@sequenceholdings/orm 2.0.0 → 2.1.1

package/dist/authoring.js

@@ -1,7 +1,7 @@
 import { sql, eq, notExists } from 'drizzle-orm';
-import { pgSchema, PgDialect, QueryBuilder, getViewConfig, extractUsedTable, jsonb, date, timestamp, boolean, doublePrecision, numeric, bigint, integer, text, uuid } from 'drizzle-orm/pg-core';
-import { createHash } from 'crypto';
+import { getTableConfig, pgSchema, PgDialect, QueryBuilder, getViewConfig, extractUsedTable, jsonb, date, timestamp, boolean, doublePrecision, numeric, bigint, integer, text, uuid } from 'drizzle-orm/pg-core';
 import { z } from 'zod';
+import { createHash } from 'crypto';
 import { createJiti } from 'jiti';
 import { realpath, stat, readdir } from 'fs/promises';
 import { createRequire } from 'module';
@@ -30,10 +30,12 @@ var ColumnBuilder = class {
       hasDefault: false,
       defaultValue: void 0,
       defaultFn: void 0,
+      onUpdateFn: void 0,
       description: void 0,
       renamedFrom: void 0,
       cast: void 0,
-      deprecated: false
+      deprecated: false,
+      cell: void 0
     };
   }
   /** Marks this column as (part of) the primary key. Implies NOT NULL. */
@@ -65,6 +67,15 @@ var ColumnBuilder = class {
     this.state.defaultFn = void 0;
     return this;
   }
+  /**
+   * Stamp this column with Postgres `now()` on every UPDATE. Only valid on
+   * timestamptz/date; the compiler drops it from SetInput so callers cannot
+   * supply a value.
+   */
+  onUpdate(value) {
+    this.state.onUpdateFn = value;
+    return this;
+  }
   description(text2) {
     this.state.description = text2;
     return this;
@@ -84,6 +95,11 @@ var ColumnBuilder = class {
     this.state.deprecated = true;
     return this;
   }
+  /** @internal System cell-metadata part of logical column `of` (generated resolved views only). */
+  cellPart(of, part) {
+    this.state.cell = { of, part };
+    return this;
+  }
   /** Whether `.primaryKey()` was called — collected into the table-level PK. */
   get isPrimaryKey() {
     return this.state.primaryKey;
@@ -108,9 +124,11 @@ var ColumnBuilder = class {
     };
     if (this.state.hasDefault) column.default = this.state.defaultValue ?? null;
     if (this.state.defaultFn !== void 0) column.defaultFn = this.state.defaultFn;
+    if (this.state.onUpdateFn !== void 0) column.onUpdateFn = this.state.onUpdateFn;
     if (this.state.description !== void 0) column.description = this.state.description;
     if (this.state.renamedFrom !== void 0) column.renamedFrom = this.state.renamedFrom;
     if (this.state.cast !== void 0) column.cast = this.state.cast;
+    if (this.state.cell !== void 0) column.cell = { ...this.state.cell };
     return column;
   }
 };
@@ -135,9 +153,25 @@ var t = {
 // src/constants.ts
 var NAMESPACE_PATTERN = /^[a-z][a-z0-9_]{0,40}$/;
 var IDENTIFIER_PATTERN = /^[a-z][a-z0-9_]*$/;
+var COLUMN_IDENTIFIER_PATTERN = /^_?[a-z][a-z0-9_]*$/;
 var MAX_IDENTIFIER_LENGTH = 63;
 var SYNCED_SOURCE_PATTERN = /^gold\.[a-z][a-z0-9_]*$/;
 var HASH_DOMAIN = "sequence-orm-definitions\0";
+var CELL_PARTS = ["at", "by", "rev", "source", "conflicts"];
+var CELL_PART_SUFFIX = {
+  at: "__at",
+  by: "__by",
+  rev: "__rev",
+  source: "__src",
+  conflicts: "__lost"
+};
+var MAX_TRACKED_COLUMN_NAME = MAX_IDENTIFIER_LENGTH - 6;
+var CELLS_FIELD = "cells";
+function cellColumnName(column, part) {
+  return `${column}${CELL_PART_SUFFIX[part]}`;
+}
+var MATERIALIZE_ACTOR = "orm:materialize";
+JSON.stringify({ sub: MATERIALIZE_ACTOR, org: null, roles: [], capabilities: [] });
 
 // src/errors.ts
 var OrmDefinitionError = class extends Error {
@@ -206,6 +240,8 @@ function toOne(target, options) {
     on: options.on,
     references: options.references,
     enforce: options.enforce ?? false,
+    onDelete: options.onDelete,
+    onUpdate: options.onUpdate,
     description: options.description
   };
 }
@@ -217,6 +253,8 @@ function toMany(target, options) {
     on: options.on,
     references: options.references,
     enforce: false,
+    onDelete: void 0,
+    onUpdate: void 0,
     description: options.description
   };
 }
@@ -228,6 +266,8 @@ function toPlatformUser(options) {
     on: options.on,
     references: options.references,
     enforce: false,
+    onDelete: void 0,
+    onUpdate: void 0,
     description: options.description
   };
 }
@@ -237,10 +277,10 @@ function isSeqLink(value) {
 function isSeqTable(value) {
   return typeof value === "object" && value !== null && value.kind === TABLE_BRAND;
 }
-function assertIdentifier({ value, what, file }) {
-  if (!IDENTIFIER_PATTERN.test(value) || value.length > MAX_IDENTIFIER_LENGTH) {
+function assertIdentifier({ value, what, file, pattern = IDENTIFIER_PATTERN }) {
+  if (!pattern.test(value) || value.length > MAX_IDENTIFIER_LENGTH) {
     throw new OrmDefinitionError(
-      `${what} "${value}" must match ${IDENTIFIER_PATTERN} and be at most ${MAX_IDENTIFIER_LENGTH} characters`,
+      `${what} "${value}" must match ${pattern} and be at most ${MAX_IDENTIFIER_LENGTH} characters`,
       file
     );
   }
@@ -261,7 +301,13 @@ function defineTable(name, columns, config = {}) {
       );
     }
     const columnName = builder.columnNameFor(propertyName);
-    assertIdentifier({ value: columnName, what: `table "${name}": column "${propertyName}" column name`, file });
+    assertIdentifier({ value: columnName, what: `table "${name}": column "${propertyName}" column name`, file, pattern: COLUMN_IDENTIFIER_PATTERN });
+    if (config.materializes === void 0 && (propertyName === CELLS_FIELD || Object.values(CELL_PART_SUFFIX).some((suffix) => columnName.endsWith(suffix) || propertyName.endsWith(suffix)))) {
+      throw new OrmDefinitionError(
+        `table "${name}": "${propertyName}" collides with the reserved cell-metadata names ('${CELLS_FIELD}', or a ${Object.values(CELL_PART_SUFFIX).join("/")} suffix)`,
+        file
+      );
+    }
     const existing = seenColumnNames.get(columnName);
     if (existing !== void 0) {
       throw new OrmDefinitionError(
@@ -301,7 +347,8 @@ function defineSyncedTable(name, columnsOrConfig, maybeConfig) {
     assertIdentifier({
       value: columnName,
       what: `synced table "${name}": column "${propertyName}" column name`,
-      file
+      file,
+      pattern: COLUMN_IDENTIFIER_PATTERN
     });
     const existing = seenColumnNames.get(columnName);
     if (existing !== void 0) {
@@ -390,7 +437,7 @@ function defineView(name, columns, config) {
       );
     }
     const columnName = builder.columnNameFor(propertyName);
-    if (!IDENTIFIER_PATTERN.test(columnName) || columnName.length > MAX_IDENTIFIER_LENGTH) {
+    if (!COLUMN_IDENTIFIER_PATTERN.test(columnName) || columnName.length > MAX_IDENTIFIER_LENGTH) {
       throw new OrmDefinitionError(`view "${name}": column "${propertyName}" has invalid column name "${columnName}"`, file);
     }
     const existing = seenColumnNames.get(columnName);
@@ -508,11 +555,11 @@ function compileViewQueries(input) {
       );
     }
     if (!config.query) throw new OrmDefinitionError(`view "${authored.viewName}" produced no query`, authored.file);
-    const tableDependencies = extractUsedTable(config.query).map((physical) => {
-      const logical = physicalToLogical.get(physical);
+    const tableDependencies = extractUsedTable(config.query).map((physical2) => {
+      const logical = physicalToLogical.get(physical2);
       if (!logical) {
         throw new OrmDefinitionError(
-          `view "${authored.viewName}" query references unmanaged relation "${physical}" \u2014 use relation(...) with a namespace table or view`,
+          `view "${authored.viewName}" query references unmanaged relation "${physical2}" \u2014 use relation(...) with a namespace table or view`,
           authored.file
         );
       }
@@ -836,9 +883,469 @@ function scalarColumnType(table, property, helper) {
   }
   return type;
 }
+var quoteIdentifier = (name) => `"${name.replaceAll('"', '""')}"`;
+var quoteLiteral = (value) => `'${value.replaceAll("'", "''")}'`;
+
+// src/checks/compile.ts
+function tokenize(source) {
+  const tokens = [];
+  for (let position = 0; position < source.length; ) {
+    const char = source[position];
+    if (/\s/.test(char)) {
+      position++;
+      continue;
+    }
+    if (char === "(" || char === ")" || char === ",") {
+      tokens.push({ kind: char === "(" ? "lparen" : char === ")" ? "rparen" : "comma", value: char, position });
+      position++;
+      continue;
+    }
+    if (char === "'") {
+      const start = position++;
+      let value = "";
+      let closed = false;
+      while (position < source.length) {
+        if (source[position] !== "'") {
+          value += source[position++];
+          continue;
+        }
+        if (source[position + 1] === "'") {
+          value += "'";
+          position += 2;
+          continue;
+        }
+        position++;
+        closed = true;
+        break;
+      }
+      if (!closed) throw new Error(`unterminated string at position ${start}`);
+      if (/[\x00-\x1f\x7f]/.test(value)) throw new Error(`control character in string at position ${start}`);
+      tokens.push({ kind: "string", value, position: start });
+      continue;
+    }
+    const operator = /^(<=|>=|<>|!=|!~|=|<|>|~)/.exec(source.slice(position));
+    if (operator) {
+      tokens.push({ kind: "operator", value: operator[0] === "<>" ? "!=" : operator[0], position });
+      position += operator[0].length;
+      continue;
+    }
+    const number = /^-?\d+(?:\.\d+)?/.exec(source.slice(position));
+    if (number) {
+      tokens.push({ kind: "number", value: number[0], position });
+      position += number[0].length;
+      continue;
+    }
+    const identifier3 = /^[a-zA-Z_][a-zA-Z_0-9]*/.exec(source.slice(position));
+    if (identifier3) {
+      tokens.push({ kind: "identifier", value: identifier3[0], position });
+      position += identifier3[0].length;
+      continue;
+    }
+    throw new Error(`unexpected character '${char}' at position ${position}`);
+  }
+  tokens.push({ kind: "end", value: "", position: source.length });
+  if (tokens.length > 256) throw new Error("check expression exceeds 256 tokens");
