@sequenceholdings/orm 2.1.0 → 2.2.0

package/dist/compiler.js

@@ -1,14 +1,32 @@
 import { createHash } from 'crypto';
 import { z } from 'zod';
 import { Kind, print, visit, buildSchema, parse, validate, valueFromASTUntyped } from 'graphql';
+import { PgParser } from '@supabase/pg-parser';
 
 // src/compiler-gql/artifact.ts
 
 // src/constants.ts
 var COLUMN_IDENTIFIER_PATTERN = /^_?[a-z][a-z0-9_]*$/;
-var CAPABILITY_KEY_PATTERN = /^(?:org\/)?[a-z0-9-]{1,64}$/;
+var MAX_IDENTIFIER_LENGTH = 63;
+var CAPABILITY_KEY_PATTERN = /^(?:org\/|app\/[a-z][a-z0-9-]{0,63}\/)?[a-z0-9-]{1,64}$/;
+var QUALIFIED_TABLE_PATTERN = /^[a-z][a-z0-9_]{0,62}\.[a-z][a-z0-9_]{0,62}$/;
 var ORM_SCHEMA_PREFIX = "orm_";
 var ormSchemaName = (namespace) => `${ORM_SCHEMA_PREFIX}${namespace}`;
+var CELL_PARTS = ["at", "by", "rev", "source", "conflicts"];
+var CELL_PART_SUFFIX = {
+  at: "__at",
+  by: "__by",
+  rev: "__rev",
+  source: "__src",
+  conflicts: "__lost"
+};
+var MAX_TRACKED_COLUMN_NAME = MAX_IDENTIFIER_LENGTH - 6;
+var CELLS_FIELD = "cells";
+function cellColumnName(column, part) {
+  return `${column}${CELL_PART_SUFFIX[part]}`;
+}
+var MATERIALIZE_ACTOR = "orm:materialize";
+JSON.stringify({ sub: MATERIALIZE_ACTOR, org: null, roles: [], capabilities: [] });
 
 // src/hash.ts
 function stableJson(value) {
@@ -17,9 +35,478 @@ function stableJson(value) {
   const entries = Object.entries(value).filter(([, entryValue]) => entryValue !== void 0).sort(([a], [b]) => a < b ? -1 : 1).map(([key, entryValue]) => `${JSON.stringify(key)}:${stableJson(entryValue)}`);
   return `{${entries.join(",")}}`;
 }
+
+// src/compiler/sql.ts
+var CLAIMS_SETTING = "request.jwt.claims";
+var CAPABILITIES_CLAIM_KEY = "capabilities";
+var ROLES_CLAIM_KEY = "roles";
+var quoteIdentifier = (name2) => `"${name2.replaceAll('"', '""')}"`;
+var quoteLiteral = (value) => `'${value.replaceAll("'", "''")}'`;
+var CLAIMS_SOURCE = `nullif(current_setting('${CLAIMS_SETTING}', true), '')::jsonb`;
+var claimExpression = (key) => `(${CLAIMS_SOURCE} ->> ${quoteLiteral(key)})`;
+var scopedClaimsSource = (namespace) => namespace ? `(CASE WHEN ${CLAIMS_SOURCE} ? 'namespaces' THEN ${CLAIMS_SOURCE} -> 'namespaces' -> ${quoteLiteral(namespace)} ELSE ${CLAIMS_SOURCE} END)` : CLAIMS_SOURCE;
+var capabilityExpression = (key, namespace) => `coalesce(${scopedClaimsSource(namespace)} -> '${CAPABILITIES_CLAIM_KEY}' ? ${quoteLiteral(key)}, false)`;
+var roleExpression = (key, namespace) => `coalesce(${scopedClaimsSource(namespace)} -> '${ROLES_CLAIM_KEY}' ? ${quoteLiteral(key)}, false)`;
+
+// src/checks/compile.ts
+function tokenize(source) {
+  const tokens = [];
+  for (let position = 0; position < source.length; ) {
+    const char = source[position];
+    if (/\s/.test(char)) {
+      position++;
+      continue;
+    }
+    if (char === "(" || char === ")" || char === ",") {
+      tokens.push({ kind: char === "(" ? "lparen" : char === ")" ? "rparen" : "comma", value: char, position });
+      position++;
+      continue;
+    }
+    if (char === "'") {
+      const start = position++;
+      let value = "";
+      let closed = false;
+      while (position < source.length) {
+        if (source[position] !== "'") {
+          value += source[position++];
+          continue;
+        }
+        if (source[position + 1] === "'") {
+          value += "'";
+          position += 2;
+          continue;
+        }
+        position++;
+        closed = true;
+        break;
+      }
+      if (!closed) throw new Error(`unterminated string at position ${start}`);
+      if (/[\x00-\x1f\x7f]/.test(value)) throw new Error(`control character in string at position ${start}`);
+      tokens.push({ kind: "string", value, position: start });
+      continue;
+    }
+    const operator = /^(<=|>=|<>|!=|!~|=|<|>|~)/.exec(source.slice(position));
+    if (operator) {
+      tokens.push({ kind: "operator", value: operator[0] === "<>" ? "!=" : operator[0], position });
+      position += operator[0].length;
+      continue;
+    }
+    const number = /^-?\d+(?:\.\d+)?/.exec(source.slice(position));
+    if (number) {
+      tokens.push({ kind: "number", value: number[0], position });
+      position += number[0].length;
+      continue;
+    }
+    const identifier3 = /^[a-zA-Z_][a-zA-Z_0-9]*/.exec(source.slice(position));
+    if (identifier3) {
+      tokens.push({ kind: "identifier", value: identifier3[0], position });
+      position += identifier3[0].length;
+      continue;
+    }
+    throw new Error(`unexpected character '${char}' at position ${position}`);
+  }
+  tokens.push({ kind: "end", value: "", position: source.length });
+  if (tokens.length > 256) throw new Error("check expression exceeds 256 tokens");
+  return tokens;
+}
+var Parser = class {
+  constructor(tokens, columns) {
+    this.tokens = tokens;
+    this.columns = /* @__PURE__ */ new Map();
+    for (const column of columns) {
+      for (const alias of [column.name, column.columnName]) {
+        const previous = this.columns.get(alias);
+        if (previous && previous.columnName !== column.columnName) {
+          throw new Error(`ambiguous check column '${alias}'`);
+        }
+        this.columns.set(alias, column);
+      }
+    }
+  }
+  index = 0;
+  depth = 0;
+  columns;
+  parse() {
+    const expression = this.parseOr();
+    this.expect("end", "end of expression");
+    return expression;
+  }
+  parseOr() {
+    let left = this.parseAnd();
+    while (this.matchKeyword("or")) left = `(${left} OR ${this.parseAnd()})`;
+    return left;
+  }
+  parseAnd() {
+    let left = this.parseNot();
+    while (this.matchKeyword("and")) left = `(${left} AND ${this.parseNot()})`;
+    return left;
+  }
+  parseNot() {
+    if (this.matchKeyword("not")) return `(NOT ${this.parseNot()})`;
+    return this.parsePrimary();
+  }
+  parsePrimary() {
+    if (this.peek().kind === "lparen") {
+      if (++this.depth > 32) throw new Error("check expression nesting exceeds 32 levels");
+      this.advance();
+      const expression = this.parseOr();
+      this.expect("rparen", "')'");
+      this.depth--;
+      return `(${expression})`;
+    }
+    return this.parseComparison();
+  }
+  parseComparison() {
+    const left = this.parseValue();
+    if (this.matchKeyword("is")) {
+      const negate = this.matchKeyword("not");
+      this.expectKeyword("null");
+      return `${left.sql} IS ${negate ? "NOT " : ""}NULL`;
+    }
+    if (this.matchKeyword("between")) {
+      const lower = this.parseValue();
+      this.expectKeyword("and");
+      const upper = this.parseValue();
+      return `${left.sql} BETWEEN ${lower.sql} AND ${upper.sql}`;
+    }
+    if (this.matchKeyword("in")) {
+      this.expect("lparen", "'(' after IN");
+      const values = [this.parseValue()];
+      while (this.peek().kind === "comma") {
+        this.advance();
+        values.push(this.parseValue());
+      }
+      this.expect("rparen", "')' after IN values");
+      if (values.some((value) => !value.literal)) throw new Error("IN values must be literals");
+      return `${left.sql} IN (${values.map((value) => value.sql).join(", ")})`;
+    }
+    const operator = this.expect("operator", "a comparison operator");
+    const right = this.parseValue();
+    if (operator.value === "~" || operator.value === "!~") {
+      if (left.column && left.column.type !== "text") throw new Error("regex checks require a text column");
+      if (!right.literal) throw new Error("regex pattern must be a literal");
+    }
+    return `${left.sql} ${operator.value} ${right.sql}`;
+  }
+  parseValue() {
+    const token = this.advance();
+    if (token.kind === "string") return { sql: quoteLiteral(token.value), literal: true };
+    if (token.kind === "number") {
+      const number = Number(token.value);
+      if (!Number.isFinite(number) || Number.isInteger(number) && !Number.isSafeInteger(number)) {
+        throw new Error(`unsafe numeric literal at position ${token.position}`);
+      }
+      return { sql: token.value, literal: true };
+    }
+    if (token.kind !== "identifier") throw new Error(`expected a column or literal at position ${token.position}`);
+    const keyword = token.value.toLowerCase();
+    if (keyword === "true" || keyword === "false" || keyword === "null") return { sql: keyword.toUpperCase(), literal: true };
+    if (keyword === "btrim") {
+      this.expect("lparen", "'(' after btrim");
+      const column2 = this.parseColumn();
+      this.expect("rparen", "')' after btrim column");
