@sequenceholdings/orm 0.1.2 → 2.0.0

package/dist/index.js

@@ -1,3 +1,5 @@
+import { sql, eq, notExists } from 'drizzle-orm';
+import { pgSchema, uniqueIndex, index, foreignKey, primaryKey, PgDialect, QueryBuilder, getViewConfig, extractUsedTable, jsonb, date, timestamp, boolean, doublePrecision, numeric, bigint, integer, text, uuid } from 'drizzle-orm/pg-core';
 import { createHash } from 'crypto';
 import { z } from 'zod';
 import { createJiti } from 'jiti';
@@ -5,8 +7,6 @@ import { realpath, stat, readdir, readFile, mkdir, writeFile } from 'fs/promises
 import { createRequire } from 'module';
 import { join, sep, extname } from 'path';
 import { generateDrizzleJson, upPgSnapshot, generateMigration, pushSchema } from 'drizzle-kit/api';
-import { pgSchema, uniqueIndex, index, foreignKey, primaryKey, jsonb, date, timestamp, boolean, doublePrecision, numeric, bigint, integer, text, uuid } from 'drizzle-orm/pg-core';
-import { sql } from 'drizzle-orm';
 import { load } from 'js-yaml';
 import { capabilityPinsSchema, customRolesBlockSchema, validateCapabilityPins } from '@sequenceholdings/custom-roles-manifest';
 export { capabilityPinsSchema, customRolesBlockSchema, customRolesDeclared, parseCapabilityPin, validateCapabilityPins } from '@sequenceholdings/custom-roles-manifest';
@@ -69,8 +69,8 @@ var ColumnBuilder = class {
     this.state.defaultFn = void 0;
     return this;
   }
-  description(text3) {
-    this.state.description = text3;
+  description(text4) {
+    this.state.description = text4;
     return this;
   }
   /** Migration rename hint: the previous Postgres column name. */
@@ -186,7 +186,7 @@ function contextStack() {
   return created;
 }
 function beginAuthoringContext() {
-  const context = { currentFile: void 0, tables: [], enums: [], configs: [] };
+  const context = { currentFile: void 0, tables: [], views: [], enums: [], configs: [] };
   contextStack().push(context);
   return context;
 }
@@ -210,6 +210,9 @@ function register(bucket, value) {
 function registerTable(value) {
   register("tables", value);
 }
+function registerView(value) {
+  register("views", value);
+}
 function registerEnum(value) {
   register("enums", value);
 }
@@ -297,20 +300,69 @@ function defineTable(name, columns, config = {}) {
   registerTable(table);
   return table;
 }
-function defineSyncedTable(name, config) {
+function defineSyncedTable(name, columnsOrConfig, maybeConfig) {
   const file = activeAuthoringContext()?.currentFile;
   assertIdentifier({ value: name, what: "table name", file });
+  const isTyped = maybeConfig !== void 0;
+  const columns = isTyped ? columnsOrConfig : {};
+  const config = isTyped ? maybeConfig : columnsOrConfig;
   if (!SYNCED_SOURCE_PATTERN.test(config.source)) {
     throw new OrmDefinitionError(
       `synced table "${name}": source "${config.source}" must match ${SYNCED_SOURCE_PATTERN} (gold layer only)`,
       file
     );
   }
+  const entries = Object.entries(columns);
+  const seenColumnNames = /* @__PURE__ */ new Map();
+  const columnLevelPk = [];
+  for (const [propertyName, builder] of entries) {
+    if (!isColumnBuilder(builder)) {
+      throw new OrmDefinitionError(
+        `synced table "${name}": column "${propertyName}" is not a column builder \u2014 use the t.* factories (t.uuid(), t.text(), \u2026)`,
+        file
+      );
+    }
+    const columnName = builder.columnNameFor(propertyName);
+    assertIdentifier({
+      value: columnName,
+      what: `synced table "${name}": column "${propertyName}" column name`,
+      file
+    });
+    const existing = seenColumnNames.get(columnName);
+    if (existing !== void 0) {
+      throw new OrmDefinitionError(
+        `synced table "${name}": columns "${existing}" and "${propertyName}" both map to Postgres column "${columnName}"`,
+        file
+      );
+    }
+    seenColumnNames.set(columnName, propertyName);
+    if (builder.isPrimaryKey) columnLevelPk.push(propertyName);
+  }
+  if (entries.length > 0) {
+    const hasConfigPk = config.primaryKey !== void 0 && config.primaryKey.length > 0;
+    if (columnLevelPk.length === 0 && !hasConfigPk) {
+      throw new OrmDefinitionError(
+        `synced table "${name}" declares columns but no primary key \u2014 use .primaryKey() or config.primaryKey`,
+        file
+      );
+    }
+    if (columnLevelPk.length > 0 && hasConfigPk) {
+      throw new OrmDefinitionError(
+        `synced table "${name}": declare the primary key either with .primaryKey() on columns or with config.primaryKey \u2014 not both`,
+        file
+      );
+    }
+  }
+  const tableConfig = {};
+  if (config.description !== void 0) tableConfig.description = config.description;
+  if (config.primaryKey !== void 0) tableConfig.primaryKey = config.primaryKey;
+  if (config.links !== void 0) tableConfig.links = config.links;
+  if (config.policies !== void 0) tableConfig.policies = { read: config.policies.read };
   const table = {
     kind: TABLE_BRAND,
     tableName: name,
-    columns: {},
-    config: config.description !== void 0 ? { description: config.description } : {},
+    columns,
+    config: tableConfig,
     source: config.source,
     file
   };
@@ -340,6 +392,475 @@ function defineEnum(name, values) {
   registerEnum(ref);
   return ref;
 }
+var VIEW_BRAND = "seq-view";
+function isSeqView(value) {
+  return typeof value === "object" && value !== null && value.kind === VIEW_BRAND;
+}
+function defineView(name, columns, config) {
+  const file = activeAuthoringContext()?.currentFile;
+  if (!IDENTIFIER_PATTERN.test(name) || name.length > MAX_IDENTIFIER_LENGTH) {
+    throw new OrmDefinitionError(
+      `view name "${name}" must match ${IDENTIFIER_PATTERN} and be at most ${MAX_IDENTIFIER_LENGTH} characters`,
+      file
+    );
+  }
+  const entries = Object.entries(columns);
+  if (entries.length === 0) throw new OrmDefinitionError(`view "${name}" declares no columns`, file);
+  const seenColumnNames = /* @__PURE__ */ new Map();
+  for (const [propertyName, builder] of entries) {
+    if (!isColumnBuilder(builder)) {
+      throw new OrmDefinitionError(
+        `view "${name}": column "${propertyName}" is not a column builder \u2014 use the t.* factories`,
+        file
+      );
+    }
+    const columnName = builder.columnNameFor(propertyName);
+    if (!IDENTIFIER_PATTERN.test(columnName) || columnName.length > MAX_IDENTIFIER_LENGTH) {
+      throw new OrmDefinitionError(`view "${name}": column "${propertyName}" has invalid column name "${columnName}"`, file);
+    }
+    const existing = seenColumnNames.get(columnName);
+    if (existing !== void 0) {
+      throw new OrmDefinitionError(
+        `view "${name}": columns "${existing}" and "${propertyName}" both map to Postgres column "${columnName}"`,
+        file
+      );
+    }
+    seenColumnNames.set(columnName, propertyName);
+  }
+  const view = { kind: VIEW_BRAND, viewName: name, columns, config, file };
+  registerView(view);
+  return view;
+}
+var QUERY_COLUMN_FACTORIES = {
+  uuid: (name) => uuid(name),
+  text: (name) => text(name),
+  integer: (name) => integer(name),
+  bigint: (name) => bigint(name, { mode: "bigint" }),
+  numeric: (name) => numeric(name),
+  double: (name) => doublePrecision(name),
+  boolean: (name) => boolean(name),
+  timestamptz: (name) => timestamp(name, { withTimezone: true }),
+  date: (name) => date(name),
+  jsonb: (name) => jsonb(name)
+};
+function compileViewQueries(input) {
+  const schemaName = `orm_${input.namespace}`;
+  const schema = pgSchema(schemaName);
+  const enumFactories = /* @__PURE__ */ new Map();
+  for (const entry of input.enums) {
+    const values = entry.values;
+    enumFactories.set(entry.name, schema.enum(entry.name, values));
+  }
+  const handles = /* @__PURE__ */ new Map();
+  const physicalToLogical = /* @__PURE__ */ new Map();
+  const tableByName = new Map(input.tables.map((table) => [table.table, table]));
+  for (const authored of input.authoredTables) {
+    const canonical = tableByName.get(authored.tableName);
+    if (!canonical) continue;
+    const physicalSchema = schemaName;
+    const physicalName = canonical.table;
+    const relationSchema = pgSchema(physicalSchema);
+    const columns = buildQueryColumns(canonical.columns, enumFactories);
+    const handle = relationSchema.table(physicalName, columns);
+    handles.set(authored, handle);
+    physicalToLogical.set(`${physicalSchema}.${physicalName}`, canonical.table);
+  }
+  const viewByName = new Map(input.views.map((view) => [view.view, view]));
+  for (const authored of input.authoredViews) {
+    const canonical = viewByName.get(authored.viewName);
+    if (!canonical) continue;
+    const columns = buildQueryColumns(canonical.columns, enumFactories);
+    const handle = schema.view(canonical.view, columns).existing();
+    handles.set(authored, handle);
+    physicalToLogical.set(`${schemaName}.${canonical.view}`, canonical.view);
+  }
+  const dialect = new PgDialect();
+  const compiled = /* @__PURE__ */ new Map();
+  for (const authored of input.authoredViews) {
+    const expectedFields = Object.keys(authored.columns);
+    const declaredDependencies = /* @__PURE__ */ new Set();
+    const relation = (ref) => {
+      let resolved;
+      try {
+        resolved = typeof ref === "function" ? ref() : ref;
+      } catch (error) {
+        throw new OrmDefinitionError(
+          `view "${authored.viewName}" relation thunk threw: ${error instanceof Error ? error.message : String(error)}`,
+          authored.file
+        );
+      }
+      if (!isSeqTable(resolved) && !isSeqView(resolved)) {
+        throw new OrmDefinitionError(
+          `view "${authored.viewName}" relation() expects a table or view defined by this ORM`,
+          authored.file
+        );
+      }
+      const handle = handles.get(resolved);
+      if (!handle) {
+        const name = isSeqTable(resolved) ? resolved.tableName : resolved.viewName;
+        throw new OrmDefinitionError(
+          `view "${authored.viewName}" references relation "${name}" which is not part of this namespace`,
+          authored.file
+        );
+      }
+      declaredDependencies.add(isSeqTable(resolved) ? resolved.tableName : resolved.viewName);
+      return handle;
+    };
+    let queryBuilder;
+    try {
+      queryBuilder = authored.config.query({ qb: new QueryBuilder(), relation });
+    } catch (error) {
+      if (error instanceof OrmDefinitionError) throw error;
+      throw new OrmDefinitionError(
+        `view "${authored.viewName}" query callback failed: ${error instanceof Error ? error.message : String(error)}`,
+        authored.file
+      );
+    }
+    let config;
+    try {
+      config = getViewConfig(schema.view(authored.viewName).as(queryBuilder));
+    } catch (error) {
+      throw new OrmDefinitionError(
+        `view "${authored.viewName}" query must return a Drizzle select builder: ${error instanceof Error ? error.message : String(error)}`,
+        authored.file
+      );
+    }
+    const selectedFields = Object.keys(config.selectedFields);
+    if (selectedFields.length !== expectedFields.length || selectedFields.some((field, index3) => field !== expectedFields[index3])) {
+      throw new OrmDefinitionError(
+        `view "${authored.viewName}" query selects [${selectedFields.join(", ")}], but declared columns are [${expectedFields.join(", ")}]`,
+        authored.file
+      );
+    }
+    if (!config.query) throw new OrmDefinitionError(`view "${authored.viewName}" produced no query`, authored.file);
+    const tableDependencies = extractUsedTable(config.query).map((physical) => {
+      const logical = physicalToLogical.get(physical);
+      if (!logical) {
+        throw new OrmDefinitionError(
+          `view "${authored.viewName}" query references unmanaged relation "${physical}" \u2014 use relation(...) with a namespace table or view`,
+          authored.file
+        );
+      }
+      return logical;
+    });
+    const renderedQuery = dialect.sqlToQuery(config.query.inlineParams());
+    if (renderedQuery.params.length > 0) {
+      throw new OrmDefinitionError(
+        `view "${authored.viewName}" query produced bind parameters which cannot be persisted in view DDL`,
+        authored.file
+      );
+    }
+    compiled.set(authored.viewName, {
+      query: renderedQuery.sql,
+      dependencies: [.../* @__PURE__ */ new Set([...declaredDependencies, ...tableDependencies])].sort()
+    });
+  }
+  return compiled;
+}
+function buildQueryColumns(columns, enumFactories) {
+  return Object.fromEntries(columns.map((column) => [column.name, buildQueryColumn(column, enumFactories)]));
+}
+function buildQueryColumn(column, enumFactories) {
+  const factory = typeof column.type === "string" ? QUERY_COLUMN_FACTORIES[column.type] : enumFactories.get(column.type.enum);
+  if (!factory) {
+    const type = typeof column.type === "string" ? column.type : column.type.enum;
+    throw new OrmDefinitionError(`view query column '${column.columnName}' references unknown type '${type}'`);
+  }
+  let builder = factory(column.columnName);
+  if (!column.nullable) builder = builder.notNull();
+  return builder;
+}
+function relationName(relation) {
+  return isSeqTable(relation) ? relation.tableName : relation.viewName;
+}
+function relationKind(relation) {
+  return isSeqTable(relation) ? "table" : "view";
+}
+function declaredPrimaryKeyProperties(table) {
+  const fromColumns = Object.entries(table.columns).filter(([, builder]) => builder.isPrimaryKey).map(([propertyName]) => propertyName);
+  if (fromColumns.length > 0) return fromColumns;
+  const configPk = table.config.primaryKey ?? [];
+  const resolved = [];
+  for (const ref of configPk) {
+    if (ref in table.columns) {
+      resolved.push(ref);
+      continue;
+    }
+    const byColumnName = Object.entries(table.columns).find(
+      ([propertyName, builder]) => builder.columnNameFor(propertyName) === ref
+    );
+    if (byColumnName) resolved.push(byColumnName[0]);
+  }
+  return resolved;
+}
+function assertOverlayWinsPrimaryKey({
+  table,
+  pk,
+  role
+}) {
+  if (!(pk in table.columns)) {
+    throw new OrmDefinitionError(
+      `overlayWinsUnion: pk "${pk}" must exist as a property on both overlay and synced tables`
+    );
+  }
+  const declared = declaredPrimaryKeyProperties(table);
+  if (declared.length !== 1 || declared[0] !== pk) {
+    throw new OrmDefinitionError(
+      `overlayWinsUnion: ${role} primary key must be exactly "${pk}" (declared: ${declared.length > 0 ? declared.join(", ") : "none"})`
+    );
+  }
+}
+function formatCanonicalColumnType(type) {
+  return typeof type === "string" ? type : `enum(${type.enum})`;
+}
+function assertOverlayWinsMatchingColumnTypes({
+  overlay,
+  synced,
+  columns
+}) {
+  for (const column of columns) {
+    const overlayType = overlay.columns[column].toCanonicalColumn(column).type;
+    const syncedType = synced.columns[column].toCanonicalColumn(column).type;
+    if (JSON.stringify(overlayType) !== JSON.stringify(syncedType)) {
+      throw new OrmDefinitionError(
+        `overlayWinsUnion: column "${column}" must have the same type on overlay and synced (overlay: ${formatCanonicalColumnType(overlayType)}, synced: ${formatCanonicalColumnType(syncedType)})`
