing.physicalRelation}' and '${backing.physicalRelation}') \u2014 refusing to materialize an ambiguous authorization boundary`
+      );
+    }
+    backingMap.set(backing.table, backing);
+  }
+  const statements = [];
+  for (const table of syncedTables(definition)) {
+    const backing = backingMap.get(table.table);
+    if (!backing) continue;
+    const viewName = `${schema}.${quoteIdentifier(table.table)}`;
+    const physical = splitPhysicalRelation(backing.physicalRelation);
+    const physicalTarget = `${quoteIdentifier(physical.schema)}.${quoteIdentifier(physical.table)}`;
+    const columnTypes = mergeSyncedViewColumnTypes({
+      table,
+      canonicalColumnTypes: columnTypesByTable?.get(table.table),
+      backingColumnTypes: backing.columnTypes,
+      columnNames: columnNamesByTable?.get(table.table)
+    });
+    const readPolicyIr = readPolicyIrByTable?.get(table.table);
+    const readPolicy = table.policies?.read;
+    const whereClause = readPolicyIr ? ` WHERE ${compilePredIrToSql(readPolicyIr, {
+      columnTypes,
+      columnNames: columnNamesByTable?.get(table.table)
+    })}` : readPolicy ? ` WHERE ${compilePredicate(readPolicy.ast, narrowToV1ColumnTypes(columnTypes))}` : " WHERE false";
+    statements.push(`GRANT USAGE ON SCHEMA ${quoteIdentifier(physical.schema)} TO ${owner}`);
+    statements.push(`GRANT SELECT ON ${physicalTarget} TO ${owner}`);
+    statements.push(
+      `CREATE OR REPLACE VIEW ${viewName} AS SELECT * FROM ${physicalTarget}${whereClause}`
+    );
+    statements.push(`GRANT SELECT ON ${viewName} TO ${role}`);
+  }
+  return statements;
+}
+function mergeSyncedViewColumnTypes({
+  table,
+  canonicalColumnTypes,
+  backingColumnTypes,
+  columnNames
+}) {
+  const fromTable = {};
+  for (const [name, def] of Object.entries(table.columns ?? {})) {
+    if (def?.type) fromTable[name] = def.type;
+  }
+  if (columnNames) {
+    for (const [logical, physical] of Object.entries(columnNames)) {
+      const declared = fromTable[physical] ?? fromTable[logical];
+      if (!declared) continue;
+      fromTable[physical] = declared;
+      fromTable[logical] = declared;
+    }
+  }
+  const canonicalEnums = Object.fromEntries(
+    Object.entries(canonicalColumnTypes ?? {}).filter(([, type]) => typeof type === "object")
+  );
+  return { ...fromTable, ...canonicalColumnTypes ?? {}, ...backingColumnTypes ?? {}, ...canonicalEnums };
+}
+function narrowToV1ColumnTypes(columnTypes) {
+  return Object.fromEntries(
+    Object.entries(columnTypes).map(([column, type]) => [column, typeof type === "object" ? "text" : type])
+  );
+}
+function splitPhysicalRelation(physicalRelation) {
+  const parts = physicalRelation.split(".");
+  if (parts.length === 1 && parts[0]) return { schema: "public", table: parts[0] };
+  if (parts.length === 2 && parts[0] && parts[1]) return { schema: parts[0], table: parts[1] };
+  throw new OrmDefinitionError(
+    `synced view physical relation must be "table" or "schema.table" (got "${physicalRelation}")`
+  );
+}
+function syncedViewDropStatements({
+  schemaName,
+  tables
+}) {
+  const schema = quoteIdentifier(schemaName);
+  return tables.map(
+    (table) => `DROP VIEW IF EXISTS ${schema}.${quoteIdentifier(table)} CASCADE`
+  );
+}
+function syncedBackingRevokeStatements({
+  backings,
+  executionOwnerRole = SYNCED_VIEW_EXECUTION_OWNER_ROLE
+}) {
+  const owner = quoteIdentifier(executionOwnerRole);
+  const seen = /* @__PURE__ */ new Set();
+  const statements = [];
+  for (const backing of backings) {
+    const physical = splitPhysicalRelation(backing.physicalRelation);
+    const physicalTarget = `${quoteIdentifier(physical.schema)}.${quoteIdentifier(physical.table)}`;
+    if (seen.has(physicalTarget)) continue;
+    seen.add(physicalTarget);
+    statements.push(`REVOKE SELECT ON ${physicalTarget} FROM ${owner}`);
+  }
+  return statements;
+}
+var FACTORIES = {
+  uuid: (name) => uuid(name),
+  text: (name) => text(name),
+  integer: (name) => integer(name),
+  // Mode 'bigint' keeps int8 lossless — mode 'number' silently rounds past
+  // 2^53. The read executor serializes BigInt to string for JSON.
+  bigint: (name) => bigint(name, { mode: "bigint" }),
+  numeric: (name) => numeric(name),
+  double: (name) => doublePrecision(name),
+  boolean: (name) => boolean(name),
+  timestamptz: (name) => timestamp(name, { withTimezone: true }),
+  date: (name) => date(name),
+  jsonb: (name) => jsonb(name)
+};
+function buildColumn(name, definition) {
+  let column = FACTORIES[definition.type](name);
+  if (definition.primary_key) column = column.primaryKey();
+  if (definition.nullable === false && !definition.primary_key) column = column.notNull();
+  if (definition.unique && !definition.primary_key) column = column.unique();
+  if (definition.default !== void 0) {
+    const value = definition.default;
+    column = column.default(
+      typeof value === "string" && isFunctionDefault(value, definition.type) ? sql.raw(value) : value
+    );
+  }
+  return column;
+}
+
+// src/engine/tables.ts
+var SCHEMA_IMPORT_KEY = "$schema";
+function buildDrizzleEntities(definition) {
+  const schemaName = ormSchemaName(definition.namespace);
+  const schema = pgSchema(schemaName);
+  const imports = { [SCHEMA_IMPORT_KEY]: schema };
+  const tables = {};
+  const built = /* @__PURE__ */ new Map();
+  for (const table of sortByEnforcedLinks(columnTables(definition))) {
+    const drizzleTable = buildTable(schema, table, built);
+    built.set(table.table, drizzleTable);
+    imports[table.table] = drizzleTable;
+    tables[table.table] = drizzleTable;
+  }
+  return { imports, tables, schemaName };
+}
+function buildTable(schema, table, built) {
+  const columns = Object.fromEntries(
+    Object.entries(table.columns ?? {}).map(([name, column]) => [name, buildColumn(name, column)])
+  );
+  const drizzleTable = schema.table(table.table, columns, (self) => [
+    ...buildIndexes(table, self),
+    ...buildForeignKeys(table, self, built)
+  ]);
+  return drizzleTable.enableRLS();
+}
+function buildIndexes(table, self) {
+  return (table.indexes ?? []).map((definition) => {
+    const name = indexName(table.table, definition);
+    const factory = definition.unique ? uniqueIndex(name) : index(name);
+    const columns = definition.columns.map((column) => self[column]);
+    return factory.on(...columns);
+  });
+}
+function buildForeignKeys(table, self, built) {
+  return Object.entries(table.links ?? {}).filter(([, link]) => link.enforce).map(([name, link]) => {
+    const target = link.to === table.table ? self : built.get(link.to);
+    const targetColumn = target && findPrimaryKeyColumn(target);
+    if (!target || !targetColumn) {
+      throw new OrmDefinitionError(`enforced link '${name}' on '${table.table}' has no built target '${link.to}'`);
+    }
+    return foreignKey({
+      name: foreignKeyName(table.table, name),
+      columns: [self[link.on]],
+      foreignColumns: [targetColumn]
+    });
+  });
+}
+function findPrimaryKeyColumn(target) {
+  const columns = Object.values(target).filter(
+    (value) => value !== null && typeof value === "object" && "primary" in value
+  );
+  return columns.find((column) => column.primary);
+}
+function sortByEnforcedLinks(tables) {
+  const remaining = new Map(tables.map((table) => [table.table, table]));
+  const sorted = [];
+  const placed = /* @__PURE__ */ new Set();
+  while (remaining.size > 0) {
+    const ready = [...remaining.values()].filter(
+      (table) => enforcedTargets(table).every((target) => placed.has(target) || !remaining.has(target))
+    );
+    if (ready.length === 0) {
+      throw new OrmDefinitionError(`enforced links form a cycle among: ${[...remaining.keys()].join(", ")}`);
+    }
+    for (const table of ready) {
+      sorted.push(table);
+      placed.add(table.table);
+      remaining.delete(table.table);
+    }
+  }
+  return sorted;
+}
+var enforcedTargets = (table) => Object.values(table.links ?? {}).filter((link) => link.enforce && !isQualifiedReference(link.to) && link.to !== table.table).map((link) => link.to);
+
+// src/engine/snapshot.ts
+function generateSnapshot(definition, previousId3) {
+  const { imports, schemaName } = buildDrizzleEntities(definition);
+  return generateDrizzleJson(imports, previousId3, [schemaName]);
+}
+var emptySnapshot = (namespace) => generateDrizzleJson({}, void 0, [ormSchemaName(namespace)]);
+var CURRENT_SNAPSHOT_VERSION = generateDrizzleJson({}).version;
+function normalizeSnapshot(snapshot) {
+  const upgraded = upPgSnapshot(snapshot);
+  const version = upgraded.version;
+  if (version !== CURRENT_SNAPSHOT_VERSION) {
+    throw new OrmDefinitionError(
+      `snapshot format '${String(version)}' is not supported by this drizzle-kit (expected '${CURRENT_SNAPSHOT_VERSION}') \u2014 upgrade @sequenceholdings/orm`
+    );
+  }
+  return upgraded;
+}
+function diffStatements(previous, current) {
+  assertUnambiguousDiff(previous, current);
+  return generateMigration(previous, current);
+}
+function assertUnambiguousDiff(previous, current) {
+  const previousTables = tablesOf(previous);
+  const currentTables = tablesOf(current);
+  const removedTables = [...previousTables.keys()].filter((name) => !currentTables.has(name));
+  const addedTables = [...currentTables.keys()].filter((name) => !previousTables.has(name));
+  if (removedTables.length > 0 && addedTables.length > 0) {
+    throw new OrmDefinitionError(
+      `ambiguous diff: table(s) added (${addedTables.join(", ")}) and removed (${removedTables.join(", ")}) in the same change \u2014 ship the add and the drop as separate changes`
+    );
+  }
+  for (const [name, previousColumns] of previousTables) {
+    const currentColumns = currentTables.get(name);
+    if (!currentColumns) continue;
+    const removed = [...previousColumns].filter((column) => !currentColumns.has(column));
+    const added = [...currentColumns].filter((column) => !previousColumns.has(column));
+    if (removed.length > 0 && added.length > 0) {
+      throw new OrmDefinitionError(
+        `ambiguous diff on '${name}': column(s) added (${added.join(", ")}) and removed (${removed.join(", ")}) in the same change \u2014 declare \`renamed_from\` for a rename, or ship the add and the drop as separate changes`
+      );
+    }
+  }
+}
+function tablesOf(snapshot) {
+  const tables = snapshot.tables ?? {};
+  return new Map(
+    Object.values(tables).map((table) => [`${table.schema}.${table.name}`, new Set(Object.keys(table.columns))])
+  );
+}
+function applyMigrationHints(previous, definition) {
+  const adjusted = structuredClone(previous);
+  const statements = [];
+  const schemaName = ormSchemaName(definition.namespace);
+  const qualified = (table) => `${quoteIdentifier(schemaName)}.${quoteIdentifier(table)}`;
+  for (const table of columnTables(definition)) {
+    const snapshotTable = findTable(adjusted, schemaName, table.table);
+    if (!snapshotTable) continue;
+    for (const [name, column] of Object.entries(table.columns ?? {})) {
+      if (column.renamed_from) {
+        const previousColumn = snapshotTable.columns[column.renamed_from];
+        if (previousColumn && snapshotTable.columns[name]) {
+          throw new OrmDefinitionError(
+            `'${table.table}.${name}' declares renamed_from '${column.renamed_from}', but both columns exist in the previous schema \u2014 a rename cannot overwrite a live column`
+          );
+        }
+        if (previousColumn) {
+          statements.push(
+            `ALTER TABLE ${qualified(table.table)} RENAME COLUMN ${quoteIdentifier(column.renamed_from)} TO ${quoteIdentifier(name)}`
+          );
+          delete snapshotTable.columns[column.renamed_from];
+          snapshotTable.columns[name] = { ...previousColumn, name };
+        } else if (!snapshotTable.columns[name]) {
+          throw new OrmDefinitionError(
+            `'${table.table}.${name}' declares renamed_from '${column.renamed_from}', but the previous schema has neither column \u2014 check the declared source name`
+          );
+        }
+      }
+      const cast = column.cast ? castParts(column.cast) : null;
+      if (cast) {
+        const current = snapshotTable.columns[name];