+      if (column2.type !== "text") throw new Error("btrim requires a text column");
+      return { sql: `btrim(${quoteIdentifier(column2.columnName)})`, column: column2 };
+    }
+    const column = this.columns.get(token.value);
+    if (!column) throw new Error(`unknown check column '${token.value}'`);
+    return { sql: quoteIdentifier(column.columnName), column };
+  }
+  parseColumn() {
+    const token = this.expect("identifier", "a column name");
+    const column = this.columns.get(token.value);
+    if (!column) throw new Error(`unknown check column '${token.value}'`);
+    return column;
+  }
+  peek() {
+    return this.tokens[this.index];
+  }
+  advance() {
+    const token = this.peek();
+    if (token.kind !== "end") this.index++;
+    return token;
+  }
+  matchKeyword(keyword) {
+    if (this.peek().kind !== "identifier" || this.peek().value.toLowerCase() !== keyword) return false;
+    this.advance();
+    return true;
+  }
+  expectKeyword(keyword) {
+    if (!this.matchKeyword(keyword)) throw new Error(`expected '${keyword}' at position ${this.peek().position}`);
+  }
+  expect(kind, description) {
+    const token = this.peek();
+    if (token.kind !== kind) throw new Error(`expected ${description} at position ${token.position}`);
+    return this.advance();
+  }
+};
+function compileCheckExpression(source, columns) {
+  return new Parser(tokenize(source), columns).parse();
+}
+var policyVariantSchema = z.object({
+  /** Claims-only guard (capability()/role()/claim() comparisons — no columns). */
+  when: z.string().min(1).max(1e3),
+  /** Exactly one of: allow-all bypass, or a row predicate. */
+  allow: z.literal(true).optional(),
+  policy: z.string().min(1).max(2e3).optional()
+}).refine((v) => v.allow === true !== (typeof v.policy === "string"), {
+  message: "A variant declares exactly one of allow: true or policy"
+});
+var policyExpressionSchema = z.union([
+  z.string().min(1).max(2e3),
+  z.object({
+    default: z.string().min(1).max(2e3),
+    variants: z.array(policyVariantSchema).max(10).default([])
+  })
+]);
+function parseDurationMs(input) {
+  if (typeof input === "number") return Number.isInteger(input) && input > 0 ? input : void 0;
+  const match = /^(\d+(?:\.\d+)?)(ms|s|m)$/.exec(input);
+  if (!match) return void 0;
+  const factor = match[2] === "ms" ? 1 : match[2] === "s" ? 1e3 : 6e4;
+  const value = Math.round(Number(match[1]) * factor);
+  return value > 0 ? value : void 0;
+}
+var identifier = z.string().min(1).max(63).regex(/^[a-z][a-z0-9_]*$/);
+var durationMs = z.number().int().positive().max(24 * 60 * 60 * 1e3);
+var RESOLVED_VIEW_SYSTEM_COLUMNS = {
+  writebackStatus: { name: "writebackStatus", columnName: "_writeback_status", type: "text" },
+  writebackError: { name: "writebackError", columnName: "_writeback_error", type: "text" }
+};
+var RESOLVED_SOURCE_SYSTEM_COLUMNS = {
+  tombstoned: { name: "sysTombstoned", columnName: "_tombstoned" },
+  fetchedAt: { name: "sysFetchedAt", columnName: "_fetched_at" },
+  writebackStatus: { name: "sysWritebackStatus", columnName: "_writeback_status" },
+  writebackError: { name: "sysWritebackError", columnName: "_writeback_error" },
+  writebackAt: { name: "sysWritebackAt", columnName: "_writeback_at" }
+};
+var RESOLVED_VIEW_CELL_PARTS = ["source", "at", "by", "conflicts"];
+/* @__PURE__ */ new Set([
+  ...Object.values(RESOLVED_VIEW_SYSTEM_COLUMNS).flatMap((c) => [c.name, c.columnName]),
+  ...Object.values(RESOLVED_SOURCE_SYSTEM_COLUMNS).flatMap((c) => [c.name, c.columnName])
+]);
+var COMPARATORS = ["latest", "highest", "lowest", "priority", "nonNullFirst", "custom"];
+var canonicalFunctionRefSchema = z.object({
+  /** `managed` = a Managed Function id/slug; `native` = an in-process Atlas function (reserved). */
+  kind: z.enum(["managed", "native"]),
+  id: z.string().min(1).max(200)
+}).strict();
+var canonicalFetchShapeSchema = z.union([
+  z.object({ shape: z.literal("single") }).strict(),
+  z.object({ shape: z.literal("batch"), maxKeys: z.number().int().min(2).max(500) }).strict()
+]);
+var canonicalResolvedSourceSchema = z.object({
+  name: identifier,
+  kind: z.enum(["manual", "etl", "prefetch"]),
+  /** Backing relation in this namespace: an internal table (manual/prefetch) or a synced table (etl). */
+  table: identifier,
+  /** Resolved columns (logical names) this source supplies — the primary key is implicit. */
+  columns: z.array(z.string().min(1).max(63)).min(1).max(500),
+  /** etl: logical timestamptz/date column on the synced table used as every cell's updated_at. */
+  updatedAt: z.string().min(1).max(63).optional(),
+  /** prefetch: resolved column holding the source system's key (may be the primary key). */
+  key: z.string().min(1).max(63).optional(),
+  fetch: canonicalFetchShapeSchema.optional(),
+  function: canonicalFunctionRefSchema.optional(),
+  prefetchDefaults: z.object({
+    maxStalenessMs: durationMs,
+    timeoutMs: durationMs,
+    onError: z.enum(["fallback", "fail"])
+  }).strict().optional(),
+  writeback: z.object({
+    columns: z.array(z.string().min(1).max(63)).min(1).max(500),
+    defaultMode: z.enum(["sync", "async"]),
+    timeoutMs: durationMs,
+    /** Remove confirmed cells from the manual source so a stale edit cannot shadow the source. */
+    clearManualOnConfirm: z.boolean()
+  }).strict().optional()
+}).strict();
+var canonicalResolveRuleSchema = z.object({
+  column: z.string().min(1).max(63),
+  comparator: z.enum(COMPARATORS),
+  /** Source names, in tie-break order. */
+  candidates: z.array(identifier).min(1).max(16),
+  /** custom only: SQL ORDER BY key over value / updated_at / source / actor / ord. */
+  orderBy: z.string().min(1).max(2e3).optional()
+}).strict();
+var canonicalResolvedSchema = z.object({
+  sources: z.array(canonicalResolvedSourceSchema).min(1).max(16),
+  /** One rule per resolved (non-pk) column; documents the generated view for tooling. */
+  resolve: z.array(canonicalResolveRuleSchema).max(500),
+  /** Sources whose tombstone hides the resolved row (v1: the manual source only). */
+  deletedBy: z.array(identifier).max(1).default([]),
+  /**
+   * Materialized: the view reads an indexed internal table (`table`) that the
+   * data plane keeps in step with `compute`, the internal view holding the
+   * resolution query. Omitted when the view computes on read.
+   */
+  materialized: z.object({ table: identifier, compute: identifier }).strict().optional(),
+  /** Write policies evaluated against the RESOLVED row (reads use the view's read policy). */
+  policies: z.object({
+    write: policyExpressionSchema.optional(),
+    insert: policyExpressionSchema.optional(),
+    update: policyExpressionSchema.optional()
+  }).strict().default({})
+}).strict();
+function validateResolvedView({ view, tables, views = [] }) {
+  const resolved = view.resolved;
+  if (!resolved) return [];
+  const errors = [];
+  const fail4 = (message) => errors.push(`resolved table '${view.view}': ${message}`);
+  const pkColumn = view.primaryKey?.length === 1 ? view.columns.find((c) => c.columnName === view.primaryKey?.[0]) : void 0;
+  if (!pkColumn) {
+    fail4("requires exactly one primary-key column");
+    return errors;
+  }
+  const systemNames = new Set(Object.values(RESOLVED_VIEW_SYSTEM_COLUMNS).map((c) => c.name));
+  const scope = {
+    view,
+    resolved,
+    pkColumn,
+    dataColumns: new Map(view.columns.filter((c) => !systemNames.has(c.name) && c.cell === void 0).map((c) => [c.name, c])),
+    sourceByName: /* @__PURE__ */ new Map(),
+    fail: fail4
+  };
+  if (resolved.sources.filter((source) => source.kind === "manual").length !== 1) fail4("requires exactly one manual source");
+  const tableByName = new Map(tables.map((table) => [table.table, table]));
+  for (const source of resolved.sources) {
+    if (scope.sourceByName.has(source.name)) fail4(`duplicate source '${source.name}'`);
+    scope.sourceByName.set(source.name, source);
+    const table = tableByName.get(source.table);
+    if (!table) fail4(`source '${source.name}' references unknown table '${source.table}'`);
+    else validateSource({ scope, source, table });
+  }
+  validateRules(scope);
+  validateViewCells(scope);
+  if (resolved.materialized) validateMaterialized({ scope, tableByName, views });
+  for (const name2 of resolved.deletedBy) {
+    if (scope.sourceByName.get(name2)?.kind !== "manual") fail4(`deletedBy '${name2}' must be the manual source`);
+  }
+  return errors;
+}
+function validateSource({ scope, source, table }) {
+  const { fail: fail4 } = scope;