+  return tokens;
+}
+var Parser = class {
+  constructor(tokens, columns) {
+    this.tokens = tokens;
+    this.columns = /* @__PURE__ */ new Map();
+    for (const column of columns) {
+      for (const alias of [column.name, column.columnName]) {
+        const previous = this.columns.get(alias);
+        if (previous && previous.columnName !== column.columnName) {
+          throw new Error(`ambiguous check column '${alias}'`);
+        }
+        this.columns.set(alias, column);
+      }
+    }
+  }
+  index = 0;
+  depth = 0;
+  columns;
+  parse() {
+    const expression = this.parseOr();
+    this.expect("end", "end of expression");
+    return expression;
+  }
+  parseOr() {
+    let left = this.parseAnd();
+    while (this.matchKeyword("or")) left = `(${left} OR ${this.parseAnd()})`;
+    return left;
+  }
+  parseAnd() {
+    let left = this.parseNot();
+    while (this.matchKeyword("and")) left = `(${left} AND ${this.parseNot()})`;
+    return left;
+  }
+  parseNot() {
+    if (this.matchKeyword("not")) return `(NOT ${this.parseNot()})`;
+    return this.parsePrimary();
+  }
+  parsePrimary() {
+    if (this.peek().kind === "lparen") {
+      if (++this.depth > 32) throw new Error("check expression nesting exceeds 32 levels");
+      this.advance();
+      const expression = this.parseOr();
+      this.expect("rparen", "')'");
+      this.depth--;
+      return `(${expression})`;
+    }
+    return this.parseComparison();
+  }
+  parseComparison() {
+    const left = this.parseValue();
+    if (this.matchKeyword("is")) {
+      const negate = this.matchKeyword("not");
+      this.expectKeyword("null");
+      return `${left.sql} IS ${negate ? "NOT " : ""}NULL`;
+    }
+    if (this.matchKeyword("between")) {
+      const lower = this.parseValue();
+      this.expectKeyword("and");
+      const upper = this.parseValue();
+      return `${left.sql} BETWEEN ${lower.sql} AND ${upper.sql}`;
+    }
+    if (this.matchKeyword("in")) {
+      this.expect("lparen", "'(' after IN");
+      const values = [this.parseValue()];
+      while (this.peek().kind === "comma") {
+        this.advance();
+        values.push(this.parseValue());
+      }
+      this.expect("rparen", "')' after IN values");
+      if (values.some((value) => !value.literal)) throw new Error("IN values must be literals");
+      return `${left.sql} IN (${values.map((value) => value.sql).join(", ")})`;
+    }
+    const operator = this.expect("operator", "a comparison operator");
+    const right = this.parseValue();
+    if (operator.value === "~" || operator.value === "!~") {
+      if (left.column && left.column.type !== "text") throw new Error("regex checks require a text column");
+      if (!right.literal) throw new Error("regex pattern must be a literal");
+    }
+    return `${left.sql} ${operator.value} ${right.sql}`;
+  }
+  parseValue() {
+    const token = this.advance();
+    if (token.kind === "string") return { sql: quoteLiteral(token.value), literal: true };
+    if (token.kind === "number") {
+      const number = Number(token.value);
+      if (!Number.isFinite(number) || Number.isInteger(number) && !Number.isSafeInteger(number)) {
+        throw new Error(`unsafe numeric literal at position ${token.position}`);
+      }
+      return { sql: token.value, literal: true };
+    }
+    if (token.kind !== "identifier") throw new Error(`expected a column or literal at position ${token.position}`);
+    const keyword = token.value.toLowerCase();
+    if (keyword === "true" || keyword === "false" || keyword === "null") return { sql: keyword.toUpperCase(), literal: true };
+    if (keyword === "btrim") {
+      this.expect("lparen", "'(' after btrim");
+      const column2 = this.parseColumn();
+      this.expect("rparen", "')' after btrim column");
+      if (column2.type !== "text") throw new Error("btrim requires a text column");
+      return { sql: `btrim(${quoteIdentifier(column2.columnName)})`, column: column2 };
+    }
+    const column = this.columns.get(token.value);
+    if (!column) throw new Error(`unknown check column '${token.value}'`);
+    return { sql: quoteIdentifier(column.columnName), column };
+  }
+  parseColumn() {
+    const token = this.expect("identifier", "a column name");
+    const column = this.columns.get(token.value);
+    if (!column) throw new Error(`unknown check column '${token.value}'`);
+    return column;
+  }
+  peek() {
+    return this.tokens[this.index];
+  }
+  advance() {
+    const token = this.peek();
+    if (token.kind !== "end") this.index++;
+    return token;
+  }
+  matchKeyword(keyword) {
+    if (this.peek().kind !== "identifier" || this.peek().value.toLowerCase() !== keyword) return false;
+    this.advance();
+    return true;
+  }
+  expectKeyword(keyword) {
+    if (!this.matchKeyword(keyword)) throw new Error(`expected '${keyword}' at position ${this.peek().position}`);
+  }
+  expect(kind, description) {
+    const token = this.peek();
+    if (token.kind !== kind) throw new Error(`expected ${description} at position ${token.position}`);
+    return this.advance();
+  }
+};
+function compileCheckExpression(source, columns) {
+  return new Parser(tokenize(source), columns).parse();
+}
+var policyVariantSchema = z.object({
+  /** Claims-only guard (capability()/role()/claim() comparisons — no columns). */
+  when: z.string().min(1).max(1e3),
+  /** Exactly one of: allow-all bypass, or a row predicate. */
+  allow: z.literal(true).optional(),
+  policy: z.string().min(1).max(2e3).optional()
+}).refine((v) => v.allow === true !== (typeof v.policy === "string"), {
+  message: "A variant declares exactly one of allow: true or policy"
+});
+var policyExpressionSchema = z.union([
+  z.string().min(1).max(2e3),
+  z.object({
+    default: z.string().min(1).max(2e3),
+    variants: z.array(policyVariantSchema).max(10).default([])
+  })
+]);
+function parseDurationMs(input) {
+  if (typeof input === "number") return Number.isInteger(input) && input > 0 ? input : void 0;
+  const match = /^(\d+(?:\.\d+)?)(ms|s|m)$/.exec(input);
+  if (!match) return void 0;
+  const factor = match[2] === "ms" ? 1 : match[2] === "s" ? 1e3 : 6e4;
+  const value = Math.round(Number(match[1]) * factor);
+  return value > 0 ? value : void 0;
+}
+var identifier = z.string().min(1).max(63).regex(/^[a-z][a-z0-9_]*$/);
+var durationMs = z.number().int().positive().max(24 * 60 * 60 * 1e3);
+var RESOLVED_VIEW_SYSTEM_COLUMNS = {
+  writebackStatus: { name: "writebackStatus", columnName: "_writeback_status", type: "text" },
+  writebackError: { name: "writebackError", columnName: "_writeback_error", type: "text" }
+};
+var RESOLVED_SOURCE_SYSTEM_COLUMNS = {
+  tombstoned: { name: "sysTombstoned", columnName: "_tombstoned" },
+  fetchedAt: { name: "sysFetchedAt", columnName: "_fetched_at" },
+  writebackStatus: { name: "sysWritebackStatus", columnName: "_writeback_status" },
+  writebackError: { name: "sysWritebackError", columnName: "_writeback_error" },
+  writebackAt: { name: "sysWritebackAt", columnName: "_writeback_at" }
+};
+var RESOLVED_VIEW_CELL_PARTS = ["source", "at", "by", "conflicts"];
+var RESERVED_RESOLVED_COLUMN_NAMES = /* @__PURE__ */ new Set([
+  ...Object.values(RESOLVED_VIEW_SYSTEM_COLUMNS).flatMap((c) => [c.name, c.columnName]),
+  ...Object.values(RESOLVED_SOURCE_SYSTEM_COLUMNS).flatMap((c) => [c.name, c.columnName])
+]);
+var COMPARATORS = ["latest", "highest", "lowest", "priority", "nonNullFirst", "custom"];
+var canonicalFunctionRefSchema = z.object({
+  /** `managed` = a Managed Function id/slug; `native` = an in-process Atlas function (reserved). */
+  kind: z.enum(["managed", "native"]),
+  id: z.string().min(1).max(200)
+}).strict();
+var canonicalFetchShapeSchema = z.union([
+  z.object({ shape: z.literal("single") }).strict(),
+  z.object({ shape: z.literal("batch"), maxKeys: z.number().int().min(2).max(500) }).strict()
+]);
+var canonicalResolvedSourceSchema = z.object({
+  name: identifier,
+  kind: z.enum(["manual", "etl", "prefetch"]),
+  /** Backing relation in this namespace: an internal table (manual/prefetch) or a synced table (etl). */
+  table: identifier,
+  /** Resolved columns (logical names) this source supplies — the primary key is implicit. */
+  columns: z.array(z.string().min(1).max(63)).min(1).max(500),
+  /** etl: logical timestamptz/date column on the synced table used as every cell's updated_at. */
+  updatedAt: z.string().min(1).max(63).optional(),
+  /** prefetch: resolved column holding the source system's key (may be the primary key). */
+  key: z.string().min(1).max(63).optional(),
+  fetch: canonicalFetchShapeSchema.optional(),
+  function: canonicalFunctionRefSchema.optional(),
+  prefetchDefaults: z.object({
+    maxStalenessMs: durationMs,
+    timeoutMs: durationMs,
+    onError: z.enum(["fallback", "fail"])
+  }).strict().optional(),
+  writeback: z.object({
+    columns: z.array(z.string().min(1).max(63)).min(1).max(500),
+    defaultMode: z.enum(["sync", "async"]),
+    timeoutMs: durationMs,
+    /** Remove confirmed cells from the manual source so a stale edit cannot shadow the source. */
+    clearManualOnConfirm: z.boolean()
+  }).strict().optional()
+}).strict();
+var canonicalResolveRuleSchema = z.object({
+  column: z.string().min(1).max(63),
+  comparator: z.enum(COMPARATORS),
+  /** Source names, in tie-break order. */
+  candidates: z.array(identifier).min(1).max(16),
+  /** custom only: SQL ORDER BY key over value / updated_at / source / actor / ord. */
+  orderBy: z.string().min(1).max(2e3).optional()
+}).strict();
+var canonicalResolvedSchema = z.object({
+  sources: z.array(canonicalResolvedSourceSchema).min(1).max(16),
+  /** One rule per resolved (non-pk) column; documents the generated view for tooling. */
+  resolve: z.array(canonicalResolveRuleSchema).max(500),
+  /** Sources whose tombstone hides the resolved row (v1: the manual source only). */
+  deletedBy: z.array(identifier).max(1).default([]),
+  /**
+   * Materialized: the view reads an indexed internal table (`table`) that the
+   * data plane keeps in step with `compute`, the internal view holding the
+   * resolution query. Omitted when the view computes on read.