+        const targetType = sqlTypeName(column.type);
+        if (current && current.type !== targetType) {
+          statements.push(
+            `ALTER TABLE ${qualified(table.table)} ALTER COLUMN ${quoteIdentifier(name)} TYPE ${targetType} USING ${quoteIdentifier(name)}::${targetType}`
+          );
+          current.type = targetType;
+        }
+      }
+    }
+  }
+  return { statements, adjusted };
 }
-var columnTables = (definition) => definition.tables.filter((table) => !table.source);
-var FACTORIES = {
+function findTable(snapshot, schema, table) {
+  const tables = snapshot.tables ?? {};
+  return Object.values(tables).find((entry) => entry.schema === schema && entry.name === table);
+}
+function snapshotTableNames(snapshot, schema) {
+  const tables = snapshot.tables ?? {};
+  return Object.values(tables).filter((entry) => entry.schema === schema).map((entry) => entry.name);
+}
+var FACTORIES2 = {
   uuid: (name) => uuid(name),
   text: (name) => text(name),
   integer: (name) => integer(name),
@@ -1159,81 +3614,418 @@ var FACTORIES = {
   date: (name) => date(name),
   jsonb: (name) => jsonb(name)
 };
-function buildColumn(name, definition) {
-  let column = FACTORIES[definition.type](name);
-  if (definition.primary_key) column = column.primaryKey();
-  if (definition.nullable === false && !definition.primary_key) column = column.notNull();
-  if (definition.unique && !definition.primary_key) column = column.unique();
-  if (definition.default !== void 0) {
-    const value = definition.default;
-    column = column.default(
-      typeof value === "string" && isFunctionDefault(value, definition.type) ? sql.raw(value) : value
-    );
-  }
-  return column;
-}
-
-// src/engine/tables.ts
-var SCHEMA_IMPORT_KEY = "$schema";
-function buildDrizzleEntities(definition) {
+var SCHEMA_IMPORT_KEY2 = "$schema";
+var enumImportKey = (name) => `$enum_${name}`;
+var columnTablesV2 = (definition) => definition.tables.filter((table) => !table.source);
+function buildDrizzleEntitiesV2(definition) {
   const schemaName = ormSchemaName(definition.namespace);
   const schema = pgSchema(schemaName);
-  const imports = { [SCHEMA_IMPORT_KEY]: schema };
+  const imports = { [SCHEMA_IMPORT_KEY2]: schema };
   const tables = {};
   const built = /* @__PURE__ */ new Map();
-  for (const table of sortByEnforcedLinks(columnTables(definition))) {
-    const drizzleTable = buildTable(schema, table, built);
+  const enums = /* @__PURE__ */ new Map();
+  for (const enumDefinition of definition.enums) {
+    const values = enumDefinition.values;
+    const builtEnum = schema.enum(enumDefinition.name, values);
+    enums.set(enumDefinition.name, builtEnum);
+    imports[enumImportKey(enumDefinition.name)] = builtEnum;
+  }
+  const byName = new Map(definition.tables.map((table) => [table.table, table]));
+  for (const table of sortByEnforcedLinks2(columnTablesV2(definition))) {
+    const drizzleTable = buildTable2(schema, table, built, enums, byName);
     built.set(table.table, drizzleTable);
     imports[table.table] = drizzleTable;
     tables[table.table] = drizzleTable;
   }
+  for (const view of definition.views ?? []) {
+    const columns = Object.fromEntries(
+      view.columns.map((column) => [column.columnName, buildViewColumnV2({ view: view.view, column, enums })])
+    );
+    imports[view.view] = schema.view(view.view, columns).as(
+      sql.raw(
+        rewriteSyncedSourceRelationsInViewQuery({
+          query: view.query,
+          canonical: definition,
+          schemaName,
+          dependencies: view.dependencies
+        })
+      )
+    );
+  }
   return { imports, tables, schemaName };
 }
-function buildTable(schema, table, built) {
+function rewriteSyncedSourceRelationsInViewQuery({
+  query,
+  canonical,
+  schemaName,
+  dependencies
+}) {
+  const tablesBySource = /* @__PURE__ */ new Map();
+  for (const table of canonical.tables) {
+    if (!table.source) continue;
+    tablesBySource.set(table.source, [...tablesBySource.get(table.source) ?? [], table.table]);
+  }
+  const declared = new Set(dependencies ?? []);
+  const boundTableBySource = /* @__PURE__ */ new Map();
+  for (const [source, tables] of tablesBySource) {
+    if (tables.length === 1) {
+      boundTableBySource.set(source, tables[0]);
+      continue;
+    }
+    const [sourceSchema, sourceName] = source.split(".");
+    if (!sourceSchema || !sourceName) continue;
+    const referenced = sqlReferencesQualifiedRelation(query, sourceSchema, sourceName);
+    if (!referenced) continue;
+    const declaredMatches = tables.filter((table) => declared.has(table));
+    if (declaredMatches.length === 1) {
+      boundTableBySource.set(source, declaredMatches[0]);
+      continue;
+    }
+    throw new OrmDefinitionError(
+      `synced source '${source}' is declared by multiple synced tables (${[...tables].sort().join(", ")}) \u2014 this view references it but its declared dependencies do not name exactly one of them, so the rewrite is ambiguous`
+    );
+  }
+  return transformSqlOutsideLiterals(query, (segment) => {
+    let rewritten = segment;
+    for (const table of canonical.tables) {
+      if (!table.source) continue;
+      const boundTable = boundTableBySource.get(table.source);
+      if (boundTable === void 0 || boundTable !== table.table) continue;
+      const [sourceSchema, sourceName] = table.source.split(".");
+      if (!sourceSchema || !sourceName) continue;
+      rewritten = replaceQualifiedRelation(
+        rewritten,
+        sourceSchema,
+        sourceName,
+        schemaName,
+        table.table
+      );
+    }
+    return rewritten;
+  });
+}
+function transformSqlOutsideLiterals(sql4, transform) {
+  const out = [];
+  let state = { kind: "normal" };
+  let i = 0;
+  let codeStart = 0;
+  const emitCode = (end) => {
+    if (end > codeStart) out.push(transform(sql4.slice(codeStart, end)));
+    codeStart = end;
+  };
+  while (i < sql4.length) {
+    const c = sql4[i];
+    const next = i + 1 < sql4.length ? sql4[i + 1] : "";
+    switch (state.kind) {
+      case "normal": {
+        if (c === "-" && next === "-") {
+          emitCode(i);
+          state = { kind: "line-comment" };
+          out.push("--");
+          i += 2;
+          codeStart = i;
+          break;
+        }
+        if (c === "/" && next === "*") {
+          emitCode(i);
+          state = { kind: "block-comment", depth: 1 };
+          out.push("/*");
+          i += 2;
+          codeStart = i;
+          break;
+        }
+        if ((c === "E" || c === "e") && next === "'") {
+          const prev = i > 0 ? sql4[i - 1] : "";
+          if (!/[A-Za-z0-9_]/.test(prev)) {
+            emitCode(i);
+            state = { kind: "e-single" };
+            out.push("E'");
+            i += 2;
+            codeStart = i;
+            break;
+          }
+        }
+        if (c === "'") {
+          emitCode(i);
+          state = { kind: "single" };
+          out.push("'");
+          i += 1;
+          codeStart = i;
+          break;
+        }
+        if (c === "$") {
+          const prev = i > 0 ? sql4[i - 1] : "";
+          if (!/[A-Za-z0-9_$]/.test(prev)) {
+            const tagMatch = /^\$([A-Za-z_][A-Za-z0-9_]*)?\$/.exec(sql4.slice(i));
+            if (tagMatch) {
+              emitCode(i);
+              state = { kind: "dollar", tag: tagMatch[1] ?? "" };
+              out.push(tagMatch[0]);
+              i += tagMatch[0].length;
+              codeStart = i;
+              break;
+            }
+          }
+        }
+        i += 1;
+        break;
+      }
+      case "single": {
+        if (c === "'" && next === "'") {
+          out.push("''");
+          i += 2;
+          break;
+        }
+        if (c === "'") {
+          out.push("'");
+          state = { kind: "normal" };
+          i += 1;
+          codeStart = i;
+          break;
+        }
+        out.push(c);
+        i += 1;
+        break;
+      }
+      case "e-single": {
+        if (c === "\\" && i + 1 < sql4.length) {
+          out.push(c, sql4[i + 1]);
+          i += 2;
+          break;
+        }
+        if (c === "'" && next === "'") {
+          out.push("''");
+          i += 2;
+          break;
+        }
+        if (c === "'") {
+          out.push("'");
+          state = { kind: "normal" };
+          i += 1;
+          codeStart = i;
+          break;
+        }
+        out.push(c);
+        i += 1;
+        break;
+      }
+      case "dollar": {
+        const closer = `$${state.tag}$`;
+        if (sql4.startsWith(closer, i)) {
+          out.push(closer);
+          state = { kind: "normal" };
+          i += closer.length;
+          codeStart = i;
+          break;
+        }
+        out.push(c);
+        i += 1;
+        break;
+      }
+      case "line-comment": {
+        if (c === "\n") {
+          out.push("\n");
+          state = { kind: "normal" };
+          i += 1;
+          codeStart = i;
+          break;
+        }
+        out.push(c);
+        i += 1;
+        break;
+      }
+      case "block-comment": {
+        if (c === "/" && next === "*") {
+          out.push("/*");
+          state = { kind: "block-comment", depth: state.depth + 1 };
+          i += 2;
+          break;
+        }
+        if (c === "*" && next === "/") {
+          out.push("*/");
+          const newDepth = state.depth - 1;
+          state = newDepth === 0 ? { kind: "normal" } : { kind: "block-comment", depth: newDepth };
+          i += 2;
+          if (state.kind === "normal") codeStart = i;
+          break;
+        }
+        out.push(c);
+        i += 1;
+        break;
+      }
+    }
+  }
+  emitCode(sql4.length);
+  return out.join("");
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function sqlReferencesQualifiedRelation(sql4, sourceSchema, sourceName) {
+  let referenced = false;
+  transformSqlOutsideLiterals(sql4, (segment) => {
+    if (qualifiedRelationPattern(sourceSchema, sourceName).test(segment)) referenced = true;
+    return segment;
+  });
+  return referenced;
+}
+function qualifiedRelationPattern(sourceSchema, sourceName) {
+  const schemaPattern = `(?:"${escapeRegExp(sourceSchema)}"|${escapeRegExp(sourceSchema)})`;
+  const namePattern = `(?:"${escapeRegExp(sourceName)}"|${escapeRegExp(sourceName)})`;
+  return new RegExp(`(?<![\\w."])${schemaPattern}\\.${namePattern}(?![\\w"])`, "g");
+}
+function replaceQualifiedRelation(sql4, sourceSchema, sourceName, boundSchema, boundTable) {
+  return sql4.replace(qualifiedRelationPattern(sourceSchema, sourceName), `"${boundSchema}"."${boundTable}"`);
+}
+function generateSnapshotV2(definition, previousId3) {
+  const { imports, schemaName } = buildDrizzleEntitiesV2(definition);
+  const snapshot = generateDrizzleJson(imports, previousId3, [schemaName]);
+  if ((definition.views?.length ?? 0) > 0) {
+    const extended = snapshot;
+    extended._sequenceOrm = {
+      viewDependencies: Object.fromEntries(
+        (definition.views ?? []).map((view) => [view.view, [...view.dependencies].sort()])
+      )
+    };
+  }
+  return snapshot;
+}
+function buildViewColumnV2({
+  view,
+  column,
+  enums
+}) {
+  const factory = resolveColumnFactory(view, column, enums);
+  let builder = factory(column.columnName);
+  if (!column.nullable) builder = builder.notNull();
+  return builder;
+}
+function buildTable2(schema, table, built, enums, byName) {
+  const primaryKeyColumns = table.primaryKey ?? [];
+  if (primaryKeyColumns.length === 0) {
+    throw new OrmDefinitionError(`table '${table.table}' declares no primaryKey`);
+  }
+  const columnNames = new Set(table.columns.map((column) => column.columnName));
+  for (const name of primaryKeyColumns) {
+    if (!columnNames.has(name)) {
+      throw new OrmDefinitionError(`primaryKey of '${table.table}' references unknown column '${name}'`);
+    }
+  }
+  const singlePrimaryKey = primaryKeyColumns.length === 1 ? primaryKeyColumns[0] : void 0;
+  const compositeMembers = new Set(singlePrimaryKey === void 0 ? primaryKeyColumns : []);
   const columns = Object.fromEntries(
-    Object.entries(table.columns ?? {}).map(([name, column]) => [name, buildColumn(name, column)])
+    table.columns.map((column) => [
+      column.columnName,