+  if (source.kind === "etl" && table.source === void 0) fail4(`etl source '${source.name}' must reference a synced table`);
+  if (source.kind !== "etl" && (table.internal !== true || table.cellMetadata !== true)) {
+    fail4(`${source.kind} source '${source.name}' must reference an internal table with cell metadata`);
+  }
+  const hasRev = table.columns.some((column) => column.cell?.part === "rev");
+  if (source.kind === "manual" && !hasRev) fail4(`manual source '${source.name}' must carry '__rev' cell columns`);
+  if (source.kind === "prefetch" && hasRev) fail4(`prefetch source '${source.name}' must not carry '__rev' cell columns`);
+  const byName = new Map(table.columns.map((c) => [c.name, c]));
+  validateSourceColumns({ scope, source, byName });
+  if (source.kind === "etl") {
+    const updatedAt = source.updatedAt === void 0 ? void 0 : byName.get(source.updatedAt);
+    if (source.updatedAt !== void 0 && updatedAt?.type !== "timestamptz" && updatedAt?.type !== "date") {
+      fail4(`etl source '${source.name}' updatedAt must name a timestamptz/date column on '${source.table}'`);
+    }
+  }
+  validatePrefetchFields({ scope, source });
+}
+function validatePrefetchFields({ scope, source }) {
+  const { fail: fail4, pkColumn } = scope;
+  if (source.kind !== "prefetch") {
+    if (source.key || source.fetch || source.function || source.prefetchDefaults || source.writeback) {
+      fail4(`only prefetch sources may declare key/fetch/function/prefetchDefaults/writeback ('${source.name}')`);
+    }
+    return;
+  }
+  if (!source.key || !source.fetch || !source.function || !source.prefetchDefaults) {
+    fail4(`prefetch source '${source.name}' requires key, fetch, function and prefetchDefaults`);
+  } else if (source.key !== pkColumn.name && !source.columns.includes(source.key)) {
+    fail4(`prefetch source '${source.name}' key '${source.key}' must be the primary key or one of its columns`);
+  }
+  for (const column of source.writeback?.columns ?? []) {
+    if (!source.columns.includes(column)) fail4(`prefetch source '${source.name}' writes back '${column}', which it does not supply`);
+  }
+}
+function validateSourceColumns({ scope, source, byName }) {
+  const { fail: fail4, pkColumn, dataColumns } = scope;
+  for (const column of [pkColumn.name, ...source.columns]) {
+    const own = column === pkColumn.name ? pkColumn : dataColumns.get(column);
+    const theirs = byName.get(column);
+    if (!own) fail4(`source '${source.name}' supplies unknown column '${column}'`);
+    else if (!theirs) fail4(`source '${source.name}' table '${source.table}' has no column '${column}'`);
+    else if (JSON.stringify(theirs.type) !== JSON.stringify(own.type)) fail4(`column '${column}' has a different type on source '${source.name}'`);
+  }
+}
+function validateRules({ resolved, pkColumn, dataColumns, sourceByName, fail: fail4 }) {
+  const ruled = /* @__PURE__ */ new Set();
+  for (const rule of resolved.resolve) {
+    if (!dataColumns.has(rule.column) || rule.column === pkColumn.name) {
+      fail4(`resolve rule targets unknown column '${rule.column}'`);
+      continue;
+    }
+    if (ruled.has(rule.column)) fail4(`column '${rule.column}' has more than one resolve rule`);
+    ruled.add(rule.column);
+    if (rule.comparator === "custom" !== (rule.orderBy !== void 0)) {
+      fail4(`column '${rule.column}': orderBy is required for custom comparators and only allowed there`);
+    }
+    if (new Set(rule.candidates).size !== rule.candidates.length) fail4(`column '${rule.column}' repeats a candidate`);
+    for (const candidate of rule.candidates) {
+      const source = sourceByName.get(candidate);
+      if (!source) fail4(`column '${rule.column}' names unknown candidate source '${candidate}'`);
+      else if (!source.columns.includes(rule.column)) fail4(`column '${rule.column}' candidate '${candidate}' does not supply it`);
+    }
+  }
+  for (const column of dataColumns.keys()) {
+    if (column !== pkColumn.name && !ruled.has(column)) fail4(`column '${column}' has no resolve rule`);
+  }
+}
+var VIEW_CELL_TYPES = {
+  source: "text",
+  at: "timestamptz",
+  by: "text",
+  conflicts: "jsonb"
+};
+function validateViewCells({ view, dataColumns, pkColumn, fail: fail4 }) {
+  const expected = /* @__PURE__ */ new Map();
+  for (const column of dataColumns.values()) {
+    if (column.name === pkColumn.name) continue;
+    for (const part of RESOLVED_VIEW_CELL_PARTS) {
+      expected.set(cellColumnName(column.name, part), { part, columnName: cellColumnName(column.columnName, part) });
+    }
+  }
+  for (const column of view.columns) {
+    if (!column.cell) continue;
+    const want = expected.get(column.name);
+    if (!want || want.part !== column.cell.part || want.columnName !== column.columnName || cellColumnName(column.cell.of, column.cell.part) !== column.name) {
+      fail4(`unexpected cell column '${column.name}'`);
+      continue;
+    }
+    if (column.type !== VIEW_CELL_TYPES[column.cell.part]) fail4(`cell column '${column.name}' must be ${VIEW_CELL_TYPES[column.cell.part]}`);
+    expected.delete(column.name);
+  }
+  for (const name2 of expected.keys()) fail4(`missing cell column '${name2}'`);
+}
+var columnSignature = (columns) => JSON.stringify(columns.map((column) => [column.name, column.columnName, column.type]));
+function validateMaterialized({ scope, tableByName, views }) {
+  const { view, resolved, fail: fail4 } = scope;
+  const { table: tableName, compute: computeName } = resolved.materialized;
+  const table = tableByName.get(tableName);
+  if (!table || table.internal !== true || table.materializes !== view.view) {
+    fail4(`materialized table '${tableName}' must be an internal table that materializes '${view.view}'`);
+  } else {
+    if (columnSignature(table.columns) !== columnSignature(view.columns)) fail4(`materialized table '${tableName}' must have exactly the view's columns`);
+    if (JSON.stringify(table.primaryKey ?? []) !== JSON.stringify(view.primaryKey ?? [])) fail4(`materialized table '${tableName}' must share the view's primary key`);
+  }
+  const compute = views.find((candidate) => candidate.view === computeName);
+  if (!compute || compute.internal !== true) fail4(`compute view '${computeName}' must be an internal view`);
+  else if (columnSignature(compute.columns) !== columnSignature(view.columns)) fail4(`compute view '${computeName}' must have exactly the view's columns`);
+  for (const source of resolved.sources) {
+    if (source.kind !== "etl") continue;
+    const read = tableByName.get(source.table)?.policies?.read;
+    const unconditional = typeof read === "string" ? read.trim() === "true" : read !== void 0 && read.default.trim() === "true" && read.variants.length === 0;
+    if (!unconditional) {
+      fail4(`etl source '${source.name}' must have read policy 'true' to be materialized (the copy is shared by every caller)`);
+    }
+  }
+}
+
+// src/canonical/v2.ts
 var CANONICAL_FORMAT = 2;
 var IDENTIFIER_RE = /^[a-z][a-z0-9_]*$/;
-var identifier = z.string().min(1).max(63).regex(IDENTIFIER_RE);
+var identifier2 = z.string().min(1).max(63).regex(IDENTIFIER_RE);
 var columnIdentifier = z.string().min(1).max(63).regex(COLUMN_IDENTIFIER_PATTERN);
 var COLUMN_TYPES = [
   "uuid",
@@ -35,14 +522,14 @@ var COLUMN_TYPES = [
 ];
 var columnTypeSchema = z.enum(COLUMN_TYPES);
 var canonicalEnumSchema = z.object({
-  name: identifier,
+  name: identifier2,
   values: z.array(z.string().min(1).max(63)).min(1).max(100)
 });
 var canonicalColumnSchema = z.object({
   /** Property name in TS (camelCase); columnName is the Postgres name. */
   name: z.string().min(1).max(63),
   columnName: columnIdentifier,
-  type: z.union([columnTypeSchema, z.object({ enum: identifier })]),
+  type: z.union([columnTypeSchema, z.object({ enum: identifier2 })]),
   nullable: z.boolean().default(true),
   unique: z.boolean().default(false),
   /** Literal default, or one of the allowlisted SQL functions. */
@@ -58,7 +545,14 @@ var canonicalColumnSchema = z.object({
   /** Migration hints — same semantics as v1. */
   renamedFrom: columnIdentifier.optional(),
   cast: z.string().max(200).optional(),
-  deprecated: z.boolean().default(false)
+  deprecated: z.boolean().default(false),
+  /**
+   * Marks a system cell-metadata column (see CELL_PARTS in constants): part
+   * `part` of the cell of logical column `of`. Synthesized by authoring,
+   * never client-writable, absent from GraphQL scalar fields. Omitted on
+   * ordinary columns so their hashes are unchanged.