+   */
+  materialized: z.object({ table: identifier, compute: identifier }).strict().optional(),
+  /** Write policies evaluated against the RESOLVED row (reads use the view's read policy). */
+  policies: z.object({
+    write: policyExpressionSchema.optional(),
+    insert: policyExpressionSchema.optional(),
+    update: policyExpressionSchema.optional()
+  }).strict().default({})
+}).strict();
+function validateResolvedView({ view, tables, views = [] }) {
+  const resolved = view.resolved;
+  if (!resolved) return [];
+  const errors = [];
+  const fail = (message) => errors.push(`resolved table '${view.view}': ${message}`);
+  const pkColumn = view.primaryKey?.length === 1 ? view.columns.find((c) => c.columnName === view.primaryKey?.[0]) : void 0;
+  if (!pkColumn) {
+    fail("requires exactly one primary-key column");
+    return errors;
+  }
+  const systemNames = new Set(Object.values(RESOLVED_VIEW_SYSTEM_COLUMNS).map((c) => c.name));
+  const scope = {
+    view,
+    resolved,
+    pkColumn,
+    dataColumns: new Map(view.columns.filter((c) => !systemNames.has(c.name) && c.cell === void 0).map((c) => [c.name, c])),
+    sourceByName: /* @__PURE__ */ new Map(),
+    fail
+  };
+  if (resolved.sources.filter((source) => source.kind === "manual").length !== 1) fail("requires exactly one manual source");
+  const tableByName = new Map(tables.map((table) => [table.table, table]));
+  for (const source of resolved.sources) {
+    if (scope.sourceByName.has(source.name)) fail(`duplicate source '${source.name}'`);
+    scope.sourceByName.set(source.name, source);
+    const table = tableByName.get(source.table);
+    if (!table) fail(`source '${source.name}' references unknown table '${source.table}'`);
+    else validateSource({ scope, source, table });
+  }
+  validateRules(scope);
+  validateViewCells(scope);
+  if (resolved.materialized) validateMaterialized({ scope, tableByName, views });
+  for (const name of resolved.deletedBy) {
+    if (scope.sourceByName.get(name)?.kind !== "manual") fail(`deletedBy '${name}' must be the manual source`);
+  }
+  return errors;
+}
+function validateSource({ scope, source, table }) {
+  const { fail } = scope;
+  if (source.kind === "etl" && table.source === void 0) fail(`etl source '${source.name}' must reference a synced table`);
+  if (source.kind !== "etl" && (table.internal !== true || table.cellMetadata !== true)) {
+    fail(`${source.kind} source '${source.name}' must reference an internal table with cell metadata`);
+  }
+  const hasRev = table.columns.some((column) => column.cell?.part === "rev");
+  if (source.kind === "manual" && !hasRev) fail(`manual source '${source.name}' must carry '__rev' cell columns`);
+  if (source.kind === "prefetch" && hasRev) fail(`prefetch source '${source.name}' must not carry '__rev' cell columns`);
+  const byName = new Map(table.columns.map((c) => [c.name, c]));
+  validateSourceColumns({ scope, source, byName });
+  if (source.kind === "etl") {
+    const updatedAt = source.updatedAt === void 0 ? void 0 : byName.get(source.updatedAt);
+    if (source.updatedAt !== void 0 && updatedAt?.type !== "timestamptz" && updatedAt?.type !== "date") {
+      fail(`etl source '${source.name}' updatedAt must name a timestamptz/date column on '${source.table}'`);
+    }
+  }
+  validatePrefetchFields({ scope, source });
+}
+function validatePrefetchFields({ scope, source }) {
+  const { fail, pkColumn } = scope;
+  if (source.kind !== "prefetch") {
+    if (source.key || source.fetch || source.function || source.prefetchDefaults || source.writeback) {
+      fail(`only prefetch sources may declare key/fetch/function/prefetchDefaults/writeback ('${source.name}')`);
+    }
+    return;
+  }
+  if (!source.key || !source.fetch || !source.function || !source.prefetchDefaults) {
+    fail(`prefetch source '${source.name}' requires key, fetch, function and prefetchDefaults`);
+  } else if (source.key !== pkColumn.name && !source.columns.includes(source.key)) {
+    fail(`prefetch source '${source.name}' key '${source.key}' must be the primary key or one of its columns`);
+  }
+  for (const column of source.writeback?.columns ?? []) {
+    if (!source.columns.includes(column)) fail(`prefetch source '${source.name}' writes back '${column}', which it does not supply`);
+  }
+}
+function validateSourceColumns({ scope, source, byName }) {
+  const { fail, pkColumn, dataColumns } = scope;
+  for (const column of [pkColumn.name, ...source.columns]) {
+    const own = column === pkColumn.name ? pkColumn : dataColumns.get(column);
+    const theirs = byName.get(column);
+    if (!own) fail(`source '${source.name}' supplies unknown column '${column}'`);
+    else if (!theirs) fail(`source '${source.name}' table '${source.table}' has no column '${column}'`);
+    else if (JSON.stringify(theirs.type) !== JSON.stringify(own.type)) fail(`column '${column}' has a different type on source '${source.name}'`);
+  }
+}
+function validateRules({ resolved, pkColumn, dataColumns, sourceByName, fail }) {
+  const ruled = /* @__PURE__ */ new Set();
+  for (const rule of resolved.resolve) {
+    if (!dataColumns.has(rule.column) || rule.column === pkColumn.name) {
+      fail(`resolve rule targets unknown column '${rule.column}'`);
+      continue;
+    }
+    if (ruled.has(rule.column)) fail(`column '${rule.column}' has more than one resolve rule`);
+    ruled.add(rule.column);
+    if (rule.comparator === "custom" !== (rule.orderBy !== void 0)) {
+      fail(`column '${rule.column}': orderBy is required for custom comparators and only allowed there`);
+    }
+    if (new Set(rule.candidates).size !== rule.candidates.length) fail(`column '${rule.column}' repeats a candidate`);
+    for (const candidate of rule.candidates) {
+      const source = sourceByName.get(candidate);
+      if (!source) fail(`column '${rule.column}' names unknown candidate source '${candidate}'`);
+      else if (!source.columns.includes(rule.column)) fail(`column '${rule.column}' candidate '${candidate}' does not supply it`);
+    }
+  }
+  for (const column of dataColumns.keys()) {
+    if (column !== pkColumn.name && !ruled.has(column)) fail(`column '${column}' has no resolve rule`);
+  }
+}
+var VIEW_CELL_TYPES = {
+  source: "text",
+  at: "timestamptz",
+  by: "text",
+  conflicts: "jsonb"
+};
+function validateViewCells({ view, dataColumns, pkColumn, fail }) {
+  const expected = /* @__PURE__ */ new Map();
+  for (const column of dataColumns.values()) {
+    if (column.name === pkColumn.name) continue;
+    for (const part of RESOLVED_VIEW_CELL_PARTS) {
+      expected.set(cellColumnName(column.name, part), { part, columnName: cellColumnName(column.columnName, part) });
+    }
+  }
+  for (const column of view.columns) {
+    if (!column.cell) continue;
+    const want = expected.get(column.name);
+    if (!want || want.part !== column.cell.part || want.columnName !== column.columnName || cellColumnName(column.cell.of, column.cell.part) !== column.name) {
+      fail(`unexpected cell column '${column.name}'`);
+      continue;
+    }
+    if (column.type !== VIEW_CELL_TYPES[column.cell.part]) fail(`cell column '${column.name}' must be ${VIEW_CELL_TYPES[column.cell.part]}`);
+    expected.delete(column.name);
+  }
+  for (const name of expected.keys()) fail(`missing cell column '${name}'`);
+}
+var columnSignature = (columns) => JSON.stringify(columns.map((column) => [column.name, column.columnName, column.type]));
+function validateMaterialized({ scope, tableByName, views }) {
+  const { view, resolved, fail } = scope;
+  const { table: tableName, compute: computeName } = resolved.materialized;
+  const table = tableByName.get(tableName);
+  if (!table || table.internal !== true || table.materializes !== view.view) {
+    fail(`materialized table '${tableName}' must be an internal table that materializes '${view.view}'`);
+  } else {
+    if (columnSignature(table.columns) !== columnSignature(view.columns)) fail(`materialized table '${tableName}' must have exactly the view's columns`);
+    if (JSON.stringify(table.primaryKey ?? []) !== JSON.stringify(view.primaryKey ?? [])) fail(`materialized table '${tableName}' must share the view's primary key`);
+  }
+  const compute = views.find((candidate) => candidate.view === computeName);
+  if (!compute || compute.internal !== true) fail(`compute view '${computeName}' must be an internal view`);
+  else if (columnSignature(compute.columns) !== columnSignature(view.columns)) fail(`compute view '${computeName}' must have exactly the view's columns`);
+  for (const source of resolved.sources) {
+    if (source.kind !== "etl") continue;
+    const read = tableByName.get(source.table)?.policies?.read;
+    const unconditional = typeof read === "string" ? read.trim() === "true" : read !== void 0 && read.default.trim() === "true" && read.variants.length === 0;
+    if (!unconditional) {
+      fail(`etl source '${source.name}' must have read policy 'true' to be materialized (the copy is shared by every caller)`);
+    }
+  }
+}
+
+// src/canonical/v2.ts
 var CANONICAL_FORMAT = 2;
 var IDENTIFIER_RE = /^[a-z][a-z0-9_]*$/;
-var identifier = z.string().min(1).max(63).regex(IDENTIFIER_RE);
+var identifier2 = z.string().min(1).max(63).regex(IDENTIFIER_RE);
+var columnIdentifier = z.string().min(1).max(63).regex(COLUMN_IDENTIFIER_PATTERN);
 var COLUMN_TYPES = [
   "uuid",
   "text",
@@ -853,59 +1360,71 @@ var COLUMN_TYPES = [
 ];
 var columnTypeSchema = z.enum(COLUMN_TYPES);
 var canonicalEnumSchema = z.object({
-  name: identifier,
+  name: identifier2,
   values: z.array(z.string().min(1).max(63)).min(1).max(100)
 });
 var canonicalColumnSchema = z.object({
   /** Property name in TS (camelCase); columnName is the Postgres name. */
   name: z.string().min(1).max(63),
-  columnName: identifier,
-  type: z.union([columnTypeSchema, z.object({ enum: identifier })]),
+  columnName: columnIdentifier,
+  type: z.union([columnTypeSchema, z.object({ enum: identifier2 })]),
   nullable: z.boolean().default(true),
   unique: z.boolean().default(false),
   /** Literal default, or one of the allowlisted SQL functions. */
   default: z.union([z.string(), z.number(), z.boolean(), z.null()]).optional(),
   defaultFn: z.enum(["gen_random_uuid()", "now()"]).optional(),
+  /**
+   * Stamp this column from the database clock on UPDATE (`now()`). The
+   * column stays insertable (defaults fill gaps) but is omitted from
+   * SetInput / settable so callers cannot backdate it.
+   */
+  onUpdateFn: z.enum(["now()"]).optional(),
   description: z.string().max(500).optional(),
   /** Migration hints — same semantics as v1. */
-  renamedFrom: identifier.optional(),
+  renamedFrom: columnIdentifier.optional(),
   cast: z.string().max(200).optional(),
-  deprecated: z.boolean().default(false)
+  deprecated: z.boolean().default(false),
+  /**
+   * Marks a system cell-metadata column (see CELL_PARTS in constants): part
+   * `part` of the cell of logical column `of`. Synthesized by authoring,
+   * never client-writable, absent from GraphQL scalar fields. Omitted on
+   * ordinary columns so their hashes are unchanged.