+      buildColumnV2({ table: table.table, column, singlePrimaryKey, compositeMembers, enums })
+    ])
   );
   const drizzleTable = schema.table(table.table, columns, (self) => [
-    ...buildIndexes(table, self),
-    ...buildForeignKeys(table, self, built)
+    ...buildCompositePrimaryKey(table, primaryKeyColumns, self),
+    ...buildIndexes2(table, self),
+    ...buildForeignKeys2(table, self, built, byName)
   ]);
   return drizzleTable.enableRLS();
 }
-function buildIndexes(table, self) {
-  return (table.indexes ?? []).map((definition) => {
+function resolveColumnFactory(table, column, enums) {
+  if (typeof column.type === "string") return FACTORIES2[column.type];
+  const enumFactory = enums.get(column.type.enum);
+  if (!enumFactory) {
+    throw new OrmDefinitionError(`column '${table}.${column.columnName}' references undeclared enum '${column.type.enum}'`);
+  }
+  return enumFactory;
+}
+function buildColumnV2({
+  table,
+  column,
+  singlePrimaryKey,
+  compositeMembers,
+  enums
+}) {
+  const factory = resolveColumnFactory(table, column, enums);
+  let builder = factory(column.columnName);
+  const isSinglePrimaryKey = column.columnName === singlePrimaryKey;
+  if (isSinglePrimaryKey) builder = builder.primaryKey();
+  if ((column.nullable === false || compositeMembers.has(column.columnName)) && !isSinglePrimaryKey) {
+    builder = builder.notNull();
+  }
+  if (column.unique && !isSinglePrimaryKey) builder = builder.unique();
+  if (column.defaultFn !== void 0 && column.default !== void 0) {
+    throw new OrmDefinitionError(`column '${table}.${column.columnName}' declares both default and defaultFn`);
+  }
+  if (column.defaultFn !== void 0) {
+    if (typeof column.type !== "string" || !isFunctionDefault(column.defaultFn, column.type)) {
+      throw new OrmDefinitionError(
+        `column '${table}.${column.columnName}' declares defaultFn '${column.defaultFn}' which is invalid for its type`
+      );
+    }
+    builder = builder.default(sql.raw(column.defaultFn));
+  } else if (column.default !== void 0 && column.default !== null) {
+    builder = builder.default(column.default);
+  }
+  return builder;
+}
+function buildCompositePrimaryKey(table, primaryKeyColumns, self) {
+  if (primaryKeyColumns.length < 2) return [];
+  return [
+    primaryKey({
+      name: `${table.table}_pkey`,
+      columns: primaryKeyColumns.map((column) => self[column])
+    })
+  ];
+}
+function buildIndexes2(table, self) {
+  return table.indexes.map((definition) => {
+    for (const column of definition.columns) {
+      if (!(column in self)) {
+        throw new OrmDefinitionError(`index on '${table.table}' references unknown column '${column}'`);
+      }
+    }
     const name = indexName(table.table, definition);
     const factory = definition.unique ? uniqueIndex(name) : index(name);
     const columns = definition.columns.map((column) => self[column]);
     return factory.on(...columns);
   });
 }
-function buildForeignKeys(table, self, built) {
-  return Object.entries(table.links ?? {}).filter(([, link]) => link.enforce).map(([name, link]) => {
-    const target = link.to === table.table ? self : built.get(link.to);
-    const targetColumn = target && findPrimaryKeyColumn(target);
-    if (!target || !targetColumn) {
-      throw new OrmDefinitionError(`enforced link '${name}' on '${table.table}' has no built target '${link.to}'`);
+function buildForeignKeys2(table, self, built, byName) {
+  return table.links.filter((link) => link.enforce).map((link) => {
+    if (link.kind !== "toOne" || !link.target) {
+      throw new OrmDefinitionError(
+        `enforced link '${link.name}' on '${table.table}' must be a toOne link with a namespace-local target`
+      );
+    }
+    const targetTable = byName.get(link.target);
+    const target = link.target === table.table ? self : built.get(link.target);
+    if (!targetTable || !target) {
+      throw new OrmDefinitionError(`enforced link '${link.name}' on '${table.table}' has no built target '${link.target}'`);
+    }
+    const referencedColumn = link.references ?? singlePrimaryKeyOf(targetTable);
+    if (!referencedColumn) {
+      throw new OrmDefinitionError(
+        `enforced link '${link.name}' on '${table.table}' targets '${link.target}' whose primary key is composite \u2014 declare 'references'`
+      );
+    }
+    const targetColumn = target[referencedColumn];
+    const sourceColumn = self[link.on];
+    if (!targetColumn || !sourceColumn) {
+      throw new OrmDefinitionError(
+        `enforced link '${link.name}' on '${table.table}' references unknown column '${targetColumn ? link.on : referencedColumn}'`
+      );
     }
     return foreignKey({
-      name: foreignKeyName(table.table, name),
-      columns: [self[link.on]],
+      name: foreignKeyName(table.table, link.name),
+      columns: [sourceColumn],
       foreignColumns: [targetColumn]
     });
   });
 }
-function findPrimaryKeyColumn(target) {
-  const columns = Object.values(target).filter(
-    (value) => value !== null && typeof value === "object" && "primary" in value
-  );
-  return columns.find((column) => column.primary);
-}
-function sortByEnforcedLinks(tables) {
+var singlePrimaryKeyOf = (table) => table.primaryKey?.length === 1 ? table.primaryKey[0] : void 0;
+function sortByEnforcedLinks2(tables) {
   const remaining = new Map(tables.map((table) => [table.table, table]));
   const sorted = [];
   const placed = /* @__PURE__ */ new Set();
   while (remaining.size > 0) {
     const ready = [...remaining.values()].filter(
-      (table) => enforcedTargets(table).every((target) => placed.has(target) || !remaining.has(target))
+      (table) => enforcedTargets2(table).every((target) => placed.has(target) || !remaining.has(target))
     );
     if (ready.length === 0) {
       throw new OrmDefinitionError(`enforced links form a cycle among: ${[...remaining.keys()].join(", ")}`);
@@ -1246,108 +4038,376 @@ function sortByEnforcedLinks(tables) {
   }
   return sorted;
 }
-var enforcedTargets = (table) => Object.values(table.links ?? {}).filter((link) => link.enforce && !isQualifiedReference(link.to) && link.to !== table.table).map((link) => link.to);
-
-// src/engine/snapshot.ts
-function generateSnapshot(definition, previousId2) {
-  const { imports, schemaName } = buildDrizzleEntities(definition);
-  return generateDrizzleJson(imports, previousId2, [schemaName]);
+var enforcedTargets2 = (table) => table.links.flatMap(
+  (link) => (
+    // A self-target is not an ordering dependency — the FK builds inline.
+    link.enforce && link.target !== void 0 && link.target !== table.table ? [link.target] : []
+  )
+);
+function applyMigrationHintsV2(previous, definition) {
+  const adjusted = structuredClone(previous);
+  const statements = [];
+  const schemaName = ormSchemaName(definition.namespace);
+  const qualified = (table) => `${quoteIdentifier(schemaName)}.${quoteIdentifier(table)}`;
+  const enumsByName = new Map(definition.enums.map((entry) => [entry.name, entry]));
+  for (const table of columnTablesV2(definition)) {
+    if (table.renamedFrom) {
+      applyTableRename({ adjusted, schemaName, table, renamedFrom: table.renamedFrom, statements, qualified });
+    }
+    const snapshotTable = findTable2(adjusted, schemaName, table.table);
+    if (!snapshotTable) continue;
+    for (const column of table.columns) {
+      const name = column.columnName;
+      if (column.renamedFrom) {
+        const previousColumn = snapshotTable.columns[column.renamedFrom];
+        if (previousColumn && snapshotTable.columns[name]) {
+          throw new OrmDefinitionError(
+            `'${table.table}.${name}' declares renamedFrom '${column.renamedFrom}', but both columns exist in the previous schema \u2014 a rename cannot overwrite a live column`
+          );
+        }
+        if (previousColumn) {
+          statements.push(
+            `ALTER TABLE ${qualified(table.table)} RENAME COLUMN ${quoteIdentifier(column.renamedFrom)} TO ${quoteIdentifier(name)}`
+          );
+          delete snapshotTable.columns[column.renamedFrom];
+          snapshotTable.columns[name] = { ...previousColumn, name };
+        } else if (!snapshotTable.columns[name]) {
+          throw new OrmDefinitionError(
+            `'${table.table}.${name}' declares renamedFrom '${column.renamedFrom}', but the previous schema has neither column \u2014 check the declared source name`
+          );
+        }
+      }
+      const cast = column.cast ? castParts(column.cast) : null;
+      if (cast) {
+        const current = snapshotTable.columns[name];
+        const { snapshotType, sqlType } = castTargetTypes(column, enumsByName, schemaName, table.table);
+        if (current && current.type !== snapshotType) {
+          statements.push(
+            `ALTER TABLE ${qualified(table.table)} ALTER COLUMN ${quoteIdentifier(name)} TYPE ${sqlType} USING ${quoteIdentifier(name)}::${sqlType}`
+          );
+          current.type = snapshotType;
+        }
+      }
+    }
+  }
+  return { statements, adjusted };
 }
-var emptySnapshot = (namespace) => generateDrizzleJson({}, void 0, [ormSchemaName(namespace)]);
-var CURRENT_SNAPSHOT_VERSION = generateDrizzleJson({}).version;
-function normalizeSnapshot(snapshot) {
-  const upgraded = upPgSnapshot(snapshot);
-  const version = upgraded.version;
-  if (version !== CURRENT_SNAPSHOT_VERSION) {
+function castTargetTypes(column, enums, schemaName, table) {
+  if (typeof column.type === "string") {
+    const name = sqlTypeName(column.type);
+    return { snapshotType: name, sqlType: name };
+  }
+  const enumName = column.type.enum;
+  if (!enums.has(enumName)) {
+    throw new OrmDefinitionError(`column '${table}.${column.columnName}' casts to undeclared enum '${enumName}'`);
+  }
+  return { snapshotType: enumName, sqlType: `${quoteIdentifier(schemaName)}.${quoteIdentifier(enumName)}` };
+}
+function applyTableRename({
+  adjusted,
+  schemaName,
+  table,
+  renamedFrom,
+  statements,
+  qualified
+}) {
+  const tables = adjusted.tables ?? {};
+  const previousEntry = Object.entries(tables).find(
+    ([, entry]) => entry.schema === schemaName && entry.name === renamedFrom
+  );
+  const currentTable = findTable2(adjusted, schemaName, table.table);
+  if (previousEntry && currentTable) {
     throw new OrmDefinitionError(
-      `snapshot format '${String(version)}' is not supported by this drizzle-kit (expected '${CURRENT_SNAPSHOT_VERSION}') \u2014 upgrade @sequenceholdings/orm`
+      `'${table.table}' declares renamedFrom '${renamedFrom}', but both tables exist in the previous schema \u2014 a rename cannot overwrite a live table`
     );
   }
-  return upgraded;
-}
-function diffStatements(previous, current) {
-  assertUnambiguousDiff(previous, current);
-  return generateMigration(previous, current);
-}
-function assertUnambiguousDiff(previous, current) {
-  const previousTables = tablesOf(previous);
-  const currentTables = tablesOf(current);
-  const removedTables = [...previousTables.keys()].filter((name) => !currentTables.has(name));
-  const addedTables = [...currentTables.keys()].filter((name) => !previousTables.has(name));
-  if (removedTables.length > 0 && addedTables.length > 0) {
+  if (!previousEntry) {
+    if (currentTable) return;
     throw new OrmDefinitionError(
-      `ambiguous diff: table(s) added (${addedTables.join(", ")}) and removed (${removedTables.join(", ")}) in the same change \u2014 ship the add and the drop as separate changes`
+      `'${table.table}' declares renamedFrom '${renamedFrom}', but the previous schema has neither table \u2014 check the declared source name`
     );
   }
-  for (const [name, previousColumns] of previousTables) {
-    const currentColumns = currentTables.get(name);
-    if (!currentColumns) continue;
-    const removed = [...previousColumns].filter((column) => !currentColumns.has(column));
-    const added = [...currentColumns].filter((column) => !previousColumns.has(column));
-    if (removed.length > 0 && added.length > 0) {
-      throw new OrmDefinitionError(
-        `ambiguous diff on '${name}': column(s) added (${added.join(", ")}) and removed (${removed.join(", ")}) in the same change \u2014 declare \`renamed_from\` for a rename, or ship the add and the drop as separate changes`