+   */
+  cell: z.object({ of: z.string().min(1).max(63), part: z.enum(CELL_PARTS) }).strict().optional()
 }).superRefine((column, ctx) => {
   if (column.onUpdateFn === void 0) return;
   if (typeof column.type !== "string" || column.type !== "timestamptz" && column.type !== "date") {
@@ -73,36 +567,28 @@ var canonicalLinkSchema = z.object({
   name: z.string().min(1).max(63),
   kind: z.enum(["toOne", "toMany", "toPlatformUser"]),
   /** Target table name (namespace-local). Absent for toPlatformUser. */
-  target: identifier.optional(),
+  target: identifier2.optional(),
+  /** Owning namespace of an imported target; omitted for local links. */
+  namespace: identifier2.max(41).optional(),
   /** FK column on the owning side (toOne/toPlatformUser: on this table; toMany: on the target). */
   on: columnIdentifier,
   /** Referenced column on the target (default: target's PK / platform user `sub`). */
   references: columnIdentifier.optional(),
   /** enforce: true emits a real FK constraint (same-namespace toOne only). */
   enforce: z.boolean().default(false),
+  onDelete: z.enum(["cascade", "restrict", "no action", "set null", "set default"]).optional(),
+  onUpdate: z.enum(["cascade", "restrict", "no action", "set null", "set default"]).optional(),
   description: z.string().max(500).optional()
 });
 var canonicalIndexSchema = z.object({
   columns: z.array(columnIdentifier).min(1),
   unique: z.boolean().default(false),
-  name: identifier.optional()
-});
-var policyVariantSchema = z.object({
-  /** Claims-only guard (capability()/role()/claim() comparisons — no columns). */
-  when: z.string().min(1).max(1e3),
-  /** Exactly one of: allow-all bypass, or a row predicate. */
-  allow: z.literal(true).optional(),
-  policy: z.string().min(1).max(2e3).optional()
-}).refine((v) => v.allow === true !== (typeof v.policy === "string"), {
-  message: "A variant declares exactly one of allow: true or policy"
+  name: identifier2.optional()
 });
-var policyExpressionSchema = z.union([
-  z.string().min(1).max(2e3),
-  z.object({
-    default: z.string().min(1).max(2e3),
-    variants: z.array(policyVariantSchema).max(10).default([])
-  })
-]);
+var canonicalCheckSchema = z.object({
+  name: identifier2,
+  expression: z.string().min(1).max(2e3)
+}).strict();
 var canonicalPoliciesSchema = z.object({
   read: policyExpressionSchema.optional(),
   write: policyExpressionSchema.optional(),
@@ -133,7 +619,7 @@ function isSingleViewQuerySql(value) {
   return state === "normal" && !/\$[a-z_0-9]*\$/i.test(query);
 }
 var canonicalActionSchema = z.object({
-  name: identifier,
+  name: identifier2,
   requires: z.string().max(1e3).optional(),
   params: z.record(z.string(), z.object({
     type: columnTypeSchema,
@@ -145,9 +631,9 @@ var canonicalActionSchema = z.object({
 });
 var canonicalCowMutationSchema = z.object({
   kind: z.enum(["override", "revert"]),
-  name: identifier,
+  name: identifier2,
   /** Synced table (same namespace) the overlay copies from / falls back to. */
-  synced: identifier,
+  synced: identifier2,
   /** Single-column primary key PROPERTY (TS camelCase, like column `name`) shared by overlay and synced. */
   pk: z.string().min(1).max(63),
   /** Override: contract properties copied INSERT…SELECT from synced (pk included). Empty for revert. */
@@ -175,23 +661,28 @@ var canonicalCowMutationSchema = z.object({
   }
 });
 var canonicalForeignKeySchema = z.object({
-  name: identifier,
+  name: identifier2,
   columns: z.array(columnIdentifier).min(1).max(8),
-  target: identifier,
+  target: identifier2,
   references: z.array(columnIdentifier).min(1).max(8),
-  deferrable: z.enum(["initially-immediate", "initially-deferred"]).optional()
+  deferrable: z.enum(["initially-immediate", "initially-deferred"]).optional(),
+  onDelete: z.enum(["cascade", "restrict", "no action", "set null", "set default"]).optional(),
+  onUpdate: z.enum(["cascade", "restrict", "no action", "set null", "set default"]).optional()
 }).strict();
 var canonicalTableSchema = z.object({
-  table: identifier,
+  table: identifier2,
+  displayName: z.string().trim().min(1).max(120).optional(),
   description: z.string().max(2e3).optional(),
   /** Table-level rename hint (new in v2). */
-  renamedFrom: identifier.optional(),
-  /** Synced/reflected read-only tables (`source: gold.*`) — v1 semantics. */
-  source: z.string().regex(/^gold\.[a-z][a-z0-9_]*$/).optional(),
+  renamedFrom: identifier2.optional(),
+  /** Synced/reflected read-only tables (`source: schema.table`) — v1 semantics. */
+  source: z.string().regex(QUALIFIED_TABLE_PATTERN).optional(),
   columns: z.array(canonicalColumnSchema).default([]),
   primaryKey: z.array(columnIdentifier).min(1).max(8).optional(),
   links: z.array(canonicalLinkSchema).default([]),
   indexes: z.array(canonicalIndexSchema).default([]),
+  /** Omitted by old definitions, preserving their existing content hashes. */
+  checks: z.array(canonicalCheckSchema).max(100).optional(),
   policies: canonicalPoliciesSchema.default({}),
   /**
    * v1-conversion carry-over only. v2 has no action surface — the runtime
@@ -202,22 +693,55 @@ var canonicalTableSchema = z.object({
   /** Optional (not defaulted) so pre-CoW canonical documents keep byte-identical hashes. */
   cowMutations: z.array(canonicalCowMutationSchema).optional(),
   /** Omitted by old definitions, preserving their existing content hashes. */
-  foreignKeys: z.array(canonicalForeignKeySchema).max(100).optional()
+  foreignKeys: z.array(canonicalForeignKeySchema).max(100).optional(),
+  /**
+   * Per-cell edit metadata (`cellMetadata: true` in authoring): every tracked
+   * column `c` carries typed `c__at` / `c__by` system columns (plus `c__rev`
+   * on a resolved table's internal sources), listed explicitly in `columns`
+   * with a `cell` marker so DDL and migrations treat them as ordinary columns.
+   * Omitted when off so existing definitions hash unchanged.
+   */
+  cellMetadata: z.literal(true).optional(),
+  /**
+   * System-owned backing table of a resolved table (its manual or prefetch
+   * source). Internal tables get DDL and IR metadata but no GraphQL surface;
+   * only the data plane writes them. Omitted when false.
+   */
+  internal: z.literal(true).optional(),
+  /**
+   * The materialized copy of resolved table `materializes` (internal): the
+   * same columns as that view, including its cell parts, maintained by the
+   * data plane. Omitted otherwise.
+   */
+  materializes: identifier2.optional()
 });
+var MAX_VIEW_QUERY = 1e5;
+var MAX_RESOLVED_VIEW_QUERY = 5e6;
 var canonicalViewSchema = z.object({
-  view: identifier,
+  view: identifier2,
   description: z.string().max(2e3).optional(),
   columns: z.array(canonicalColumnSchema).min(1),
   /** Logical identity for GraphQL only; PostgreSQL views have no PK constraint. */
   primaryKey: z.array(columnIdentifier).min(1).max(8).optional(),
   links: z.array(canonicalLinkSchema).default([]),
   policies: z.object({ read: policyExpressionSchema }).strict(),
-  query: z.string().min(1).max(1e5).refine(isSingleViewQuerySql, {
+  query: z.string().min(1).max(MAX_RESOLVED_VIEW_QUERY).refine(isSingleViewQuerySql, {
     message: "view query must be one SELECT/WITH statement without comments or dollar-quoted bodies"
   }),
   /** Namespace-local logical relation names, sorted for deterministic hashing. */
-  dependencies: z.array(identifier).max(500)
+  dependencies: z.array(identifier2).max(500),
+  /**
+   * Present when this view is a resolved table (defineResolvedTable): the
+   * multi-source metadata behind its generated query. Omitted otherwise so
+   * existing views hash unchanged.
+   */
+  resolved: canonicalResolvedSchema.optional(),
+  /** System-owned view (a materialized resolved table's compute view): no GraphQL surface. */
+  internal: z.literal(true).optional()
 }).superRefine((view, ctx) => {
+  if (view.resolved === void 0 && view.query.length > MAX_VIEW_QUERY) {
+    ctx.addIssue({ code: "custom", path: ["query"], message: `view query must be at most ${MAX_VIEW_QUERY} characters` });
+  }
   for (const [index, column] of view.columns.entries()) {
     if (column.default !== void 0 || column.defaultFn !== void 0) {
       ctx.addIssue({ code: "custom", path: ["columns", index], message: `view column '${column.name}' cannot declare a default` });
@@ -232,20 +756,91 @@ var canonicalViewSchema = z.object({
       ctx.addIssue({ code: "custom", path: ["columns", index], message: `view column '${column.name}' cannot declare migration hints` });
     }
   }
+  if (view.resolved === void 0 && view.internal !== true) {
+    for (const [index, column] of view.columns.entries()) {
+      if (column.cell) ctx.addIssue({ code: "custom", path: ["columns", index], message: `only resolved tables carry cell columns ('${column.name}')` });
+    }
+  }
   for (const [index, link] of view.links.entries()) {
     if (link.enforce) {
       ctx.addIssue({ code: "custom", path: ["links", index, "enforce"], message: `view link '${link.name}' cannot enforce a foreign key` });
     }
+    if (link.onDelete !== void 0 || link.onUpdate !== void 0) {
+      ctx.addIssue({ code: "custom", path: ["links", index], message: `view link '${link.name}' cannot declare referential actions` });
+    }
   }
 });
-var canonicalDefinitionSchema = z.object({
+var CELL_PART_TYPES = {
+  at: "timestamptz",
+  by: "text",
+  rev: "uuid",
+  source: "text",
+  conflicts: "jsonb"
+};
+function trackedCellColumns(table) {
+  const pk = new Set(table.primaryKey ?? []);
+  return table.columns.filter((column) => column.cell === void 0 && !pk.has(column.columnName) && column.onUpdateFn === void 0);
+}
+var SUFFIXES = Object.values(CELL_PART_SUFFIX);
+function validateCellMetadata(table, index, ctx) {
+  const fail4 = (message, path = ["tables", index]) => ctx.addIssue({ code: "custom", path, message });
+  const cells = table.columns.flatMap((column, position) => column.cell ? [{ column, position, cell: column.cell }] : []);
+  if (table.materializes !== void 0) return;
+  if (table.cellMetadata !== true) {
+    for (const { position } of cells) fail4(`cell-metadata columns require cellMetadata on table '${table.table}'`, ["tables", index, "columns", position]);
+    return;
+  }
+  if (table.source !== void 0) {
+    fail4(`synced table '${table.table}' cannot track cell metadata`);
+    return;
+  }
+  const tracked = trackedCellColumns(table);
+  const byName = new Map(tracked.map((column) => [column.name, column]));
+  const withRev = cells.some(({ cell }) => cell.part === "rev");
+  if (withRev && table.internal !== true) fail4(`only a resolved table's internal sources carry '__rev' cell columns ('${table.table}')`);
+  const seen = /* @__PURE__ */ new Set();
+  for (const { column, position, cell } of cells) {
+    const path = ["tables", index, "columns", position];
+    const owner = byName.get(cell.of);
+    if (!owner) {
+      fail4(`cell column '${column.name}' belongs to '${cell.of}', which is not a tracked column`, path);
+      continue;
+    }
+    if (cell.part !== "at" && cell.part !== "by" && cell.part !== "rev") fail4(`a table cell column must be part at/by/rev, not '${cell.part}'`, path);
+    if (column.name !== cellColumnName(owner.name, cell.part) || column.columnName !== cellColumnName(owner.columnName, cell.part)) {
+      fail4(`cell column for '${owner.name}' ${cell.part} must be named '${cellColumnName(owner.name, cell.part)}' / '${cellColumnName(owner.columnName, cell.part)}'`, path);
+    }
+    if (column.type !== CELL_PART_TYPES[cell.part] || !column.nullable || column.unique || column.default !== void 0 || column.defaultFn !== void 0) {