+   */
+  cell: z.object({ of: z.string().min(1).max(63), part: z.enum(CELL_PARTS) }).strict().optional()
+}).superRefine((column, ctx) => {
+  if (column.onUpdateFn === void 0) return;
+  if (typeof column.type !== "string" || column.type !== "timestamptz" && column.type !== "date") {
+    ctx.addIssue({
+      code: "custom",
+      path: ["onUpdateFn"],
+      message: `onUpdateFn '${column.onUpdateFn}' is only valid on timestamptz/date columns`
+    });
+  }
 });
 var canonicalLinkSchema = z.object({
   name: z.string().min(1).max(63),
   kind: z.enum(["toOne", "toMany", "toPlatformUser"]),
   /** Target table name (namespace-local). Absent for toPlatformUser. */
-  target: identifier.optional(),
+  target: identifier2.optional(),
   /** FK column on the owning side (toOne/toPlatformUser: on this table; toMany: on the target). */
-  on: identifier,
+  on: columnIdentifier,
   /** Referenced column on the target (default: target's PK / platform user `sub`). */
-  references: identifier.optional(),
+  references: columnIdentifier.optional(),
   /** enforce: true emits a real FK constraint (same-namespace toOne only). */
   enforce: z.boolean().default(false),
+  onDelete: z.enum(["cascade", "restrict", "no action", "set null", "set default"]).optional(),
+  onUpdate: z.enum(["cascade", "restrict", "no action", "set null", "set default"]).optional(),
   description: z.string().max(500).optional()
 });
 var canonicalIndexSchema = z.object({
-  columns: z.array(identifier).min(1),
+  columns: z.array(columnIdentifier).min(1),
   unique: z.boolean().default(false),
-  name: identifier.optional()
+  name: identifier2.optional()
 });
-var policyVariantSchema = z.object({
-  /** Claims-only guard (capability()/role()/claim() comparisons — no columns). */
-  when: z.string().min(1).max(1e3),
-  /** Exactly one of: allow-all bypass, or a row predicate. */
-  allow: z.literal(true).optional(),
-  policy: z.string().min(1).max(2e3).optional()
-}).refine((v) => v.allow === true !== (typeof v.policy === "string"), {
-  message: "A variant declares exactly one of allow: true or policy"
-});
-var policyExpressionSchema = z.union([
-  z.string().min(1).max(2e3),
-  z.object({
-    default: z.string().min(1).max(2e3),
-    variants: z.array(policyVariantSchema).max(10).default([])
-  })
-]);
+var canonicalCheckSchema = z.object({
+  name: identifier2,
+  expression: z.string().min(1).max(2e3)
+}).strict();
 var canonicalPoliciesSchema = z.object({
   read: policyExpressionSchema.optional(),
   write: policyExpressionSchema.optional(),
@@ -935,8 +1454,165 @@ function isSingleViewQuerySql(value) {
   }
   return state === "normal" && !/\$[a-z_0-9]*\$/i.test(query);
 }
+var VIEW_QUERY_FUNCTION_ALLOWLIST = [
+  "abs",
+  "age",
+  "array_agg",
+  "array_append",
+  "array_cat",
+  "array_dims",
+  "array_length",
+  "array_lower",
+  "array_ndims",
+  "array_position",
+  "array_positions",
+  "array_prepend",
+  "array_remove",
+  "array_replace",
+  "array_to_string",
+  "array_trim",
+  "array_upper",
+  "ascii",
+  "avg",
+  "bit_and",
+  "bit_or",
+  "bit_xor",
+  "bool_and",
+  "bool_or",
+  "btrim",
+  "cardinality",
+  "cbrt",
+  "ceil",
+  "ceiling",
+  "char_length",
+  "character_length",
+  "chr",
+  "concat",
+  "concat_ws",
+  "count",
+  "cume_dist",
+  "date_bin",
+  "date_part",
+  "date_trunc",
+  "decode",
+  "degrees",
+  "dense_rank",
+  "encode",
+  "enum_first",
+  "enum_last",
+  "enum_range",
+  "every",
+  "exp",
+  "first_value",
+  "floor",
+  "format",
+  "grouping",
+  "initcap",
+  "json_agg",
+  "json_array_length",
+  "json_build_array",
+  "json_build_object",
+  "json_extract_path",
+  "json_extract_path_text",
+  "json_object_agg",
+  "json_object_keys",
+  "json_strip_nulls",
+  "json_typeof",
+  "jsonb_agg",
+  "jsonb_array_length",
+  "jsonb_build_array",
+  "jsonb_build_object",
+  "jsonb_extract_path",
+  "jsonb_extract_path_text",
+  "jsonb_insert",
+  "jsonb_object_agg",
+  "jsonb_object_keys",
+  "jsonb_path_exists",
+  "jsonb_path_match",
+  "jsonb_path_query",
+  "jsonb_path_query_array",
+  "jsonb_path_query_first",
+  "jsonb_pretty",
+  "jsonb_set",
+  "jsonb_set_lax",
+  "jsonb_strip_nulls",
+  "jsonb_typeof",
+  "justify_days",
+  "justify_hours",
+  "justify_interval",
+  "lag",
+  "last_value",
+  "lead",
+  "left",
+  "length",
+  "ln",
+  "log",
+  "lower",
+  "lpad",
+  "ltrim",
+  "make_date",
+  "make_interval",
+  "make_time",
+  "make_timestamp",
+  "make_timestamptz",
+  "max",
+  "md5",
+  "min",
+  "mod",
+  "nth_value",
+  "ntile",
+  "octet_length",
+  "percent_rank",
+  "pi",
+  "power",
+  "quote_ident",
+  "quote_literal",
+  "quote_nullable",
+  "radians",
+  "rank",
+  "regexp_count",
+  "regexp_instr",
+  "regexp_like",
+  "regexp_match",
+  "regexp_matches",
+  "regexp_replace",
+  "regexp_split_to_array",
+  "regexp_split_to_table",
+  "repeat",
+  "replace",
+  "reverse",
+  "right",
+  "round",
+  "row_number",
+  "rpad",
+  "rtrim",
+  "sign",
+  "split_part",
+  "sqrt",
+  "starts_with",
+  "string_agg",
+  "string_to_array",
+  "strpos",
+  "substr",
+  "substring",
+  "sum",
+  "timezone",
+  "to_ascii",
+  "to_char",
+  "to_date",
+  "to_hex",
+  "to_json",
+  "to_jsonb",
+  "to_number",
+  "to_timestamp",
+  "translate",
+  "trunc",
+  "unnest",
+  "upper",
+  "width_bucket"
+];
 var canonicalActionSchema = z.object({
-  name: identifier,
+  name: identifier2,
   requires: z.string().max(1e3).optional(),
   params: z.record(z.string(), z.object({
     type: columnTypeSchema,
@@ -948,9 +1624,9 @@ var canonicalActionSchema = z.object({
 });
 var canonicalCowMutationSchema = z.object({
   kind: z.enum(["override", "revert"]),
-  name: identifier,
+  name: identifier2,
   /** Synced table (same namespace) the overlay copies from / falls back to. */
-  synced: identifier,
+  synced: identifier2,
   /** Single-column primary key PROPERTY (TS camelCase, like column `name`) shared by overlay and synced. */
   pk: z.string().min(1).max(63),
   /** Override: contract properties copied INSERT…SELECT from synced (pk included). Empty for revert. */
@@ -977,17 +1653,28 @@ var canonicalCowMutationSchema = z.object({
     }
   }
 });
+var canonicalForeignKeySchema = z.object({
+  name: identifier2,
+  columns: z.array(columnIdentifier).min(1).max(8),
+  target: identifier2,
+  references: z.array(columnIdentifier).min(1).max(8),
+  deferrable: z.enum(["initially-immediate", "initially-deferred"]).optional(),
+  onDelete: z.enum(["cascade", "restrict", "no action", "set null", "set default"]).optional(),
+  onUpdate: z.enum(["cascade", "restrict", "no action", "set null", "set default"]).optional()
+}).strict();
 var canonicalTableSchema = z.object({
-  table: identifier,
+  table: identifier2,
   description: z.string().max(2e3).optional(),
   /** Table-level rename hint (new in v2). */
-  renamedFrom: identifier.optional(),
+  renamedFrom: identifier2.optional(),
   /** Synced/reflected read-only tables (`source: gold.*`) — v1 semantics. */
   source: z.string().regex(/^gold\.[a-z][a-z0-9_]*$/).optional(),
   columns: z.array(canonicalColumnSchema).default([]),
-  primaryKey: z.array(identifier).min(1).max(8).optional(),
+  primaryKey: z.array(columnIdentifier).min(1).max(8).optional(),
   links: z.array(canonicalLinkSchema).default([]),
   indexes: z.array(canonicalIndexSchema).default([]),
+  /** Omitted by old definitions, preserving their existing content hashes. */
+  checks: z.array(canonicalCheckSchema).max(100).optional(),
   policies: canonicalPoliciesSchema.default({}),
   /**
    * v1-conversion carry-over only. v2 has no action surface — the runtime
@@ -996,26 +1683,64 @@ var canonicalTableSchema = z.object({
    */
   actions: z.array(canonicalActionSchema).default([]),
   /** Optional (not defaulted) so pre-CoW canonical documents keep byte-identical hashes. */
-  cowMutations: z.array(canonicalCowMutationSchema).optional()
+  cowMutations: z.array(canonicalCowMutationSchema).optional(),
+  /** Omitted by old definitions, preserving their existing content hashes. */
+  foreignKeys: z.array(canonicalForeignKeySchema).max(100).optional(),
+  /**
+   * Per-cell edit metadata (`cellMetadata: true` in authoring): every tracked
+   * column `c` carries typed `c__at` / `c__by` system columns (plus `c__rev`
+   * on a resolved table's internal sources), listed explicitly in `columns`
+   * with a `cell` marker so DDL and migrations treat them as ordinary columns.
+   * Omitted when off so existing definitions hash unchanged.
+   */
+  cellMetadata: z.literal(true).optional(),
+  /**
+   * System-owned backing table of a resolved table (its manual or prefetch
+   * source). Internal tables get DDL and IR metadata but no GraphQL surface;
+   * only the data plane writes them. Omitted when false.
+   */
+  internal: z.literal(true).optional(),
+  /**
+   * The materialized copy of resolved table `materializes` (internal): the
+   * same columns as that view, including its cell parts, maintained by the
+   * data plane. Omitted otherwise.
+   */
+  materializes: identifier2.optional()
 });
+var MAX_VIEW_QUERY = 1e5;
+var MAX_RESOLVED_VIEW_QUERY = 5e6;
 var canonicalViewSchema = z.object({
-  view: identifier,
+  view: identifier2,
   description: z.string().max(2e3).optional(),
   columns: z.array(canonicalColumnSchema).min(1),
   /** Logical identity for GraphQL only; PostgreSQL views have no PK constraint. */
-  primaryKey: z.array(identifier).min(1).max(8).optional(),
+  primaryKey: z.array(columnIdentifier).min(1).max(8).optional(),
   links: z.array(canonicalLinkSchema).default([]),
   policies: z.object({ read: policyExpressionSchema }).strict(),
-  query: z.string().min(1).max(1e5).refine(isSingleViewQuerySql, {
+  query: z.string().min(1).max(MAX_RESOLVED_VIEW_QUERY).refine(isSingleViewQuerySql, {
     message: "view query must be one SELECT/WITH statement without comments or dollar-quoted bodies"
   }),
   /** Namespace-local logical relation names, sorted for deterministic hashing. */
-  dependencies: z.array(identifier).max(500)
+  dependencies: z.array(identifier2).max(500),
+  /**
+   * Present when this view is a resolved table (defineResolvedTable): the
+   * multi-source metadata behind its generated query. Omitted otherwise so
+   * existing views hash unchanged.