+      );
+    }
+  }
+}
+function overlayWinsUnion(input) {
+  const { overlay, synced, pk, tombstone } = input;
+  return ({ qb, relation }) => {
+    assertOverlayWinsPrimaryKey({ table: overlay, pk, role: "overlay" });
+    assertOverlayWinsPrimaryKey({ table: synced, pk, role: "synced" });
+    const overlayHandle = relation(overlay);
+    const syncedHandle = relation(synced);
+    const overlayCols = overlayHandle;
+    const syncedCols = syncedHandle;
+    const overlayPk = overlayCols[pk];
+    const syncedPk = syncedCols[pk];
+    if (tombstone !== void 0) {
+      const tombstoneBuilder = overlay.columns[tombstone];
+      if (!tombstoneBuilder) {
+        throw new OrmDefinitionError(
+          `overlayWinsUnion: tombstone "${tombstone}" must exist as a property on the overlay table`
+        );
+      }
+      const tombstoneCanonical = tombstoneBuilder.toCanonicalColumn(tombstone);
+      if (tombstoneCanonical.type !== "boolean") {
+        throw new OrmDefinitionError(
+          `overlayWinsUnion: tombstone "${tombstone}" must be a boolean column`
+        );
+      }
+      if (tombstoneCanonical.nullable) {
+        throw new OrmDefinitionError(
+          `overlayWinsUnion: tombstone "${tombstone}" must be notNull \u2014 nullable tombstones silently drop rows`
+        );
+      }
+    }
+    const overlayColumns = Object.keys(overlay.columns);
+    const syncedColumns = Object.keys(synced.columns);
+    const sharedColumns = overlayColumns.filter((col) => syncedColumns.includes(col) && col !== pk);
+    assertOverlayWinsMatchingColumnTypes({
+      overlay,
+      synced,
+      columns: [pk, ...sharedColumns]
+    });
+    const overlaySelect = {
+      [pk]: overlayPk,
+      ...Object.fromEntries(sharedColumns.map((col) => [col, overlayCols[col]])),
+      provenance: sql`'overlay'`.as("provenance")
+    };
+    const syncedSelect = {
+      [pk]: syncedPk,
+      ...Object.fromEntries(sharedColumns.map((col) => [col, syncedCols[col]])),
+      provenance: sql`'synced'`.as("provenance")
+    };
+    const overlayFrom = qb.select(overlaySelect).from(overlayHandle);
+    const overlayQuery = tombstone !== void 0 ? overlayFrom.where(eq(overlayCols[tombstone], false)) : overlayFrom;
+    const syncedQuery = qb.select(syncedSelect).from(syncedHandle).where(
+      notExists(
+        qb.select({ one: sql`1` }).from(overlayHandle).where(eq(overlayPk, syncedPk))
+      )
+    );
+    return overlayQuery.unionAll(syncedQuery);
+  };
+}
+
+// src/authoring/cow-mutations.ts
+function overrideRowMutation(input) {
+  const { overlay, synced, pk } = input;
+  const name = input.name ?? `override_${overlay.tableName}`;
+  assertMutationName(name, "overrideRowMutation");
+  assertOverlayPairPrimaryKey({ overlay, synced, pk, helper: "overrideRowMutation" });
+  const sharedProperties = sharedNonPkProperties({ overlay, synced, pk });
+  const setProperties = resolveSetProperties({
+    overlay,
+    synced,
+    pk,
+    set: input.set,
+    sharedProperties,
+    helper: "overrideRowMutation"
+  });
+  assertMatchingColumns({
+    overlay,
+    synced,
+    properties: [pk, ...sharedProperties],
+    helper: "overrideRowMutation"
+  });
+  return {
+    kind: "override",
+    name,
+    synced: synced.tableName,
+    pk,
+    copy: [pk, ...sharedProperties],
+    set: setProperties
+  };
+}
+function revertOverlayMutation(input) {
+  const { overlay, synced, pk } = input;
+  const name = input.name ?? `revert_${overlay.tableName}`;
+  assertMutationName(name, "revertOverlayMutation");
+  assertOverlayPairPrimaryKey({ overlay, synced, pk, helper: "revertOverlayMutation" });
+  assertMatchingColumns({ overlay, synced, properties: [pk], helper: "revertOverlayMutation" });
+  return {
+    kind: "revert",
+    name,
+    synced: synced.tableName,
+    pk,
+    copy: [],
+    set: []
+  };
+}
+function assertMutationName(name, helper) {
+  if (!IDENTIFIER_PATTERN.test(name) || name.length > MAX_IDENTIFIER_LENGTH) {
+    throw new OrmDefinitionError(
+      `${helper}: mutation name "${name}" must match ${IDENTIFIER_PATTERN} and be at most ${MAX_IDENTIFIER_LENGTH} characters`
+    );
+  }
+}
+function assertOverlayPairPrimaryKey({
+  overlay,
+  synced,
+  pk,
+  helper
+}) {
+  assertSinglePrimaryKey({ table: overlay, pk, role: "overlay", helper });
+  assertSinglePrimaryKey({ table: synced, pk, role: "synced", helper });
+}
+function assertSinglePrimaryKey({
+  table,
+  pk,
+  role,
+  helper
+}) {
+  if (!(pk in table.columns)) {
+    throw new OrmDefinitionError(`${helper}: pk "${pk}" must exist as a property on the ${role} table`);
+  }
+  const declared = declaredPrimaryKeyProperties2(table);
+  if (declared.length !== 1 || declared[0] !== pk) {
+    throw new OrmDefinitionError(
+      `${helper}: ${role} primary key must be exactly "${pk}" (declared: ${declared.length > 0 ? declared.join(", ") : "none"})`
+    );
+  }
+}
+function declaredPrimaryKeyProperties2(table) {
+  const fromColumns = Object.entries(table.columns).filter(([, builder]) => builder.isPrimaryKey).map(([propertyName]) => propertyName);
+  if (fromColumns.length > 0) return fromColumns;
+  const configPk = table.config?.primaryKey ?? [];
+  const resolved = [];
+  for (const ref of configPk) {
+    if (ref in table.columns) {
+      resolved.push(ref);
+      continue;
+    }
+    const byColumnName = Object.entries(table.columns).find(
+      ([propertyName, builder]) => builder.columnNameFor(propertyName) === ref
+    );
+    if (byColumnName) resolved.push(byColumnName[0]);
+  }
+  return resolved;
+}
+function sharedNonPkProperties({
+  overlay,
+  synced,
+  pk
+}) {
+  return Object.keys(overlay.columns).filter((property) => property !== pk && property in synced.columns);
+}
+function resolveSetProperties({
+  overlay,
+  synced,
+  pk,
+  set,
+  sharedProperties,
+  helper
+}) {
+  const properties = set !== void 0 ? [...set] : [...sharedProperties];
+  if (properties.length === 0) {
+    throw new OrmDefinitionError(
+      `${helper}: set must declare at least one non-PK column to update after the copy`
+    );
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const property of properties) {
+    if (property === pk) {
+      throw new OrmDefinitionError(`${helper}: set must not include pk "${pk}" \u2014 identity columns are pinned`);
+    }
+    if (!(property in overlay.columns)) {
+      throw new OrmDefinitionError(`${helper}: set column "${property}" must exist on the overlay table`);
+    }
+    if (!(property in synced.columns)) {
+      throw new OrmDefinitionError(
+        `${helper}: set column "${property}" must exist on the synced table (contract columns only)`
+      );
+    }
+    if (seen.has(property)) {
+      throw new OrmDefinitionError(`${helper}: set column "${property}" is duplicated`);
+    }
+    seen.add(property);
+  }
+  return properties;
+}
+function assertMatchingColumns({
+  overlay,
+  synced,
+  properties,
+  helper
+}) {
+  for (const property of properties) {
+    const overlayCanonical = overlay.columns[property].toCanonicalColumn(property);
+    const syncedCanonical = synced.columns[property].toCanonicalColumn(property);
+    const overlayType = scalarColumnType(overlay, property, helper);
+    const syncedType = scalarColumnType(synced, property, helper);
+    if (overlayType !== syncedType) {
+      throw new OrmDefinitionError(
+        `${helper}: column "${property}" must have the same scalar type on overlay and synced (overlay: ${overlayType}, synced: ${syncedType})`
+      );
+    }
+    const overlayColumn = overlay.columns[property].columnNameFor(property);
+    const syncedColumn = synced.columns[property].columnNameFor(property);
+    if (overlayColumn !== syncedColumn) {
+      throw new OrmDefinitionError(
+        `${helper}: column "${property}" maps to different Postgres names on overlay (${overlayColumn}) and synced (${syncedColumn})`
+      );
+    }
+    if (syncedCanonical.nullable && !overlayCanonical.nullable) {
+      throw new OrmDefinitionError(
+        `${helper}: column "${property}" is nullable on synced but NOT NULL on overlay \u2014 a NULL synced value would fail the copy-from-synced insert; make overlay nullable or synced notNull`
+      );
+    }
+  }
+}
+function scalarColumnType(table, property, helper) {
+  const type = table.columns[property].toCanonicalColumn(property).type;
+  if (typeof type !== "string") {
+    throw new OrmDefinitionError(
+      `${helper}: column "${property}" on "${table.tableName}" must be a scalar type (enums are not supported in cow mutation arguments)`
+    );
+  }
+  return type;
+}
 var CANONICAL_FORMAT = 2;
 var IDENTIFIER_RE = /^[a-z][a-z0-9_]*$/;
 var identifier = z.string().min(1).max(63).regex(IDENTIFIER_RE);
@@ -412,8 +933,190 @@ var policyExpressionSchema = z.union([
 ]);
 var canonicalPoliciesSchema = z.object({
   read: policyExpressionSchema.optional(),
-  write: policyExpressionSchema.optional()
+  write: policyExpressionSchema.optional(),
+  insert: policyExpressionSchema.optional(),
+  update: policyExpressionSchema.optional()
 });
+function isSingleViewQuerySql(value) {
+  const query = value.trim();
+  if (!/^\(*(?:select|with)\b/i.test(query) || query.includes("\0")) return false;
+  let state = "normal";
+  for (let index3 = 0; index3 < query.length; index3 += 1) {
+    const char = query[index3];
+    const next = query[index3 + 1];
+    if (state === "single") {
+      if (char === "'" && next === "'") index3 += 1;
+      else if (char === "'") state = "normal";
+      continue;
+    }
+    if (state === "double") {
+      if (char === '"' && next === '"') index3 += 1;
+      else if (char === '"') state = "normal";
+      continue;
+    }
+    if (char === "'") state = "single";
+    else if (char === '"') state = "double";
+    else if (char === ";" || char === "-" && next === "-" || char === "/" && next === "*") return false;
+  }
+  return state === "normal" && !/\$[a-z_0-9]*\$/i.test(query);
+}
+var VIEW_QUERY_FUNCTION_ALLOWLIST = [
+  "abs",
+  "age",
+  "array_agg",
+  "array_append",
+  "array_cat",
+  "array_dims",
+  "array_length",
+  "array_lower",
+  "array_ndims",
+  "array_position",
+  "array_positions",
+  "array_prepend",
+  "array_remove",
+  "array_replace",
+  "array_to_string",
+  "array_trim",
+  "array_upper",
+  "ascii",
+  "avg",
+  "bit_and",
+  "bit_or",
+  "bit_xor",
+  "bool_and",
+  "bool_or",
+  "btrim",
+  "cardinality",
+  "cbrt",
+  "ceil",
+  "ceiling",
+  "char_length",
+  "character_length",
+  "chr",
+  "concat",
+  "concat_ws",
+  "count",
+  "cume_dist",
+  "date_bin",
+  "date_part",
+  "date_trunc",
+  "decode",
+  "degrees",
+  "dense_rank",
+  "encode",
+  "enum_first",
+  "enum_last",
+  "enum_range",
+  "every",
+  "exp",
+  "first_value",
+  "floor",
+  "format",
+  "grouping",
+  "initcap",
+  "json_agg",
+  "json_array_length",
+  "json_build_array",
+  "json_build_object",
+  "json_extract_path",
+  "json_extract_path_text",
+  "json_object_agg",
+  "json_object_keys",
+  "json_strip_nulls",
+  "json_typeof",
+  "jsonb_agg",
+  "jsonb_array_length",
+  "jsonb_build_array",
+  "jsonb_build_object",
+  "jsonb_extract_path",
+  "jsonb_extract_path_text",
+  "jsonb_insert",
+  "jsonb_object_agg",
+  "jsonb_object_keys",
+  "jsonb_path_exists",
+  "jsonb_path_match",
+  "jsonb_path_query",
+  "jsonb_path_query_array",
+  "jsonb_path_query_first",
+  "jsonb_pretty",
+  "jsonb_set",
+  "jsonb_set_lax",
+  "jsonb_strip_nulls",
+  "jsonb_typeof",
+  "justify_days",
+  "justify_hours",
+  "justify_interval",
+  "lag",
+  "last_value",
+  "lead",
+  "left",
+  "length",
+  "ln",
+  "log",
+  "lower",
+  "lpad",
+  "ltrim",
+  "make_date",
+  "make_interval",
+  "make_time",
+  "make_timestamp",
+  "make_timestamptz",
+  "max",
+  "md5",
+  "min",
+  "mod",
+  "nth_value",
+  "ntile",
+  "octet_length",
+  "percent_rank",
+  "pi",
+  "power",
+  "quote_ident",
+  "quote_literal",
+  "quote_nullable",
+  "radians",
+  "rank",
+  "regexp_count",
+  "regexp_instr",
+  "regexp_like",
+  "regexp_match",
+  "regexp_matches",
+  "regexp_replace",
+  "regexp_split_to_array",
+  "regexp_split_to_table",
+  "repeat",
+  "replace",
+  "reverse",
+  "right",
+  "round",
+  "row_number",
+  "rpad",
+  "rtrim",
+  "sign",
+  "split_part",
+  "sqrt",
+  "starts_with",
+  "string_agg",
+  "string_to_array",
+  "strpos",
+  "substr",
+  "substring",
+  "sum",
+  "timezone",
+  "to_ascii",
+  "to_char",
+  "to_date",
+  "to_hex",
+  "to_json",
+  "to_jsonb",
+  "to_number",
+  "to_timestamp",
+  "translate",
+  "trunc",
+  "unnest",
+  "upper",
+  "width_bucket"
+];
 var canonicalActionSchema = z.object({
   name: identifier,
   requires: z.string().max(1e3).optional(),
@@ -425,6 +1128,37 @@ var canonicalActionSchema = z.object({
   returns: z.enum(["rows", "rowsAffected", "scalar"]).default("rowsAffected"),
   audit: z.object({ action: z.string(), resource: z.string() }).optional()
 });
+var canonicalCowMutationSchema = z.object({
+  kind: z.enum(["override", "revert"]),
+  name: identifier,
+  /** Synced table (same namespace) the overlay copies from / falls back to. */
+  synced: identifier,
+  /** Single-column primary key PROPERTY (TS camelCase, like column `name`) shared by overlay and synced. */
+  pk: z.string().min(1).max(63),
+  /** Override: contract properties copied INSERT…SELECT from synced (pk included). Empty for revert. */
+  copy: z.array(z.string().min(1).max(63)).default([]),
+  /** Override: overlay properties written by the UPDATE (never the pk). Empty for revert. */
+  set: z.array(z.string().min(1).max(63)).default([])
+}).superRefine((mutation, ctx) => {
+  if (mutation.kind === "override") {
+    if (mutation.set.length === 0) {
+      ctx.addIssue({ code: "custom", path: ["set"], message: "override mutations must set at least one column" });
+    }
+    if (!mutation.copy.includes(mutation.pk)) {
+      ctx.addIssue({ code: "custom", path: ["copy"], message: "override copy list must include the pk" });
+    }
+  } else if (mutation.set.length > 0 || mutation.copy.length > 0) {
+    ctx.addIssue({ code: "custom", path: ["set"], message: "revert mutations take no copy/set columns" });
+  }
+  if (mutation.set.includes(mutation.pk)) {
+    ctx.addIssue({ code: "custom", path: ["set"], message: "set must not include the pk \u2014 identity columns are pinned" });
+  }
+  for (const [field, values] of [["copy", mutation.copy], ["set", mutation.set]]) {
+    if (new Set(values).size !== values.length) {
+      ctx.addIssue({ code: "custom", path: [field], message: `${field} must not contain duplicate columns` });
+    }
+  }
+});
 var canonicalTableSchema = z.object({
   table: identifier,
   description: z.string().max(2e3).optional(),
@@ -437,7 +1171,45 @@ var canonicalTableSchema = z.object({
   links: z.array(canonicalLinkSchema).default([]),
   indexes: z.array(canonicalIndexSchema).default([]),
   policies: canonicalPoliciesSchema.default({}),
-  actions: z.array(canonicalActionSchema).default([])
+  /**
+   * v1-conversion carry-over only. v2 has no action surface — the runtime
+   * neither compiles nor executes these; writes are mutations. Kept parseable
+   * so stored definitions and their content hashes stay stable.