+      fail4(`cell column '${column.name}' must be a nullable, default-less ${CELL_PART_TYPES[cell.part]}`, path);
+    }
+    const key = `${cell.of}:${cell.part}`;
+    if (seen.has(key)) fail4(`duplicate cell column '${column.name}'`, path);
+    seen.add(key);
+  }
+  for (const column of tracked) {
+    if (column.columnName.length > MAX_TRACKED_COLUMN_NAME) {
+      fail4(`column '${column.columnName}' is too long to track cell metadata (max ${MAX_TRACKED_COLUMN_NAME} characters)`);
+    }
+    if (SUFFIXES.some((suffix) => column.columnName.endsWith(suffix))) {
+      fail4(`column '${column.columnName}' ends in a reserved cell-metadata suffix (${SUFFIXES.join(", ")})`);
+    }
+    for (const part of withRev ? ["at", "by", "rev"] : ["at", "by"]) {
+      if (!seen.has(`${column.name}:${part}`)) fail4(`tracked column '${column.name}' is missing its '${cellColumnName(column.columnName, part)}' cell column`);
+    }
+  }
+}
+var exportGateSchema = z.union([z.literal(true), z.object({ capability: z.string().min(1) }).strict(), z.object({ role: z.string().min(1) }).strict()]);
+var relationExportSchema = z.object({ read: exportGateSchema, write: exportGateSchema.optional() }).strict();
+var localDefinitionSchema = z.object({
   definition_format: z.literal(CANONICAL_FORMAT),
-  namespace: identifier.max(41),
+  namespace: identifier2.max(41),
   description: z.string().max(2e3).optional(),
   enums: z.array(canonicalEnumSchema).default([]),
   tables: z.array(canonicalTableSchema).min(0).max(500),
   /** Optional to preserve byte-identical hashes for pre-view canonical v2 documents. */
   views: z.array(canonicalViewSchema).max(500).optional(),
+  /** Target-owned cross-namespace access contract, using existing namespace grants. */
+  exports: z.record(identifier2, relationExportSchema).optional(),
   /** Verbatim custom-roles grammar (@sequenceholdings/custom-roles-manifest). */
   capabilities: z.object({
     roles: z.unknown().optional(),
@@ -258,6 +853,7 @@ var canonicalDefinitionSchema = z.object({
       ctx.addIssue({ code: "custom", path: ["tables", index, "table"], message: `duplicate relation '${table.table}'` });
     }
     seen.add(table.table);
+    validateCellMetadata(table, index, ctx);
     if (table.source !== void 0) {
       for (const [columnIndex, column] of table.columns.entries()) {
         if (column.onUpdateFn !== void 0) {
@@ -271,31 +867,68 @@ var canonicalDefinitionSchema = z.object({
     }
   }
   const fkTables = new Map(definition.tables.map((table) => [table.table, table]));
+  const relations = /* @__PURE__ */ new Set([...fkTables.keys(), ...(definition.views ?? []).map((view) => view.view)]);
+  for (const name2 of Object.keys(definition.exports ?? {})) {
+    if (!relations.has(name2)) ctx.addIssue({ code: "custom", path: ["exports", name2], message: `export '${name2}' is not a local object` });
+  }
   for (const [tableIndex, table] of definition.tables.entries()) {
+    for (const [linkIndex, link] of table.links.entries()) {
+      if (link.enforce && link.namespace !== void 0 && link.namespace !== definition.namespace) {
+        ctx.addIssue({ code: "custom", path: ["tables", tableIndex, "links", linkIndex], message: "physical foreign keys require a local target; use an ORM link without enforce" });
+      }
+    }
     const names = /* @__PURE__ */ new Set([
       ...table.primaryKey?.length ? [`${table.table}_pkey`] : [],
       ...table.columns.filter((column) => column.unique && !(table.primaryKey?.length === 1 && table.primaryKey[0] === column.columnName)).map((column) => `${table.table}_${column.columnName}_unique`),
       ...table.links.filter((link) => link.enforce).map((link) => `fk_${table.table}_${link.name}`)
     ]);
+    for (const [index, link] of table.links.entries()) {
+      if ((link.onDelete !== void 0 || link.onUpdate !== void 0) && (!link.enforce || link.kind !== "toOne")) {
+        ctx.addIssue({ code: "custom", path: ["tables", tableIndex, "links", index], message: "referential actions require an enforced toOne link" });
+      }
+      if (link.onDelete === "set null" || link.onUpdate === "set null") {
+        const source = table.columns.find((column) => column.columnName === link.on);
+        if (source?.nullable === false || table.primaryKey?.includes(link.on)) ctx.addIssue({ code: "custom", path: ["tables", tableIndex, "links", index], message: "SET NULL requires a nullable source column" });
+      }
+    }
+    for (const [index, check] of (table.checks ?? []).entries()) {
+      const fail4 = (message) => ctx.addIssue({ code: "custom", path: ["tables", tableIndex, "checks", index], message });
+      if (table.source) fail4("synced tables cannot declare checks");
+      if (names.has(check.name)) fail4(`duplicate constraint '${check.name}'`);
+      names.add(check.name);
+      try {
+        compileCheckExpression(check.expression, table.columns);
+      } catch (error) {
+        fail4(error instanceof Error ? error.message : String(error));
+      }
+    }
     for (const [index, fk] of (table.foreignKeys ?? []).entries()) {
-      const fail2 = (message) => ctx.addIssue({ code: "custom", path: ["tables", tableIndex, "foreignKeys", index], message });
-      if (names.has(fk.name)) fail2(`duplicate foreign key '${fk.name}'`);
+      const fail4 = (message) => ctx.addIssue({ code: "custom", path: ["tables", tableIndex, "foreignKeys", index], message });
+      if (names.has(fk.name)) fail4(`duplicate foreign key '${fk.name}'`);
       names.add(fk.name);
       const target = fkTables.get(fk.target);
       if (table.source || !target || target.source) {
-        fail2("foreign keys must connect owned tables in the same namespace");
+        fail4("foreign keys must connect owned tables in the same namespace");
         continue;
       }
-      if (fk.columns.length !== fk.references.length) fail2("foreign key columns and references must have the same number of columns");
-      if (new Set(fk.columns).size !== fk.columns.length || new Set(fk.references).size !== fk.references.length) fail2("foreign key columns must not repeat");
-      for (const [position, name] of fk.columns.entries()) {
-        const sourceColumn = table.columns.find((column) => column.columnName === name);
+      if (fk.columns.length !== fk.references.length) fail4("foreign key columns and references must have the same number of columns");
+      if (new Set(fk.columns).size !== fk.columns.length || new Set(fk.references).size !== fk.references.length) fail4("foreign key columns must not repeat");
+      for (const [position, name2] of fk.columns.entries()) {
+        const sourceColumn = table.columns.find((column) => column.columnName === name2);
         const targetColumn = target.columns.find((column) => column.columnName === fk.references[position]);
-        if (!sourceColumn || !targetColumn) fail2("foreign key references an unknown column");
-        else if (JSON.stringify(sourceColumn.type) !== JSON.stringify(targetColumn.type)) fail2("foreign key column types must match");
+        if (!sourceColumn || !targetColumn) fail4("foreign key references an unknown column");
+        else if (JSON.stringify(sourceColumn.type) !== JSON.stringify(targetColumn.type)) fail4("foreign key column types must match");
+      }
+      if (fk.onDelete === "set null" || fk.onUpdate === "set null") {
+        if (fk.columns.some((name2) => table.columns.find((column) => column.columnName === name2)?.nullable === false || table.primaryKey?.includes(name2))) fail4("SET NULL requires nullable source columns");
       }
       const uniqueKeys = [target.primaryKey ?? [], ...target.indexes.filter((index2) => index2.unique).map((index2) => index2.columns), ...target.columns.filter((column) => column.unique).map((column) => [column.columnName])];
-      if (!uniqueKeys.some((key) => key.length === fk.references.length && key.every((column) => fk.references.includes(column)))) fail2("foreign key target columns must form a unique key");
+      if (!uniqueKeys.some((key) => key.length === fk.references.length && key.every((column) => fk.references.includes(column)))) fail4("foreign key target columns must form a unique key");
+    }
+  }
+  for (const [viewIndex, view] of (definition.views ?? []).entries()) {
+    for (const message of validateResolvedView({ view, tables: definition.tables, views: definition.views ?? [] })) {
+      ctx.addIssue({ code: "custom", path: ["views", viewIndex, "resolved"], message });
     }
   }
   const tableByName = new Map(definition.tables.map((table) => [table.table, table]));
@@ -392,27 +1025,31 @@ var canonicalDefinitionSchema = z.object({
   const visiting = /* @__PURE__ */ new Set();
   const visited = /* @__PURE__ */ new Set();
   let cycleReported = false;
-  const visit2 = (name, path) => {
-    if (visited.has(name) || cycleReported) return;
-    if (visiting.has(name)) {
+  const visit2 = (name2, path) => {
+    if (visited.has(name2) || cycleReported) return;
+    if (visiting.has(name2)) {
       cycleReported = true;
       ctx.addIssue({
         code: "custom",
         path: ["views"],
-        message: `view dependencies form a cycle: ${[...path, name].join(" -> ")}`
+        message: `view dependencies form a cycle: ${[...path, name2].join(" -> ")}`
       });
       return;
     }
-    visiting.add(name);
-    const view = viewByName.get(name);
+    visiting.add(name2);
+    const view = viewByName.get(name2);
     for (const dependency of view?.dependencies ?? []) {
-      if (viewByName.has(dependency)) visit2(dependency, [...path, name]);
+      if (viewByName.has(dependency)) visit2(dependency, [...path, name2]);
     }
-    visiting.delete(name);
-    visited.add(name);
+    visiting.delete(name2);
+    visited.add(name2);
   };
   for (const view of views) visit2(view.view, []);
 });
+var canonicalDefinitionSchema = localDefinitionSchema.safeExtend({
+  /** Flattened, pinned snapshots. Imported relations never participate in this namespace's DDL. */
+  imports: z.array(localDefinitionSchema).max(32).optional()
+});
 function canonicalRelations(definition) {
   const views = (definition.views ?? []).map((view) => ({
     table: view.view,
@@ -421,8 +1058,12 @@ function canonicalRelations(definition) {
     ...view.primaryKey !== void 0 ? { primaryKey: view.primaryKey } : {},
     links: view.links,
     indexes: [],
-    policies: { read: view.policies.read },
-    actions: []
+    // A resolved table's write policies (evaluated against the resolved row)
+    // ride alongside the view's read policy.
+    policies: { read: view.policies.read, ...view.resolved?.policies ?? {} },
+    actions: [],
+    ...view.resolved !== void 0 ? { resolved: view.resolved } : {},
+    ...view.internal ? { internal: true } : {}
   }));
   return [...definition.tables, ...views].sort((a, b) => a.table.localeCompare(b.table));
 }
@@ -432,13 +1073,14 @@ function normalizeCanonical(definition) {
     ...definition,
     enums: sortByName(definition.enums),
     tables: [...definition.tables].sort((a, b) => a.table.localeCompare(b.table)).map((t) => {
-      const { cowMutations, foreignKeys, ...rest } = t;
+      const { cowMutations, foreignKeys, checks, ...rest } = t;
       return {
         ...rest,
         links: sortByName(t.links),
         indexes: [...t.indexes].sort((a, b) => (a.name ?? a.columns.join("_")).localeCompare(b.name ?? b.columns.join("_"))),
         actions: sortByName(t.actions),
         ...foreignKeys?.length ? { foreignKeys: sortByName(foreignKeys) } : {},
+        ...checks?.length ? { checks: sortByName(checks) } : {},
         // Omitted entirely when absent/empty so pre-CoW documents hash unchanged.