+   */
+  resolved: canonicalResolvedSchema.optional(),
+  /** System-owned view (a materialized resolved table's compute view): no GraphQL surface. */
+  internal: z.literal(true).optional()
 }).superRefine((view, ctx) => {
+  if (view.resolved === void 0 && view.query.length > MAX_VIEW_QUERY) {
+    ctx.addIssue({ code: "custom", path: ["query"], message: `view query must be at most ${MAX_VIEW_QUERY} characters` });
+  }
   for (const [index, column] of view.columns.entries()) {
     if (column.default !== void 0 || column.defaultFn !== void 0) {
       ctx.addIssue({ code: "custom", path: ["columns", index], message: `view column '${column.name}' cannot declare a default` });
     }
+    if (column.onUpdateFn !== void 0) {
+      ctx.addIssue({ code: "custom", path: ["columns", index], message: `view column '${column.name}' cannot declare onUpdateFn` });
+    }
     if (column.unique) {
       ctx.addIssue({ code: "custom", path: ["columns", index], message: `view column '${column.name}' cannot declare unique` });
     }
@@ -1023,15 +1748,82 @@ var canonicalViewSchema = z.object({
       ctx.addIssue({ code: "custom", path: ["columns", index], message: `view column '${column.name}' cannot declare migration hints` });
     }
   }
+  if (view.resolved === void 0 && view.internal !== true) {
+    for (const [index, column] of view.columns.entries()) {
+      if (column.cell) ctx.addIssue({ code: "custom", path: ["columns", index], message: `only resolved tables carry cell columns ('${column.name}')` });
+    }
+  }
   for (const [index, link] of view.links.entries()) {
     if (link.enforce) {
       ctx.addIssue({ code: "custom", path: ["links", index, "enforce"], message: `view link '${link.name}' cannot enforce a foreign key` });
     }
+    if (link.onDelete !== void 0 || link.onUpdate !== void 0) {
+      ctx.addIssue({ code: "custom", path: ["links", index], message: `view link '${link.name}' cannot declare referential actions` });
+    }
   }
 });
+var CELL_PART_TYPES = {
+  at: "timestamptz",
+  by: "text",
+  rev: "uuid",
+  source: "text",
+  conflicts: "jsonb"
+};
+function trackedCellColumns(table) {
+  const pk = new Set(table.primaryKey ?? []);
+  return table.columns.filter((column) => column.cell === void 0 && !pk.has(column.columnName) && column.onUpdateFn === void 0);
+}
+var SUFFIXES = Object.values(CELL_PART_SUFFIX);
+function validateCellMetadata(table, index, ctx) {
+  const fail = (message, path = ["tables", index]) => ctx.addIssue({ code: "custom", path, message });
+  const cells = table.columns.flatMap((column, position) => column.cell ? [{ column, position, cell: column.cell }] : []);
+  if (table.materializes !== void 0) return;
+  if (table.cellMetadata !== true) {
+    for (const { position } of cells) fail(`cell-metadata columns require cellMetadata on table '${table.table}'`, ["tables", index, "columns", position]);
+    return;
+  }
+  if (table.source !== void 0) {
+    fail(`synced table '${table.table}' cannot track cell metadata`);
+    return;
+  }
+  const tracked = trackedCellColumns(table);
+  const byName = new Map(tracked.map((column) => [column.name, column]));
+  const withRev = cells.some(({ cell }) => cell.part === "rev");
+  if (withRev && table.internal !== true) fail(`only a resolved table's internal sources carry '__rev' cell columns ('${table.table}')`);
+  const seen = /* @__PURE__ */ new Set();
+  for (const { column, position, cell } of cells) {
+    const path = ["tables", index, "columns", position];
+    const owner = byName.get(cell.of);
+    if (!owner) {
+      fail(`cell column '${column.name}' belongs to '${cell.of}', which is not a tracked column`, path);
+      continue;
+    }
+    if (cell.part !== "at" && cell.part !== "by" && cell.part !== "rev") fail(`a table cell column must be part at/by/rev, not '${cell.part}'`, path);
+    if (column.name !== cellColumnName(owner.name, cell.part) || column.columnName !== cellColumnName(owner.columnName, cell.part)) {
+      fail(`cell column for '${owner.name}' ${cell.part} must be named '${cellColumnName(owner.name, cell.part)}' / '${cellColumnName(owner.columnName, cell.part)}'`, path);
+    }
+    if (column.type !== CELL_PART_TYPES[cell.part] || !column.nullable || column.unique || column.default !== void 0 || column.defaultFn !== void 0) {
+      fail(`cell column '${column.name}' must be a nullable, default-less ${CELL_PART_TYPES[cell.part]}`, path);
+    }
+    const key = `${cell.of}:${cell.part}`;
+    if (seen.has(key)) fail(`duplicate cell column '${column.name}'`, path);
+    seen.add(key);
+  }
+  for (const column of tracked) {
+    if (column.columnName.length > MAX_TRACKED_COLUMN_NAME) {
+      fail(`column '${column.columnName}' is too long to track cell metadata (max ${MAX_TRACKED_COLUMN_NAME} characters)`);
+    }
+    if (SUFFIXES.some((suffix) => column.columnName.endsWith(suffix))) {
+      fail(`column '${column.columnName}' ends in a reserved cell-metadata suffix (${SUFFIXES.join(", ")})`);
+    }
+    for (const part of withRev ? ["at", "by", "rev"] : ["at", "by"]) {
+      if (!seen.has(`${column.name}:${part}`)) fail(`tracked column '${column.name}' is missing its '${cellColumnName(column.columnName, part)}' cell column`);
+    }
+  }
+}
 var canonicalDefinitionSchema = z.object({
   definition_format: z.literal(CANONICAL_FORMAT),
-  namespace: identifier.max(41),
+  namespace: identifier2.max(41),
   description: z.string().max(2e3).optional(),
   enums: z.array(canonicalEnumSchema).default([]),
   tables: z.array(canonicalTableSchema).min(0).max(500),
@@ -1049,6 +1841,74 @@ var canonicalDefinitionSchema = z.object({
       ctx.addIssue({ code: "custom", path: ["tables", index, "table"], message: `duplicate relation '${table.table}'` });
     }
     seen.add(table.table);
+    validateCellMetadata(table, index, ctx);
+    if (table.source !== void 0) {
+      for (const [columnIndex, column] of table.columns.entries()) {
+        if (column.onUpdateFn !== void 0) {
+          ctx.addIssue({
+            code: "custom",
+            path: ["tables", index, "columns", columnIndex],
+            message: `synced table '${table.table}' column '${column.name}' cannot declare onUpdateFn`
+          });
+        }
+      }
+    }
+  }
+  const fkTables = new Map(definition.tables.map((table) => [table.table, table]));
+  for (const [tableIndex, table] of definition.tables.entries()) {
+    const names = /* @__PURE__ */ new Set([
+      ...table.primaryKey?.length ? [`${table.table}_pkey`] : [],
+      ...table.columns.filter((column) => column.unique && !(table.primaryKey?.length === 1 && table.primaryKey[0] === column.columnName)).map((column) => `${table.table}_${column.columnName}_unique`),
+      ...table.links.filter((link) => link.enforce).map((link) => `fk_${table.table}_${link.name}`)
+    ]);
+    for (const [index, link] of table.links.entries()) {
+      if ((link.onDelete !== void 0 || link.onUpdate !== void 0) && (!link.enforce || link.kind !== "toOne")) {
+        ctx.addIssue({ code: "custom", path: ["tables", tableIndex, "links", index], message: "referential actions require an enforced toOne link" });
+      }
+      if (link.onDelete === "set null" || link.onUpdate === "set null") {
+        const source = table.columns.find((column) => column.columnName === link.on);
+        if (source?.nullable === false || table.primaryKey?.includes(link.on)) ctx.addIssue({ code: "custom", path: ["tables", tableIndex, "links", index], message: "SET NULL requires a nullable source column" });
+      }
+    }
+    for (const [index, check] of (table.checks ?? []).entries()) {
+      const fail = (message) => ctx.addIssue({ code: "custom", path: ["tables", tableIndex, "checks", index], message });
+      if (table.source) fail("synced tables cannot declare checks");
+      if (names.has(check.name)) fail(`duplicate constraint '${check.name}'`);
+      names.add(check.name);
+      try {
+        compileCheckExpression(check.expression, table.columns);
+      } catch (error) {
+        fail(error instanceof Error ? error.message : String(error));
+      }
+    }
+    for (const [index, fk] of (table.foreignKeys ?? []).entries()) {
+      const fail = (message) => ctx.addIssue({ code: "custom", path: ["tables", tableIndex, "foreignKeys", index], message });
+      if (names.has(fk.name)) fail(`duplicate foreign key '${fk.name}'`);
+      names.add(fk.name);
+      const target = fkTables.get(fk.target);
+      if (table.source || !target || target.source) {
+        fail("foreign keys must connect owned tables in the same namespace");
+        continue;
+      }
+      if (fk.columns.length !== fk.references.length) fail("foreign key columns and references must have the same number of columns");
+      if (new Set(fk.columns).size !== fk.columns.length || new Set(fk.references).size !== fk.references.length) fail("foreign key columns must not repeat");
+      for (const [position, name] of fk.columns.entries()) {
+        const sourceColumn = table.columns.find((column) => column.columnName === name);
+        const targetColumn = target.columns.find((column) => column.columnName === fk.references[position]);
+        if (!sourceColumn || !targetColumn) fail("foreign key references an unknown column");
+        else if (JSON.stringify(sourceColumn.type) !== JSON.stringify(targetColumn.type)) fail("foreign key column types must match");
+      }
+      if (fk.onDelete === "set null" || fk.onUpdate === "set null") {
+        if (fk.columns.some((name) => table.columns.find((column) => column.columnName === name)?.nullable === false || table.primaryKey?.includes(name))) fail("SET NULL requires nullable source columns");
+      }
+      const uniqueKeys = [target.primaryKey ?? [], ...target.indexes.filter((index2) => index2.unique).map((index2) => index2.columns), ...target.columns.filter((column) => column.unique).map((column) => [column.columnName])];
+      if (!uniqueKeys.some((key) => key.length === fk.references.length && key.every((column) => fk.references.includes(column)))) fail("foreign key target columns must form a unique key");
+    }
+  }
+  for (const [viewIndex, view] of (definition.views ?? []).entries()) {
+    for (const message of validateResolvedView({ view, tables: definition.tables, views: definition.views ?? [] })) {
+      ctx.addIssue({ code: "custom", path: ["views", viewIndex, "resolved"], message });
+    }
   }
   const tableByName = new Map(definition.tables.map((table) => [table.table, table]));
   for (const [tableIndex, table] of definition.tables.entries()) {
@@ -1171,12 +2031,14 @@ function normalizeCanonical(definition) {
     ...definition,
     enums: sortByName(definition.enums),
     tables: [...definition.tables].sort((a, b) => a.table.localeCompare(b.table)).map((t2) => {
-      const { cowMutations, ...rest } = t2;
+      const { cowMutations, foreignKeys, checks, ...rest } = t2;
       return {
         ...rest,
         links: sortByName(t2.links),
         indexes: [...t2.indexes].sort((a, b) => (a.name ?? a.columns.join("_")).localeCompare(b.name ?? b.columns.join("_"))),
         actions: sortByName(t2.actions),
+        ...foreignKeys?.length ? { foreignKeys: sortByName(foreignKeys) } : {},
+        ...checks?.length ? { checks: sortByName(checks) } : {},
         // Omitted entirely when absent/empty so pre-CoW documents hash unchanged.
         ...cowMutations !== void 0 && cowMutations.length > 0 ? { cowMutations: sortByName(cowMutations) } : {}
       };
@@ -1191,6 +2053,454 @@ function normalizeCanonical(definition) {
   }
   return normalized;
 }
+
+// src/authoring/resolved-sources.ts
+function cloneColumn({ builder, property, notNull, primaryKey }) {
+  const canonical = builder.toCanonicalColumn(property);
+  let clone = new ColumnBuilder(canonical.type, canonical.columnName);
+  if (primaryKey) clone = clone.primaryKey();
+  if (notNull) clone = clone.notNull();
+  if (canonical.description !== void 0) clone = clone.description(canonical.description);
+  return clone;
+}
+function planSource(input) {
+  const { sourceName, input: source, fail } = input;
+  if (!IDENTIFIER_PATTERN.test(sourceName)) fail(`source name "${sourceName}" must match ${IDENTIFIER_PATTERN}`);
+  switch (source.kind) {
+    case "manual":
+      return {
+        name: sourceName,
+        kind: "manual",
+        columns: input.dataColumns,
+        table: internalTable(input, input.dataColumns, {
+          [RESOLVED_SOURCE_SYSTEM_COLUMNS.tombstoned.name]: tombstoned(),
+          [RESOLVED_SOURCE_SYSTEM_COLUMNS.writebackStatus.name]: t.text(RESOLVED_SOURCE_SYSTEM_COLUMNS.writebackStatus.columnName),
+          [RESOLVED_SOURCE_SYSTEM_COLUMNS.writebackError.name]: t.text(RESOLVED_SOURCE_SYSTEM_COLUMNS.writebackError.columnName),
+          [RESOLVED_SOURCE_SYSTEM_COLUMNS.writebackAt.name]: t.timestamptz(RESOLVED_SOURCE_SYSTEM_COLUMNS.writebackAt.columnName)
+        }, { revisions: true })
+      };
+    case "etl":
+      return planEtl(input, source);
+    case "prefetch":
+      return planPrefetch(input, source);
+  }
+}
+var tombstoned = () => t.boolean(RESOLVED_SOURCE_SYSTEM_COLUMNS.tombstoned.columnName).notNull().default(false);
+function internalTable(input, supplied, system, options = {}) {
+  const { viewName, sourceName, columns, pk, pkBuilder } = input;
+  const tableColumns = { [pk]: cloneColumn({ builder: pkBuilder, property: pk, notNull: true, primaryKey: true }) };
+  for (const property of supplied) {
+    tableColumns[property] = cloneColumn({ builder: columns[property], property, notNull: false, primaryKey: false });
+  }
+  return defineTable(`${viewName}__${sourceName}`, { ...tableColumns, ...system }, {
+    description: `Internal ${input.input.kind} source "${sourceName}" of resolved table "${viewName}". System-maintained.`,
+    cellMetadata: true,
+    // The manual source identifies each edit (`c__rev`) so an async
+    // confirmation clears only the exact edit it delivered.