+   */
+  actions: z.array(canonicalActionSchema).default([]),
+  /** Optional (not defaulted) so pre-CoW canonical documents keep byte-identical hashes. */
+  cowMutations: z.array(canonicalCowMutationSchema).optional()
+});
+var canonicalViewSchema = z.object({
+  view: identifier,
+  description: z.string().max(2e3).optional(),
+  columns: z.array(canonicalColumnSchema).min(1),
+  /** Logical identity for GraphQL only; PostgreSQL views have no PK constraint. */
+  primaryKey: z.array(identifier).min(1).max(8).optional(),
+  links: z.array(canonicalLinkSchema).default([]),
+  policies: z.object({ read: policyExpressionSchema }).strict(),
+  query: z.string().min(1).max(1e5).refine(isSingleViewQuerySql, {
+    message: "view query must be one SELECT/WITH statement without comments or dollar-quoted bodies"
+  }),
+  /** Namespace-local logical relation names, sorted for deterministic hashing. */
+  dependencies: z.array(identifier).max(500)
+}).superRefine((view, ctx) => {
+  for (const [index3, column] of view.columns.entries()) {
+    if (column.default !== void 0 || column.defaultFn !== void 0) {
+      ctx.addIssue({ code: "custom", path: ["columns", index3], message: `view column '${column.name}' cannot declare a default` });
+    }
+    if (column.unique) {
+      ctx.addIssue({ code: "custom", path: ["columns", index3], message: `view column '${column.name}' cannot declare unique` });
+    }
+    if (column.renamedFrom !== void 0 || column.cast !== void 0) {
+      ctx.addIssue({ code: "custom", path: ["columns", index3], message: `view column '${column.name}' cannot declare migration hints` });
+    }
+  }
+  for (const [index3, link] of view.links.entries()) {
+    if (link.enforce) {
+      ctx.addIssue({ code: "custom", path: ["links", index3, "enforce"], message: `view link '${link.name}' cannot enforce a foreign key` });
+    }
+  }
 });
 var canonicalDefinitionSchema = z.object({
   definition_format: z.literal(CANONICAL_FORMAT),
@@ -445,24 +1217,174 @@ var canonicalDefinitionSchema = z.object({
   description: z.string().max(2e3).optional(),
   enums: z.array(canonicalEnumSchema).default([]),
   tables: z.array(canonicalTableSchema).min(0).max(500),
+  /** Optional to preserve byte-identical hashes for pre-view canonical v2 documents. */
+  views: z.array(canonicalViewSchema).max(500).optional(),
   /** Verbatim custom-roles grammar (@sequenceholdings/custom-roles-manifest). */
   capabilities: z.object({
     roles: z.unknown().optional(),
     uses: z.array(z.string()).default([])
   }).default({ uses: [] })
+}).superRefine((definition, ctx) => {
+  const seen = /* @__PURE__ */ new Set();
+  for (const [index3, table] of definition.tables.entries()) {
+    if (seen.has(table.table)) {
+      ctx.addIssue({ code: "custom", path: ["tables", index3, "table"], message: `duplicate relation '${table.table}'` });
+    }
+    seen.add(table.table);
+  }
+  const tableByName = new Map(definition.tables.map((table) => [table.table, table]));
+  for (const [tableIndex, table] of definition.tables.entries()) {
+    const cowMutations = table.cowMutations ?? [];
+    if (cowMutations.length === 0) continue;
+    const path = (index3, ...rest) => ["tables", tableIndex, "cowMutations", index3, ...rest];
+    if (table.source !== void 0) {
+      ctx.addIssue({ code: "custom", path: path(0), message: `synced table '${table.table}' cannot declare cow mutations \u2014 it is read-only` });
+      continue;
+    }
+    for (const [index3, mutation] of cowMutations.entries()) {
+      const synced = tableByName.get(mutation.synced);
+      if (!synced || synced.source === void 0) {
+        ctx.addIssue({
+          code: "custom",
+          path: path(index3, "synced"),
+          message: `cow mutation '${mutation.name}' references '${mutation.synced}', which is not a synced table in this namespace`
+        });
+        continue;
+      }
+      const overlayColumnsByName = new Map(table.columns.map((column) => [column.name, column]));
+      const syncedColumnsByName = new Map(synced.columns.map((column) => [column.name, column]));
+      let columnsExist = true;
+      for (const property of [mutation.pk, ...mutation.copy, ...mutation.set]) {
+        if (!overlayColumnsByName.has(property)) {
+          columnsExist = false;
+          ctx.addIssue({ code: "custom", path: path(index3), message: `cow mutation '${mutation.name}': column '${property}' does not exist on overlay '${table.table}'` });
+        }
+      }
+      for (const property of [mutation.pk, ...mutation.copy]) {
+        if (!syncedColumnsByName.has(property)) {
+          columnsExist = false;
+          ctx.addIssue({ code: "custom", path: path(index3), message: `cow mutation '${mutation.name}': column '${property}' does not exist on synced '${mutation.synced}'` });
+        }
+      }
+      if (!columnsExist) continue;
+      const overlayPk = table.primaryKey ?? [];
+      const syncedPk = synced.primaryKey ?? [];
+      if (overlayPk.length !== 1 || overlayPk[0] !== mutation.pk || syncedPk.length !== 1 || syncedPk[0] !== mutation.pk) {
+        ctx.addIssue({
+          code: "custom",
+          path: path(index3, "pk"),
+          message: `cow mutation '${mutation.name}': pk '${mutation.pk}' must be the single-column primary key on both '${table.table}' and '${mutation.synced}'`
+        });
+      }
+      for (const property of [mutation.pk, ...mutation.copy]) {
+        const overlayColumn = overlayColumnsByName.get(property);
+        const syncedColumn = syncedColumnsByName.get(property);
+        if (!overlayColumn || !syncedColumn) continue;
+        if (JSON.stringify(overlayColumn.type) !== JSON.stringify(syncedColumn.type)) {
+          ctx.addIssue({
+            code: "custom",
+            path: path(index3),
+            message: `cow mutation '${mutation.name}': column '${property}' must have the same type on overlay and synced`
+          });
+        }
+        if (overlayColumn.columnName !== syncedColumn.columnName) {
+          ctx.addIssue({
+            code: "custom",
+            path: path(index3),
+            message: `cow mutation '${mutation.name}': column '${property}' maps to different Postgres names on overlay ('${overlayColumn.columnName}') and synced ('${syncedColumn.columnName}')`
+          });
+        }
+        if (syncedColumn.nullable !== false && overlayColumn.nullable === false) {
+          ctx.addIssue({
+            code: "custom",
+            path: path(index3),
+            message: `cow mutation '${mutation.name}': column '${property}' is nullable on synced but NOT NULL on overlay \u2014 a NULL synced value would fail the copy`
+          });
+        }
+      }
+    }
+  }
+  for (const [index3, view] of (definition.views ?? []).entries()) {
+    if (seen.has(view.view)) {
+      ctx.addIssue({ code: "custom", path: ["views", index3, "view"], message: `duplicate relation '${view.view}'` });
+    }
+    seen.add(view.view);
+  }
+  const views = definition.views ?? [];
+  const viewByName = new Map(views.map((view) => [view.view, view]));
+  for (const [viewIndex, view] of views.entries()) {
+    for (const [dependencyIndex, dependency] of view.dependencies.entries()) {
+      if (!seen.has(dependency)) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["views", viewIndex, "dependencies", dependencyIndex],
+          message: `view '${view.view}' depends on unknown relation '${dependency}'`
+        });
+      }
+    }
+  }
+  const visiting = /* @__PURE__ */ new Set();
+  const visited = /* @__PURE__ */ new Set();
+  let cycleReported = false;
+  const visit = (name, path) => {
+    if (visited.has(name) || cycleReported) return;
+    if (visiting.has(name)) {
+      cycleReported = true;
+      ctx.addIssue({
+        code: "custom",
+        path: ["views"],
+        message: `view dependencies form a cycle: ${[...path, name].join(" -> ")}`
+      });
+      return;
+    }
+    visiting.add(name);
+    const view = viewByName.get(name);
+    for (const dependency of view?.dependencies ?? []) {
+      if (viewByName.has(dependency)) visit(dependency, [...path, name]);
+    }
+    visiting.delete(name);
+    visited.add(name);
+  };
+  for (const view of views) visit(view.view, []);
 });
+function canonicalRelations(definition) {
+  const views = (definition.views ?? []).map((view) => ({
+    table: view.view,
+    ...view.description !== void 0 ? { description: view.description } : {},
+    columns: view.columns,
+    ...view.primaryKey !== void 0 ? { primaryKey: view.primaryKey } : {},
+    links: view.links,
+    indexes: [],
+    policies: { read: view.policies.read },
+    actions: []
+  }));
+  return [...definition.tables, ...views].sort((a, b) => a.table.localeCompare(b.table));
+}
 function normalizeCanonical(definition) {
   const sortByName = (items) => [...items].sort((a, b) => a.name.localeCompare(b.name));
-  return {
+  const normalized = {
     ...definition,
     enums: sortByName(definition.enums),
-    tables: [...definition.tables].sort((a, b) => a.table.localeCompare(b.table)).map((t2) => ({
-      ...t2,
-      links: sortByName(t2.links),
-      indexes: [...t2.indexes].sort((a, b) => (a.name ?? a.columns.join("_")).localeCompare(b.name ?? b.columns.join("_"))),
-      actions: sortByName(t2.actions)
-    }))
+    tables: [...definition.tables].sort((a, b) => a.table.localeCompare(b.table)).map((t2) => {
+      const { cowMutations, ...rest } = t2;
+      return {
+        ...rest,
+        links: sortByName(t2.links),
+        indexes: [...t2.indexes].sort((a, b) => (a.name ?? a.columns.join("_")).localeCompare(b.name ?? b.columns.join("_"))),
+        actions: sortByName(t2.actions),
+        // Omitted entirely when absent/empty so pre-CoW documents hash unchanged.
+        ...cowMutations !== void 0 && cowMutations.length > 0 ? { cowMutations: sortByName(cowMutations) } : {}
+      };
+    })
   };
+  if (definition.views !== void 0) {
+    normalized.views = [...definition.views].sort((a, b) => a.view.localeCompare(b.view)).map((view) => ({
+      ...view,
+      links: sortByName(view.links),
+      dependencies: [...view.dependencies].sort()
+    }));
+  }
+  return normalized;
 }
 function stableJson(value) {
   if (value === null || typeof value !== "object") return JSON.stringify(value);
@@ -484,9 +1406,13 @@ function canonicalTable(table) {
     source: table.source ?? null,
     links: emptyToNull(table.links),
     indexes: emptyToNull(table.indexes),
+    // insert/update are omitted rather than nulled when absent, so definitions
+    // predating split policies keep the hash they were registered under.
     policies: {
       read: table.policies?.read?.source ?? null,
-      write: table.policies?.write?.source ?? null
+      write: table.policies?.write?.source ?? null,
+      ...table.policies?.insert !== void 0 ? { insert: table.policies.insert.source } : {},
+      ...table.policies?.update !== void 0 ? { update: table.policies.update.source } : {}
     },
     actions: emptyToNull(
       Object.fromEntries(
@@ -567,6 +1493,7 @@ function defineNamespace(input) {
 }
 function serializeNamespace(input) {
   const { config, tables } = input;
+  const views = input.views ?? [];
   const enums = input.enums ?? [];
   const tablesByName = /* @__PURE__ */ new Map();
   for (const table of tables) {
@@ -579,6 +1506,29 @@ function serializeNamespace(input) {
     }
     tablesByName.set(table.tableName, table);
   }
+  const viewsByName = /* @__PURE__ */ new Map();
+  for (const view of views) {
+    const existing = viewsByName.get(view.viewName);
+    if (existing) {
+      throw new OrmDefinitionError(
+        `duplicate view "${view.viewName}" (defined in ${describeFile(existing)} and ${describeFile(view)})`,
+        view.file
+      );
+    }
+    viewsByName.set(view.viewName, view);
+  }
+  const relationsByName = /* @__PURE__ */ new Map();
+  for (const relation of [...tables, ...views]) {
+    const name = relationName(relation);
+    const existing = relationsByName.get(name);
+    if (existing) {
+      throw new OrmDefinitionError(
+        `duplicate relation "${name}" (defined as ${relationKind(existing)} in ${describeFile(existing)} and ${relationKind(relation)} in ${describeFile(relation)})`,
+        relation.file
+      );
+    }
+    relationsByName.set(name, relation);
+  }
   const enumsByName = /* @__PURE__ */ new Map();
   for (const ref of enums) {
     if (enumsByName.has(ref.name)) {
@@ -586,11 +1536,26 @@ function serializeNamespace(input) {
     }
     enumsByName.set(ref.name, ref);
   }
-  const canonicalTables = tables.map((table) => buildCanonicalTable({ table, tablesByName, enumsByName }));
+  const canonicalTables = tables.map((table) => buildCanonicalTable({ table, relationsByName, enumsByName }));
   const canonicalEnums = [...enumsByName.values()].map((ref) => ({
     name: ref.name,
     values: [...ref.values]
   }));
+  const viewDrafts = views.map((view) => buildCanonicalView({ view, relationsByName, enumsByName }));
+  const compiledViews = compileViewQueries({
+    namespace: config.namespace,
+    tables: canonicalTables,
+    views: viewDrafts,
+    enums: canonicalEnums,
+    authoredTables: tables,
+    authoredViews: views
+  });
+  const canonicalViews = viewDrafts.map((draft) => {
+    const compiled = compiledViews.get(draft.view);
+    if (!compiled) throw new OrmDefinitionError(`view "${draft.view}" did not compile`, viewsByName.get(draft.view)?.file);
+    return canonicalViewSchema.parse({ ...draft, ...compiled });
+  });
+  assertAcyclicViewDependencies(canonicalViews);
   const candidate = {
     definition_format: CANONICAL_FORMAT,
     namespace: config.namespace,
@@ -602,6 +1567,7 @@ function serializeNamespace(input) {
     }
   };
   if (config.description !== void 0) candidate.description = config.description;
+  if (canonicalViews.length > 0) candidate.views = canonicalViews;
   let parsed;
   try {
     parsed = canonicalDefinitionSchema.parse(candidate);
@@ -616,7 +1582,7 @@ function serializeNamespace(input) {
 function computeCanonicalHash(definition) {
   return createHash("sha256").update(HASH_DOMAIN).update(stableJson(definition)).digest("hex");
 }
-function buildCanonicalTable({ table, tablesByName, enumsByName }) {
+function buildCanonicalTable({ table, relationsByName, enumsByName }) {
   const candidate = {
     table: table.tableName,
     columns: [],
@@ -628,6 +1594,31 @@ function buildCanonicalTable({ table, tablesByName, enumsByName }) {
   if (table.config.description !== void 0) candidate.description = table.config.description;
   if (table.config.renamedFrom !== void 0) candidate.renamedFrom = table.config.renamedFrom;
   if (table.source !== void 0) candidate.source = table.source;
+  if (table.source !== void 0) {
+    if (table.config.indexes !== void 0 && table.config.indexes.length > 0) {
+      throw new OrmDefinitionError(
+        `synced table "${table.tableName}" is system-owned; indexes are not allowed`,
+        table.file
+      );
+    }
+    if (table.config.cowMutations !== void 0 && table.config.cowMutations.length > 0) {
+      throw new OrmDefinitionError(
+        `synced table "${table.tableName}" is read-only; cow mutations belong on the overlay table`,
+        table.file
+      );
+    }
+    if (table.config.policies?.write !== void 0 || table.config.policies?.insert !== void 0 || table.config.policies?.update !== void 0) {
+      throw new OrmDefinitionError(`synced table "${table.tableName}" is read-only`, table.file);
+    }
+    for (const [linkName, link] of Object.entries(table.config.links ?? {})) {
+      if (link.enforce) {
+        throw new OrmDefinitionError(
+          `synced table "${table.tableName}": link "${linkName}" cannot enforce foreign keys \u2014 its DDL is owned by the sync`,
+          table.file
+        );
+      }
+    }
+  }
   const columnLevelPk = [];
   for (const [propertyName, builder] of Object.entries(table.columns)) {
     const column = builder.toCanonicalColumn(propertyName);
@@ -649,40 +1640,38 @@ function buildCanonicalTable({ table, tablesByName, enumsByName }) {
       );
     }
     candidate.primaryKey = table.config.primaryKey.map(
-      (ref) => resolveColumnRef({ table, ref, role: "primaryKey" })
+      (ref) => resolveColumnRef({ relation: table, ref, role: "primaryKey" })
     );
   } else if (columnLevelPk.length > 0) {
     candidate.primaryKey = columnLevelPk;
   }
   for (const index3 of table.config.indexes ?? []) {
     const entry = {
-      columns: index3.columns.map((ref) => resolveColumnRef({ table, ref, role: "index" }))
+      columns: index3.columns.map((ref) => resolveColumnRef({ relation: table, ref, role: "index" }))
     };
     if (index3.unique !== void 0) entry.unique = index3.unique;
     if (index3.name !== void 0) entry.name = index3.name;