         ...cowMutations !== void 0 && cowMutations.length > 0 ? { cowMutations: sortByName(cowMutations) } : {}
       };
@@ -451,13 +1093,22 @@ function normalizeCanonical(definition) {
       dependencies: [...view.dependencies].sort()
     }));
   }
+  if (definition.imports?.length) {
+    normalized.imports = definition.imports.map(normalizeCanonical).sort((a, b) => a.namespace.localeCompare(b.namespace));
+  } else {
+    delete normalized.imports;
+  }
   return normalized;
 }
 
 // src/ir/index.ts
-var IR_VERSION = 2;
+var IR_VERSION = 5;
 var LEGACY_IR_VERSION = 1;
-var irVersionSchema = z.union([z.literal(LEGACY_IR_VERSION), z.literal(IR_VERSION)]);
+var GUARDED_IR_VERSION = 2;
+var COMPOSED_IR_VERSION = 3;
+var SQL_IR_VERSION = 4;
+var RUNTIME_SQL_IR_VERSION = 5;
+var irVersionSchema = z.union([z.literal(LEGACY_IR_VERSION), z.literal(GUARDED_IR_VERSION), z.literal(COMPOSED_IR_VERSION), z.literal(SQL_IR_VERSION), z.literal(RUNTIME_SQL_IR_VERSION)]);
 var operationVersionSchema = z.object({ irVersion: irVersionSchema });
 function requiredArtifactIrVersion(operations) {
   let required = LEGACY_IR_VERSION;
@@ -509,8 +1160,8 @@ var predIrSchema = z.lazy(
       value: z.number(),
       where: predIrSchema.optional()
     }),
-    z.object({ kind: z.literal("capability"), key: z.string() }),
-    z.object({ kind: z.literal("role"), key: z.string() }),
+    z.object({ kind: z.literal("capability"), key: z.string(), namespace: z.string().optional() }),
+    z.object({ kind: z.literal("role"), key: z.string(), namespace: z.string().optional() }),
     z.object({ kind: z.literal("dynamicFilter"), slot: z.string() }),
     z.object({ kind: z.literal("const"), value: z.boolean() })
   ])
@@ -538,6 +1189,21 @@ var selectionIrSchema = z.lazy(
   () => z.object({
     typename: z.string(),
     columns: z.array(z.object({ alias: z.string(), column: z.string() })),
+    cells: z.object({
+      alias: z.string(),
+      typename: z.string(),
+      fields: z.array(z.object({
+        alias: z.string(),
+        column: z.string(),
+        typename: z.string(),
+        parts: z.array(z.object({
+          alias: z.string(),
+          part: z.enum(["source", "at", "by", "conflicts"]),
+          fields: z.array(z.object({ alias: z.string(), field: z.enum(["source", "at", "value"]) })).optional(),
+          typename: z.string().optional()
+        }))
+      }))
+    }).optional(),
     relations: z.array(z.object({
       alias: z.string(),
       link: z.string(),
@@ -559,6 +1225,11 @@ var selectionIrSchema = z.lazy(
   })
 );
 var includeIfSchema = z.object({ variable: z.string(), negated: z.boolean() });
+var prefetchPlanIrSchema = z.object({
+  source: z.string(),
+  maxStalenessMs: z.number().int().positive().optional(),
+  key: z.union([z.object({ one: valueIrSchema }), z.object({ many: valueIrSchema })])
+});
 var selectRootSchema = z.object({
   kind: z.literal("select"),
   alias: z.string(),
@@ -570,7 +1241,8 @@ var selectRootSchema = z.object({
   distinctOn: z.union([z.array(z.string()), z.object({ slot: z.string() })]).optional(),
   limit: limitIrSchema,
   offset: z.object({ variable: z.string().optional(), value: z.number().int().optional() }).optional(),
-  includeIf: includeIfSchema.optional()
+  includeIf: includeIfSchema.optional(),
+  prefetch: z.array(prefetchPlanIrSchema).optional()
 });
 var byPkRootSchema = z.object({
   kind: z.literal("byPk"),
@@ -580,7 +1252,8 @@ var byPkRootSchema = z.object({
   pk: z.array(z.object({ column: z.string(), value: valueIrSchema })).min(1),
   /** Policy predicate — ANDed with the PK match. */
   where: predIrSchema,
-  includeIf: includeIfSchema.optional()
+  includeIf: includeIfSchema.optional(),
+  prefetch: z.array(prefetchPlanIrSchema).optional()
 });
 var aggregateRootSchema = z.object({
   kind: z.literal("aggregate"),
@@ -638,7 +1311,20 @@ var mutationRootSchema = z.object({
    * coalesce view falls back to synced. Both are gated on a matching synced
    * row and carry the write policy in `where` like update/delete.
    */
-  op: z.enum(["insert", "insertOne", "update", "updateByPk", "delete", "deleteByPk", "cowOverride", "cowRevert"]),
+  op: z.enum(["insert", "insertOne", "update", "updateByPk", "delete", "deleteByPk", "cowOverride", "cowRevert", "resolvedWrite"]),
+  /**
+   * resolvedWrite: a write to a resolved table (`table` is its view). The
+   * executor gates on the resolved row (write policy in `where`), writes only
+   * the touched cells into the manual source, then re-checks `insertCheck`
+   * against the resolved row. `revert` clears `revertColumns` from the manual
+   * source; `delete` tombstones the row there.
+   */
+  resolvedAction: z.enum(["insert", "update", "delete", "revert"]).optional(),
+  revertColumns: z.array(z.string()).optional(),
+  /** `@writeback(source:, mode:)` directives on this root. */
+  writeback: z.array(z.object({ source: z.string(), mode: z.enum(["sync", "async"]) })).optional(),
+  /** `@localOnly(source:)` — writeback columns deliberately kept local for these sources. */
+  localOnly: z.array(z.string()).optional(),
   alias: z.string(),
   table: z.string(),
   /** CoW ops: logical name of the synced twin (read through its policy-filtered view). */
@@ -702,7 +1388,31 @@ var variableIrSchema = z.object({
   /** Absent = no default declared; see {@link variableDefaultIrSchema}. */
   defaultValue: variableDefaultIrSchema.optional()
 });
+var sqlColumnSchema = z.object({ name: z.string(), type: z.enum(["text", "boolean", "integer", "bigint", "numeric", "double", "uuid", "date", "timestamptz"]), nullable: z.boolean() });
 var compiledOperationSchema = z.object({
+  language: z.literal("sql").optional(),
+  /** Server-compiled object catalog and permission ceiling, never caller SQL. */
+  sqlQuery: z.object({
+    catalog: z.object({
+      identity: z.string(),
+      objects: z.array(z.object({
+        ref: z.string(),
+        table: z.string(),
+        columns: z.array(sqlColumnSchema.extend({ type: z.string() })).min(1),
+        scan: z.string().min(1),
+        read: z.array(z.string()).min(1)
+      }).strict()).min(1).max(256)
+    }).strict(),
+    read: z.array(z.string()).min(1).max(256),
+    maxRows: z.number().int().min(1).max(1e4)
+  }).strict().optional(),
+  sql: z.object({
+    text: z.string().min(1).max(1048576),
+    columns: z.array(sqlColumnSchema).min(1).max(256),
+    parameters: z.array(z.string()).max(128),
+    read: z.array(z.string()).min(1).max(256),
+    maxRows: z.number().int().min(1).max(1e4)
+  }).strict().optional(),
   irVersion: irVersionSchema,
   name: z.string(),
   opHash: z.string().regex(/^sha256:[0-9a-f]{64}$/),
@@ -714,8 +1424,16 @@ var compiledOperationSchema = z.object({
   variables: z.array(variableIrSchema),
   /** Every table the op touches — data-token scoping + audit. */
   tableSet: z.array(z.string()).min(1),
-  roots: z.array(rootIrSchema).min(1)
+  roots: z.array(rootIrSchema)
 }).superRefine((operation, ctx) => {
+  if (operation.language === "sql") {
+    const validPlan = operation.sqlQuery ? !operation.sql && operation.irVersion === RUNTIME_SQL_IR_VERSION : !!operation.sql && operation.irVersion === SQL_IR_VERSION;
+    if (!validPlan || operation.kind !== "query" || operation.roots.length !== 0 || !operation.requires?.capability) {
+      ctx.addIssue({ code: "custom", message: "SQL operations require a query-only v4 plan or v5 runtime contract, capability, and no GraphQL roots" });
+    }
+  } else if (operation.sql || operation.sqlQuery || operation.roots.length === 0) {
+    ctx.addIssue({ code: "custom", message: "GraphQL operations require roots and cannot carry SQL" });
+  }
   for (const [index, root] of operation.roots.entries()) {
     if (root.kind !== "mutation" || root.assertAffectedRows === void 0) continue;
     if (operation.irVersion < 2 || operation.kind !== "mutation" || root.includeIf !== void 0) {
@@ -723,13 +1441,55 @@ var compiledOperationSchema = z.object({
     }
   }
 });
+var resolvedSourceIrSchema = z.object({
+  name: z.string(),
+  kind: z.enum(["manual", "etl", "prefetch"]),
+  /** Logical table key of the backing relation. */
+  table: z.string(),
+  columns: z.array(z.string()),
+  key: z.string().optional(),
+  fetch: z.union([
+    z.object({ shape: z.literal("single") }),
+    z.object({ shape: z.literal("batch"), maxKeys: z.number().int().positive() })
+  ]).optional(),
+  function: z.object({ kind: z.enum(["managed", "native"]), id: z.string() }).optional(),
+  prefetchDefaults: z.object({
+    maxStalenessMs: z.number().int().positive(),
+    timeoutMs: z.number().int().positive(),
+    onError: z.enum(["fallback", "fail"])
+  }).optional(),
+  writeback: z.object({
+    columns: z.array(z.string()),
+    defaultMode: z.enum(["sync", "async"]),
+    timeoutMs: z.number().int().positive(),
+    clearManualOnConfirm: z.boolean()
+  }).optional()
+});
+var resolvedMetaIrSchema = z.object({
+  /** Logical pk column of the resolved view (single-column). */
+  pk: z.string(),
+  /** Source name of the manual source. */
+  manual: z.string(),
+  sources: z.array(resolvedSourceIrSchema),
+  deletedBy: z.array(z.string()),
+  /**
+   * Materialized: the view reads `table`, which the data plane refreshes from
+   * the `compute` view (claims-gated) whenever it writes a source row.