+    ...options.revisions ? { cellRevisions: true } : {},
+    internal: true
+  });
+}
+function assertColumns(input, list, what) {
+  for (const column of list) if (!input.dataColumns.includes(column)) input.fail(`${what} names unknown column "${column}"`);
+}
+function planEtl(input, source) {
+  const { sourceName, pk, dataColumns, fail } = input;
+  const table = typeof source.table === "function" ? source.table() : source.table;
+  if (!isSeqTable(table) || table.source === void 0) fail(`etl source "${sourceName}" must reference a defineSyncedTable`);
+  const synced = table;
+  if (!(pk in synced.columns)) fail(`etl source "${sourceName}" table "${synced.tableName}" has no "${pk}" column`);
+  const supplied = source.columns ? [...source.columns] : dataColumns.filter((column) => column in synced.columns);
+  assertColumns(input, supplied, `etl source "${sourceName}"`);
+  if (source.updatedAt !== void 0 && !(source.updatedAt in synced.columns)) {
+    fail(`etl source "${sourceName}" updatedAt "${source.updatedAt}" is not a column of "${synced.tableName}"`);
+  }
+  return { name: sourceName, kind: "etl", table: synced, columns: supplied, ...source.updatedAt ? { updatedAt: source.updatedAt } : {} };
+}
+function planPrefetch(input, source) {
+  const { sourceName, pk, fail } = input;
+  assertColumns(input, source.columns, `prefetch source "${sourceName}"`);
+  if (source.key !== pk && !source.columns.includes(source.key)) {
+    fail(`prefetch source "${sourceName}" key "${source.key}" must be the primary key or one of its columns`);
+  }
+  for (const column of source.writeback?.columns ?? []) {
+    if (!source.columns.includes(column)) fail(`prefetch source "${sourceName}" writes back "${column}", which it does not supply`);
+  }
+  const writeback = source.writeback;
+  return {
+    name: sourceName,
+    kind: "prefetch",
+    columns: [...source.columns],
+    key: source.key,
+    function: source.function,
+    fetch: source.fetch === "single" ? { shape: "single" } : { shape: "batch", maxKeys: source.fetch.batch.maxKeys },
+    prefetchDefaults: {
+      maxStalenessMs: parseDuration(source.prefetchDefaults?.maxStaleness ?? "30s"),
+      timeoutMs: parseDuration(source.prefetchDefaults?.timeout ?? "1500ms"),
+      onError: source.prefetchDefaults?.onError ?? "fallback"
+    },
+    ...writeback ? {
+      writeback: {
+        columns: [...writeback.columns],
+        defaultMode: writeback.defaultMode ?? "sync",
+        timeoutMs: parseDuration(writeback.timeout ?? "5s"),
+        clearManualOnConfirm: writeback.clearManualOnConfirm ?? true
+      }
+    } : {},
+    table: internalTable(input, source.columns, {
+      [RESOLVED_SOURCE_SYSTEM_COLUMNS.fetchedAt.name]: t.timestamptz(RESOLVED_SOURCE_SYSTEM_COLUMNS.fetchedAt.columnName).notNull().default("now()"),
+      [RESOLVED_SOURCE_SYSTEM_COLUMNS.tombstoned.name]: tombstoned()
+    })
+  };
+}
+function parseDuration(input) {
+  const value = parseDurationMs(input);
+  if (value === void 0) throw new OrmDefinitionError(`invalid duration "${input}" \u2014 use e.g. '1500ms', '30s', '5m'`);
+  return value;
+}
+var PG_TYPE = {
+  uuid: "uuid",
+  text: "text",
+  integer: "integer",
+  bigint: "bigint",
+  numeric: "numeric",
+  double: "double precision",
+  boolean: "boolean",
+  timestamptz: "timestamptz",
+  date: "date",
+  jsonb: "jsonb"
+};
+var ident = (value) => `"${value.replace(/"/g, '""')}"`;
+var literal = (value) => `'${value.replace(/'/g, "''")}'`;
+var physical = ({ source, property }) => source.table.columns[property].columnNameFor(property);
+function candidateSql({ source, column, pk, pgType }) {
+  const a = ident(`s_${source.name}`);
+  const name = physical({ source, property: column });
+  const value = `CAST(${a}.${ident(name)} AS ${pgType})`;
+  if (source.kind === "etl") {
+    return {
+      source: source.name,
+      value,
+      has: `(${a}.${ident(physical({ source, property: pk }))} IS NOT NULL)`,
+      at: source.updatedAt ? `CAST(${a}.${ident(physical({ source, property: source.updatedAt }))} AS timestamptz)` : "CAST(NULL AS timestamptz)",
+      by: "CAST(NULL AS text)"
+    };
+  }
+  const at = `${a}.${ident(cellColumnName(name, "at"))}`;
+  const tombstoned2 = source.kind === "prefetch" ? ` AND NOT ${a}.${ident(RESOLVED_SOURCE_SYSTEM_COLUMNS.tombstoned.columnName)}` : "";
+  return { source: source.name, value, has: `(${at} IS NOT NULL${tombstoned2})`, at, by: `${a}.${ident(cellColumnName(name, "by"))}` };
+}
+function outranks({ i, j, key, direction, inclusive }) {
+  const ki = i[key];
+  const kj = j[key];
+  const op = inclusive ? `${direction}=` : direction;
+  return inclusive ? `(${kj} IS NULL OR (${ki} IS NOT NULL AND ${ki} ${op} ${kj}))` : `(${ki} IS NOT NULL AND (${kj} IS NULL OR ${ki} ${op} ${kj}))`;
+}
+function rankedWinner({ candidates, key, direction }) {
+  const branches = candidates.map((candidate, index) => {
+    const beats = candidates.map((other, otherIndex) => otherIndex === index ? null : `(NOT ${other.has} OR ${outranks({ i: candidate, j: other, key, direction, inclusive: index < otherIndex })})`).filter((clause) => clause !== null);
+    return `WHEN ${[candidate.has, ...beats].join(" AND ")} THEN ${index + 1}`;
+  });
+  return `CASE ${branches.join(" ")} END`;
+}
+function winnerIndex({ comparator, candidates }) {
+  const firstWith = (test) => candidates.map((candidate, index) => `WHEN ${test(candidate)} THEN ${index + 1}`).join(" ");
+  if (candidates.length === 1 || comparator === "priority") return `CASE ${firstWith((c) => c.has)} END`;
+  switch (comparator) {
+    case "latest":
+      return rankedWinner({ candidates, key: "at", direction: ">" });
+    case "highest":
+      return rankedWinner({ candidates, key: "value", direction: ">" });
+    case "lowest":
+      return rankedWinner({ candidates, key: "value", direction: "<" });
+    case "nonNullFirst":
+      return `CASE ${firstWith((c) => `${c.has} AND ${c.value} IS NOT NULL`)} ${firstWith((c) => c.has)} END`;
+  }
+}
+function pick(winner, candidates, field) {
+  return `CASE ${winner} ${candidates.map((candidate, index) => `WHEN ${index + 1} THEN ${field(candidate)}`).join(" ")} END`;
+}
+function loserSql({ loser, winner }) {
+  return `CASE WHEN ${loser.has} AND ${loser.value} IS DISTINCT FROM ${winner.value} AND ${loser.at} > ${winner.at} THEN jsonb_build_array(jsonb_build_object('source', ${literal(loser.source)}, 'value', to_jsonb(${loser.value}), 'at', ${loser.at})) ELSE '[]'::jsonb END`;
+}
+function losersAgainst({ candidates, winner, isWinner }) {
+  const losers = candidates.flatMap((loser, index) => {
+    const excluded = isWinner(loser, index);
+    if (excluded === true) return [];
+    const clause = loserSql({ loser, winner });
+    return [excluded === false ? clause : `CASE WHEN ${excluded} THEN '[]'::jsonb ELSE ${clause} END`];
+  });
+  return losers.length === 0 ? "CAST(NULL AS jsonb)" : `NULLIF(${losers.join(" || ")}, '[]'::jsonb)`;
+}
+function builtinCell({ comparator, candidates }) {
+  const winner = winnerIndex({ comparator, candidates });
+  const conflicts = comparator === "latest" || candidates.length < 2 ? "CAST(NULL AS jsonb)" : `CASE ${winner} ${candidates.map((known, index) => `WHEN ${index + 1} THEN ${losersAgainst({ candidates, winner: known, isWinner: (_c, other) => other === index })}`).join(" ")} END`;
+  return {
+    value: pick(winner, candidates, (c) => c.value),
+    parts: {
+      source: pick(winner, candidates, (c) => literal(c.source)),
+      at: pick(winner, candidates, (c) => c.at),
+      by: pick(winner, candidates, (c) => c.by),
+      conflicts
+    }
+  };
+}
+function customCell({ candidates, orderBy, index }) {
+  const w = ident(`w_${index}`);
+  const rows = candidates.map((c, ord) => `(${literal(c.source)}, ${c.has}, ${c.value}, ${c.at}, ${c.by}, ${ord})`);
+  const lateral = ` LEFT JOIN LATERAL (SELECT max(winner.source) AS source, (array_agg(winner.value))[1] AS value, max(winner.updated_at) AS updated_at, max(winner.actor) AS actor FROM (WITH cand(source, has, value, updated_at, actor, ord) AS (VALUES ${rows.join(", ")}) SELECT c.source, c.value, c.updated_at, c.actor FROM cand c WHERE c.has ORDER BY ${orderBy}, c.ord LIMIT 1) AS winner) AS ${w} ON true`;
+  const winner = { value: `${w}.value`, at: `${w}.updated_at` };
+  return {
+    value: winner.value,
+    lateral,
+    parts: {
+      source: `${w}.source`,
+      at: winner.at,
+      by: `${w}.actor`,
+      conflicts: candidates.length < 2 ? "CAST(NULL AS jsonb)" : losersAgainst({ candidates, winner, isWinner: (c) => `${w}.source = ${literal(c.source)}` })
+    }
+  };
+}
+function buildResolvedQuery({ context, plan }) {
+  const { qb, relation } = context;
+  const pkColumn = plan.columns[plan.pk].columnNameFor(plan.pk);
+  const alias = (source) => ident(`s_${source}`);
+  const tombstoned2 = RESOLVED_SOURCE_SYSTEM_COLUMNS.tombstoned.columnName;
+  const sourceByName = new Map(plan.plans.map((source) => [source.name, source]));
+  const schema = getTableConfig(relation(plan.plans[0].table)).schema;
+  const keyBranches = plan.plans.map((source) => {
+    const where = source.kind === "prefetch" ? sql.raw(` WHERE NOT ${ident(tombstoned2)}`) : sql.raw("");
+    const sourcePk = ident(physical({ source, property: plan.pk }));
+    const selectedPk = sourcePk === ident(pkColumn) ? sourcePk : `${sourcePk} AS ${ident(pkColumn)}`;
+    return sql`SELECT ${sql.raw(selectedPk)} FROM ${relation(source.table)}${where}`;
+  });
+  const joins = plan.plans.map(
+    (source) => sql` LEFT JOIN ${relation(source.table)} AS ${sql.raw(alias(source.name))} ON ${sql.raw(`${alias(source.name)}.${ident(physical({ source, property: plan.pk }))} = "k".${ident(pkColumn)}`)}`
+  );
+  const cells = /* @__PURE__ */ new Map();
+  plan.rules.forEach((rule, index) => {
+    const canonical = plan.columns[rule.column].toCanonicalColumn(rule.column);
+    const pgType = typeof canonical.type === "string" ? PG_TYPE[canonical.type] : `${schema === void 0 ? "" : `${ident(schema)}.`}${ident(canonical.type.enum)}`;
+    const candidates = rule.candidates.map((name) => candidateSql({ source: sourceByName.get(name), column: rule.column, pk: plan.pk, pgType }));