     candidate.indexes?.push(entry);
   }
   for (const [linkName, link] of Object.entries(table.config.links ?? {})) {
-    candidate.links?.push(buildCanonicalLink({ table, linkName, link, tablesByName }));
+    candidate.links?.push(buildCanonicalLink({ relation: table, linkName, link, relationsByName }));
   }
   const policies = {};
   if (table.config.policies?.read !== void 0) policies.read = toCanonicalPolicy(table.config.policies.read);
   if (table.config.policies?.write !== void 0) policies.write = toCanonicalPolicy(table.config.policies.write);
+  if (table.config.policies?.insert !== void 0) policies.insert = toCanonicalPolicy(table.config.policies.insert);
+  if (table.config.policies?.update !== void 0) policies.update = toCanonicalPolicy(table.config.policies.update);
   candidate.policies = policies;
-  for (const action of table.config.actions ?? []) {
-    candidate.actions?.push({
-      name: action.name,
-      ...action.requires !== void 0 ? { requires: action.requires } : {},
-      params: Object.fromEntries(
-        Object.entries(action.params ?? {}).map(([name, param]) => [
-          name,
-          { type: param.type, nullable: param.nullable ?? false }
-        ])
-      ),
-      executes: action.executes,
-      returns: action.returns ?? "rowsAffected",
-      ...action.audit !== void 0 ? { audit: action.audit } : {}
-    });
+  const cowMutations = table.config.cowMutations ?? [];
+  if (cowMutations.length > 0) {
+    candidate.cowMutations = cowMutations.map((mutation) => ({
+      kind: mutation.kind,
+      name: mutation.name,
+      synced: mutation.synced,
+      pk: mutation.pk,
+      copy: [...mutation.copy],
+      set: [...mutation.set]
+    }));
   }
   try {
     return canonicalTableSchema.parse(candidate);
@@ -693,14 +1682,71 @@ function buildCanonicalTable({ table, tablesByName, enumsByName }) {
     throw error;
   }
 }
+function buildCanonicalView({
+  view,
+  relationsByName,
+  enumsByName
+}) {
+  if (view.config.policies?.read === void 0) {
+    throw new OrmDefinitionError(`view "${view.viewName}" must declare policies.read`, view.file);
+  }
+  const columns = [];
+  const columnLevelPk = [];
+  for (const [propertyName, builder] of Object.entries(view.columns)) {
+    const column = builder.toCanonicalColumn(propertyName);
+    if (column.default !== void 0 || column.defaultFn !== void 0) {
+      throw new OrmDefinitionError(`view "${view.viewName}": column "${propertyName}" cannot declare a default`, view.file);
+    }
+    if (column.unique) {
+      throw new OrmDefinitionError(`view "${view.viewName}": column "${propertyName}" cannot declare unique`, view.file);
+    }
+    if (column.renamedFrom !== void 0 || column.cast !== void 0) {
+      throw new OrmDefinitionError(`view "${view.viewName}": column "${propertyName}" cannot declare migration hints`, view.file);
+    }
+    const enumName = builder.enumName;
+    if (enumName !== void 0 && !enumsByName.has(enumName)) {
+      throw new OrmDefinitionError(
+        `view "${view.viewName}": column "${propertyName}" references enum "${enumName}" which is not part of this namespace`,
+        view.file
+      );
+    }
+    if (builder.isPrimaryKey) columnLevelPk.push(column.columnName);
+    columns.push(column);
+  }
+  let primaryKey2;
+  if (view.config.primaryKey !== void 0) {
+    if (columnLevelPk.length > 0) {
+      throw new OrmDefinitionError(
+        `view "${view.viewName}": declare the logical primary key either on columns or with config.primaryKey \u2014 not both`,
+        view.file
+      );
+    }
+    primaryKey2 = view.config.primaryKey.map((ref) => resolveColumnRef({ relation: view, ref, role: "primaryKey" }));
+  } else if (columnLevelPk.length > 0) {
+    primaryKey2 = columnLevelPk;
+  }
+  const links = Object.entries(view.config.links ?? {}).map(
+    ([linkName, link]) => buildCanonicalLink({ relation: view, linkName, link, relationsByName })
+  );
+  return {
+    view: view.viewName,
+    ...view.config.description !== void 0 ? { description: view.config.description } : {},
+    columns,
+    ...primaryKey2 !== void 0 ? { primaryKey: primaryKey2 } : {},
+    links,
+    policies: { read: toCanonicalPolicy(view.config.policies.read) }
+  };
+}
 function buildCanonicalLink({
-  table,
+  relation,
   linkName,
   link,
-  tablesByName
+  relationsByName
 }) {
+  const ownerKind = relationKind(relation);
+  const ownerName = relationName(relation);
   const fail = (message) => {
-    throw new OrmDefinitionError(`table "${table.tableName}": link "${linkName}" ${message}`, table.file);
+    throw new OrmDefinitionError(`${ownerKind} "${ownerName}": link "${linkName}" ${message}`, relation.file);
   };
   if (link.enforce && link.linkKind !== "toOne") {
     return fail("sets enforce: true, which is only supported on toOne links");
@@ -710,29 +1756,34 @@ function buildCanonicalLink({
     return {
       name: linkName,
       kind: "toPlatformUser",
-      on: resolveColumnRef({ table, ref: link.on, role: `link "${linkName}" on` }),
+      on: resolveColumnRef({ relation, ref: link.on, role: `link "${linkName}" on` }),
       ...link.references !== void 0 ? { references: deriveColumnName(link.references) } : {},
       enforce: false,
       ...link.description !== void 0 ? { description: link.description } : {}
     };
   }
-  const target = resolveTableRef({ ref: link.target, fail });
-  if (!tablesByName.has(target.tableName)) {
-    return fail(`targets table "${target.tableName}" which is not part of this namespace`);
+  const target = resolveRelationRef({ ref: link.target, fail });
+  const targetName = relationName(target);
+  if (!relationsByName.has(targetName)) {
+    return fail(`targets ${relationKind(target)} "${targetName}" which is not part of this namespace`);
+  }
+  if (link.enforce && (!isSeqTable(relation) || !isSeqTable(target))) {
+    return fail("cannot enforce a PostgreSQL foreign key involving a view");
   }
-  const owningSide = link.linkKind === "toOne" ? table : target;
+  const owningSide = link.linkKind === "toOne" ? relation : target;
+  const referencedSide = link.linkKind === "toOne" ? target : relation;
   return {
     name: linkName,
     kind: link.linkKind,
-    target: target.tableName,
-    on: resolveColumnRef({ table: owningSide, ref: link.on, role: `link "${linkName}" on` }),
-    ...link.references !== void 0 ? { references: resolveColumnRef({ table: target, ref: link.references, role: `link "${linkName}" references` }) } : {},
+    target: targetName,
+    on: resolveColumnRef({ relation: owningSide, ref: link.on, role: `link "${linkName}" on` }),
+    ...link.references !== void 0 ? { references: resolveColumnRef({ relation: referencedSide, ref: link.references, role: `link "${linkName}" references` }) } : {},
     enforce: link.enforce,
     ...link.description !== void 0 ? { description: link.description } : {}
   };
 }
-function resolveTableRef({ ref, fail }) {
-  if (ref === void 0) return fail("declares no target table");
+function resolveRelationRef({ ref, fail }) {
+  if (ref === void 0) return fail("declares no target relation");
   if (typeof ref !== "function") return ref;
   let resolved;
   try {
@@ -742,21 +1793,36 @@ function resolveTableRef({ ref, fail }) {
       `target thunk threw (${error instanceof Error ? error.message : String(error)}) \u2014 lazy refs resolve at serialize time; make sure the target module ran`
     );
   }
-  if (!isSeqTable(resolved)) return fail("target thunk did not return a table defined with defineTable");
+  if (!isSeqTable(resolved) && !isSeqView(resolved)) {
+    return fail("target thunk did not return a relation defined with defineTable/defineView");
+  }
   return resolved;
 }
-function resolveColumnRef({ table, ref, role }) {
-  const direct = table.columns[ref];
+function resolveColumnRef({ relation, ref, role }) {
+  const direct = relation.columns[ref];
   if (direct) return direct.columnNameFor(ref);
-  for (const [propertyName, builder] of Object.entries(table.columns)) {
+  for (const [propertyName, builder] of Object.entries(relation.columns)) {
     if (builder.columnNameFor(propertyName) === ref) return ref;
   }
-  const known = Object.keys(table.columns).join(", ");
+  const known = Object.keys(relation.columns).join(", ");
   throw new OrmDefinitionError(
-    `table "${table.tableName}": ${role} references unknown column "${ref}" (known columns: ${known || "none"})`,
-    table.file
+    `${relationKind(relation)} "${relationName(relation)}": ${role} references unknown column "${ref}" (known columns: ${known || "none"})`,
+    relation.file
   );
 }
+function assertAcyclicViewDependencies(views) {
+  const viewNames = new Set(views.map((view) => view.view));
+  const remaining = new Map(
+    views.map((view) => [view.view, new Set(view.dependencies.filter((dependency) => viewNames.has(dependency)))])
+  );
+  while (remaining.size > 0) {
+    const ready = [...remaining.entries()].filter(([, dependencies]) => [...dependencies].every((dependency) => !remaining.has(dependency))).map(([name]) => name);
+    if (ready.length === 0) {
+      throw new OrmDefinitionError(`view dependencies form a cycle among: ${[...remaining.keys()].sort().join(", ")}`);
+    }
+    for (const name of ready) remaining.delete(name);
+  }
+}
 function toCanonicalPolicy(policy) {
   if (typeof policy === "string") return policy;
   return {
@@ -768,12 +1834,110 @@ function toCanonicalPolicy(policy) {
     }))
   };
 }
-function describeFile(table) {
-  return table.file ?? "<unknown file>";
+function describeFile(relation) {
+  return relation.file ?? "<unknown file>";
 }
 function formatZodIssues(error) {
   return error.issues.map((issue) => issue.path.length > 0 ? `${issue.path.join(".")}: ${issue.message}` : issue.message).join("; ");
 }
+var SYNCED_CONTRACT_HASH_DOMAIN = "sequence-orm-synced-contract\0";
+var ORM_TO_PIPELINE_TYPE = {
+  uuid: "uuid",
+  text: "string",
+  integer: "int",
+  bigint: "long",
+  numeric: "numeric",
+  double: "double",
+  boolean: "boolean",
+  timestamptz: "timestamp",
+  date: "date",
+  jsonb: "json"
+};
+function isColumnType(value) {
+  return typeof value === "string" && value in ORM_TO_PIPELINE_TYPE;
+}
+function syncedContractSurface({
+  namespace,
+  table,
+  columns,
+  primary_key
+}) {
+  return {
+    namespace,
+    table,
+    columns: Object.fromEntries(
+      Object.entries(columns).map(([name, column]) => [
+        name,
+        { type: column.type, nullable: column.nullable, key: column.key }
+      ])
+    ),
+    primary_key: [...primary_key]
+  };
+}
+function computeSyncedContractHash(surface) {
+  return createHash("sha256").update(SYNCED_CONTRACT_HASH_DOMAIN).update(stableJson(surface)).digest("hex");
+}
+function extractOrmSyncedTableContract({
+  namespace,
+  table
+}) {
+  if (!NAMESPACE_PATTERN.test(namespace)) {
+    throw new OrmDefinitionError(
+      `namespace "${namespace}" must match ${NAMESPACE_PATTERN}`
+    );
+  }
+  if (table.source === void 0) {
+    throw new OrmDefinitionError(
+      `table "${table.table}" is not a synced table \u2014 extractOrmSyncedTableContract requires source: gold.*`
+    );
+  }
+  if (table.columns.length === 0) {
+    throw new OrmDefinitionError(
+      `synced table "${table.table}" has no typed columns \u2014 declare a typed defineSyncedTable contract before exporting`
+    );
+  }
+  const primaryKey2 = table.primaryKey;
+  if (primaryKey2 === void 0 || primaryKey2.length === 0) {
+    throw new OrmDefinitionError(
+      `synced table "${table.table}" has no primary key \u2014 typed synced contracts require a primary key`
+    );
+  }
+  const pkSet = new Set(primaryKey2);
+  const columns = {};
+  for (const column of table.columns) {
+    if (!isColumnType(column.type)) {
+      const enumName = typeof column.type === "object" && column.type !== null && "enum" in column.type ? column.type.enum : String(column.type);
+      throw new OrmDefinitionError(
+        `synced table "${table.table}": column "${column.columnName}" has enum/type '${enumName}', which has no pipeline-type mapping \u2014 use an ORM-mappable scalar`
+      );
+    }
+    columns[column.columnName] = {
+      type: ORM_TO_PIPELINE_TYPE[column.type],
+      nullable: column.nullable,
+      key: pkSet.has(column.columnName)
+    };
+  }
+  for (const key of primaryKey2) {
+    if (!(key in columns)) {
+      throw new OrmDefinitionError(
+        `synced table "${table.table}": primary key column "${key}" is not declared in columns`
+      );
+    }
+  }
+  const surface = syncedContractSurface({
+    namespace,
+    table: table.table,
+    columns,
+    primary_key: primaryKey2
+  });
+  return {
+    namespace,
+    table: table.table,
+    columns,
+    primary_key: [...primaryKey2],
+    content_hash: computeSyncedContractHash(surface)
+  };
+}
 var NAMESPACE_CONFIG_FILE = "sequence.config.ts";
 var SCHEMA_DIR = "schema";
 async function loadNamespaceFromDir(dir, options = {}) {
@@ -791,7 +1955,12 @@ async function loadNamespaceFromDir(dir, options = {}) {
   const jiti = createJiti(import.meta.url, {
     interopDefault: true,
     fsCache: false,
-    ...options.ormModulePath !== void 0 ? { alias: { "@sequenceholdings/orm": options.ormModulePath } } : {}
+    ...options.ormModulePath !== void 0 ? {
+      alias: {
+        "@sequenceholdings/orm": options.ormModulePath,
+        "@sequenceholdings/orm/authoring": options.ormModulePath
+      }
+    } : {}
   });
   const context = beginAuthoringContext();
   try {
@@ -832,16 +2001,20 @@ async function loadNamespaceFromDir(dir, options = {}) {
   for (const entry of context.tables) {
     if (isSeqTable(entry.value)) tables.push(entry.value);
   }
-  if (tables.length === 0) {
+  const views = [];
+  for (const entry of context.views) {
+    if (isSeqView(entry.value)) views.push(entry.value);
+  }
+  if (tables.length === 0 && views.length === 0) {
     throw new OrmDefinitionError(
-      `no tables registered \u2014 ${SCHEMA_DIR}/*.ts modules must call defineTable(...) at import time`
+      `no relations registered \u2014 ${SCHEMA_DIR}/*.ts modules must call defineTable(...) or defineView(...) at import time`
     );
   }
   const enums = [];
   for (const entry of context.enums) {
     if (isEnumRef(entry.value)) enums.push(entry.value);
   }
-  const canonical = serializeNamespace({ config: configEntry.value, tables, enums });
+  const canonical = serializeNamespace({ config: configEntry.value, tables, views, enums });
   return { canonical, hash: computeCanonicalHash(canonical), files };
 }
 async function listSchemaFiles(root) {
@@ -879,13 +2052,17 @@ function generateNamespaceTypes(definition) {
     `export type ${typesInterfaceName(definition.namespace)} = {`
   ];
   for (const table of definition.tables) {
-    if (table.source) {
+    const columns = Object.entries(table.columns ?? {});
+    if (table.source && columns.length === 0) {
       lines.push(`  /** Synced from ${table.source} \u2014 columns reflect the gold source. */`);
       lines.push(`  ${table.table}: Record<string, unknown>`);
       continue;
     }
+    if (table.source) {
+      lines.push(`  /** Synced from ${table.source} \u2014 read-only typed contract. */`);
+    }
     lines.push(`  ${table.table}: {`);
-    for (const [name, column] of Object.entries(table.columns ?? {})) {
+    for (const [name, column] of columns) {
       if (column.deprecated) continue;
       lines.push(`    ${name}: ${columnWireType(column)}`);
     }
@@ -1342,8 +2519,8 @@ var actionSchema = z.strictObject({
     }
   }
 });
-function extractNamedParams(sql3) {
-  const withoutStrings = sql3.replace(QUOTED_STRING_PATTERN, "''");
+function extractNamedParams(sql4) {
+  const withoutStrings = sql4.replace(QUOTED_STRING_PATTERN, "''");
   const names = [...withoutStrings.matchAll(NAMED_PARAM_PATTERN)].map((match) => match[1]);
   return [...new Set(names)];
 }
@@ -1413,11 +2590,13 @@ var sqlTypeName = (type) => SQL_TYPE_NAMES[type] ?? type;
 // src/compiler/sql.ts
 var CLAIMS_SETTING = "request.jwt.claims";
 var CAPABILITIES_CLAIM_KEY = "capabilities";
+var ROLES_CLAIM_KEY = "roles";
 var quoteIdentifier = (name) => `"${name.replaceAll('"', '""')}"`;
 var quoteLiteral = (value) => `'${value.replaceAll("'", "''")}'`;
 var CLAIMS_SOURCE = `nullif(current_setting('${CLAIMS_SETTING}', true), '')::jsonb`;
 var claimExpression = (key) => `(${CLAIMS_SOURCE} ->> ${quoteLiteral(key)})`;
 var capabilityExpression = (key) => `coalesce(${CLAIMS_SOURCE} -> '${CAPABILITIES_CLAIM_KEY}' ? ${quoteLiteral(key)}, false)`;
+var roleExpression = (key) => `coalesce(${CLAIMS_SOURCE} -> '${ROLES_CLAIM_KEY}' ? ${quoteLiteral(key)}, false)`;
 
 // src/compiler/predicates.ts
 var SQL_COMPARE_OPS = {