-      );
+  statements.push(`ALTER TABLE ${qualified(renamedFrom)} RENAME TO ${quoteIdentifier(table.table)}`);
+  const [previousKey, previousTable] = previousEntry;
+  delete tables[previousKey];
+  tables[`${schemaName}.${table.table}`] = { ...previousTable, name: table.table };
+}
+function findTable2(snapshot, schema, table) {
+  const tables = snapshot.tables ?? {};
+  return Object.values(tables).find((entry) => entry.schema === schema && entry.name === table);
+}
+async function planMigrationV2({
+  canonical,
+  previousSnapshot
+}) {
+  const schema = ormSchemaName(canonical.namespace);
+  const previous = previousSnapshot ? normalizeSnapshot(previousSnapshot) : emptySnapshot(canonical.namespace);
+  assertValidViewDependencies(canonical);
+  const hints = applyMigrationHintsV2(previous, canonical);
+  const snapshot = generateSnapshotV2(canonical, previousId(previous));
+  const baseDdl = await diffStatements(withoutViews(hints.adjusted), withoutViews(snapshot));
+  const previousViews = snapshotViews(hints.adjusted);
+  const currentViews = snapshotViews(snapshot);
+  const previousDependencies = snapshotViewDependencies(hints.adjusted);
+  const currentDependencies = snapshotViewDependencies(snapshot);
+  const affected = affectedViewNames({
+    previousViews,
+    currentViews,
+    previousDependencies,
+    currentDependencies,
+    baseChanged: hints.statements.length > 0 || baseDdl.length > 0
+  });
+  const dropOrder = topologicalViewNames(
+    new Set([...affected].filter((name) => previousViews.has(name))),
+    previousDependencies
+  ).reverse();
+  const createOrder = topologicalViewNames(
+    new Set([...affected].filter((name) => currentViews.has(name))),
+    currentDependencies
+  );
+  const dropDdl = await generatedViewStatements({
+    snapshot: hints.adjusted,
+    names: new Set(dropOrder),
+    mode: "drop",
+    schema
+  });
+  const createDdl = await generatedViewStatements({
+    snapshot,
+    names: new Set(createOrder),
+    mode: "create",
+    schema
+  });
+  const currentViewDefinitions = new Map((canonical.views ?? []).map((view) => [view.view, view]));
+  const statements = [
+    ...dropOrder.map((name) => ({ kind: "ddl", sql: requiredViewStatement(dropDdl, name, schema, "DROP") })),
+    ...hints.statements.map((statement) => ({ kind: "hint", sql: statement })),
+    ...baseDdl.map((statement) => ({ kind: "ddl", sql: statement.replace(/;\s*$/, "") })),
+    ...createOrder.map((name) => ({ kind: "ddl", sql: requiredViewStatement(createDdl, name, schema, "CREATE") })),
+    ...createOrder.map((name) => {
+      const view = currentViewDefinitions.get(name);
+      if (!view) throw new OrmDefinitionError(`missing canonical definition for view '${name}'`);
+      return { kind: "ddl", sql: validateViewCatalogStatement({ canonical, view, schema }) };
+    })
+  ];
+  return { namespace: canonical.namespace, schema, statements, snapshot };
+}
+function validateViewCatalogStatement({
+  canonical,
+  view,
+  schema
+}) {
+  const qualified = `${schema}.${view.view}`;
+  const expectedColumns = sqlTextArray(view.columns.map((column) => column.columnName));
+  const expectedTypes = `ARRAY[${view.columns.map((column) => `${viewTypeRegtype(column, schema)}::oid`).join(", ")}]::oid[]`;
+  const relationIdentity = /* @__PURE__ */ new Map();
+  for (const table of canonical.tables) {
+    relationIdentity.set(table.table, `${schema}.${table.table}`);
+  }
+  for (const candidate of canonical.views ?? []) {
+    relationIdentity.set(candidate.view, `${schema}.${candidate.view}`);
+  }
+  const expectedDependencies = sqlTextArray(
+    view.dependencies.map((dependency) => {
+      const physical = relationIdentity.get(dependency);
+      if (!physical) throw new OrmDefinitionError(`view '${view.view}' depends on unknown relation '${dependency}'`);
+      return physical;
+    }).sort()
+  );
+  const allowedFunctions = sqlTextArray(VIEW_QUERY_FUNCTION_ALLOWLIST);
+  return `DO $sequence_orm_validate_view$
+DECLARE
+  actual_columns text[];
+  actual_types oid[];
+  actual_dependencies text[];
+BEGIN
+  SELECT
+    array_agg(attribute.attname ORDER BY attribute.attnum),
+    array_agg(attribute.atttypid ORDER BY attribute.attnum)
+  INTO actual_columns, actual_types
+  FROM pg_catalog.pg_attribute AS attribute
+  WHERE attribute.attrelid = pg_catalog.to_regclass(${quoteLiteral(qualified)})
+    AND attribute.attnum > 0
+    AND NOT attribute.attisdropped;
+
+  IF actual_columns IS DISTINCT FROM ${expectedColumns} THEN
+    RAISE EXCEPTION 'managed view ${qualified} columns do not match its declaration: expected %, got %', ${expectedColumns}, actual_columns
+      USING ERRCODE = '42804';
+  END IF;
+  IF actual_types IS DISTINCT FROM ${expectedTypes} THEN
+    RAISE EXCEPTION 'managed view ${qualified} types do not match its declaration: expected %, got %', ${expectedTypes}, actual_types
+      USING ERRCODE = '42804';
+  END IF;
+
+  SELECT coalesce(array_agg(found.name ORDER BY found.name), ARRAY[]::text[])
+  INTO actual_dependencies
+  FROM (
+    SELECT DISTINCT dependency_namespace.nspname || '.' || dependency_relation.relname AS name
+    FROM pg_catalog.pg_rewrite AS rewrite
+    JOIN pg_catalog.pg_depend AS dependency
+      ON dependency.classid = 'pg_catalog.pg_rewrite'::regclass
+      AND dependency.objid = rewrite.oid
+      AND dependency.refclassid = 'pg_catalog.pg_class'::regclass
+    JOIN pg_catalog.pg_class AS dependency_relation ON dependency_relation.oid = dependency.refobjid
+    JOIN pg_catalog.pg_namespace AS dependency_namespace ON dependency_namespace.oid = dependency_relation.relnamespace
+    WHERE rewrite.ev_class = pg_catalog.to_regclass(${quoteLiteral(qualified)})
+      AND dependency.refobjid <> rewrite.ev_class
+      AND dependency_relation.relkind IN ('r', 'p', 'v', 'm', 'f')
+  ) AS found;
+
+  IF actual_dependencies IS DISTINCT FROM ${expectedDependencies} THEN
+    RAISE EXCEPTION 'managed view ${qualified} dependencies do not match its declaration: expected %, got %', ${expectedDependencies}, actual_dependencies
+      USING ERRCODE = '2BP01';
+  END IF;
+
+  IF EXISTS (
+    SELECT 1
+    FROM pg_catalog.pg_rewrite AS rewrite
+    JOIN pg_catalog.pg_depend AS dependency
+      ON dependency.classid = 'pg_catalog.pg_rewrite'::regclass
+      AND dependency.objid = rewrite.oid
+      AND dependency.refclassid = 'pg_catalog.pg_proc'::regclass
+    JOIN pg_catalog.pg_proc AS dependency_function ON dependency_function.oid = dependency.refobjid
+    JOIN pg_catalog.pg_namespace AS function_namespace ON function_namespace.oid = dependency_function.pronamespace
+    WHERE rewrite.ev_class = pg_catalog.to_regclass(${quoteLiteral(qualified)})
+      AND (
+        function_namespace.nspname <> 'pg_catalog'
+        OR dependency_function.proname <> ALL (${allowedFunctions})
+      )
+  ) THEN
+    RAISE EXCEPTION 'managed view ${qualified} may only call explicitly allowlisted side-effect-free pg_catalog functions'
+      USING ERRCODE = '42501';
+  END IF;
+
+  IF EXISTS (
+    SELECT 1
+    FROM pg_catalog.pg_rewrite AS rewrite
+    JOIN pg_catalog.pg_depend AS dependency
+      ON dependency.classid = 'pg_catalog.pg_rewrite'::regclass
+      AND dependency.objid = rewrite.oid
+      AND dependency.refclassid = 'pg_catalog.pg_operator'::regclass
+    JOIN pg_catalog.pg_operator AS dependency_operator ON dependency_operator.oid = dependency.refobjid
+    JOIN pg_catalog.pg_namespace AS operator_namespace ON operator_namespace.oid = dependency_operator.oprnamespace
+    WHERE rewrite.ev_class = pg_catalog.to_regclass(${quoteLiteral(qualified)})
+      AND operator_namespace.nspname <> 'pg_catalog'
+  ) THEN
+    RAISE EXCEPTION 'managed view ${qualified} may only use pg_catalog operators'
+      USING ERRCODE = '42501';
+  END IF;
+END
+$sequence_orm_validate_view$`;
+}
+function sqlTextArray(values) {
+  return values.length === 0 ? "ARRAY[]::text[]" : `ARRAY[${values.map((value) => quoteLiteral(value)).join(", ")}]::text[]`;
+}
+function viewTypeRegtype(column, schema) {
+  if (typeof column.type === "string") return `${quoteLiteral(sqlTypeName(column.type))}::regtype`;
+  return `${quoteLiteral(`${quoteIdentifier(schema)}.${quoteIdentifier(column.type.enum)}`)}::regtype`;
+}
+var previousId = (snapshot) => snapshot.id;
+function snapshotViews(snapshot) {
+  const views = snapshot.views ?? {};
+  return new Map(Object.values(views).map((view) => [view.name, view]));
+}
+function snapshotViewDependencies(snapshot) {
+  const metadata = snapshot._sequenceOrm;
+  return metadata?.viewDependencies ?? {};
+}
+function withoutViews(snapshot) {
+  const clone = structuredClone(snapshot);
+  clone.views = {};
+  delete clone._sequenceOrm;
+  return clone;
+}
+function affectedViewNames({
+  previousViews,
+  currentViews,
+  previousDependencies,
+  currentDependencies,
+  baseChanged
+}) {
+  const allNames = /* @__PURE__ */ new Set([...previousViews.keys(), ...currentViews.keys()]);
+  if (baseChanged) return allNames;
+  const affected = new Set(
+    [...allNames].filter((name) => {
+      const before = previousViews.get(name);
+      const after = currentViews.get(name);
+      return before === void 0 || after === void 0 || stableJson(before) !== stableJson(after);
+    })
+  );
+  let grew = true;
+  while (grew) {
+    grew = false;
+    for (const name of allNames) {
+      if (affected.has(name)) continue;
+      const dependencies = /* @__PURE__ */ new Set([...previousDependencies[name] ?? [], ...currentDependencies[name] ?? []]);
+      if ([...dependencies].some((dependency) => affected.has(dependency))) {
+        affected.add(name);
+        grew = true;
+      }
+    }
+  }
+  return affected;
+}
+function topologicalViewNames(names, dependencies) {
+  const remaining = new Set(names);
+  const ordered = [];
+  while (remaining.size > 0) {
+    const ready = [...remaining].filter((name) => (dependencies[name] ?? []).every((dependency) => !remaining.has(dependency))).sort();
+    if (ready.length === 0) {
+      throw new OrmDefinitionError(`view dependencies form a cycle among: ${[...remaining].sort().join(", ")}`);
+    }
+    for (const name of ready) {
+      ordered.push(name);
+      remaining.delete(name);
     }
   }
+  return ordered;
+}
+async function generatedViewStatements({
+  snapshot,
+  names,
+  mode,
+  schema
+}) {
+  if (names.size === 0) return /* @__PURE__ */ new Map();
+  const without = structuredClone(snapshot);
+  const holder = without;
+  const views = holder.views ?? {};
+  holder.views = Object.fromEntries(Object.entries(views).filter(([, view]) => !names.has(view.name)));
+  const generated = mode === "drop" ? await diffStatements(snapshot, without) : await diffStatements(without, snapshot);
+  const statements = /* @__PURE__ */ new Map();
+  for (const name of names) {
+    const qualified = `${quoteIdentifier(schema)}.${quoteIdentifier(name)}`;
+    const prefix = mode === "drop" ? "DROP VIEW" : "CREATE VIEW";
+    const statement = generated.find((candidate) => candidate.trimStart().startsWith(`${prefix} ${qualified}`));
+    if (statement) statements.set(name, statement.replace(/;\s*$/, ""));
+  }
+  return statements;
 }
-function tablesOf(snapshot) {
-  const tables = snapshot.tables ?? {};
-  return new Map(
-    Object.values(tables).map((table) => [`${table.schema}.${table.name}`, new Set(Object.keys(table.columns))])
-  );
+function requiredViewStatement(statements, name, schema, operation) {
+  const statement = statements.get(name);
+  if (!statement) {
+    throw new OrmDefinitionError(`drizzle-kit did not generate ${operation} VIEW for '${schema}.${name}'`);
+  }
+  return statement;
 }
-function applyMigrationHints(previous, definition) {
-  const adjusted = structuredClone(previous);
-  const statements = [];
-  const schemaName = ormSchemaName(definition.namespace);
-  const qualified = (table) => `${quoteIdentifier(schemaName)}.${quoteIdentifier(table)}`;
-  for (const table of columnTables(definition)) {
-    const snapshotTable = findTable(adjusted, schemaName, table.table);
-    if (!snapshotTable) continue;
-    for (const [name, column] of Object.entries(table.columns ?? {})) {