+   */
+  materialized: z.object({ table: z.string(), compute: z.string() }).optional()
+});
 var tableMetaIrSchema = z.object({
   table: z.string(),
+  namespace: z.string().optional(),
+  dependencies: z.array(z.string()).optional(),
+  foreignReferences: z.array(z.object({ column: z.string(), target: z.string(), targetColumn: z.string() })).optional(),
+  exportRead: z.union([z.literal(true), z.object({ capability: z.string() }), z.object({ role: z.string() })]).optional(),
+  exportWrite: z.union([z.literal(true), z.object({ capability: z.string() }), z.object({ role: z.string() })]).optional(),
   schema: z.string(),
   typename: z.string(),
   /**
    * True when statements over this relation evaluate a claims-gated synced
-   * view: synced twins (`source: gold.*`) materialize as views whose baked
+   * view: synced twins (`source: schema.table`) materialize as views whose baked
    * policy reads `current_setting('request.jwt.claims')`, and namespace views
    * inherit the gate transitively through their declared dependencies. The
    * executor must stamp that GUC (transaction-scoped) before any statement
@@ -763,6 +1523,22 @@ var tableMetaIrSchema = z.object({
    * `onUpdateFn`). Omitted when empty so pre-onUpdate artifacts still parse.
    */
   touchOnUpdate: z.array(z.string()).optional(),
+  /**
+   * Per-cell metadata: logical column → the logical names of its cell-part
+   * columns (which are listed in `columns`, but never filterable, orderable or
+   * writable). Tables stamp `at`/`by` (and a manual source `rev`) on every
+   * write; resolved views expose `source`/`at`/`by`/`conflicts`. Omitted when
+   * the relation tracks no cells.
+   */
+  cells: z.record(z.string(), z.object({
+    at: z.string().optional(),
+    by: z.string().optional(),
+    rev: z.string().optional(),
+    source: z.string().optional(),
+    conflicts: z.string().optional()
+  }).strict()).optional(),
+  /** Resolved-table view metadata (sources, prefetch/writeback config) for the data plane. */
+  resolved: resolvedMetaIrSchema.optional(),
   constraints: z.array(z.object({ name: z.string(), columns: z.array(z.string()) })),
   /** Depth/node caps for dynamic filter trees on this table. */
   dynamicFilterMaxDepth: z.number().int().positive().default(6),
@@ -772,13 +1548,21 @@ var compiledArtifactSchema = z.object({
   irVersion: irVersionSchema,
   namespace: z.string(),
   schemaHash: z.string(),
+  ownSchemaHash: z.string().optional(),
+  dependencies: z.record(z.string(), z.string()).optional(),
+  readPolicies: z.record(z.string(), predIrSchema).optional(),
   opsHash: z.string(),
+  /** Apply-observed synced objects without a serving backing; not part of the authored schema hash. */
+  unbackedTables: z.array(z.string()).optional(),
   tables: z.record(z.string(), tableMetaIrSchema),
   operations: z.record(z.string(), compiledOperationSchema)
 }).superRefine((artifact, ctx) => {
-  for (const [name, operation] of Object.entries(artifact.operations)) {
+  if (Object.keys(artifact.dependencies ?? {}).length > 0 && artifact.irVersion < COMPOSED_IR_VERSION) {
+    ctx.addIssue({ code: "custom", path: ["irVersion"], message: "cross-namespace dependencies require IR v3" });
+  }
+  for (const [name2, operation] of Object.entries(artifact.operations)) {
     if (operation.irVersion > artifact.irVersion) {
-      ctx.addIssue({ code: "custom", path: ["operations", name, "irVersion"], message: "operation requires a newer IR version than its artifact" });
+      ctx.addIssue({ code: "custom", path: ["operations", name2, "irVersion"], message: "operation requires a newer IR version than its artifact" });
     }
   }
 });
@@ -791,10 +1575,119 @@ var IrVersionError = class extends Error {
 function normalizeIr(raw) {
   if (!raw || typeof raw !== "object") throw new IrVersionError(void 0);
   const version = raw.irVersion;
-  if (version !== LEGACY_IR_VERSION && version !== IR_VERSION) throw new IrVersionError(version);
+  if (!irVersionSchema.safeParse(version).success) throw new IrVersionError(version);
   return compiledArtifactSchema.parse(raw);
 }
 
+// src/sdl/naming.ts
+function camelCase(name2) {
+  const segments = name2.split("_").filter((segment) => segment.length > 0);
+  const first = segments[0];
+  if (first === void 0) return name2;
+  const head = first.charAt(0).toLowerCase() + first.slice(1);
+  return head + segments.slice(1).map(capitalizeFirst).join("");
+}
+function pascalCase(name2) {
+  return capitalizeFirst(camelCase(name2));
+}
+function capitalizeFirst(segment) {
+  return segment.charAt(0).toUpperCase() + segment.slice(1);
+}
+function singularizeWord(word) {
+  if (word.endsWith("ies") && word.length > 3) return `${word.slice(0, -3)}y`;
+  for (const suffix of ["sses", "xes", "ches", "shes"]) {
+    if (word.endsWith(suffix)) return word.slice(0, -2);
+  }
+  if (word.endsWith("ss")) return word;
+  if (word.endsWith("s") && word.length > 1) return word.slice(0, -1);
+  return word;
+}
+function typeName(table) {
+  const segments = table.split("_").filter((segment) => segment.length > 0);
+  const last = segments[segments.length - 1];
+  if (last === void 0) return pascalCase(table);
+  return [...segments.slice(0, -1), singularizeWord(last)].map(capitalizeFirst).join("");
+}
+function enumTypeName(name2) {
+  return pascalCase(name2);
+}
+var SCALAR_FOR_COLUMN_TYPE = {
+  uuid: "uuid",
+  text: "String",
+  integer: "Int",
+  bigint: "bigint",
+  numeric: "numeric",
+  double: "Float",
+  boolean: "Boolean",
+  timestamptz: "timestamptz",
+  date: "date",
+  jsonb: "jsonb"
+};
+function graphqlScalarFor(type) {
+  return SCALAR_FOR_COLUMN_TYPE[type];
+}
+var COLUMN_TYPE_BY_SCALAR = new Map([
+  ["ID", "text"],
+  ...COLUMN_TYPES.map((type) => [graphqlScalarFor(type), type])
+]);
+function columnTypeForScalar(scalarName) {
+  return COLUMN_TYPE_BY_SCALAR.get(scalarName);
+}
+var VARIABLE_SCALAR_NAMES = [...COLUMN_TYPE_BY_SCALAR.keys()];
+var PLATFORM_USER_TYPENAME = "PlatformUser";
+function tableNames(table) {
+  const root = camelCase(table);
+  const rootPascal = pascalCase(table);
+  const type = typeName(table);
+  return {
+    typename: type,
+    selectRoot: root,
+    byPkRoot: `${root}ByPk`,
+    aggregateRoot: `${root}Aggregate`,
+    insertRoot: `insert${rootPascal}`,
+    insertOneRoot: `insert${rootPascal}One`,
+    updateRoot: `update${rootPascal}`,
+    updateByPkRoot: `update${rootPascal}ByPk`,
+    deleteRoot: `delete${rootPascal}`,
+    deleteByPkRoot: `delete${rootPascal}ByPk`,
+    revertByPkRoot: `revert${rootPascal}ByPk`,
+    boolExp: `${type}BoolExp`,
+    orderBy: `${type}OrderBy`,
+    selectColumn: `${type}SelectColumn`,
+    insertInput: `${type}InsertInput`,
+    setInput: `${type}SetInput`,
+    appendInput: `${type}AppendInput`,
+    incInput: `${type}IncInput`,
+    onConflict: `${type}OnConflict`,
+    pkColumnsInput: `${type}PkColumnsInput`,
+    constraintEnum: `${type}Constraint`,
+    updateColumnEnum: `${type}UpdateColumn`,
+    mutationResponse: `${type}MutationResponse`,
+    aggregate: `${type}Aggregate`,
+    aggregateFields: `${type}AggregateFields`,
+    sumFields: `${type}SumFields`,
+    avgFields: `${type}AvgFields`,
+    aggregateBoolExp: `${type}AggregateBoolExp`,
+    aggregateBoolExpCount: `${type}AggregateBoolExpCount`,
+    aggregateGroupsRoot: `${root}AggregateGroups`,
+    groupByColumnEnum: `${type}GroupByColumn`,
+    groupByInput: `${type}GroupBy`,
+    groupKey: `${type}GroupKey`,
+    aggregateGroup: `${type}AggregateGroup`
+  };
+}
+var CELL_TYPENAMES = {
+  /** A plain table's cell: when and by whom it was last written. */
+  stamp: "CellStamp",
+  /** A resolved table's cell: which source won, when, by whom, and newer losers. */
+  resolved: "ResolvedCell",
+  /** A newer candidate that lost to the column's rule. */
+  conflict: "CellConflict"
+};
+function cellsTypename(typename) {
+  return `${typename}Cells`;
+}
+
 // src/predicate-v2/ast.ts
 var POLICY_COMPARE_OPS = ["=", "!=", "<", "<=", ">", ">="];
 function walkPolicy(node, visit2) {
@@ -831,7 +1724,7 @@ var IDENTIFIER_CHAR = /[a-zA-Z0-9_]/;
 var NUMBER_PATTERN = /^-?\d+(\.\d+)?/;
 var SCALAR_CLAIM_KEYS = Object.entries(CLAIMS_CONTRACT).filter(([, type]) => !type.endsWith("[]")).map(([key]) => key);
 var ARRAY_CLAIM_KEYS = Object.entries(CLAIMS_CONTRACT).filter(([, type]) => type.endsWith("[]")).map(([key]) => key);
-function tokenize(source) {
+function tokenize2(source) {
   const tokens = [];
   let position = 0;
   while (position < source.length) {
@@ -910,7 +1803,7 @@ function readString(source, start) {
   }
   throw new PolicyParseError("unterminated string literal", start);
 }
-var Parser = class {
+var Parser2 = class {
   constructor(tokens) {
     this.tokens = tokens;
   }
@@ -1084,7 +1977,7 @@ var Parser = class {
 function parsePolicy(source) {
   const trimmed = source.trim();
   if (trimmed.length === 0) throw new PolicyParseError("empty policy expression", 0);
-  return { source: trimmed, ast: new Parser(tokenize(trimmed)).parse() };
+  return { source: trimmed, ast: new Parser2(tokenize2(trimmed)).parse() };
 }
 
 // src/predicate-v2/compile.ts
@@ -1484,6 +2377,7 @@ var PolicyInjector = class {
   injectMutation(root) {
     const table = root.table;
     const returning = root.returning ? this.injectSelection(root.returning, table) : root.returning;
+    if (root.op === "resolvedWrite") return this.injectResolvedWrite(root, returning);
     if (root.op === "insert" || root.op === "insertOne") {
       const insertPolicy = this.insert(table);
       if (predContainsExists(insertPolicy)) {
@@ -1506,7 +2400,7 @@ var PolicyInjector = class {
     const updatePolicy = this.update(table);
     const where = andPred(updatePolicy, root.where ? this.injectDocPred(root.where, table) : void 0);
     if (root.op === "update" || root.op === "updateByPk") {
-      const check = predContainsExists(updatePolicy) ? {} : { insertCheck: updatePolicy };
+      const check = predContainsExists(updatePolicy) && !this.ctx.composed ? {} : { insertCheck: updatePolicy };
       return { ...root, where, ...check, returning };
     }
     if (root.op === "cowOverride") {
@@ -1520,11 +2414,29 @@ var PolicyInjector = class {
       const pins = (this.ctx.pins.get(table) ?? []).map(
         (pin) => ({ column: pin.column, value: { kind: "claim", key: pin.claim } })
       );
-      const check = predContainsExists(updatePolicy) ? {} : { insertCheck: updatePolicy };
+      const check = predContainsExists(updatePolicy) && !this.ctx.composed ? {} : { insertCheck: updatePolicy };
       return { ...root, pinnedColumns: pins, cowCopyCheck: insertPolicy, where, ...check, returning };
     }
     return { ...root, where, returning };
   }
+  /**
+   * Resolved writes are policed against the RESOLVED row, not the sparse
+   * manual row: `where` gates the existing row (update/revert/delete) and
+   * `insertCheck` is re-evaluated as a SELECT over the view after the write,
+   * so link-traversing (exists) policies are representable here.