@@ -1498,8 +2677,8 @@ var actionParamArg = (name) => `p_${name}`;
 function compileActionStatements(action, renderParam = actionParamArg) {
   return actionStatementSources(action.executes).map((statement) => compileStatement(statement, renderParam));
 }
-function compileStatement(sql3, renderParam) {
-  const compiled = sql3.replace(TOKEN_PATTERN, (token, claimKey, capabilityKey, paramName) => {
+function compileStatement(sql4, renderParam) {
+  const compiled = sql4.replace(TOKEN_PATTERN, (token, claimKey, capabilityKey, paramName) => {
     if (claimKey !== void 0) {
       if (!CLAIM_KEY_PATTERN.test(claimKey)) throw new OrmDefinitionError(`invalid claim key in executes: ${token}`);
       return claimExpression(claimKey);
@@ -1531,6 +2710,118 @@ function referencedExecuteCapabilities(action) {
   return keys;
 }
 
+// src/compiler/pred-ir-sql.ts
+function compilePredIrToSql(pred, options = {}) {
+  switch (pred.kind) {
+    case "const":
+      return pred.value ? "TRUE" : "FALSE";
+    case "and":
+      return `(${pred.operands.map((operand) => compilePredIrToSql(operand, options)).join(" AND ")})`;
+    case "or":
+      return `(${pred.operands.map((operand) => compilePredIrToSql(operand, options)).join(" OR ")})`;
+    case "not":
+      return `(NOT ${compilePredIrToSql(pred.operand, options)})`;
+    case "cmp":
+      return compileCmp(pred.op, pred.column, pred.value, options);
+    case "capability":
+      return `(${capabilityExpression(pred.key)})`;
+    case "role":
+      return `(${roleExpression(pred.key)})`;
+    case "exists":
+    case "aggPredicate":
+    case "dynamicFilter":
+      throw new OrmDefinitionError(
+        `synced view read policy cannot use '${pred.kind}' \u2014 use row filters and claim/capability/role checks only`
+      );
+    default: {
+      const exhausted = pred;
+      throw new OrmDefinitionError(`unsupported synced view predicate kind '${String(exhausted)}'`);
+    }
+  }
+}
+function physicalColumn(logical, options) {
+  return options.columnNames?.[logical] ?? logical;
+}
+function compileCmp(op, column, value, options) {
+  const physical = physicalColumn(column, options);
+  const declared = options.columnTypes?.[physical] ?? options.columnTypes?.[column];
+  const isEnum = typeof declared === "object" && declared !== null;
+  const col = isEnum ? `${quoteIdentifier(physical)}::text` : quoteIdentifier(physical);
+  const columnType = isEnum ? "text" : declared;
+  switch (op) {
+    case "eq":
+      return compileEquality(col, value, columnType, false);
+    case "neq":
+      return compileEquality(col, value, columnType, true);
+    case "gt":
+      return `${col} > ${compileValue(value, columnType)}`;
+    case "gte":
+      return `${col} >= ${compileValue(value, columnType)}`;
+    case "lt":
+      return `${col} < ${compileValue(value, columnType)}`;
+    case "lte":
+      return `${col} <= ${compileValue(value, columnType)}`;
+    case "in":
+      return `${col} = ANY(${compileArrayValue(value, columnType)})`;
+    case "nin":
+      return `${col} <> ALL(${compileArrayValue(value, columnType)})`;
+    case "like":
+      return `${col} LIKE ${compileValue(value, columnType)}`;
+    case "ilike":
+      return `${col} ILIKE ${compileValue(value, columnType)}`;
+    case "isNull":
+      return value.kind === "literal" && value.value === true ? `${col} IS NULL` : `${col} IS NOT NULL`;
+    case "contains":
+    case "hasKey":
+      throw new OrmDefinitionError(`synced view read policy cannot use json operator '${op}'`);
+    default: {
+      const exhausted = op;
+      throw new OrmDefinitionError(`unsupported synced view comparison '${String(exhausted)}'`);
+    }
+  }
+}
+function compileEquality(col, value, columnType, negated, options) {
+  if (value.kind === "literal" && value.value === null) {
+    return negated ? `${col} IS NOT NULL` : `${col} IS NULL`;
+  }
+  const rhs = compileValue(value, columnType);
+  return negated ? `${col} <> ${rhs}` : `${col} = ${rhs}`;
+}
+function compileValue(value, columnType, _options) {
+  switch (value.kind) {
+    case "literal": {
+      const literal = value.value;
+      if (literal === null) return "NULL";
+      if (typeof literal === "string") return quoteLiteral(literal);
+      if (typeof literal === "boolean") return literal ? "TRUE" : "FALSE";
+      return String(literal);
+    }
+    case "claim": {
+      const expression = claimExpression(value.key);
+      return columnType && columnType !== "text" ? `(${expression})::${sqlTypeName(columnType)}` : expression;
+    }
+    case "variable":
+      throw new OrmDefinitionError("synced view read policy cannot reference operation variables");
+    default: {
+      const exhausted = value;
+      throw new OrmDefinitionError(`unsupported synced view value kind '${String(exhausted)}'`);
+    }
+  }
+}
+function compileArrayValue(value, columnType, _options) {
+  if (value.kind !== "literal" || !Array.isArray(value.value)) {
+    throw new OrmDefinitionError("synced view IN/NIN comparisons require literal arrays");
+  }
+  const entries = value.value.map((entry) => {
+    if (entry === null) return "NULL";
+    if (typeof entry === "string") return quoteLiteral(entry);
+    if (typeof entry === "boolean") return entry ? "TRUE" : "FALSE";
+    return String(entry);
+  });
+  const array = `ARRAY[${entries.join(", ")}]`;
+  return columnType ? `${array}::${sqlTypeName(columnType)}[]` : array;
+}
+
 // src/engine/actions.ts
 var ACTION_REQUIRES_DENIED_SQLSTATE = "ORMRQ";
 var ACTION_VALIDATES_FAILED_SQLSTATE = "ORMVL";
@@ -1552,8 +2843,8 @@ function actionPrepareChecks(definition) {
     const order = actionParamOrder(action);
     const signature = order.length > 0 ? ` (${order.map((param) => sqlTypeName(action.params[param].type)).join(", ")})` : "";
     const compiled = compileActionStatements(action, (param) => `$${order.indexOf(param) + 1}`);
-    compiled.forEach((sql3, index3) => {
-      const checked = action.returns && index3 === compiled.length - 1 ? returnProjection(action.returns, sql3) : sql3;
+    compiled.forEach((sql4, index3) => {
+      const checked = action.returns && index3 === compiled.length - 1 ? returnProjection(action.returns, sql4) : sql4;
       statements.push(`PREPARE ${quoteIdentifier(`orm_check_${name}_${index3}`)}${signature} AS ${checked}`);
     });
   }
@@ -1672,7 +2963,9 @@ var indexSchema = z.union([
 ]).transform((index3) => Array.isArray(index3) ? { columns: index3 } : index3);
 var policiesSchema = z.strictObject({
   read: parsedPredicateSchema.optional(),
-  write: parsedPredicateSchema.optional()
+  write: parsedPredicateSchema.optional(),
+  insert: parsedPredicateSchema.optional(),
+  update: parsedPredicateSchema.optional()
 });
 var tableFileSchema = z.strictObject({
   namespace: namespaceSchema,
@@ -1708,7 +3001,6 @@ var policyName = (table, suffix) => `${table}_${suffix}`;
 var foreignKeyName = (table, link) => `fk_${table}_${link}`;
 function validateSyncedTable(table, ctx) {
   const forbidden = [
-    ["columns", "synced tables reflect their source; columns are not declared"],
     ["actions", "synced tables are read-only; actions are not allowed"],
     ["indexes", "synced tables are system-owned; indexes are not allowed"]
   ];
@@ -1718,6 +3010,39 @@ function validateSyncedTable(table, ctx) {
   if (table.policies?.write) {
     ctx.addIssue({ code: "custom", message: "synced tables are read-only", path: ["policies", "write"] });
   }
+  if (table.policies?.insert) {
+    ctx.addIssue({ code: "custom", message: "synced tables are read-only", path: ["policies", "insert"] });
+  }
+  if (table.policies?.update) {
+    ctx.addIssue({ code: "custom", message: "synced tables are read-only", path: ["policies", "update"] });
+  }
+  const columns = table.columns ?? {};
+  const names = Object.keys(columns);
+  if (names.length === 0) return;
+  const primaryKeys = names.filter((name) => columns[name]?.primary_key);
+  if (primaryKeys.length !== 1) {
+    ctx.addIssue({ code: "custom", message: "exactly one column must be primary_key", path: ["columns"] });
+  }
+  validateRenames(columns, names, ctx);
+  for (const name of names) {
+    const column = columns[name];
+    if (!column) continue;
+    const cast = column.cast ? castParts(column.cast) : null;
+    if (column.cast && cast?.column !== name) {
+      ctx.addIssue({
+        code: "custom",
+        message: "cast must reference the column it is declared on",
+        path: ["columns", name, "cast"]
+      });
+    }
+    if (cast && cast.type !== column.type) {
+      ctx.addIssue({
+        code: "custom",
+        message: `cast target '${cast.type}' must match the declared type '${column.type}'`,
+        path: ["columns", name, "cast"]
+      });
+    }
+  }
 }
 function validateRenames(columns, names, ctx) {
   const renameSources = /* @__PURE__ */ new Map();
@@ -1795,7 +3120,7 @@ function validateColumnTable(table, ctx) {
 function validateLinks(table, ctx) {
   const columnNames = Object.keys(table.columns ?? {});
   for (const [name, link] of Object.entries(table.links ?? {})) {
-    if (!table.source && !columnNames.includes(link.on)) {
+    if (columnNames.length > 0 && !columnNames.includes(link.on)) {
       ctx.addIssue({ code: "custom", message: `link references unknown column '${link.on}'`, path: ["links", name, "on"] });
     }
     if (link.enforce && link.to.includes(".")) {
@@ -1868,10 +3193,10 @@ var TYPE_GROUPS = {
 };
 var columnTypeGroup = (type) => TYPE_GROUPS[type];
 function validatePolicyColumns(table, ctx) {
-  if (table.source) return;
   const columns = table.columns ?? {};
   const columnNames = Object.keys(columns);
-  for (const kind of ["read", "write"]) {
+  if (columnNames.length === 0) return;
+  for (const kind of ["read", "write", "insert", "update"]) {
     const predicate = table.policies?.[kind];
     if (!predicate) continue;
     for (const column of referencedColumns(predicate.ast)) {
@@ -1948,10 +3273,15 @@ function policyStatements(schema, table) {
   if (read) {
     statements.push(`CREATE POLICY ${policyName2("read")} ON ${qualified} FOR SELECT USING (${compilePredicate(read.ast, columnTypes)})`);
   }
-  const write = table.policies?.write;
-  if (write) {
-    const predicate = compilePredicate(write.ast, columnTypes);
-    statements.push(`CREATE POLICY ${policyName2("insert")} ON ${qualified} FOR INSERT WITH CHECK (${predicate})`);
+  const insertPolicy = table.policies?.insert ?? table.policies?.write;
+  const updatePolicy = table.policies?.update ?? table.policies?.write;
+  if (insertPolicy) {
+    statements.push(
+      `CREATE POLICY ${policyName2("insert")} ON ${qualified} FOR INSERT WITH CHECK (${compilePredicate(insertPolicy.ast, columnTypes)})`
+    );
+  }
+  if (updatePolicy) {
+    const predicate = compilePredicate(updatePolicy.ast, columnTypes);
     statements.push(
       `CREATE POLICY ${policyName2("update")} ON ${qualified} FOR UPDATE USING (${predicate}) WITH CHECK (${predicate})`
     );
@@ -1960,6 +3290,118 @@ function policyStatements(schema, table) {
   return statements;
 }
 var columnTables = (definition) => definition.tables.filter((table) => !table.source);
+var syncedTables = (definition) => definition.tables.filter((table) => !!table.source);
+var SYNCED_VIEW_EXECUTION_OWNER_ROLE = "orm_exec";
+function syncedViewStatements({
+  definition,
+  backings,
+  readPolicyIrByTable,
+  columnNamesByTable,
+  columnTypesByTable,
+  executionOwnerRole = SYNCED_VIEW_EXECUTION_OWNER_ROLE
+}) {
+  const schema = quoteIdentifier(ormSchemaName(definition.namespace));
+  const role = quoteIdentifier(consumerRoleName(definition.namespace));
+  const owner = quoteIdentifier(executionOwnerRole);
+  const backingMap = /* @__PURE__ */ new Map();
+  for (const backing of backings) {
+    const existing = backingMap.get(backing.table);
+    if (existing) {
+      throw new OrmDefinitionError(
+        `duplicate synced backing for table "${backing.table}" ('${existing.physicalRelation}' and '${backing.physicalRelation}') \u2014 refusing to materialize an ambiguous authorization boundary`
+      );
+    }
+    backingMap.set(backing.table, backing);
+  }
+  const statements = [];
+  for (const table of syncedTables(definition)) {
+    const backing = backingMap.get(table.table);
+    if (!backing) continue;
+    const viewName = `${schema}.${quoteIdentifier(table.table)}`;
+    const physical = splitPhysicalRelation(backing.physicalRelation);
+    const physicalTarget = `${quoteIdentifier(physical.schema)}.${quoteIdentifier(physical.table)}`;
+    const columnTypes = mergeSyncedViewColumnTypes({
+      table,
+      canonicalColumnTypes: columnTypesByTable?.get(table.table),
+      backingColumnTypes: backing.columnTypes,
+      columnNames: columnNamesByTable?.get(table.table)
+    });
+    const readPolicyIr = readPolicyIrByTable?.get(table.table);
+    const readPolicy = table.policies?.read;
+    const whereClause = readPolicyIr ? ` WHERE ${compilePredIrToSql(readPolicyIr, {
+      columnTypes,
+      columnNames: columnNamesByTable?.get(table.table)
+    })}` : readPolicy ? ` WHERE ${compilePredicate(readPolicy.ast, narrowToV1ColumnTypes(columnTypes))}` : " WHERE false";
+    statements.push(`GRANT USAGE ON SCHEMA ${quoteIdentifier(physical.schema)} TO ${owner}`);
+    statements.push(`GRANT SELECT ON ${physicalTarget} TO ${owner}`);
+    statements.push(
+      `CREATE OR REPLACE VIEW ${viewName} AS SELECT * FROM ${physicalTarget}${whereClause}`
+    );
+    statements.push(`GRANT SELECT ON ${viewName} TO ${role}`);
+  }
+  return statements;
+}
+function mergeSyncedViewColumnTypes({
+  table,
+  canonicalColumnTypes,
+  backingColumnTypes,
+  columnNames
+}) {
+  const fromTable = {};
+  for (const [name, def] of Object.entries(table.columns ?? {})) {
+    if (def?.type) fromTable[name] = def.type;
+  }
+  if (columnNames) {
+    for (const [logical, physical] of Object.entries(columnNames)) {
+      const declared = fromTable[physical] ?? fromTable[logical];
+      if (!declared) continue;
+      fromTable[physical] = declared;
+      fromTable[logical] = declared;
+    }
+  }
+  const canonicalEnums = Object.fromEntries(
+    Object.entries(canonicalColumnTypes ?? {}).filter(([, type]) => typeof type === "object")
+  );
+  return { ...fromTable, ...canonicalColumnTypes ?? {}, ...backingColumnTypes ?? {}, ...canonicalEnums };
+}
+function narrowToV1ColumnTypes(columnTypes) {
+  return Object.fromEntries(
+    Object.entries(columnTypes).map(([column, type]) => [column, typeof type === "object" ? "text" : type])
+  );
+}
+function splitPhysicalRelation(physicalRelation) {
+  const parts = physicalRelation.split(".");
+  if (parts.length === 1 && parts[0]) return { schema: "public", table: parts[0] };
+  if (parts.length === 2 && parts[0] && parts[1]) return { schema: parts[0], table: parts[1] };
+  throw new OrmDefinitionError(
+    `synced view physical relation must be "table" or "schema.table" (got "${physicalRelation}")`
+  );
+}
+function syncedViewDropStatements({
+  schemaName,
+  tables
+}) {
+  const schema = quoteIdentifier(schemaName);
+  return tables.map(
+    (table) => `DROP VIEW IF EXISTS ${schema}.${quoteIdentifier(table)} CASCADE`
+  );
+}
+function syncedBackingRevokeStatements({
+  backings,
+  executionOwnerRole = SYNCED_VIEW_EXECUTION_OWNER_ROLE
+}) {
+  const owner = quoteIdentifier(executionOwnerRole);
+  const seen = /* @__PURE__ */ new Set();
+  const statements = [];
+  for (const backing of backings) {
+    const physical = splitPhysicalRelation(backing.physicalRelation);
+    const physicalTarget = `${quoteIdentifier(physical.schema)}.${quoteIdentifier(physical.table)}`;
+    if (seen.has(physicalTarget)) continue;
+    seen.add(physicalTarget);
+    statements.push(`REVOKE SELECT ON ${physicalTarget} FROM ${owner}`);
+  }
+  return statements;
+}
 var FACTORIES = {
   uuid: (name) => uuid(name),
   text: (name) => text(name),
@@ -2153,99 +3595,16 @@ function applyMigrationHints(previous, definition) {
       }
     }
   }
-  return { statements, adjusted };
-}
-function findTable(snapshot, schema, table) {
-  const tables = snapshot.tables ?? {};
-  return Object.values(tables).find((entry) => entry.schema === schema && entry.name === table);
-}
-function snapshotTableNames(snapshot, schema) {
-  const tables = snapshot.tables ?? {};
-  return Object.values(tables).filter((entry) => entry.schema === schema).map((entry) => entry.name);
-}
-var OWNED_STATEMENT = new RegExp(
-  [
-    String.raw`^\s*(CREATE|DROP)\s+POLICY\b`,
-    String.raw`^\s*(GRANT|REVOKE)\b`,
-    String.raw`^\s*(CREATE|DROP|ALTER)\s+ROLE\b`,
-    String.raw`^\s*(CREATE|DROP)\s+(OR\s+REPLACE\s+)?VIEW\b`,
-    // Only ever appears in an RLS toggle (ALTER TABLE … [ENABLE|FORCE] ROW LEVEL
-    // SECURITY) — a three-word phrase, never an identifier.