-      if (column.renamed_from) {
-        const previousColumn = snapshotTable.columns[column.renamed_from];
-        if (previousColumn && snapshotTable.columns[name]) {
-          throw new OrmDefinitionError(
-            `'${table.table}.${name}' declares renamed_from '${column.renamed_from}', but both columns exist in the previous schema \u2014 a rename cannot overwrite a live column`
-          );
-        }
-        if (previousColumn) {
-          statements.push(
-            `ALTER TABLE ${qualified(table.table)} RENAME COLUMN ${quoteIdentifier(column.renamed_from)} TO ${quoteIdentifier(name)}`
-          );
-          delete snapshotTable.columns[column.renamed_from];
-          snapshotTable.columns[name] = { ...previousColumn, name };
-        } else if (!snapshotTable.columns[name]) {
-          throw new OrmDefinitionError(
-            `'${table.table}.${name}' declares renamed_from '${column.renamed_from}', but the previous schema has neither column \u2014 check the declared source name`
-          );
-        }
-      }
-      const cast = column.cast ? castParts(column.cast) : null;
-      if (cast) {
-        const current = snapshotTable.columns[name];
-        const targetType = sqlTypeName(column.type);
-        if (current && current.type !== targetType) {
-          statements.push(
-            `ALTER TABLE ${qualified(table.table)} ALTER COLUMN ${quoteIdentifier(name)} TYPE ${targetType} USING ${quoteIdentifier(name)}::${targetType}`
-          );
-          current.type = targetType;
-        }
+function assertValidViewDependencies(canonical) {
+  const views = canonical.views ?? [];
+  const known = /* @__PURE__ */ new Set([...canonical.tables.map((table) => table.table), ...views.map((view) => view.view)]);
+  for (const view of views) {
+    for (const dependency of view.dependencies) {
+      if (!known.has(dependency)) {
+        throw new OrmDefinitionError(`view '${view.view}' depends on unknown relation '${dependency}'`);
       }
     }
   }
-  return { statements, adjusted };
-}
-function findTable(snapshot, schema, table) {
-  const tables = snapshot.tables ?? {};
-  return Object.values(tables).find((entry) => entry.schema === schema && entry.name === table);
-}
-function snapshotTableNames(snapshot, schema) {
-  const tables = snapshot.tables ?? {};
-  return Object.values(tables).filter((entry) => entry.schema === schema).map((entry) => entry.name);
+  topologicalViewNames(
+    new Set(views.map((view) => view.view)),
+    Object.fromEntries(views.map((view) => [view.view, view.dependencies]))
+  );
 }
+
+// src/engine/converge.ts
 var OWNED_STATEMENT = new RegExp(
   [
     String.raw`^\s*(CREATE|DROP)\s+POLICY\b`,
@@ -1360,18 +4420,43 @@ var OWNED_STATEMENT = new RegExp(
   ].join("|"),
   "i"
 );
+var V2_OWNED_STATEMENT = new RegExp(
+  [
+    String.raw`^\s*(CREATE|DROP)\s+POLICY\b`,
+    String.raw`^\s*(GRANT|REVOKE)\b`,
+    String.raw`^\s*(CREATE|DROP|ALTER)\s+ROLE\b`,
+    String.raw`\bROW LEVEL SECURITY\b`
+  ].join("|"),
+  "i"
+);
 function isOwnedStatement(statement) {
   return OWNED_STATEMENT.test(statement);
 }
+function isOwnedStatementV2(statement) {
+  return V2_OWNED_STATEMENT.test(statement);
+}
 async function pendingKitStatements({
   definition,
   db
 }) {
-  const { imports, schemaName } = buildDrizzleEntities(definition);
+  return pendingStatements({ entities: buildDrizzleEntities(definition), db, owned: OWNED_STATEMENT });
+}
+async function pendingKitStatementsV2({
+  canonical,
+  db
+}) {
+  return pendingStatements({ entities: buildDrizzleEntitiesV2(canonical), db, owned: V2_OWNED_STATEMENT });
+}
+async function pendingStatements({
+  entities,
+  db,
+  owned
+}) {
+  const { imports, schemaName } = entities;
   const { statementsToExecute } = await withExitGuard(
     () => pushSchema(imports, shimExecute(db), [schemaName])
   );
-  return statementsToExecute.filter((statement) => !OWNED_STATEMENT.test(statement));
+  return statementsToExecute.filter((statement) => !owned.test(statement));
 }
 function shimExecute(db) {
   const execute = db.execute.bind(db);
@@ -1405,7 +4490,7 @@ async function guardedRun(run) {
 }
 
 // src/engine/index.ts
-var STATEMENT_KINDS = ["hint", "ddl", "security", "function"];
+var STATEMENT_KINDS = ["hint", "ddl", "security", "function", "synced_view"];
 async function planMigration({
   definition,
   previousSnapshot
@@ -1413,254 +4498,308 @@ async function planMigration({
   const schema = ormSchemaName(definition.namespace);
   const previous = previousSnapshot ? normalizeSnapshot(previousSnapshot) : emptySnapshot(definition.namespace);
   const hints = applyMigrationHints(previous, definition);
-  const snapshot = generateSnapshot(definition, previousId(previous));
+  const snapshot = generateSnapshot(definition, previousId2(previous));
   const ddl = await diffStatements(hints.adjusted, snapshot);
   const policyDrops = policyDropStatements(schema, snapshotTableNames(previous, schema));
   const statements = [
-    ...policyDrops.map((sql2) => ({ kind: "security", sql: sql2 })),
-    ...hints.statements.map((sql2) => ({ kind: "hint", sql: sql2 })),
-    ...ddl.map((sql2) => ({ kind: "ddl", sql: sql2.replace(/;\s*$/, "") })),
-    ...securityStatements(definition).map((sql2) => ({ kind: "security", sql: sql2 })),
+    ...policyDrops.map((sql4) => ({ kind: "security", sql: sql4 })),
+    ...hints.statements.map((sql4) => ({ kind: "hint", sql: sql4 })),
+    ...ddl.map((sql4) => ({ kind: "ddl", sql: sql4.replace(/;\s*$/, "") })),
+    ...securityStatements(definition).map((sql4) => ({ kind: "security", sql: sql4 })),
     // PREPARE each action's executes first (plpgsql bodies don't check columns
     // at CREATE), then create the functions. Both reference the tables the DDL
     // above creates, so they close the plan.
-    ...actionPrepareChecks(definition).map((sql2) => ({ kind: "function", sql: sql2 })),
-    ...actionFunctionStatements(definition).map((sql2) => ({ kind: "function", sql: sql2 }))
+    ...actionPrepareChecks(definition).map((sql4) => ({ kind: "function", sql: sql4 })),
+    ...actionFunctionStatements(definition).map((sql4) => ({ kind: "function", sql: sql4 }))
   ];
   return { namespace: definition.namespace, schema, statements, snapshot };
 }
 var compileNamespace = (definition) => planMigration({ definition });
-var previousId = (snapshot) => snapshot.id;
-function stableJson(value) {
-  if (value === null || typeof value !== "object") return JSON.stringify(value);
-  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
-  const entries = Object.entries(value).filter(([, entryValue]) => entryValue !== void 0).sort(([a], [b]) => a < b ? -1 : 1).map(([key, entryValue]) => `${JSON.stringify(key)}:${stableJson(entryValue)}`);
-  return `{${entries.join(",")}}`;
-}
-function emptyToNull(value) {
-  if (value == null) return null;
-  if (Array.isArray(value)) return value.length === 0 ? null : value;
-  if (typeof value === "object" && Object.keys(value).length === 0) return null;
-  return value;
-}
-function canonicalTable(table) {
-  return {
-    table: table.table,
-    description: table.description ?? null,
-    columns: table.columns ?? null,
-    source: table.source ?? null,
-    links: emptyToNull(table.links),
-    indexes: emptyToNull(table.indexes),
-    policies: {
-      read: table.policies?.read?.source ?? null,
-      write: table.policies?.write?.source ?? null
-    },
-    actions: emptyToNull(
-      Object.fromEntries(
-        Object.entries(table.actions ?? {}).map(([name, action]) => [
-          name,
-          {
-            description: action.description ?? null,
-            requires: action.requires?.source ?? null,
-            params: emptyToNull(action.params),
-            validates: emptyToNull(action.validates?.map((entry) => entry.source)),
-            executes: action.executes,
-            returns: emptyToNull(action.returns),
-            audit: action.audit ?? null
-          }
-        ])
-      )
-    )
-  };
-}
-function canonicalCapabilities(capabilities) {
-  const { definitions, capabilities: declared } = capabilities.roles;
-  const isEmpty = Object.keys(definitions).length === 0 && Object.keys(declared).length === 0 && capabilities.uses.length === 0;
-  if (isEmpty) return null;
-  return {
-    roles: {
-      definitions: Object.fromEntries(
-        Object.entries(definitions).map(([key, def]) => [
-          key,
-          {
-            ...def.description !== void 0 ? { description: def.description } : {},
-            default: def.default,
-            inherits: [...def.inherits].sort(),
-            grants: [...def.grants].sort()
-          }
-        ])
-      ),
-      capabilities: Object.fromEntries(
-        Object.entries(declared).map(([key, cap]) => [
-          key,
-          cap.description !== void 0 ? { description: cap.description } : {}
-        ])
-      )
-    },
-    uses: [...capabilities.uses].sort()
-  };
-}
-function canonicalizeDefinition(definition) {
-  return {
-    namespace: definition.namespace,
-    description: definition.description,
-    capabilities: canonicalCapabilities(definition.capabilities),
-    tables: definition.tables.map(canonicalTable)
-  };
-}
-function computeDefinitionHash(definition) {
-  return createHash("sha256").update(HASH_DOMAIN).update(stableJson(canonicalizeDefinition(definition))).digest("hex");
-}
-var CUSTOM_ROLE_KEY_RE = /^[a-z0-9-]+$/;
-var customRoleKeySchema = z.string().min(1).max(64).regex(
-  CUSTOM_ROLE_KEY_RE,
-  "Role and capability keys must match [a-z0-9-]+"
+var previousId2 = (snapshot) => snapshot.id;
+var IR_VERSION = 1;
+var CLAIMS_CONTRACT = {
+  sub: "string",
+  org: "string?",
+  roles: "string[]",
+  capabilities: "string[]"
+};
+var scalarLiteral = z.union([z.string(), z.number(), z.boolean(), z.null()]);
+var valueIrSchema = z.discriminatedUnion("kind", [
+  z.object({ kind: z.literal("literal"), value: z.union([scalarLiteral, z.array(scalarLiteral)]) }),
+  z.object({ kind: z.literal("variable"), name: z.string() }),
+  z.object({ kind: z.literal("claim"), key: z.enum(["sub", "org"]) })
+]);
+var CMP_OPS = [
+  "eq",
+  "neq",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "in",
+  "nin",
+  "like",
+  "ilike",
+  "isNull",
+  "contains",
+  "hasKey"
+];
+var predIrSchema = z.lazy(
+  () => z.discriminatedUnion("kind", [
+    z.object({ kind: z.literal("and"), operands: z.array(predIrSchema).min(1) }),
+    z.object({ kind: z.literal("or"), operands: z.array(predIrSchema).min(1) }),
+    z.object({ kind: z.literal("not"), operand: predIrSchema }),
+    z.object({ kind: z.literal("cmp"), op: z.enum(CMP_OPS), column: z.string(), value: valueIrSchema }),
+    z.object({ kind: z.literal("exists"), link: z.string(), where: predIrSchema }),
+    z.object({
+      kind: z.literal("aggPredicate"),
+      link: z.string(),
+      fn: z.literal("count"),
+      op: z.enum(["eq", "neq", "gt", "gte", "lt", "lte"]),
+      value: z.number(),
+      where: predIrSchema.optional()
+    }),
+    z.object({ kind: z.literal("capability"), key: z.string() }),
+    z.object({ kind: z.literal("role"), key: z.string() }),
+    z.object({ kind: z.literal("dynamicFilter"), slot: z.string() }),
+    z.object({ kind: z.literal("const"), value: z.boolean() })
+  ])
 );
-var MAX_CUSTOM_ROLE_DEFINITIONS = 50;
-var MAX_CUSTOM_ROLE_CAPABILITIES = 100;
-var customRoleCapabilityDeclarationSchema = z.object({
-  description: z.string().max(500).optional()
+var orderIrSchema = z.discriminatedUnion("kind", [
+  z.object({
+    kind: z.literal("column"),
+    column: z.string(),
+    /** Order through a to-one link: `link` is set and `column` is on the target. */
+    link: z.string().optional(),
+    direction: z.enum(["asc", "desc"]),
+    nulls: z.enum(["first", "last"]).optional()
+  }),
+  /** §4f: `$orderBy: [FooOrderBy!]` variable — validated + lowered at runtime. */
+  z.object({ kind: z.literal("dynamic"), slot: z.string() })
+]);
+var limitIrSchema = z.object({
+  /** Fixed value or a variable, clamped to [1, max]; absent → default. */
+  variable: z.string().optional(),
+  value: z.number().int().positive().optional(),
+  default: z.number().int().positive(),