+    cells.set(rule.column, rule.comparator === "custom" ? customCell({ candidates, orderBy: rule.orderBy, index }) : builtinCell({ comparator: rule.comparator, candidates }));
+  });
+  const laterals = [...cells.values()].flatMap((cell) => cell.lateral ? [sql.raw(cell.lateral)] : []);
+  const from = sql.join([sql`(${sql.join(keyBranches, sql.raw(" UNION "))}) AS "k"`, ...joins, ...laterals], sql.raw(""));
+  const selected = {
+    [plan.pk]: sql.raw(`"k".${ident(pkColumn)}`).as(pkColumn)
+  };
+  for (const [property, builder] of Object.entries(plan.columns)) {
+    if (property === plan.pk) continue;
+    const cell = cells.get(property);
+    const columnName = builder.columnNameFor(property);
+    selected[property] = sql.raw(cell.value).as(columnName);
+    for (const [part, expression] of Object.entries(cell.parts)) {
+      selected[cellColumnName(property, part)] = sql.raw(expression).as(cellColumnName(columnName, part));
+    }
+  }
+  const manual = plan.plans.find((source) => source.kind === "manual");
+  const system = RESOLVED_VIEW_SYSTEM_COLUMNS;
+  selected[system.writebackStatus.name] = sql.raw(`${alias(manual.name)}.${ident(RESOLVED_SOURCE_SYSTEM_COLUMNS.writebackStatus.columnName)}`).as(system.writebackStatus.columnName);
+  selected[system.writebackError.name] = sql.raw(`${alias(manual.name)}.${ident(RESOLVED_SOURCE_SYSTEM_COLUMNS.writebackError.columnName)}`).as(system.writebackError.columnName);
+  const hidden = plan.deletedBy.map((name) => `NOT COALESCE(${alias(name)}.${ident(tombstoned2)}, false)`);
+  const query = qb.select(selected).from(from);
+  return hidden.length > 0 ? query.where(sql.raw(hidden.join(" AND "))) : query;
+}
+function managedFn(id) {
+  return { kind: "managed", id };
+}
+function manualSource() {
+  return { kind: "manual" };
+}
+function etlSource(input) {
+  return { kind: "etl", ...input };
+}
+function prefetchSource(input) {
+  return { kind: "prefetch", ...input };
+}
+var latest = (candidates) => ({ kind: "latest", candidates });
+var highest = (candidates) => ({ kind: "highest", candidates });
+var lowest = (candidates) => ({ kind: "lowest", candidates });
+var priority = (candidates) => ({ kind: "priority", candidates });
+var nonNullFirst = (candidates) => ({ kind: "nonNullFirst", candidates });
+var custom = (candidates, orderBy) => ({ kind: "custom", candidates, orderBy });
+var SYSTEM_VIEW_COLUMNS = {
+  [RESOLVED_VIEW_SYSTEM_COLUMNS.writebackStatus.name]: () => t.text(RESOLVED_VIEW_SYSTEM_COLUMNS.writebackStatus.columnName),
+  [RESOLVED_VIEW_SYSTEM_COLUMNS.writebackError.name]: () => t.text(RESOLVED_VIEW_SYSTEM_COLUMNS.writebackError.columnName)
+};
+function defineResolvedTable(name, columns, config) {
+  const file = activeAuthoringContext()?.currentFile;
+  const fail = (message) => {
+    throw new OrmDefinitionError(`resolved table "${name}": ${message}`, file);
+  };
+  if (!IDENTIFIER_PATTERN.test(name)) fail(`name must match ${IDENTIFIER_PATTERN}`);
+  for (const property of Object.keys(columns)) {
+    if (RESERVED_RESOLVED_COLUMN_NAMES.has(property) || RESERVED_RESOLVED_COLUMN_NAMES.has(columns[property].columnNameFor(property))) {
+      fail(`column "${property}" collides with a reserved system column`);
+    }
+  }
+  for (const property of Object.keys(columns)) {
+    if (columns[property].columnNameFor(property).length > MAX_TRACKED_COLUMN_NAME) {
+      fail(`column "${property}" is too long for a resolved table (max ${MAX_TRACKED_COLUMN_NAME} characters, room for cell parts)`);
+    }
+  }
+  const pkEntries = Object.entries(columns).filter(([, builder]) => builder.isPrimaryKey);
+  if (pkEntries.length !== 1) fail("declare exactly one .primaryKey() column");
+  const [pk, pkBuilder] = pkEntries[0];
+  const dataColumns = Object.keys(columns).filter((property) => property !== pk);
+  if (dataColumns.length === 0) fail("declare at least one non-key column");
+  const sourceEntries = Object.entries(config.sources);
+  if (sourceEntries.filter(([, source]) => source.kind === "manual").length !== 1) fail("declare exactly one manualSource()");
+  const plans = sourceEntries.map(
+    ([sourceName, input]) => planSource({ viewName: name, sourceName, input, columns, pk, pkBuilder, dataColumns, fail })
+  );
+  const rules = planRules({ config, plans, dataColumns, fail });
+  const deletedBy = [...config.rows?.deletedBy ?? []];
+  for (const source of deletedBy) {
+    if (plans.find((plan) => plan.name === source)?.kind !== "manual") fail(`rows.deletedBy "${source}" must be the manual source`);
+  }
+  const partType = { source: t.text, at: t.timestamptz, by: t.text, conflicts: t.jsonb };
+  const viewColumns = {};
+  for (const [property, builder] of Object.entries(columns)) {
+    viewColumns[property] = cloneColumn({ builder, property, notNull: property === pk, primaryKey: property === pk });
+    if (property === pk) continue;
+    const columnName = builder.columnNameFor(property);
+    for (const part of RESOLVED_VIEW_CELL_PARTS) {
+      viewColumns[cellColumnName(property, part)] = partType[part](cellColumnName(columnName, part)).cellPart(property, part);
+    }
+  }
+  for (const [property, make] of Object.entries(SYSTEM_VIEW_COLUMNS)) viewColumns[property] = make();
+  const { read, ...writePolicies } = config.policies;
+  const resolved = {
+    internalTables: plans.filter((plan) => plan.kind !== "etl").map((plan) => plan.table),
+    sources: plans,
+    rules,
+    deletedBy,
+    policies: writePolicies
+  };
+  const queryPlan = { columns, pk, plans, rules, deletedBy };
+  const typedColumns = viewColumns;
+  const surface = {
+    ...config.description !== void 0 ? { description: config.description } : {},
+    ...config.links !== void 0 ? { links: config.links } : {},
+    policies: { read }
+  };
+  if (!config.materialize) {
+    return defineView(name, typedColumns, { ...surface, query: (context) => buildResolvedQuery({ context, plan: queryPlan }), resolved });
+  }
+  const materialize = config.materialize === true ? {} : config.materialize;
+  const computeName = `${name}__compute`;
+  const tableName = `${name}__materialized`;
+  const compute = defineView(computeName, typedColumns, {
+    policies: { read },
+    query: (context) => buildResolvedQuery({ context, plan: queryPlan }),
+    internal: true
+  });
+  const table = defineTable(tableName, viewColumns, {
+    description: `Materialized rows of resolved table "${name}". System-maintained from "${computeName}".`,
+    internal: true,
+    materializes: name,
+    ...materialize.indexes !== void 0 ? { indexes: materialize.indexes } : {}
+  });
+  return defineView(name, typedColumns, {
+    ...surface,
+    query: (context) => {
+      const handle = context.relation(table);
+      const selected = Object.fromEntries(Object.entries(viewColumns).map(([property, builder]) => [
+        property,
+        sql`${handle[property]}`.as(builder.columnNameFor(property))
+      ]));
+      return context.qb.select(selected).from(context.relation(table));
+    },
+    resolved: {
+      ...resolved,
+      internalTables: [...resolved.internalTables, table],
+      internalViews: [compute],
+      materialized: { table: tableName, compute: computeName }
+    }
+  });
+}
+function planRules({ config, plans, dataColumns, fail }) {
+  const kindOrder = { manual: 0, prefetch: 1, etl: 2 };
+  const fallback = config.default ?? priority([...plans].sort((a, b) => kindOrder[a.kind] - kindOrder[b.kind]).map((plan) => plan.name));
+  for (const column of Object.keys(config.resolve ?? {})) {
+    if (!dataColumns.includes(column)) fail(`resolve names unknown column "${column}"`);
+  }
+  return dataColumns.map((column) => {
+    const explicit = config.resolve?.[column];
+    const comparator = explicit ?? fallback;
+    const candidates = explicit ? [...explicit.candidates] : comparator.candidates.filter((name) => plans.find((plan) => plan.name === name)?.columns.includes(column));
+    for (const candidate of candidates) {
+      const plan = plans.find((entry) => entry.name === candidate);
+      if (!plan) fail(`column "${column}" names unknown source "${candidate}"`);
+      else if (!plan.columns.includes(column)) fail(`column "${column}" candidate "${candidate}" does not supply it`);
+    }
+    if (candidates.length === 0) fail(`column "${column}" has no candidate source`);
+    if (comparator.kind === "custom") assertSafeOrderBy({ orderBy: comparator.orderBy ?? "", column, fail });
+    return {
+      column,
+      comparator: comparator.kind,
+      candidates,
+      ...comparator.kind === "custom" && comparator.orderBy !== void 0 ? { orderBy: comparator.orderBy } : {}
+    };
+  });
+}
+var ORDER_BY_KEYWORDS = /* @__PURE__ */ new Set([
+  "value",
+  "updated_at",
+  "source",
+  "actor",
+  "ord",
+  "asc",
+  "desc",
+  "nulls",
+  "first",
+  "last",
+  "case",
+  "when",
+  "then",
+  "else",
+  "end",
+  "and",
+  "or",
+  "not",
+  "is",
+  "null",
+  "true",
+  "false",
+  "in",
+  "distinct",
+  "from",
+  "coalesce",
+  "nullif",
+  "greatest",
+  "least",
+  "text",
+  "numeric",
+  "integer",
+  "bigint",
+  "boolean",
+  "timestamptz",
+  "date",
+  "jsonb",
+  "interval"
+]);
+var ALLOWED_FUNCTIONS = new Set(VIEW_QUERY_FUNCTION_ALLOWLIST);
+var ORDER_BY_TOKEN = /\s+|'(?:[^']|'')*'|\d+(?:\.\d+)?|[a-z_][a-z0-9_]*|::|<=|>=|<>|!=|[-+*/%<>=(),|]/giy;
+function assertSafeOrderBy({ orderBy, column, fail }) {
+  ORDER_BY_TOKEN.lastIndex = 0;
+  let consumed = 0;
+  for (let match = ORDER_BY_TOKEN.exec(orderBy); match; match = ORDER_BY_TOKEN.exec(orderBy)) {
+    consumed = ORDER_BY_TOKEN.lastIndex;
+    const token = match[0].toLowerCase();
+    if (/^[a-z_]/.test(token) && !ORDER_BY_KEYWORDS.has(token) && !ALLOWED_FUNCTIONS.has(token)) {
+      fail(`column "${column}" custom orderBy uses "${match[0]}" \u2014 only value, updated_at, source, actor, ord, SQL keywords and allowlisted functions`);
+    }
+  }
+  if (consumed !== orderBy.length || orderBy.trim() === "") {
+    fail(`column "${column}" custom orderBy contains an unsupported character near "${orderBy.slice(consumed, consumed + 10)}"`);
+  }
+}
 function stableJson(value) {
   if (value === null || typeof value !== "object") return JSON.stringify(value);
   if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