-    String.raw`\bROW LEVEL SECURITY\b`
-  ].join("|"),
-  "i"
-);
-function isOwnedStatement(statement) {
-  return OWNED_STATEMENT.test(statement);
-}
-async function pendingKitStatements({
-  definition,
-  db
-}) {
-  const { imports, schemaName } = buildDrizzleEntities(definition);
-  const { statementsToExecute } = await withExitGuard(
-    () => pushSchema(imports, shimExecute(db), [schemaName])
-  );
-  return statementsToExecute.filter((statement) => !OWNED_STATEMENT.test(statement));
-}
-function shimExecute(db) {
-  const execute = db.execute.bind(db);
-  return {
-    execute: async (query) => {
-      const result = await execute(query);
-      if (result && typeof result === "object" && "rows" in result) return result;
-      return { rows: result };
-    }
-  };
-}
-var exitGuardChain = Promise.resolve();
-function withExitGuard(run) {
-  const next = exitGuardChain.then(() => guardedRun(run));
-  exitGuardChain = next.then(
-    () => void 0,
-    () => void 0
-  );
-  return next;
-}
-async function guardedRun(run) {
-  const originalExit = process.exit;
-  process.exit = ((code) => {
-    throw new Error(`drizzle-kit attempted process.exit(${code ?? 0}) during pushSchema introspection`);
-  });
-  try {
-    return await run();
-  } finally {
-    process.exit = originalExit;
-  }
+  return { statements, adjusted };
 }
-
-// src/engine/index.ts
-var STATEMENT_KINDS = ["hint", "ddl", "security", "function"];
-async function planMigration({
-  definition,
-  previousSnapshot
-}) {
-  const schema = ormSchemaName(definition.namespace);
-  const previous = previousSnapshot ? normalizeSnapshot(previousSnapshot) : emptySnapshot(definition.namespace);
-  const hints = applyMigrationHints(previous, definition);
-  const snapshot = generateSnapshot(definition, previousId(previous));
-  const ddl = await diffStatements(hints.adjusted, snapshot);
-  const policyDrops = policyDropStatements(schema, snapshotTableNames(previous, schema));
-  const statements = [
-    ...policyDrops.map((sql3) => ({ kind: "security", sql: sql3 })),
-    ...hints.statements.map((sql3) => ({ kind: "hint", sql: sql3 })),
-    ...ddl.map((sql3) => ({ kind: "ddl", sql: sql3.replace(/;\s*$/, "") })),
-    ...securityStatements(definition).map((sql3) => ({ kind: "security", sql: sql3 })),
-    // PREPARE each action's executes first (plpgsql bodies don't check columns
-    // at CREATE), then create the functions. Both reference the tables the DDL
-    // above creates, so they close the plan.
-    ...actionPrepareChecks(definition).map((sql3) => ({ kind: "function", sql: sql3 })),
-    ...actionFunctionStatements(definition).map((sql3) => ({ kind: "function", sql: sql3 }))
-  ];
-  return { namespace: definition.namespace, schema, statements, snapshot };
+function findTable(snapshot, schema, table) {
+  const tables = snapshot.tables ?? {};
+  return Object.values(tables).find((entry) => entry.schema === schema && entry.name === table);
+}
+function snapshotTableNames(snapshot, schema) {
+  const tables = snapshot.tables ?? {};
+  return Object.values(tables).filter((entry) => entry.schema === schema).map((entry) => entry.name);
 }
-var compileNamespace = (definition) => planMigration({ definition });
-var previousId = (snapshot) => snapshot.id;
 var FACTORIES2 = {
   uuid: (name) => uuid(name),
   text: (name) => text(name),
@@ -2283,11 +3642,268 @@ function buildDrizzleEntitiesV2(definition) {
     imports[table.table] = drizzleTable;
     tables[table.table] = drizzleTable;
   }
+  for (const view of definition.views ?? []) {
+    const columns = Object.fromEntries(
+      view.columns.map((column) => [column.columnName, buildViewColumnV2({ view: view.view, column, enums })])
+    );
+    imports[view.view] = schema.view(view.view, columns).as(
+      sql.raw(
+        rewriteSyncedSourceRelationsInViewQuery({
+          query: view.query,
+          canonical: definition,
+          schemaName,
+          dependencies: view.dependencies
+        })
+      )
+    );
+  }
   return { imports, tables, schemaName };
 }
+function rewriteSyncedSourceRelationsInViewQuery({
+  query,
+  canonical,
+  schemaName,
+  dependencies
+}) {
+  const tablesBySource = /* @__PURE__ */ new Map();
+  for (const table of canonical.tables) {
+    if (!table.source) continue;
+    tablesBySource.set(table.source, [...tablesBySource.get(table.source) ?? [], table.table]);
+  }
+  const declared = new Set(dependencies ?? []);
+  const boundTableBySource = /* @__PURE__ */ new Map();
+  for (const [source, tables] of tablesBySource) {
+    if (tables.length === 1) {
+      boundTableBySource.set(source, tables[0]);
+      continue;
+    }
+    const [sourceSchema, sourceName] = source.split(".");
+    if (!sourceSchema || !sourceName) continue;
+    const referenced = sqlReferencesQualifiedRelation(query, sourceSchema, sourceName);
+    if (!referenced) continue;
+    const declaredMatches = tables.filter((table) => declared.has(table));
+    if (declaredMatches.length === 1) {
+      boundTableBySource.set(source, declaredMatches[0]);
+      continue;
+    }
+    throw new OrmDefinitionError(
+      `synced source '${source}' is declared by multiple synced tables (${[...tables].sort().join(", ")}) \u2014 this view references it but its declared dependencies do not name exactly one of them, so the rewrite is ambiguous`
+    );
+  }
+  return transformSqlOutsideLiterals(query, (segment) => {
+    let rewritten = segment;
+    for (const table of canonical.tables) {
+      if (!table.source) continue;
+      const boundTable = boundTableBySource.get(table.source);
+      if (boundTable === void 0 || boundTable !== table.table) continue;
+      const [sourceSchema, sourceName] = table.source.split(".");
+      if (!sourceSchema || !sourceName) continue;
+      rewritten = replaceQualifiedRelation(
+        rewritten,
+        sourceSchema,
+        sourceName,
+        schemaName,
+        table.table
+      );
+    }
+    return rewritten;
+  });
+}
+function transformSqlOutsideLiterals(sql4, transform) {
+  const out = [];
+  let state = { kind: "normal" };
+  let i = 0;
+  let codeStart = 0;
+  const emitCode = (end) => {
+    if (end > codeStart) out.push(transform(sql4.slice(codeStart, end)));
+    codeStart = end;
+  };
+  while (i < sql4.length) {
+    const c = sql4[i];
+    const next = i + 1 < sql4.length ? sql4[i + 1] : "";
+    switch (state.kind) {
+      case "normal": {
+        if (c === "-" && next === "-") {
+          emitCode(i);
+          state = { kind: "line-comment" };
+          out.push("--");
+          i += 2;
+          codeStart = i;
+          break;
+        }
+        if (c === "/" && next === "*") {
+          emitCode(i);
+          state = { kind: "block-comment", depth: 1 };
+          out.push("/*");
+          i += 2;
+          codeStart = i;
+          break;
+        }
+        if ((c === "E" || c === "e") && next === "'") {
+          const prev = i > 0 ? sql4[i - 1] : "";
+          if (!/[A-Za-z0-9_]/.test(prev)) {
+            emitCode(i);
+            state = { kind: "e-single" };
+            out.push("E'");
+            i += 2;
+            codeStart = i;
+            break;
+          }
+        }
+        if (c === "'") {
+          emitCode(i);
+          state = { kind: "single" };
+          out.push("'");
+          i += 1;
+          codeStart = i;
+          break;
+        }
+        if (c === "$") {
+          const prev = i > 0 ? sql4[i - 1] : "";
+          if (!/[A-Za-z0-9_$]/.test(prev)) {
+            const tagMatch = /^\$([A-Za-z_][A-Za-z0-9_]*)?\$/.exec(sql4.slice(i));
+            if (tagMatch) {
+              emitCode(i);
+              state = { kind: "dollar", tag: tagMatch[1] ?? "" };
+              out.push(tagMatch[0]);
+              i += tagMatch[0].length;
+              codeStart = i;
+              break;
+            }
+          }
+        }
+        i += 1;
+        break;
+      }
+      case "single": {
+        if (c === "'" && next === "'") {
+          out.push("''");
+          i += 2;
+          break;
+        }
+        if (c === "'") {
+          out.push("'");
+          state = { kind: "normal" };
+          i += 1;
+          codeStart = i;
+          break;
+        }
+        out.push(c);
+        i += 1;
+        break;
+      }
+      case "e-single": {
+        if (c === "\\" && i + 1 < sql4.length) {
+          out.push(c, sql4[i + 1]);
+          i += 2;
+          break;
+        }
+        if (c === "'" && next === "'") {
+          out.push("''");
+          i += 2;
+          break;
+        }
+        if (c === "'") {
+          out.push("'");
+          state = { kind: "normal" };
+          i += 1;
+          codeStart = i;
+          break;
+        }
+        out.push(c);
+        i += 1;
+        break;
+      }
+      case "dollar": {
+        const closer = `$${state.tag}$`;
+        if (sql4.startsWith(closer, i)) {
+          out.push(closer);
+          state = { kind: "normal" };
+          i += closer.length;
+          codeStart = i;
+          break;
+        }
+        out.push(c);
+        i += 1;
+        break;
+      }
+      case "line-comment": {
+        if (c === "\n") {
+          out.push("\n");
+          state = { kind: "normal" };
+          i += 1;
+          codeStart = i;
+          break;
+        }
+        out.push(c);
+        i += 1;
+        break;
+      }
+      case "block-comment": {
+        if (c === "/" && next === "*") {
+          out.push("/*");
+          state = { kind: "block-comment", depth: state.depth + 1 };
+          i += 2;
+          break;
+        }
+        if (c === "*" && next === "/") {
+          out.push("*/");
+          const newDepth = state.depth - 1;
+          state = newDepth === 0 ? { kind: "normal" } : { kind: "block-comment", depth: newDepth };
+          i += 2;
+          if (state.kind === "normal") codeStart = i;
+          break;
+        }
+        out.push(c);
+        i += 1;
+        break;
+      }
+    }
+  }
+  emitCode(sql4.length);
+  return out.join("");
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function sqlReferencesQualifiedRelation(sql4, sourceSchema, sourceName) {
+  let referenced = false;
+  transformSqlOutsideLiterals(sql4, (segment) => {
+    if (qualifiedRelationPattern(sourceSchema, sourceName).test(segment)) referenced = true;
+    return segment;
+  });
+  return referenced;
+}
+function qualifiedRelationPattern(sourceSchema, sourceName) {
+  const schemaPattern = `(?:"${escapeRegExp(sourceSchema)}"|${escapeRegExp(sourceSchema)})`;
+  const namePattern = `(?:"${escapeRegExp(sourceName)}"|${escapeRegExp(sourceName)})`;
+  return new RegExp(`(?<![\\w."])${schemaPattern}\\.${namePattern}(?![\\w"])`, "g");
+}
+function replaceQualifiedRelation(sql4, sourceSchema, sourceName, boundSchema, boundTable) {
+  return sql4.replace(qualifiedRelationPattern(sourceSchema, sourceName), `"${boundSchema}"."${boundTable}"`);
+}
 function generateSnapshotV2(definition, previousId3) {
   const { imports, schemaName } = buildDrizzleEntitiesV2(definition);
-  return generateDrizzleJson(imports, previousId3, [schemaName]);
+  const snapshot = generateDrizzleJson(imports, previousId3, [schemaName]);
+  if ((definition.views?.length ?? 0) > 0) {
+    const extended = snapshot;
+    extended._sequenceOrm = {
+      viewDependencies: Object.fromEntries(
+        (definition.views ?? []).map((view) => [view.view, [...view.dependencies].sort()])
+      )
+    };
+  }
+  return snapshot;
+}
+function buildViewColumnV2({
+  view,
+  column,
+  enums
+}) {
+  const factory = resolveColumnFactory(view, column, enums);
+  let builder = factory(column.columnName);
+  if (!column.nullable) builder = builder.notNull();
+  return builder;
 }
 function buildTable2(schema, table, built, enums, byName) {
   const primaryKeyColumns = table.primaryKey ?? [];
@@ -2531,15 +4147,379 @@ async function planMigrationV2({
 }) {
   const schema = ormSchemaName(canonical.namespace);
   const previous = previousSnapshot ? normalizeSnapshot(previousSnapshot) : emptySnapshot(canonical.namespace);
+  assertValidViewDependencies(canonical);
   const hints = applyMigrationHintsV2(previous, canonical);
-  const snapshot = generateSnapshotV2(canonical, previousId2(previous));
-  const ddl = await diffStatements(hints.adjusted, snapshot);
+  const snapshot = generateSnapshotV2(canonical, previousId(previous));
+  const baseDdl = await diffStatements(withoutViews(hints.adjusted), withoutViews(snapshot));
+  const previousViews = snapshotViews(hints.adjusted);
+  const currentViews = snapshotViews(snapshot);
+  const previousDependencies = snapshotViewDependencies(hints.adjusted);
+  const currentDependencies = snapshotViewDependencies(snapshot);
+  const affected = affectedViewNames({
+    previousViews,
+    currentViews,
+    previousDependencies,
+    currentDependencies,
+    baseChanged: hints.statements.length > 0 || baseDdl.length > 0
+  });
+  const dropOrder = topologicalViewNames(
+    new Set([...affected].filter((name) => previousViews.has(name))),
+    previousDependencies
+  ).reverse();
+  const createOrder = topologicalViewNames(
+    new Set([...affected].filter((name) => currentViews.has(name))),
+    currentDependencies
+  );
+  const dropDdl = await generatedViewStatements({
+    snapshot: hints.adjusted,
+    names: new Set(dropOrder),
+    mode: "drop",
+    schema
+  });
+  const createDdl = await generatedViewStatements({
+    snapshot,
+    names: new Set(createOrder),
+    mode: "create",
+    schema
+  });
+  const currentViewDefinitions = new Map((canonical.views ?? []).map((view) => [view.view, view]));
   const statements = [
+    ...dropOrder.map((name) => ({ kind: "ddl", sql: requiredViewStatement(dropDdl, name, schema, "DROP") })),
     ...hints.statements.map((statement) => ({ kind: "hint", sql: statement })),
-    ...ddl.map((statement) => ({ kind: "ddl", sql: statement.replace(/;\s*$/, "") }))
+    ...baseDdl.map((statement) => ({ kind: "ddl", sql: statement.replace(/;\s*$/, "") })),
+    ...createOrder.map((name) => ({ kind: "ddl", sql: requiredViewStatement(createDdl, name, schema, "CREATE") })),
+    ...createOrder.map((name) => {
+      const view = currentViewDefinitions.get(name);
+      if (!view) throw new OrmDefinitionError(`missing canonical definition for view '${name}'`);
+      return { kind: "ddl", sql: validateViewCatalogStatement({ canonical, view, schema }) };
+    })
   ];
   return { namespace: canonical.namespace, schema, statements, snapshot };
 }
+function validateViewCatalogStatement({
+  canonical,
+  view,
+  schema
+}) {
+  const qualified = `${schema}.${view.view}`;
+  const expectedColumns = sqlTextArray(view.columns.map((column) => column.columnName));
+  const expectedTypes = `ARRAY[${view.columns.map((column) => `${viewTypeRegtype(column, schema)}::oid`).join(", ")}]::oid[]`;
+  const relationIdentity = /* @__PURE__ */ new Map();
+  for (const table of canonical.tables) {
+    relationIdentity.set(table.table, `${schema}.${table.table}`);
+  }
+  for (const candidate of canonical.views ?? []) {
+    relationIdentity.set(candidate.view, `${schema}.${candidate.view}`);
+  }
+  const expectedDependencies = sqlTextArray(
+    view.dependencies.map((dependency) => {
+      const physical = relationIdentity.get(dependency);