+  max: z.number().int().positive()
 });
-var customRoleDefinitionSchema = z.object({
-  description: z.string().max(500).optional(),
+var selectionIrSchema = z.lazy(
+  () => z.object({
+    typename: z.string(),
+    columns: z.array(z.object({ alias: z.string(), column: z.string() })),
+    relations: z.array(z.object({
+      alias: z.string(),
+      link: z.string(),
+      selection: selectionIrSchema,
+      where: predIrSchema.optional(),
+      orderBy: z.array(orderIrSchema).optional(),
+      limit: limitIrSchema.optional(),
+      offset: z.object({ variable: z.string().optional(), value: z.number().int().optional() }).optional()
+    })),
+    aggregates: z.array(z.object({
+      alias: z.string(),
+      link: z.string().optional(),
+      where: predIrSchema.optional(),
+      count: z.object({ columns: z.array(z.string()).optional(), distinct: z.boolean().optional() }).optional(),
+      sum: z.array(z.string()).optional(),
+      avg: z.array(z.string()).optional(),
+      nodes: selectionIrSchema.optional()
+    }))
+  })
+);
+var includeIfSchema = z.object({ variable: z.string(), negated: z.boolean() });
+var selectRootSchema = z.object({
+  kind: z.literal("select"),
+  alias: z.string(),
+  table: z.string(),
+  selection: selectionIrSchema,
+  /** Composed at compile time: AND(policy, documentWhere?, dynamicFilter?). */
+  where: predIrSchema,
+  orderBy: z.array(orderIrSchema).default([]),
+  distinctOn: z.union([z.array(z.string()), z.object({ slot: z.string() })]).optional(),
+  limit: limitIrSchema,
+  offset: z.object({ variable: z.string().optional(), value: z.number().int().optional() }).optional(),
+  includeIf: includeIfSchema.optional()
+});
+var byPkRootSchema = z.object({
+  kind: z.literal("byPk"),
+  alias: z.string(),
+  table: z.string(),
+  selection: selectionIrSchema,
+  pk: z.array(z.object({ column: z.string(), value: valueIrSchema })).min(1),
+  /** Policy predicate — ANDed with the PK match. */
+  where: predIrSchema,
+  includeIf: includeIfSchema.optional()
+});
+var aggregateRootSchema = z.object({
+  kind: z.literal("aggregate"),
+  alias: z.string(),
+  table: z.string(),
+  where: predIrSchema,
+  count: z.object({ columns: z.array(z.string()).optional(), distinct: z.boolean().optional() }).optional(),
+  sum: z.array(z.string()).optional(),
+  avg: z.array(z.string()).optional(),
+  nodes: selectionIrSchema.optional(),
+  includeIf: includeIfSchema.optional()
+});
+var writeValuesSchema = z.union([
+  z.object({ slot: z.string() }),
+  z.object({ entries: z.array(z.object({ column: z.string(), value: valueIrSchema })) })
+]);
+var onConflictIrSchema = z.union([
+  z.object({ slot: z.string() }),
+  z.object({ constraint: z.string(), updateColumns: z.array(z.string()) })
+]);
+var mutationRootSchema = z.object({
+  kind: z.literal("mutation"),
   /**
-   * Grants this role to the host's entire runtime audience. Resolved at the
-   * app layer at claim time — every caller who passes the host floor
-   * (`end_user`) holds the default roles; no tuple is written for it.
+   * CRUD verbs plus the structured copy-on-write ops. `cowOverride` copies the
+   * synced row into the overlay (INSERT…SELECT, ON CONFLICT DO NOTHING) then
+   * applies `set` — both statements generated by the executor from this
+   * metadata, never authored SQL. `cowRevert` deletes the override so the
+   * coalesce view falls back to synced. Both are gated on a matching synced
+   * row and carry the write policy in `where` like update/delete.
    */
-  default: z.boolean().default(false),
-  /** Role keys whose grants this role also receives (privilege waterfall). */
-  inherits: z.array(customRoleKeySchema).default([]),
-  /** Capability keys this role grants directly. */
-  grants: z.array(customRoleKeySchema).default([])
+  op: z.enum(["insert", "insertOne", "update", "updateByPk", "delete", "deleteByPk", "cowOverride", "cowRevert"]),
+  alias: z.string(),
+  table: z.string(),
+  /** CoW ops: logical name of the synced twin (read through its policy-filtered view). */
+  cowSynced: z.string().optional(),
+  /** cowOverride: logical properties copied INSERT…SELECT from synced (pk included). */
+  cowCopyColumns: z.array(z.string()).optional(),
+  /** cowOverride: insert-policy WITH CHECK evaluated over the copied rows. */
+  cowCopyCheck: predIrSchema.optional(),
+  /** insert/insertOne: rows come from a slot ($object/$objects) or literals. */
+  objects: z.union([
+    z.object({ slot: z.string() }),
+    z.object({ rows: z.array(z.array(z.object({ column: z.string(), value: valueIrSchema }))) })
+  ]).optional(),
+  /** Server-pinned columns (e.g. author_sub ← claim('sub')) merged into every inserted row. */
+  pinnedColumns: z.array(z.object({ column: z.string(), value: valueIrSchema })).default([]),
+  onConflict: onConflictIrSchema.optional(),
+  set: writeValuesSchema.optional(),
+  append: writeValuesSchema.optional(),
+  inc: writeValuesSchema.optional(),
+  /** update/delete row filter: AND(writePolicy, documentWhere/pk, dynamicFilter?). */
+  where: predIrSchema.optional(),
+  pk: z.array(z.object({ column: z.string(), value: valueIrSchema })).optional(),
+  /** WITH CHECK analogue evaluated against NEW row values (insert/update). */
+  insertCheck: predIrSchema.optional(),
+  returning: selectionIrSchema.nullable(),
+  affectedRows: z.boolean().default(false),
+  includeIf: includeIfSchema.optional()
 });
-var customRolesBlockSchema = z.object({
-  /** Roles grantable to principals, keyed by role key. */
-  definitions: z.record(customRoleKeySchema, customRoleDefinitionSchema).default({}),
-  /** Leaf capability keys the host's code checks, keyed by capability key. */
-  capabilities: z.record(customRoleKeySchema, customRoleCapabilityDeclarationSchema).default({})
-}).superRefine((block, ctx) => {
-  const roleKeys = Object.keys(block.definitions);
-  const capabilityKeys = new Set(Object.keys(block.capabilities));
-  if (roleKeys.length > MAX_CUSTOM_ROLE_DEFINITIONS) {
-    ctx.addIssue({
-      code: "custom",
-      message: `At most ${MAX_CUSTOM_ROLE_DEFINITIONS} role definitions are allowed`,
-      path: ["definitions"]
-    });
-  }
-  if (capabilityKeys.size > MAX_CUSTOM_ROLE_CAPABILITIES) {
-    ctx.addIssue({
-      code: "custom",
-      message: `At most ${MAX_CUSTOM_ROLE_CAPABILITIES} capabilities are allowed`,
-      path: ["capabilities"]
-    });
-  }
-  for (const key of roleKeys) {
-    if (capabilityKeys.has(key)) {
-      ctx.addIssue({
-        code: "custom",
-        message: `Key "${key}" is declared as both a role and a capability`,
-        path: ["definitions", key]
-      });
-    }
-  }
-  const roleKeySet = new Set(roleKeys);
-  for (const [roleKey, definition] of Object.entries(block.definitions)) {
-    const seenInherits = /* @__PURE__ */ new Set();
-    for (const inherited of definition.inherits) {
-      if (seenInherits.has(inherited)) {
-        ctx.addIssue({
-          code: "custom",
-          message: `Role "${roleKey}" lists "${inherited}" in inherits more than once`,
-          path: ["definitions", roleKey, "inherits"]
-        });
-      }
-      seenInherits.add(inherited);
-      if (!roleKeySet.has(inherited)) {
-        ctx.addIssue({
-          code: "custom",
-          message: `Role "${roleKey}" inherits unknown role "${inherited}"`,
-          path: ["definitions", roleKey, "inherits"]
-        });
-      }
-    }
-    const seenGrants = /* @__PURE__ */ new Set();
-    for (const granted of definition.grants) {
-      if (seenGrants.has(granted)) {
-        ctx.addIssue({
-          code: "custom",
-          message: `Role "${roleKey}" lists "${granted}" in grants more than once`,
-          path: ["definitions", roleKey, "grants"]
-        });
-      }
-      seenGrants.add(granted);
-      if (!capabilityKeys.has(granted)) {
-        ctx.addIssue({
-          code: "custom",
-          message: `Role "${roleKey}" grants unknown capability "${granted}"`,
-          path: ["definitions", roleKey, "grants"]
-        });
-      }
-    }
-  }
-  const state = /* @__PURE__ */ new Map();
-  const visit = (key, path) => {
-    if (state.get(key) === "done") return null;
-    if (state.get(key) === "visiting") return [...path, key];
-    state.set(key, "visiting");
-    const definition = block.definitions[key];
-    for (const inherited of definition?.inherits ?? []) {
-      if (!roleKeySet.has(inherited)) continue;
-      const cycle = visit(inherited, [...path, key]);
-      if (cycle) return cycle;
-    }
-    state.set(key, "done");
-    return null;
-  };
-  for (const roleKey of roleKeys) {
-    const cycle = visit(roleKey, []);
-    if (cycle) {
-      ctx.addIssue({
-        code: "custom",
-        message: `Role inheritance cycle: ${cycle.join(" -> ")}`,
-        path: ["definitions"]
-      });
-      break;
-    }
-  }
+var rootIrSchema = z.discriminatedUnion("kind", [
+  selectRootSchema,
+  byPkRootSchema,
+  aggregateRootSchema,
+  mutationRootSchema
+]);
+var INPUT_REF_KINDS = [
+  "boolExp",
+  "orderBy",
+  "selectColumn",
+  "insertInput",
+  "setInput",
+  "appendInput",
+  "onConflict"
+];
+var variableDefaultIrSchema = z.object({
+  value: z.union([scalarLiteral, z.array(scalarLiteral)])
 });
-function customRolesDeclared(block) {
-  if (!block) return false;
-  return Object.keys(block.definitions).length > 0 || Object.keys(block.capabilities).length > 0;
-}
-var CUSTOM_CAPABILITY_PIN_RE = /^(?:org\/)?[a-z0-9-]+$/;
-var MAX_CAPABILITY_PINS = 100;
-var capabilityPinsSchema = z.array(
-  z.string().min(1).max(68).regex(
-    CUSTOM_CAPABILITY_PIN_RE,
-    'Pins must be "org/<key>" or a bare "<key>" matching [a-z0-9-]+'
-  )
-).max(MAX_CAPABILITY_PINS).default([]);
-function parseCapabilityPin(pin) {
-  return pin.startsWith("org/") ? { scope: "org", key: pin.slice("org/".length) } : { scope: "host", key: pin };
-}
-function validateCapabilityPins({
-  uses,
-  roles
-}) {
-  const errors = [];
-  const seen = /* @__PURE__ */ new Set();
-  const roleKeys = new Set(Object.keys(roles?.definitions ?? {}));
-  for (const pin of uses) {
-    if (seen.has(pin)) errors.push(`Pin "${pin}" is listed more than once`);
-    seen.add(pin);
-    const parsed = parseCapabilityPin(pin);
-    if (parsed.scope === "host" && roleKeys.has(parsed.key)) {
-      errors.push(`Pin "${pin}" references a role \u2014 roles are never pinned`);
-    }
+var variableIrSchema = z.object({
+  name: z.string(),
+  type: z.union([
+    z.object({ kind: z.literal("scalar"), scalar: z.enum(COLUMN_TYPES) }),
+    /** `values` is the declared membership whitelist — the executor validates against it. */
+    z.object({ kind: z.literal("enum"), name: z.string(), values: z.array(z.string()).min(1) }),
+    /** §4f dynamic slot: validated against `tables[table]` whitelists at runtime. */
+    z.object({ kind: z.literal("inputRef"), input: z.enum(INPUT_REF_KINDS), table: z.string() })
+  ]),
+  nullable: z.boolean(),
+  list: z.boolean(),
+  /** Absent = no default declared; see {@link variableDefaultIrSchema}. */
+  defaultValue: variableDefaultIrSchema.optional()
+});
+var compiledOperationSchema = z.object({
+  irVersion: z.literal(IR_VERSION),
+  name: z.string(),
+  opHash: z.string().regex(/^sha256:[0-9a-f]{64}$/),
+  kind: z.enum(["query", "mutation"]),
+  requires: z.object({
+    capability: z.string().optional(),
+    role: z.string().optional()
+  }).nullable(),
+  variables: z.array(variableIrSchema),
+  /** Every table the op touches — data-token scoping + audit. */
+  tableSet: z.array(z.string()).min(1),
+  roots: z.array(rootIrSchema).min(1)
+});
+var tableMetaIrSchema = z.object({
+  table: z.string(),
+  schema: z.string(),
+  typename: z.string(),
+  /**
+   * True when statements over this relation evaluate a claims-gated synced
+   * view: synced twins (`source: gold.*`) materialize as views whose baked
+   * policy reads `current_setting('request.jwt.claims')`, and namespace views
+   * inherit the gate transitively through their declared dependencies. The
+   * executor must stamp that GUC (transaction-scoped) before any statement
+   * touching such a relation, or the synced arm yields zero rows regardless
+   * of the compiled predicates.