@@ -1219,8 +2529,19 @@ function defineNamespace(input) {
   return config;
 }
 function serializeNamespace(input) {
-  const { config, tables } = input;
-  const views = input.views ?? [];
+  const { config } = input;
+  const views = [...input.views ?? []];
+  const tables = [...input.tables];
+  for (const view of views) {
+    for (const internal of view.config.resolved?.internalTables ?? []) {
+      if (!tables.includes(internal)) tables.push(internal);
+    }
+  }
+  for (const view of [...views]) {
+    for (const internal of view.config.resolved?.internalViews ?? []) {
+      if (!views.includes(internal)) views.push(internal);
+    }
+  }
   const enums = input.enums ?? [];
   const tablesByName = /* @__PURE__ */ new Map();
   for (const table of tables) {
@@ -1322,6 +2643,9 @@ function buildCanonicalTable({ table, relationsByName, enumsByName }) {
   if (table.config.renamedFrom !== void 0) candidate.renamedFrom = table.config.renamedFrom;
   if (table.source !== void 0) candidate.source = table.source;
   if (table.source !== void 0) {
+    if (table.config.checks?.length) {
+      throw new OrmDefinitionError(`synced table "${table.tableName}" is system-owned; checks are not allowed`, table.file);
+    }
     if (table.config.indexes !== void 0 && table.config.indexes.length > 0) {
       throw new OrmDefinitionError(
         `synced table "${table.tableName}" is system-owned; indexes are not allowed`,
@@ -1359,6 +2683,11 @@ function buildCanonicalTable({ table, relationsByName, enumsByName }) {
     if (builder.isPrimaryKey) columnLevelPk.push(column.columnName);
     candidate.columns?.push(column);
   }
+  if (table.config.internal === true) candidate.internal = true;
+  if (table.config.materializes !== void 0) candidate.materializes = table.config.materializes;
+  if (table.config.cellMetadata === true && table.source !== void 0) {
+    throw new OrmDefinitionError(`synced table "${table.tableName}" cannot track cell metadata \u2014 its DDL is owned by the sync`, table.file);
+  }
   if (table.config.primaryKey !== void 0) {
     if (columnLevelPk.length > 0) {
       throw new OrmDefinitionError(
@@ -1372,6 +2701,45 @@ function buildCanonicalTable({ table, relationsByName, enumsByName }) {
   } else if (columnLevelPk.length > 0) {
     candidate.primaryKey = columnLevelPk;
   }
+  if (table.config.cellMetadata === true) {
+    candidate.cellMetadata = true;
+    const parts = table.config.cellRevisions === true ? ["at", "by", "rev"] : ["at", "by"];
+    const tracked = trackedCellColumns({ columns: candidate.columns ?? [], primaryKey: candidate.primaryKey });
+    for (const column of tracked) {
+      for (const part of parts) {
+        candidate.columns?.push({
+          name: cellColumnName(column.name, part),
+          columnName: cellColumnName(column.columnName, part),
+          type: CELL_PART_TYPES[part],
+          nullable: true,
+          unique: false,
+          deprecated: false,
+          cell: { of: column.name, part }
+        });
+      }
+    }
+  }
+  if (table.config.foreignKeys?.length) {
+    if (table.source) throw new OrmDefinitionError(`synced table "${table.tableName}" cannot enforce foreign keys`, table.file);
+    candidate.foreignKeys = table.config.foreignKeys.map((fk) => {
+      const target = resolveRelationRef({ ref: fk.target, fail: (message) => {
+        throw new OrmDefinitionError(message, table.file);
+      } });
+      if (!isSeqTable(target) || !relationsByName.has(target.tableName)) throw new OrmDefinitionError("foreign key target must be a table in this namespace", table.file);
+      return {
+        name: fk.name,
+        columns: fk.columns.map((ref) => resolveColumnRef({ relation: table, ref, role: `foreign key "${fk.name}" column` })),
+        target: target.tableName,
+        references: fk.references.map((ref) => resolveColumnRef({ relation: target, ref, role: `foreign key "${fk.name}" reference` })),
+        ...fk.deferrable ? { deferrable: fk.deferrable } : {},
+        ...fk.onDelete ? { onDelete: fk.onDelete } : {},
+        ...fk.onUpdate ? { onUpdate: fk.onUpdate } : {}
+      };
+    });
+  }
+  if (table.config.checks?.length) {
+    candidate.checks = table.config.checks.map((check) => ({ name: check.name, expression: check.expression }));
+  }
   for (const index of table.config.indexes ?? []) {
     const entry = {
       columns: index.columns.map((ref) => resolveColumnRef({ relation: table, ref, role: "index" }))
@@ -1424,6 +2792,12 @@ function buildCanonicalView({
     if (column.default !== void 0 || column.defaultFn !== void 0) {
       throw new OrmDefinitionError(`view "${view.viewName}": column "${propertyName}" cannot declare a default`, view.file);
     }
+    if (column.onUpdateFn !== void 0) {
+      throw new OrmDefinitionError(
+        `view "${view.viewName}": column "${propertyName}" cannot declare onUpdateFn`,
+        view.file
+      );
+    }
     if (column.unique) {
       throw new OrmDefinitionError(`view "${view.viewName}": column "${propertyName}" cannot declare unique`, view.file);
     }
@@ -1461,7 +2835,33 @@ function buildCanonicalView({
     columns,
     ...primaryKey !== void 0 ? { primaryKey } : {},
     links,
-    policies: { read: toCanonicalPolicy(view.config.policies.read) }
+    policies: { read: toCanonicalPolicy(view.config.policies.read) },
+    ...view.config.resolved !== void 0 ? { resolved: buildCanonicalResolved(view.config.resolved) } : {},
+    ...view.config.internal === true ? { internal: true } : {}
+  };
+}
+function buildCanonicalResolved(resolved) {
+  const policies = {};
+  if (resolved.policies.write !== void 0) policies.write = toCanonicalPolicy(resolved.policies.write);
+  if (resolved.policies.insert !== void 0) policies.insert = toCanonicalPolicy(resolved.policies.insert);
+  if (resolved.policies.update !== void 0) policies.update = toCanonicalPolicy(resolved.policies.update);
+  return {
+    sources: resolved.sources.map((source) => ({
+      name: source.name,
+      kind: source.kind,
+      table: source.table.tableName,
+      columns: [...source.columns],
+      ...source.updatedAt !== void 0 ? { updatedAt: source.updatedAt } : {},
+      ...source.key !== void 0 ? { key: source.key } : {},
+      ...source.fetch !== void 0 ? { fetch: source.fetch } : {},
+      ...source.function !== void 0 ? { function: { ...source.function } } : {},
+      ...source.prefetchDefaults !== void 0 ? { prefetchDefaults: { ...source.prefetchDefaults } } : {},
+      ...source.writeback !== void 0 ? { writeback: { ...source.writeback, columns: [...source.writeback.columns] } } : {}
+    })),
+    resolve: resolved.rules.map((rule) => ({ ...rule, candidates: [...rule.candidates] })),
+    deletedBy: [...resolved.deletedBy],
+    ...resolved.materialized ? { materialized: { ...resolved.materialized } } : {},
+    policies
   };
 }
 function buildCanonicalLink({
@@ -1478,6 +2878,9 @@ function buildCanonicalLink({
   if (link.enforce && link.linkKind !== "toOne") {
     return fail("sets enforce: true, which is only supported on toOne links");
   }
+  if ((link.onDelete !== void 0 || link.onUpdate !== void 0) && !link.enforce) {
+    return fail("sets a referential action without enforce: true");
+  }
   if (link.linkKind === "toPlatformUser") {
     if (link.target !== void 0) return fail("is toPlatformUser and must not declare a target table");
     return {
@@ -1506,6 +2909,8 @@ function buildCanonicalLink({
     on: resolveColumnRef({ relation: owningSide, ref: link.on, role: `link "${linkName}" on` }),
     ...link.references !== void 0 ? { references: resolveColumnRef({ relation: referencedSide, ref: link.references, role: `link "${linkName}" references` }) } : {},
     enforce: link.enforce,
+    ...link.onDelete !== void 0 ? { onDelete: link.onDelete } : {},
+    ...link.onUpdate !== void 0 ? { onUpdate: link.onUpdate } : {},
     ...link.description !== void 0 ? { description: link.description } : {}
   };
 }
@@ -1684,6 +3089,10 @@ async function loadNamespaceFromDir(dir, options = {}) {
     fsCache: false,
     ...options.ormModulePath !== void 0 ? {
       alias: {
+        // The public /drizzle barrel re-exports this pinned dependency.
+        // Explicitly map it before the root alias: otherwise jiti appends
+        // "/drizzle" to the overridden module's filename.
+        "@sequenceholdings/orm/drizzle": createRequire(import.meta.url).resolve("drizzle-orm"),
         "@sequenceholdings/orm": options.ormModulePath,
         "@sequenceholdings/orm/authoring": options.ormModulePath
       }
@@ -1759,6 +3168,6 @@ function purgeModuleCache(root) {
   }
 }
 
-export { COLUMN_BRAND, COLUMN_DEFAULT_FNS, ColumnBuilder, ENUM_BRAND, LINK_BRAND, NAMESPACE_CONFIG_BRAND, NAMESPACE_CONFIG_FILE, ORM_TO_PIPELINE_TYPE, SCHEMA_DIR, SYNCED_CONTRACT_HASH_DOMAIN, TABLE_BRAND, VIEW_BRAND, activeAuthoringContext, beginAuthoringContext, computeCanonicalHash, computeSyncedContractHash, defineEnum, defineNamespace, defineSyncedTable, defineTable, defineView, deriveColumnName, endAuthoringContext, extractOrmSyncedTableContract, isColumnBuilder, isEnumRef, isSeqLink, isSeqNamespaceConfig, isSeqTable, isSeqView, loadNamespaceFromDir, overlayWinsUnion, overrideRowMutation, revertOverlayMutation, serializeNamespace, syncedContractSurface, t, toMany, toOne, toPlatformUser };
+export { COLUMN_BRAND, COLUMN_DEFAULT_FNS, ColumnBuilder, ENUM_BRAND, LINK_BRAND, NAMESPACE_CONFIG_BRAND, NAMESPACE_CONFIG_FILE, ORM_TO_PIPELINE_TYPE, SCHEMA_DIR, SYNCED_CONTRACT_HASH_DOMAIN, TABLE_BRAND, VIEW_BRAND, activeAuthoringContext, beginAuthoringContext, computeCanonicalHash, computeSyncedContractHash, custom, defineEnum, defineNamespace, defineResolvedTable, defineSyncedTable, defineTable, defineView, deriveColumnName, endAuthoringContext, etlSource, extractOrmSyncedTableContract, highest, isColumnBuilder, isEnumRef, isSeqLink, isSeqNamespaceConfig, isSeqTable, isSeqView, latest, loadNamespaceFromDir, lowest, managedFn, manualSource, nonNullFirst, overlayWinsUnion, overrideRowMutation, prefetchSource, priority, revertOverlayMutation, serializeNamespace, syncedContractSurface, t, toMany, toOne, toPlatformUser };
 //# sourceMappingURL=authoring.js.map
 //# sourceMappingURL=authoring.js.map