+      if (!physical) throw new OrmDefinitionError(`view '${view.view}' depends on unknown relation '${dependency}'`);
+      return physical;
+    }).sort()
+  );
+  const allowedFunctions = sqlTextArray(VIEW_QUERY_FUNCTION_ALLOWLIST);
+  return `DO $sequence_orm_validate_view$
+DECLARE
+  actual_columns text[];
+  actual_types oid[];
+  actual_dependencies text[];
+BEGIN
+  SELECT
+    array_agg(attribute.attname ORDER BY attribute.attnum),
+    array_agg(attribute.atttypid ORDER BY attribute.attnum)
+  INTO actual_columns, actual_types
+  FROM pg_catalog.pg_attribute AS attribute
+  WHERE attribute.attrelid = pg_catalog.to_regclass(${quoteLiteral(qualified)})
+    AND attribute.attnum > 0
+    AND NOT attribute.attisdropped;
+
+  IF actual_columns IS DISTINCT FROM ${expectedColumns} THEN
+    RAISE EXCEPTION 'managed view ${qualified} columns do not match its declaration: expected %, got %', ${expectedColumns}, actual_columns
+      USING ERRCODE = '42804';
+  END IF;
+  IF actual_types IS DISTINCT FROM ${expectedTypes} THEN
+    RAISE EXCEPTION 'managed view ${qualified} types do not match its declaration: expected %, got %', ${expectedTypes}, actual_types
+      USING ERRCODE = '42804';
+  END IF;
+
+  SELECT coalesce(array_agg(found.name ORDER BY found.name), ARRAY[]::text[])
+  INTO actual_dependencies
+  FROM (
+    SELECT DISTINCT dependency_namespace.nspname || '.' || dependency_relation.relname AS name
+    FROM pg_catalog.pg_rewrite AS rewrite
+    JOIN pg_catalog.pg_depend AS dependency
+      ON dependency.classid = 'pg_catalog.pg_rewrite'::regclass
+      AND dependency.objid = rewrite.oid
+      AND dependency.refclassid = 'pg_catalog.pg_class'::regclass
+    JOIN pg_catalog.pg_class AS dependency_relation ON dependency_relation.oid = dependency.refobjid
+    JOIN pg_catalog.pg_namespace AS dependency_namespace ON dependency_namespace.oid = dependency_relation.relnamespace
+    WHERE rewrite.ev_class = pg_catalog.to_regclass(${quoteLiteral(qualified)})
+      AND dependency.refobjid <> rewrite.ev_class
+      AND dependency_relation.relkind IN ('r', 'p', 'v', 'm', 'f')
+  ) AS found;
+
+  IF actual_dependencies IS DISTINCT FROM ${expectedDependencies} THEN
+    RAISE EXCEPTION 'managed view ${qualified} dependencies do not match its declaration: expected %, got %', ${expectedDependencies}, actual_dependencies
+      USING ERRCODE = '2BP01';
+  END IF;
+
+  IF EXISTS (
+    SELECT 1
+    FROM pg_catalog.pg_rewrite AS rewrite
+    JOIN pg_catalog.pg_depend AS dependency
+      ON dependency.classid = 'pg_catalog.pg_rewrite'::regclass
+      AND dependency.objid = rewrite.oid
+      AND dependency.refclassid = 'pg_catalog.pg_proc'::regclass
+    JOIN pg_catalog.pg_proc AS dependency_function ON dependency_function.oid = dependency.refobjid
+    JOIN pg_catalog.pg_namespace AS function_namespace ON function_namespace.oid = dependency_function.pronamespace
+    WHERE rewrite.ev_class = pg_catalog.to_regclass(${quoteLiteral(qualified)})
+      AND (
+        function_namespace.nspname <> 'pg_catalog'
+        OR dependency_function.proname <> ALL (${allowedFunctions})
+      )
+  ) THEN
+    RAISE EXCEPTION 'managed view ${qualified} may only call explicitly allowlisted side-effect-free pg_catalog functions'
+      USING ERRCODE = '42501';
+  END IF;
+
+  IF EXISTS (
+    SELECT 1
+    FROM pg_catalog.pg_rewrite AS rewrite
+    JOIN pg_catalog.pg_depend AS dependency
+      ON dependency.classid = 'pg_catalog.pg_rewrite'::regclass
+      AND dependency.objid = rewrite.oid
+      AND dependency.refclassid = 'pg_catalog.pg_operator'::regclass
+    JOIN pg_catalog.pg_operator AS dependency_operator ON dependency_operator.oid = dependency.refobjid
+    JOIN pg_catalog.pg_namespace AS operator_namespace ON operator_namespace.oid = dependency_operator.oprnamespace
+    WHERE rewrite.ev_class = pg_catalog.to_regclass(${quoteLiteral(qualified)})
+      AND operator_namespace.nspname <> 'pg_catalog'
+  ) THEN
+    RAISE EXCEPTION 'managed view ${qualified} may only use pg_catalog operators'
+      USING ERRCODE = '42501';
+  END IF;
+END
+$sequence_orm_validate_view$`;
+}
+function sqlTextArray(values) {
+  return values.length === 0 ? "ARRAY[]::text[]" : `ARRAY[${values.map((value) => quoteLiteral(value)).join(", ")}]::text[]`;
+}
+function viewTypeRegtype(column, schema) {
+  if (typeof column.type === "string") return `${quoteLiteral(sqlTypeName(column.type))}::regtype`;
+  return `${quoteLiteral(`${quoteIdentifier(schema)}.${quoteIdentifier(column.type.enum)}`)}::regtype`;
+}
+var previousId = (snapshot) => snapshot.id;
+function snapshotViews(snapshot) {
+  const views = snapshot.views ?? {};
+  return new Map(Object.values(views).map((view) => [view.name, view]));
+}
+function snapshotViewDependencies(snapshot) {
+  const metadata = snapshot._sequenceOrm;
+  return metadata?.viewDependencies ?? {};
+}
+function withoutViews(snapshot) {
+  const clone = structuredClone(snapshot);
+  clone.views = {};
+  delete clone._sequenceOrm;
+  return clone;
+}
+function affectedViewNames({
+  previousViews,
+  currentViews,
+  previousDependencies,
+  currentDependencies,
+  baseChanged
+}) {
+  const allNames = /* @__PURE__ */ new Set([...previousViews.keys(), ...currentViews.keys()]);
+  if (baseChanged) return allNames;
+  const affected = new Set(
+    [...allNames].filter((name) => {
+      const before = previousViews.get(name);
+      const after = currentViews.get(name);
+      return before === void 0 || after === void 0 || stableJson(before) !== stableJson(after);
+    })
+  );
+  let grew = true;
+  while (grew) {
+    grew = false;
+    for (const name of allNames) {
+      if (affected.has(name)) continue;
+      const dependencies = /* @__PURE__ */ new Set([...previousDependencies[name] ?? [], ...currentDependencies[name] ?? []]);
+      if ([...dependencies].some((dependency) => affected.has(dependency))) {
+        affected.add(name);
+        grew = true;
+      }
+    }
+  }
+  return affected;
+}
+function topologicalViewNames(names, dependencies) {
+  const remaining = new Set(names);
+  const ordered = [];
+  while (remaining.size > 0) {
+    const ready = [...remaining].filter((name) => (dependencies[name] ?? []).every((dependency) => !remaining.has(dependency))).sort();
+    if (ready.length === 0) {
+      throw new OrmDefinitionError(`view dependencies form a cycle among: ${[...remaining].sort().join(", ")}`);
+    }
+    for (const name of ready) {
+      ordered.push(name);
+      remaining.delete(name);
+    }
+  }
+  return ordered;
+}
+async function generatedViewStatements({
+  snapshot,
+  names,
+  mode,
+  schema
+}) {
+  if (names.size === 0) return /* @__PURE__ */ new Map();
+  const without = structuredClone(snapshot);
+  const holder = without;
+  const views = holder.views ?? {};
+  holder.views = Object.fromEntries(Object.entries(views).filter(([, view]) => !names.has(view.name)));
+  const generated = mode === "drop" ? await diffStatements(snapshot, without) : await diffStatements(without, snapshot);
+  const statements = /* @__PURE__ */ new Map();
+  for (const name of names) {
+    const qualified = `${quoteIdentifier(schema)}.${quoteIdentifier(name)}`;
+    const prefix = mode === "drop" ? "DROP VIEW" : "CREATE VIEW";
+    const statement = generated.find((candidate) => candidate.trimStart().startsWith(`${prefix} ${qualified}`));
+    if (statement) statements.set(name, statement.replace(/;\s*$/, ""));
+  }
+  return statements;
+}
+function requiredViewStatement(statements, name, schema, operation) {
+  const statement = statements.get(name);
+  if (!statement) {
+    throw new OrmDefinitionError(`drizzle-kit did not generate ${operation} VIEW for '${schema}.${name}'`);
+  }
+  return statement;
+}
+function assertValidViewDependencies(canonical) {
+  const views = canonical.views ?? [];
+  const known = /* @__PURE__ */ new Set([...canonical.tables.map((table) => table.table), ...views.map((view) => view.view)]);
+  for (const view of views) {
+    for (const dependency of view.dependencies) {
+      if (!known.has(dependency)) {
+        throw new OrmDefinitionError(`view '${view.view}' depends on unknown relation '${dependency}'`);
+      }
+    }
+  }
+  topologicalViewNames(
+    new Set(views.map((view) => view.view)),
+    Object.fromEntries(views.map((view) => [view.view, view.dependencies]))
+  );
+}
+
+// src/engine/converge.ts
+var OWNED_STATEMENT = new RegExp(
+  [
+    String.raw`^\s*(CREATE|DROP)\s+POLICY\b`,
+    String.raw`^\s*(GRANT|REVOKE)\b`,
+    String.raw`^\s*(CREATE|DROP|ALTER)\s+ROLE\b`,
+    String.raw`^\s*(CREATE|DROP)\s+(OR\s+REPLACE\s+)?VIEW\b`,
+    // Only ever appears in an RLS toggle (ALTER TABLE … [ENABLE|FORCE] ROW LEVEL
+    // SECURITY) — a three-word phrase, never an identifier.
+    String.raw`\bROW LEVEL SECURITY\b`
+  ].join("|"),
+  "i"
+);
+var V2_OWNED_STATEMENT = new RegExp(
+  [
+    String.raw`^\s*(CREATE|DROP)\s+POLICY\b`,
+    String.raw`^\s*(GRANT|REVOKE)\b`,
+    String.raw`^\s*(CREATE|DROP|ALTER)\s+ROLE\b`,
+    String.raw`\bROW LEVEL SECURITY\b`
+  ].join("|"),
+  "i"
+);
+function isOwnedStatement(statement) {
+  return OWNED_STATEMENT.test(statement);
+}
+function isOwnedStatementV2(statement) {
+  return V2_OWNED_STATEMENT.test(statement);
+}
+async function pendingKitStatements({
+  definition,
+  db
+}) {
+  return pendingStatements({ entities: buildDrizzleEntities(definition), db, owned: OWNED_STATEMENT });
+}
+async function pendingKitStatementsV2({
+  canonical,
+  db
+}) {
+  return pendingStatements({ entities: buildDrizzleEntitiesV2(canonical), db, owned: V2_OWNED_STATEMENT });
+}
+async function pendingStatements({
+  entities,
+  db,
+  owned
+}) {
+  const { imports, schemaName } = entities;
+  const { statementsToExecute } = await withExitGuard(
+    () => pushSchema(imports, shimExecute(db), [schemaName])
+  );
+  return statementsToExecute.filter((statement) => !owned.test(statement));
+}
+function shimExecute(db) {
+  const execute = db.execute.bind(db);
+  return {
+    execute: async (query) => {
+      const result = await execute(query);
+      if (result && typeof result === "object" && "rows" in result) return result;
+      return { rows: result };
+    }
+  };
+}
+var exitGuardChain = Promise.resolve();
+function withExitGuard(run) {
+  const next = exitGuardChain.then(() => guardedRun(run));
+  exitGuardChain = next.then(
+    () => void 0,
+    () => void 0
+  );
+  return next;
+}
+async function guardedRun(run) {
+  const originalExit = process.exit;
+  process.exit = ((code) => {
+    throw new Error(`drizzle-kit attempted process.exit(${code ?? 0}) during pushSchema introspection`);
+  });
+  try {
+    return await run();
+  } finally {
+    process.exit = originalExit;
+  }
+}
+
+// src/engine/index.ts
+var STATEMENT_KINDS = ["hint", "ddl", "security", "function", "synced_view"];
+async function planMigration({
+  definition,
+  previousSnapshot
+}) {
+  const schema = ormSchemaName(definition.namespace);
+  const previous = previousSnapshot ? normalizeSnapshot(previousSnapshot) : emptySnapshot(definition.namespace);
+  const hints = applyMigrationHints(previous, definition);
+  const snapshot = generateSnapshot(definition, previousId2(previous));
+  const ddl = await diffStatements(hints.adjusted, snapshot);
+  const policyDrops = policyDropStatements(schema, snapshotTableNames(previous, schema));
+  const statements = [
+    ...policyDrops.map((sql4) => ({ kind: "security", sql: sql4 })),
+    ...hints.statements.map((sql4) => ({ kind: "hint", sql: sql4 })),
+    ...ddl.map((sql4) => ({ kind: "ddl", sql: sql4.replace(/;\s*$/, "") })),
+    ...securityStatements(definition).map((sql4) => ({ kind: "security", sql: sql4 })),
+    // PREPARE each action's executes first (plpgsql bodies don't check columns
+    // at CREATE), then create the functions. Both reference the tables the DDL
+    // above creates, so they close the plan.
+    ...actionPrepareChecks(definition).map((sql4) => ({ kind: "function", sql: sql4 })),
+    ...actionFunctionStatements(definition).map((sql4) => ({ kind: "function", sql: sql4 }))
+  ];
+  return { namespace: definition.namespace, schema, statements, snapshot };
+}
+var compileNamespace = (definition) => planMigration({ definition });
 var previousId2 = (snapshot) => snapshot.id;
 var IR_VERSION = 1;
 var CLAIMS_CONTRACT = {
@@ -2678,9 +4658,23 @@ var onConflictIrSchema = z.union([
 ]);
 var mutationRootSchema = z.object({
   kind: z.literal("mutation"),
-  op: z.enum(["insert", "insertOne", "update", "updateByPk", "delete", "deleteByPk"]),
+  /**
+   * CRUD verbs plus the structured copy-on-write ops. `cowOverride` copies the
+   * synced row into the overlay (INSERT…SELECT, ON CONFLICT DO NOTHING) then
+   * applies `set` — both statements generated by the executor from this
+   * metadata, never authored SQL. `cowRevert` deletes the override so the
+   * coalesce view falls back to synced. Both are gated on a matching synced
+   * row and carry the write policy in `where` like update/delete.
+   */
+  op: z.enum(["insert", "insertOne", "update", "updateByPk", "delete", "deleteByPk", "cowOverride", "cowRevert"]),
   alias: z.string(),
   table: z.string(),
+  /** CoW ops: logical name of the synced twin (read through its policy-filtered view). */
+  cowSynced: z.string().optional(),
+  /** cowOverride: logical properties copied INSERT…SELECT from synced (pk included). */
+  cowCopyColumns: z.array(z.string()).optional(),
+  /** cowOverride: insert-policy WITH CHECK evaluated over the copied rows. */
+  cowCopyCheck: predIrSchema.optional(),
   /** insert/insertOne: rows come from a slot ($object/$objects) or literals. */
   objects: z.union([
     z.object({ slot: z.string() }),
@@ -2701,19 +4695,11 @@ var mutationRootSchema = z.object({
   affectedRows: z.boolean().default(false),
   includeIf: includeIfSchema.optional()
 });
-var actionRootSchema = z.object({
-  kind: z.literal("action"),
-  alias: z.string(),
-  name: z.string(),
-  params: z.array(z.object({ name: z.string(), value: valueIrSchema })),
-  returns: z.enum(["rows", "rowsAffected", "scalar"])
-});
 var rootIrSchema = z.discriminatedUnion("kind", [
   selectRootSchema,
   byPkRootSchema,
   aggregateRootSchema,
-  mutationRootSchema,
-  actionRootSchema
+  mutationRootSchema
 ]);
 var INPUT_REF_KINDS = [
   "boolExp",
@@ -2745,7 +4731,7 @@ var compiledOperationSchema = z.object({
   irVersion: z.literal(IR_VERSION),
   name: z.string(),
   opHash: z.string().regex(/^sha256:[0-9a-f]{64}$/),
-  kind: z.enum(["query", "mutation", "action"]),
+  kind: z.enum(["query", "mutation"]),
   requires: z.object({
     capability: z.string().optional(),
     role: z.string().optional()
@@ -2759,13 +4745,24 @@ var tableMetaIrSchema = z.object({
   table: z.string(),
   schema: z.string(),
   typename: z.string(),
+  /**
+   * True when statements over this relation evaluate a claims-gated synced
+   * view: synced twins (`source: gold.*`) materialize as views whose baked
+   * policy reads `current_setting('request.jwt.claims')`, and namespace views
+   * inherit the gate transitively through their declared dependencies. The
+   * executor must stamp that GUC (transaction-scoped) before any statement
+   * touching such a relation, or the synced arm yields zero rows regardless
+   * of the compiled predicates.