+   */
+  claimsGated: z.boolean().default(false),
+  columns: z.array(z.object({
+    name: z.string(),
+    columnName: z.string(),
+    type: z.union([z.enum(COLUMN_TYPES), z.object({ enum: z.string(), values: z.array(z.string()) })]),
+    nullable: z.boolean()
+  })),
+  /** Empty for keyless read-only views; keyed tables and views list logical columns. */
+  primaryKey: z.array(z.string()),
+  links: z.array(z.object({
+    name: z.string(),
+    kind: z.enum(["toOne", "toMany", "toPlatformUser"]),
+    target: z.string(),
+    on: z.string(),
+    references: z.string()
+  })),
+  /** §4f whitelists: what dynamic inputs may reference. */
+  filterable: z.array(z.string()),
+  orderable: z.array(z.string()),
+  insertable: z.array(z.string()),
+  settable: z.array(z.string()),
+  appendable: z.array(z.string()),
+  constraints: z.array(z.object({ name: z.string(), columns: z.array(z.string()) })),
+  /** Depth/node caps for dynamic filter trees on this table. */
+  dynamicFilterMaxDepth: z.number().int().positive().default(6),
+  dynamicFilterMaxNodes: z.number().int().positive().default(64)
+});
+var compiledArtifactSchema = z.object({
+  irVersion: z.literal(IR_VERSION),
+  namespace: z.string(),
+  schemaHash: z.string(),
+  opsHash: z.string(),
+  tables: z.record(z.string(), tableMetaIrSchema),
+  operations: z.record(z.string(), compiledOperationSchema)
+});
+var IrVersionError = class extends Error {
+  constructor(found) {
+    super(`Unsupported IR version ${String(found)} \u2014 this executor supports up to ${IR_VERSION}. Upgrade @sequenceholdings/orm or re-push the namespace.`);
+    this.name = "IrVersionError";
   }
-  return errors;
+};
+function normalizeIr(raw) {
+  if (!raw || typeof raw !== "object") throw new IrVersionError(void 0);
+  const version = raw.irVersion;
+  if (version !== IR_VERSION) throw new IrVersionError(version);
+  return compiledArtifactSchema.parse(raw);
+}
+function indexByHash(artifact) {
+  const map = /* @__PURE__ */ new Map();
+  for (const op of Object.values(artifact.operations)) map.set(op.opHash, op);
+  return map;
 }
 
 // src/schema/namespace.ts
@@ -1785,6 +4924,8 @@ function validateCapabilityRefs(files, declared) {
     const referenced = [
       ...table.policies?.read ? referencedCapabilities(table.policies.read.ast) : [],
       ...table.policies?.write ? referencedCapabilities(table.policies.write.ast) : [],
+      ...table.policies?.insert ? referencedCapabilities(table.policies.insert.ast) : [],
+      ...table.policies?.update ? referencedCapabilities(table.policies.update.ast) : [],
       ...Object.values(table.actions ?? {}).flatMap((action) => [
         ...action.requires ? referencedCapabilities(action.requires.ast) : [],
         ...referencedExecuteCapabilities(action)
@@ -1918,8 +5059,8 @@ async function readMigrationWorkspace(dir, namespace) {
       journalPath
     );
   }
-  parsed.data.entries.forEach((entry, index2) => {
-    if (entry.ordinal !== index2 + 1) {
+  parsed.data.entries.forEach((entry, index3) => {
+    if (entry.ordinal !== index3 + 1) {
       throw new OrmDefinitionError(`migration journal entries must be contiguous from 1 (found ${entry.name})`, journalPath);
     }
   });
@@ -1942,7 +5083,7 @@ async function readMigrationSql(dir, entry) {
     throw new OrmDefinitionError("missing migration file", path);
   });
 }
-var checksumOf = (text2) => createHash("sha256").update(text2).digest("hex");
+var checksumOf = (text4) => createHash("sha256").update(text4).digest("hex");
 var migrationName = (ordinal, contentHash) => `${pad(ordinal)}_${contentHash.slice(0, 12)}`;
 function renderMigrationSql({
   name,
@@ -1968,12 +5109,12 @@ async function writeMigration({
   const tip = workspace.journal.entries.at(-1);
   const ordinal = (tip?.ordinal ?? 0) + 1;
   const name = migrationName(ordinal, contentHash);
-  const sql2 = renderMigrationSql({ name, namespace: workspace.journal.namespace, contentHash, plan });
+  const sql4 = renderMigrationSql({ name, namespace: workspace.journal.namespace, contentHash, plan });
   const metaDir = join(dir, MIGRATIONS_DIRNAME, META_DIRNAME);
   await mkdir(metaDir, { recursive: true });
   const snapshotText = `${JSON.stringify(plan.snapshot, null, 2)}
 `;
-  await writeFile(join(dir, MIGRATIONS_DIRNAME, `${name}.sql`), sql2);
+  await writeFile(join(dir, MIGRATIONS_DIRNAME, `${name}.sql`), sql4);
   await writeFile(join(metaDir, `${pad(ordinal)}.snapshot.json`), snapshotText);
   const journal = {
     ...workspace.journal,
@@ -1984,7 +5125,7 @@ async function writeMigration({
         name,
         content_hash: contentHash,
         previous_content_hash: tip?.content_hash ?? null,
-        checksum: checksumOf(sql2),
+        checksum: checksumOf(sql4),
         snapshot_checksum: checksumOf(snapshotText),
         destructive
       }
@@ -2096,11 +5237,11 @@ async function checkWorkspace({
     log(`no committed migrations for '${loaded.definition.namespace}' \u2014 run \`seq-studio orm diff\` and commit the result`);
     return 1;
   }
-  let previousId2;
+  let previousId3;
   let previousHash = null;
   for (const entry of workspace.journal.entries) {
-    const sql2 = await readMigrationSql(dir, entry);
-    if (checksumOf(sql2) !== entry.checksum) {
+    const sql4 = await readMigrationSql(dir, entry);
+    if (checksumOf(sql4) !== entry.checksum) {
       log(`${MIGRATIONS_DIRNAME}/${entry.name}.sql does not match its journal checksum \u2014 committed migrations must not be edited`);
       return 1;
     }
@@ -2110,7 +5251,7 @@ async function checkWorkspace({
       return 1;
     }
     const snapshot = JSON.parse(snapshotText);
-    if (entry.ordinal > 1 && snapshot.prevId !== previousId2) {
+    if (entry.ordinal > 1 && snapshot.prevId !== previousId3) {
       log(`snapshot chain broken at ${entry.name} \u2014 regenerate the workspace with \`seq-studio orm diff\``);
       return 1;
     }
@@ -2118,7 +5259,7 @@ async function checkWorkspace({
       log(`content-hash chain broken at ${entry.name} \u2014 migrations must be appended in order by \`seq-studio orm diff\``);
       return 1;
     }
-    previousId2 = snapshot.id;
+    previousId3 = snapshot.id;
     previousHash = entry.content_hash;
   }
   if (tip.content_hash !== loaded.contentHash) {
@@ -2140,12 +5281,145 @@ async function checkWorkspace({
   log(`migrations in sync \u2014 ${workspace.journal.entries.length} committed, tip ${tip.name}`);
   return 0;
 }
-var firstLine = (sql2) => sql2.split("\n")[0] ?? sql2;
+var firstLine = (sql4) => sql4.split("\n")[0] ?? sql4;
+
+// src/migrations/from-yaml.ts
+function convertV1DefinitionToCanonical(definition) {
+  const raw = {
+    definition_format: CANONICAL_FORMAT,
+    namespace: definition.namespace,
+    description: definition.description ?? void 0,
+    enums: [],
+    tables: definition.tables.map(convertTable),
+    capabilities: {
+      roles: definition.capabilities.roles,
+      uses: [...definition.capabilities.uses]
+    }
+  };
+  const parsed = canonicalDefinitionSchema.safeParse(raw);
+  if (!parsed.success) {
+    const issue = parsed.error.issues[0];
+    throw new OrmDefinitionError(
+      `converted definition is not valid canonical v2: ${issue ? `${issue.path.join(".")}: ${issue.message}` : "unknown issue"}`
+    );
+  }
+  return normalizeCanonical(parsed.data);
+}
+function convertTable(table) {
+  const columns = Object.entries(table.columns ?? {});
+  const primaryKey2 = columns.filter(([, column]) => column.primary_key).map(([name]) => name);
+  return {
+    table: table.table,
+    description: table.description,
+    source: table.source,
+    columns: columns.map(([name, column]) => convertColumn(name, column)),
+    // Synced tables may declare a typed column/PK contract; untyped remain empty.
+    primaryKey: primaryKey2.length > 0 ? primaryKey2 : void 0,
+    links: Object.entries(table.links ?? {}).map(([name, link]) => convertLink(table.table, name, link)),
+    indexes: (table.indexes ?? []).map((index3) => ({
+      columns: [...index3.columns],
+      unique: index3.unique ?? false,
+      name: index3.name
+    })),
+    policies: {
+      // Verbatim DSL source strings — the parsed v1 AST is derived state.
+      read: table.policies?.read?.source,
+      write: table.policies?.write?.source
+    },
+    // v2 has no action surface (writes are mutations); the transition sweep
+    // drops the plpgsql action_* functions, so carrying the metadata would be
+    // dead weight. droppedV1Actions() surfaces them for the emitter's TODO.
+    actions: []
+  };
+}
+function convertColumn(name, column) {
+  const isDefaultFn = column.default !== void 0 && isFunctionDefault(column.default, column.type);
+  return {
+    name,
+    columnName: name,
+    type: column.type,
+    nullable: column.primary_key ? false : column.nullable !== false,
+    unique: column.unique === true,
+    default: isDefaultFn ? void 0 : column.default,
+    // isFunctionDefault guarantees one of the two allowlisted functions; the
+    // canonicalDefinitionSchema parse below re-checks the enum.