+   */
+  claimsGated: z.boolean().default(false),
   columns: z.array(z.object({
     name: z.string(),
     columnName: z.string(),
     type: z.union([z.enum(COLUMN_TYPES), z.object({ enum: z.string(), values: z.array(z.string()) })]),
     nullable: z.boolean()
   })),
-  primaryKey: z.array(z.string()).min(1),
+  /** Empty for keyless read-only views; keyed tables and views list logical columns. */
+  primaryKey: z.array(z.string()),
   links: z.array(z.object({
     name: z.string(),
     kind: z.enum(["toOne", "toMany", "toPlatformUser"]),
@@ -2932,6 +4929,8 @@ function validateCapabilityRefs(files, declared) {
     const referenced = [
       ...table.policies?.read ? referencedCapabilities(table.policies.read.ast) : [],
       ...table.policies?.write ? referencedCapabilities(table.policies.write.ast) : [],
+      ...table.policies?.insert ? referencedCapabilities(table.policies.insert.ast) : [],
+      ...table.policies?.update ? referencedCapabilities(table.policies.update.ast) : [],
       ...Object.values(table.actions ?? {}).flatMap((action) => [
         ...action.requires ? referencedCapabilities(action.requires.ast) : [],
         ...referencedExecuteCapabilities(action)
@@ -3089,7 +5088,7 @@ async function readMigrationSql(dir, entry) {
     throw new OrmDefinitionError("missing migration file", path);
   });
 }
-var checksumOf = (text3) => createHash("sha256").update(text3).digest("hex");
+var checksumOf = (text4) => createHash("sha256").update(text4).digest("hex");
 var migrationName = (ordinal, contentHash) => `${pad(ordinal)}_${contentHash.slice(0, 12)}`;
 function renderMigrationSql({
   name,
@@ -3115,12 +5114,12 @@ async function writeMigration({
   const tip = workspace.journal.entries.at(-1);
   const ordinal = (tip?.ordinal ?? 0) + 1;
   const name = migrationName(ordinal, contentHash);
-  const sql3 = renderMigrationSql({ name, namespace: workspace.journal.namespace, contentHash, plan });
+  const sql4 = renderMigrationSql({ name, namespace: workspace.journal.namespace, contentHash, plan });
   const metaDir = join(dir, MIGRATIONS_DIRNAME, META_DIRNAME);
   await mkdir(metaDir, { recursive: true });
   const snapshotText = `${JSON.stringify(plan.snapshot, null, 2)}
 `;
-  await writeFile(join(dir, MIGRATIONS_DIRNAME, `${name}.sql`), sql3);
+  await writeFile(join(dir, MIGRATIONS_DIRNAME, `${name}.sql`), sql4);
   await writeFile(join(metaDir, `${pad(ordinal)}.snapshot.json`), snapshotText);
   const journal = {
     ...workspace.journal,
@@ -3131,7 +5130,7 @@ async function writeMigration({
         name,
         content_hash: contentHash,
         previous_content_hash: tip?.content_hash ?? null,
-        checksum: checksumOf(sql3),
+        checksum: checksumOf(sql4),
         snapshot_checksum: checksumOf(snapshotText),
         destructive
       }
@@ -3246,8 +5245,8 @@ async function checkWorkspace({
   let previousId3;
   let previousHash = null;
   for (const entry of workspace.journal.entries) {
-    const sql3 = await readMigrationSql(dir, entry);
-    if (checksumOf(sql3) !== entry.checksum) {
+    const sql4 = await readMigrationSql(dir, entry);
+    if (checksumOf(sql4) !== entry.checksum) {
       log(`${MIGRATIONS_DIRNAME}/${entry.name}.sql does not match its journal checksum \u2014 committed migrations must not be edited`);
       return 1;
     }
@@ -3287,7 +5286,7 @@ async function checkWorkspace({
   log(`migrations in sync \u2014 ${workspace.journal.entries.length} committed, tip ${tip.name}`);
   return 0;
 }
-var firstLine = (sql3) => sql3.split("\n")[0] ?? sql3;
+var firstLine = (sql4) => sql4.split("\n")[0] ?? sql4;
 
 // src/migrations/from-yaml.ts
 function convertV1DefinitionToCanonical(definition) {
@@ -3319,7 +5318,7 @@ function convertTable(table) {
     description: table.description,
     source: table.source,
     columns: columns.map(([name, column]) => convertColumn(name, column)),
-    // Synced tables reflect their source — no columns, no primary key.
+    // Synced tables may declare a typed column/PK contract; untyped remain empty.
     primaryKey: primaryKey2.length > 0 ? primaryKey2 : void 0,
     links: Object.entries(table.links ?? {}).map(([name, link]) => convertLink(table.table, name, link)),
     indexes: (table.indexes ?? []).map((index3) => ({
@@ -3332,7 +5331,10 @@ function convertTable(table) {
       read: table.policies?.read?.source,
       write: table.policies?.write?.source
     },
-    actions: Object.entries(table.actions ?? {}).map(([name, action]) => convertAction(table.table, name, action))
+    // v2 has no action surface (writes are mutations); the transition sweep
+    // drops the plpgsql action_* functions, so carrying the metadata would be
+    // dead weight. droppedV1Actions() surfaces them for the emitter's TODO.
+    actions: []
   };
 }
 function convertColumn(name, column) {
@@ -3368,25 +5370,6 @@ function convertLink(table, name, link) {
     description: link.description
   };
 }
-function convertAction(table, name, action) {
-  return {
-    name,
-    requires: action.requires?.source,
-    params: Object.fromEntries(
-      Object.entries(action.params ?? {}).map(([param, definition]) => [
-        param,
-        { type: definition.type, nullable: definition.optional === true }
-      ])
-    ),
-    // The v2 contract carries one SQL string; statement boundaries survive as
-    // `;\n` (v1 validation guarantees no bare `;` inside a single statement).
-    executes: actionStatementSources(action.executes).join(";\n"),
-    // v1 declared the RETURNING columns inline; v2 types them at compile time,
-    // so the shape collapses to rows-vs-rowsAffected.
-    returns: action.returns ? "rows" : "rowsAffected",
-    audit: action.audit ? { action: action.audit.action, resource: action.audit.resource ?? table } : void 0
-  };
-}
 
 // src/migrations/v2.ts
 var SHA256_HEX = /^[0-9a-f]{64}$/;
@@ -3409,7 +5392,7 @@ function buildRebaseJournalEntry({ namespace, previousHash, newHash, ordinal, sn
     throw new OrmDefinitionError(`rebase ordinal must be an integer \u2265 2 (a rebase sits on an existing journal tip); got ${ordinal}`);
   }
   const name = migrationName(ordinal, newHash);
-  const sql3 = renderRebaseMigrationSql({ name, namespace, previousHash, newHash });
+  const sql4 = renderRebaseMigrationSql({ name, namespace, previousHash, newHash });
   const snapshotText = `${JSON.stringify(snapshot, null, 2)}
 `;
   const entry = {
@@ -3417,11 +5400,11 @@ function buildRebaseJournalEntry({ namespace, previousHash, newHash, ordinal, sn
     name,
     content_hash: newHash,
     previous_content_hash: previousHash,
-    checksum: checksumOf(sql3),
+    checksum: checksumOf(sql4),
     snapshot_checksum: checksumOf(snapshotText),
     destructive: false
   };
-  return { name, entry, sql: sql3, snapshotText };
+  return { name, entry, sql: sql4, snapshotText };
 }
 function renderRebaseMigrationSql({
   name,
@@ -3494,8 +5477,9 @@ function canonicalPolicies(value) {
   if (value === null || typeof value !== "object") return void 0;
   const record = value;
   const policies = {};
-  if (typeof record["read"] === "string") policies["read"] = record["read"];
-  if (typeof record["write"] === "string") policies["write"] = record["write"];
+  for (const kind of ["read", "write", "insert", "update"]) {
+    if (typeof record[kind] === "string") policies[kind] = record[kind];
+  }
   return Object.keys(policies).length > 0 ? policies : void 0;
 }
 function canonicalActions(value) {
@@ -3518,6 +5502,6 @@ function canonicalActions(value) {
   );
 }
 
-export { ACTION_REQUIRES_DENIED_SQLSTATE, ACTION_VALIDATES_FAILED_SQLSTATE, AUDIT_ACTIONS, CANONICAL_FORMAT, CAPABILITIES_CLAIM_KEY, CAPABILITY_KEY_PATTERN, CLAIMS_CONTRACT, CLAIMS_SETTING, CLAIM_KEY_PATTERN, CMP_OPS, COLUMN_BRAND, COLUMN_DEFAULT_FNS, COLUMN_TYPES2 as COLUMN_TYPES, COMPARE_OPS, CONSUMER_ROLE_SUFFIX, ColumnBuilder, DEFINITION_FILE_EXTENSIONS, ENUM_BRAND, HASH_DOMAIN, IDENTIFIER_PATTERN, IDENTIFIER_RE, INPUT_REF_KINDS, IR_VERSION, IrVersionError, LINK_BRAND, MAX_DEFINITION_FILE_BYTES, MAX_IDENTIFIER_LENGTH, MIGRATIONS_DIRNAME, NAMESPACE_CONFIG_BRAND, NAMESPACE_CONFIG_FILE, NAMESPACE_CONFIG_FILENAMES, NAMESPACE_PATTERN, ORM_DATA_TOKEN_HEADER, ORM_SCHEMA_PREFIX, ORM_SERVICE_DATA_TOKEN_HEADER, OrmDefinitionError, PredicateParseError, QUALIFIED_TABLE_PATTERN, RESERVED_COLUMN_NAMES, RESERVED_TABLE_NAMES, SCHEMA_DIR, STATEMENT_KINDS, SYNCED_SOURCE_PATTERN, TABLE_BRAND, actionFunctionName, actionFunctionStatements, actionParamArg, actionParamOrder, actionParamSchema, actionPrepareChecks, actionSchema, actionWriteTargets, actionsInterfaceName, activeAuthoringContext, applyMigrationHints, applyMigrationHintsV2, beginAuthoringContext, buildActionParamsSchema, buildDrizzleEntities, buildDrizzleEntitiesV2, buildNamespaceDefinition, buildRebaseJournalEntry, canonicalActionSchema, canonicalColumnSchema, canonicalDefinitionSchema, canonicalEnumSchema, canonicalIndexSchema, canonicalLinkSchema, canonicalPoliciesSchema, canonicalTableSchema, canonicalizeDefinition, capabilityExpression, castParts, checksumOf, claimExpression, classifyDestructive, columnSchema, columnTypeSchema2 as columnTypeSchema, compileActionRequires, compileActionStatements, compileNamespace, compilePredicate, compiledArtifactSchema, compiledOperationSchema, computeCanonicalHash, computeDefinitionHash, consumerRoleName, convertV1DefinitionToCanonical, declaredCapabilityKeys, defineEnum, defineNamespace, defineSyncedTable, defineTable, deriveColumnName, diffCommand, diffStatements, emptyJournal, emptySnapshot, endAuthoringContext, extractNamedParams, generateNamespaceTypes, generateSnapshot, generateSnapshotV2, identifierSchema, indexByHash, isColumnBuilder, isEnumRef, isFunctionDefault, isOwnedStatement, isQualifiedReference, isSeqLink, isSeqNamespaceConfig, isSeqTable, limitIrSchema, loadCommittedMigrations, loadCommittedTipMigration, loadNamespaceDefinition, loadNamespaceFromDir, migrationName, namespaceConfigSchema, namespaceSchema, normalizeCanonical, normalizeIr, normalizeSnapshot, orderIrSchema, ormSchemaName, parseCanonicalDefinition, parseDefinitionSources, parsePredicate, parseTableFile, parsedPredicateSchema, pendingKitStatements, planMigration, planMigrationV2, policyExpressionSchema, policyVariantSchema, predIrSchema, predicateOperands, quoteIdentifier, quoteLiteral, readMigrationSql, readMigrationWorkspace, readSnapshot, rebaseViolations, referencedCapabilities, referencedColumns, renderMigrationSql, rootIrSchema, securityStatements, selectionIrSchema, serializeNamespace, sqlTypeName, stableJson, t, tableFileSchema, tableMetaIrSchema, tableReferenceSchema, toMany, toOne, toPlatformUser, typesInterfaceName, valueIrSchema, variableDefaultIrSchema, variableIrSchema, verifyRebaseIsNoop, walkPredicate, writeMigration };
+export { ACTION_REQUIRES_DENIED_SQLSTATE, ACTION_VALIDATES_FAILED_SQLSTATE, AUDIT_ACTIONS, CANONICAL_FORMAT, CAPABILITIES_CLAIM_KEY, CAPABILITY_KEY_PATTERN, CLAIMS_CONTRACT, CLAIMS_SETTING, CLAIM_KEY_PATTERN, CMP_OPS, COLUMN_BRAND, COLUMN_DEFAULT_FNS, COLUMN_TYPES2 as COLUMN_TYPES, COMPARE_OPS, CONSUMER_ROLE_SUFFIX, ColumnBuilder, DEFINITION_FILE_EXTENSIONS, ENUM_BRAND, HASH_DOMAIN, IDENTIFIER_PATTERN, IDENTIFIER_RE, INPUT_REF_KINDS, IR_VERSION, IrVersionError, LINK_BRAND, MAX_DEFINITION_FILE_BYTES, MAX_IDENTIFIER_LENGTH, MIGRATIONS_DIRNAME, NAMESPACE_CONFIG_BRAND, NAMESPACE_CONFIG_FILE, NAMESPACE_CONFIG_FILENAMES, NAMESPACE_PATTERN, ORM_DATA_TOKEN_HEADER, ORM_SCHEMA_PREFIX, ORM_SERVICE_DATA_TOKEN_HEADER, ORM_TO_PIPELINE_TYPE, OrmDefinitionError, PredicateParseError, QUALIFIED_TABLE_PATTERN, RESERVED_COLUMN_NAMES, RESERVED_TABLE_NAMES, ROLES_CLAIM_KEY, SCHEMA_DIR, STATEMENT_KINDS, SYNCED_CONTRACT_HASH_DOMAIN, SYNCED_SOURCE_PATTERN, SYNCED_VIEW_EXECUTION_OWNER_ROLE, TABLE_BRAND, VIEW_BRAND, actionFunctionName, actionFunctionStatements, actionParamArg, actionParamOrder, actionParamSchema, actionPrepareChecks, actionSchema, actionWriteTargets, actionsInterfaceName, activeAuthoringContext, applyMigrationHints, applyMigrationHintsV2, beginAuthoringContext, buildActionParamsSchema, buildDrizzleEntities, buildDrizzleEntitiesV2, buildNamespaceDefinition, buildRebaseJournalEntry, canonicalActionSchema, canonicalColumnSchema, canonicalDefinitionSchema, canonicalEnumSchema, canonicalIndexSchema, canonicalLinkSchema, canonicalPoliciesSchema, canonicalRelations, canonicalTableSchema, canonicalViewSchema, canonicalizeDefinition, capabilityExpression, castParts, checksumOf, claimExpression, classifyDestructive, columnSchema, columnTypeSchema2 as columnTypeSchema, compileActionRequires, compileActionStatements, compileNamespace, compilePredIrToSql, compilePredicate, compiledArtifactSchema, compiledOperationSchema, computeCanonicalHash, computeDefinitionHash, computeSyncedContractHash, consumerRoleName, convertV1DefinitionToCanonical, declaredCapabilityKeys, defineEnum, defineNamespace, defineSyncedTable, defineTable, defineView, deriveColumnName, diffCommand, diffStatements, emptyJournal, emptySnapshot, endAuthoringContext, extractNamedParams, extractOrmSyncedTableContract, generateNamespaceTypes, generateSnapshot, generateSnapshotV2, identifierSchema, indexByHash, isColumnBuilder, isEnumRef, isFunctionDefault, isOwnedStatement, isOwnedStatementV2, isQualifiedReference, isSeqLink, isSeqNamespaceConfig, isSeqTable, isSeqView, limitIrSchema, loadCommittedMigrations, loadCommittedTipMigration, loadNamespaceDefinition, loadNamespaceFromDir, migrationName, namespaceConfigSchema, namespaceSchema, normalizeCanonical, normalizeIr, normalizeSnapshot, orderIrSchema, ormSchemaName, overlayWinsUnion, overrideRowMutation, parseCanonicalDefinition, parseDefinitionSources, parsePredicate, parseTableFile, parsedPredicateSchema, pendingKitStatements, pendingKitStatementsV2, planMigration, planMigrationV2, policyExpressionSchema, policyVariantSchema, predIrSchema, predicateOperands, quoteIdentifier, quoteLiteral, readMigrationSql, readMigrationWorkspace, readSnapshot, rebaseViolations, referencedCapabilities, referencedColumns, renderMigrationSql, revertOverlayMutation, rewriteSyncedSourceRelationsInViewQuery, roleExpression, rootIrSchema, securityStatements, selectionIrSchema, serializeNamespace, sqlTypeName, stableJson, syncedBackingRevokeStatements, syncedContractSurface, syncedTables, syncedViewDropStatements, syncedViewStatements, t, tableFileSchema, tableMetaIrSchema, tableReferenceSchema, toMany, toOne, toPlatformUser, typesInterfaceName, validateViewCatalogStatement, valueIrSchema, variableDefaultIrSchema, variableIrSchema, verifyRebaseIsNoop, walkPredicate, writeMigration };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map