+    defaultFn: isDefaultFn ? column.default : void 0,
+    description: column.description,
+    renamedFrom: column.renamed_from,
+    cast: column.cast,
+    deprecated: column.deprecated === true
+  };
+}
+function convertLink(table, name, link) {
+  if (link.to.includes(".")) {
+    throw new OrmDefinitionError(
+      `link '${name}' on '${table}' targets '${link.to}' \u2014 cross-namespace links have no canonical v2 representation (links are namespace-local in v2)`
+    );
+  }
+  return {
+    name,
+    kind: "toOne",
+    target: link.to,
+    on: link.on,
+    enforce: link.enforce === true,
+    description: link.description
+  };
+}
+
+// src/migrations/v2.ts
+var SHA256_HEX = /^[0-9a-f]{64}$/;
+function rebaseViolations(statements, options) {
+  const allowSecurity = options?.allowSecurityReemission ?? false;
+  return statements.filter((statement) => !(statement.kind === "security" && allowSecurity));
+}
+var verifyRebaseIsNoop = (plan, options) => rebaseViolations(plan.statements, options).length === 0;
+function buildRebaseJournalEntry({ namespace, previousHash, newHash, ordinal, snapshot }) {
+  if (!SHA256_HEX.test(previousHash)) {
+    throw new OrmDefinitionError(`rebase previousHash is not a sha256 hex digest: '${previousHash}'`);
+  }
+  if (!SHA256_HEX.test(newHash)) {
+    throw new OrmDefinitionError(`rebase newHash is not a sha256 hex digest: '${newHash}'`);
+  }
+  if (previousHash === newHash) {
+    throw new OrmDefinitionError("rebase previousHash and newHash are identical \u2014 nothing to rebase");
+  }
+  if (!Number.isInteger(ordinal) || ordinal < 2) {
+    throw new OrmDefinitionError(`rebase ordinal must be an integer \u2265 2 (a rebase sits on an existing journal tip); got ${ordinal}`);
+  }
+  const name = migrationName(ordinal, newHash);
+  const sql4 = renderRebaseMigrationSql({ name, namespace, previousHash, newHash });
+  const snapshotText = `${JSON.stringify(snapshot, null, 2)}
+`;
+  const entry = {
+    ordinal,
+    name,
+    content_hash: newHash,
+    previous_content_hash: previousHash,
+    checksum: checksumOf(sql4),
+    snapshot_checksum: checksumOf(snapshotText),
+    destructive: false
+  };
+  return { name, entry, sql: sql4, snapshotText };
+}
+function renderRebaseMigrationSql({
+  name,
+  namespace,
+  previousHash,
+  newHash
+}) {
+  return [
+    `-- ${name}`,
+    `-- namespace: ${namespace}`,
+    `-- content hash: ${newHash}`,
+    `-- rebase: v1 definitions (${previousHash}) converted to canonical v2 \u2014 verified no-op, zero statements`,
+    "-- generated by `seq-studio orm diff --rebase` \u2014 review and commit, do not edit"
+  ].join("\n") + "\n";
+}
 
 // src/schema/canonical.ts
 function parseCanonicalDefinition(value) {
   const canonical = asCanonicalShape(value);
-  const files = canonical.tables.map((table, index2) => {
+  const files = canonical.tables.map((table, index3) => {
     const input = {
       namespace: canonical.namespace,
       table: table["table"],
@@ -2162,10 +5436,10 @@ function parseCanonicalDefinition(value) {
       const issue = parsed.error.issues[0];
       throw new OrmDefinitionError(
         `stored definition for table ${String(table["table"])} is invalid: ${issue?.message ?? "unknown issue"}`,
-        `canonical[${index2}]`
+        `canonical[${index3}]`
       );
     }
-    return { file: `canonical[${index2}]`, table: parsed.data };
+    return { file: `canonical[${index3}]`, table: parsed.data };
   });
   const config = namespaceConfigSchema.safeParse({
     namespace: canonical.namespace,
@@ -2198,8 +5472,9 @@ function canonicalPolicies(value) {
   if (value === null || typeof value !== "object") return void 0;
   const record = value;
   const policies = {};
-  if (typeof record["read"] === "string") policies["read"] = record["read"];
-  if (typeof record["write"] === "string") policies["write"] = record["write"];
+  for (const kind of ["read", "write", "insert", "update"]) {
+    if (typeof record[kind] === "string") policies[kind] = record[kind];
+  }
   return Object.keys(policies).length > 0 ? policies : void 0;
 }
 function canonicalActions(value) {
@@ -2222,6 +5497,6 @@ function canonicalActions(value) {
   );
 }
 
-export { ACTION_REQUIRES_DENIED_SQLSTATE, ACTION_VALIDATES_FAILED_SQLSTATE, AUDIT_ACTIONS, CAPABILITIES_CLAIM_KEY, CAPABILITY_KEY_PATTERN, CLAIMS_SETTING, CLAIM_KEY_PATTERN, COLUMN_TYPES, COMPARE_OPS, CONSUMER_ROLE_SUFFIX, DEFINITION_FILE_EXTENSIONS, HASH_DOMAIN, IDENTIFIER_PATTERN, MAX_DEFINITION_FILE_BYTES, MAX_IDENTIFIER_LENGTH, MIGRATIONS_DIRNAME, NAMESPACE_CONFIG_FILENAMES, NAMESPACE_PATTERN, ORM_DATA_TOKEN_HEADER, ORM_SCHEMA_PREFIX, ORM_SERVICE_DATA_TOKEN_HEADER, OrmDefinitionError, PredicateParseError, QUALIFIED_TABLE_PATTERN, RESERVED_COLUMN_NAMES, RESERVED_TABLE_NAMES, STATEMENT_KINDS, SYNCED_SOURCE_PATTERN, actionFunctionName, actionFunctionStatements, actionParamArg, actionParamOrder, actionParamSchema, actionPrepareChecks, actionSchema, actionWriteTargets, actionsInterfaceName, applyMigrationHints, buildActionParamsSchema, buildDrizzleEntities, buildNamespaceDefinition, canonicalizeDefinition, capabilityExpression, capabilityPinsSchema, castParts, checksumOf, claimExpression, classifyDestructive, columnSchema, columnTypeSchema, compileActionRequires, compileActionStatements, compileNamespace, compilePredicate, computeDefinitionHash, consumerRoleName, customRolesBlockSchema, customRolesDeclared, declaredCapabilityKeys, diffCommand, diffStatements, emptyJournal, emptySnapshot, extractNamedParams, generateNamespaceTypes, generateSnapshot, identifierSchema, isFunctionDefault, isOwnedStatement, isQualifiedReference, loadCommittedMigrations, loadCommittedTipMigration, loadNamespaceDefinition, migrationName, namespaceConfigSchema, namespaceSchema, normalizeSnapshot, ormSchemaName, parseCanonicalDefinition, parseCapabilityPin, parseDefinitionSources, parsePredicate, parseTableFile, parsedPredicateSchema, pendingKitStatements, planMigration, predicateOperands, quoteIdentifier, quoteLiteral, readMigrationSql, readMigrationWorkspace, readSnapshot, referencedCapabilities, referencedColumns, renderMigrationSql, securityStatements, sqlTypeName, stableJson, tableFileSchema, tableReferenceSchema, typesInterfaceName, validateCapabilityPins, walkPredicate, writeMigration };
+export { ACTION_REQUIRES_DENIED_SQLSTATE, ACTION_VALIDATES_FAILED_SQLSTATE, AUDIT_ACTIONS, CANONICAL_FORMAT, CAPABILITIES_CLAIM_KEY, CAPABILITY_KEY_PATTERN, CLAIMS_CONTRACT, CLAIMS_SETTING, CLAIM_KEY_PATTERN, CMP_OPS, COLUMN_BRAND, COLUMN_DEFAULT_FNS, COLUMN_TYPES2 as COLUMN_TYPES, COMPARE_OPS, CONSUMER_ROLE_SUFFIX, ColumnBuilder, DEFINITION_FILE_EXTENSIONS, ENUM_BRAND, HASH_DOMAIN, IDENTIFIER_PATTERN, IDENTIFIER_RE, INPUT_REF_KINDS, IR_VERSION, IrVersionError, LINK_BRAND, MAX_DEFINITION_FILE_BYTES, MAX_IDENTIFIER_LENGTH, MIGRATIONS_DIRNAME, NAMESPACE_CONFIG_BRAND, NAMESPACE_CONFIG_FILE, NAMESPACE_CONFIG_FILENAMES, NAMESPACE_PATTERN, ORM_DATA_TOKEN_HEADER, ORM_SCHEMA_PREFIX, ORM_SERVICE_DATA_TOKEN_HEADER, ORM_TO_PIPELINE_TYPE, OrmDefinitionError, PredicateParseError, QUALIFIED_TABLE_PATTERN, RESERVED_COLUMN_NAMES, RESERVED_TABLE_NAMES, ROLES_CLAIM_KEY, SCHEMA_DIR, STATEMENT_KINDS, SYNCED_CONTRACT_HASH_DOMAIN, SYNCED_SOURCE_PATTERN, SYNCED_VIEW_EXECUTION_OWNER_ROLE, TABLE_BRAND, VIEW_BRAND, actionFunctionName, actionFunctionStatements, actionParamArg, actionParamOrder, actionParamSchema, actionPrepareChecks, actionSchema, actionWriteTargets, actionsInterfaceName, activeAuthoringContext, applyMigrationHints, applyMigrationHintsV2, beginAuthoringContext, buildActionParamsSchema, buildDrizzleEntities, buildDrizzleEntitiesV2, buildNamespaceDefinition, buildRebaseJournalEntry, canonicalActionSchema, canonicalColumnSchema, canonicalDefinitionSchema, canonicalEnumSchema, canonicalIndexSchema, canonicalLinkSchema, canonicalPoliciesSchema, canonicalRelations, canonicalTableSchema, canonicalViewSchema, canonicalizeDefinition, capabilityExpression, castParts, checksumOf, claimExpression, classifyDestructive, columnSchema, columnTypeSchema2 as columnTypeSchema, compileActionRequires, compileActionStatements, compileNamespace, compilePredIrToSql, compilePredicate, compiledArtifactSchema, compiledOperationSchema, computeCanonicalHash, computeDefinitionHash, computeSyncedContractHash, consumerRoleName, convertV1DefinitionToCanonical, declaredCapabilityKeys, defineEnum, defineNamespace, defineSyncedTable, defineTable, defineView, deriveColumnName, diffCommand, diffStatements, emptyJournal, emptySnapshot, endAuthoringContext, extractNamedParams, extractOrmSyncedTableContract, generateNamespaceTypes, generateSnapshot, generateSnapshotV2, identifierSchema, indexByHash, isColumnBuilder, isEnumRef, isFunctionDefault, isOwnedStatement, isOwnedStatementV2, isQualifiedReference, isSeqLink, isSeqNamespaceConfig, isSeqTable, isSeqView, limitIrSchema, loadCommittedMigrations, loadCommittedTipMigration, loadNamespaceDefinition, loadNamespaceFromDir, migrationName, namespaceConfigSchema, namespaceSchema, normalizeCanonical, normalizeIr, normalizeSnapshot, orderIrSchema, ormSchemaName, overlayWinsUnion, overrideRowMutation, parseCanonicalDefinition, parseDefinitionSources, parsePredicate, parseTableFile, parsedPredicateSchema, pendingKitStatements, pendingKitStatementsV2, planMigration, planMigrationV2, policyExpressionSchema, policyVariantSchema, predIrSchema, predicateOperands, quoteIdentifier, quoteLiteral, readMigrationSql, readMigrationWorkspace, readSnapshot, rebaseViolations, referencedCapabilities, referencedColumns, renderMigrationSql, revertOverlayMutation, rewriteSyncedSourceRelationsInViewQuery, roleExpression, rootIrSchema, securityStatements, selectionIrSchema, serializeNamespace, sqlTypeName, stableJson, syncedBackingRevokeStatements, syncedContractSurface, syncedTables, syncedViewDropStatements, syncedViewStatements, t, tableFileSchema, tableMetaIrSchema, tableReferenceSchema, toMany, toOne, toPlatformUser, typesInterfaceName, validateViewCatalogStatement, valueIrSchema, variableDefaultIrSchema, variableIrSchema, verifyRebaseIsNoop, walkPredicate, writeMigration };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map