+   */
+  injectResolvedWrite(root, returning) {
+    const table = root.table;
+    if (root.resolvedAction === "insert") {
+      const pins = (this.ctx.pins.get(table) ?? []).map(
+        (pin) => ({ column: pin.column, value: { kind: "claim", key: pin.claim } })
+      );
+      return { ...root, pinnedColumns: pins, insertCheck: this.insert(table), returning };
+    }
+    const updatePolicy = this.update(table);
+    const where = andPred(updatePolicy, root.where ? this.injectDocPred(root.where, table) : void 0);
+    return root.resolvedAction === "delete" ? { ...root, where, returning } : { ...root, where, insertCheck: updatePolicy, returning };
+  }
 };
 function collectTableSet(roots, ctx) {
   const tables = /* @__PURE__ */ new Set();
@@ -1571,136 +2483,40 @@ function collectTableSet(roots, ctx) {
     tables.add(root.table);
     switch (root.kind) {
       case "select":
-      case "byPk":
-        visitPred(root.where, root.table);
-        visitSelection(root.selection, root.table);
-        break;
-      case "aggregate":
-        visitPred(root.where, root.table);
-        if (root.nodes) visitSelection(root.nodes, root.table);
-        break;
-      case "aggregateGroups":
-        visitPred(root.where, root.table);
-        break;
-      case "mutation":
-        if (root.cowSynced !== void 0) tables.add(root.cowSynced);
-        if (root.where) visitPred(root.where, root.table);
-        if (root.insertCheck) visitPred(root.insertCheck, root.table);
-        if (root.cowCopyCheck) visitPred(root.cowCopyCheck, root.table);
-        if (root.returning) visitSelection(root.returning, root.table);
-        break;
-      default: {
-        const exhausted = root;
-        throw new DocumentCompileError(
-          `internal: unhandled root kind in tableSet collection ${JSON.stringify(exhausted)}`,
-          "internal"
-        );
-      }
-    }
-  }
-  return [...tables].sort();
-}
-function injectPolicies({ roots, ctx }) {
-  const injector = new PolicyInjector(ctx);
-  const injected = roots.map((root) => injector.injectRoot(root));
-  return { roots: injected, tableSet: collectTableSet(injected, ctx) };
-}
-
-// src/sdl/naming.ts
-function camelCase(name) {
-  const segments = name.split("_").filter((segment) => segment.length > 0);
-  const first = segments[0];
-  if (first === void 0) return name;
-  const head = first.charAt(0).toLowerCase() + first.slice(1);
-  return head + segments.slice(1).map(capitalizeFirst).join("");
-}
-function pascalCase(name) {
-  return capitalizeFirst(camelCase(name));
-}
-function capitalizeFirst(segment) {
-  return segment.charAt(0).toUpperCase() + segment.slice(1);
-}
-function singularizeWord(word) {
-  if (word.endsWith("ies") && word.length > 3) return `${word.slice(0, -3)}y`;
-  for (const suffix of ["sses", "xes", "ches", "shes"]) {
-    if (word.endsWith(suffix)) return word.slice(0, -2);
-  }
-  if (word.endsWith("ss")) return word;
-  if (word.endsWith("s") && word.length > 1) return word.slice(0, -1);
-  return word;
-}
-function typeName(table) {
-  const segments = table.split("_").filter((segment) => segment.length > 0);
-  const last = segments[segments.length - 1];
-  if (last === void 0) return pascalCase(table);
-  return [...segments.slice(0, -1), singularizeWord(last)].map(capitalizeFirst).join("");
-}
-function enumTypeName(name) {
-  return pascalCase(name);
-}
-var SCALAR_FOR_COLUMN_TYPE = {
-  uuid: "uuid",
-  text: "String",
-  integer: "Int",
-  bigint: "bigint",
-  numeric: "numeric",
-  double: "Float",
-  boolean: "Boolean",
-  timestamptz: "timestamptz",
-  date: "date",
-  jsonb: "jsonb"
-};
-function graphqlScalarFor(type) {
-  return SCALAR_FOR_COLUMN_TYPE[type];
-}
-var COLUMN_TYPE_BY_SCALAR = new Map([
-  ["ID", "text"],
-  ...COLUMN_TYPES.map((type) => [graphqlScalarFor(type), type])
-]);
-function columnTypeForScalar(scalarName) {
-  return COLUMN_TYPE_BY_SCALAR.get(scalarName);
-}
-var VARIABLE_SCALAR_NAMES = [...COLUMN_TYPE_BY_SCALAR.keys()];
-var PLATFORM_USER_TYPENAME = "PlatformUser";
-function tableNames(table) {
-  const root = camelCase(table);
-  const rootPascal = pascalCase(table);
-  const type = typeName(table);
-  return {
-    typename: type,
-    selectRoot: root,
-    byPkRoot: `${root}ByPk`,
-    aggregateRoot: `${root}Aggregate`,
-    insertRoot: `insert${rootPascal}`,
-    insertOneRoot: `insert${rootPascal}One`,
-    updateRoot: `update${rootPascal}`,
-    updateByPkRoot: `update${rootPascal}ByPk`,
-    deleteRoot: `delete${rootPascal}`,
-    deleteByPkRoot: `delete${rootPascal}ByPk`,
-    boolExp: `${type}BoolExp`,
-    orderBy: `${type}OrderBy`,
-    selectColumn: `${type}SelectColumn`,
-    insertInput: `${type}InsertInput`,
-    setInput: `${type}SetInput`,
-    appendInput: `${type}AppendInput`,
-    incInput: `${type}IncInput`,
-    onConflict: `${type}OnConflict`,
-    pkColumnsInput: `${type}PkColumnsInput`,
-    constraintEnum: `${type}Constraint`,
-    updateColumnEnum: `${type}UpdateColumn`,
-    mutationResponse: `${type}MutationResponse`,
-    aggregate: `${type}Aggregate`,
-    aggregateFields: `${type}AggregateFields`,
-    sumFields: `${type}SumFields`,
-    avgFields: `${type}AvgFields`,
-    aggregateBoolExp: `${type}AggregateBoolExp`,
-    aggregateBoolExpCount: `${type}AggregateBoolExpCount`,
-    aggregateGroupsRoot: `${root}AggregateGroups`,
-    groupByColumnEnum: `${type}GroupByColumn`,
-    groupByInput: `${type}GroupBy`,
-    groupKey: `${type}GroupKey`,
-    aggregateGroup: `${type}AggregateGroup`
-  };
+      case "byPk":
+        visitPred(root.where, root.table);
+        visitSelection(root.selection, root.table);
+        break;
+      case "aggregate":
+        visitPred(root.where, root.table);
+        if (root.nodes) visitSelection(root.nodes, root.table);
+        break;
+      case "aggregateGroups":
+        visitPred(root.where, root.table);
+        break;
+      case "mutation":
+        if (root.cowSynced !== void 0) tables.add(root.cowSynced);
+        for (const source of ctx.tables[root.table]?.resolved?.sources ?? []) tables.add(source.table);
+        if (root.where) visitPred(root.where, root.table);
+        if (root.insertCheck) visitPred(root.insertCheck, root.table);
+        if (root.cowCopyCheck) visitPred(root.cowCopyCheck, root.table);
+        if (root.returning) visitSelection(root.returning, root.table);
+        break;
+      default: {
+        const exhausted = root;
+        throw new DocumentCompileError(
+          `internal: unhandled root kind in tableSet collection ${JSON.stringify(exhausted)}`,
+          "internal"
+        );
+      }
+    }
+  }
+  return [...tables].sort();
+}
+function injectPolicies({ roots, ctx }) {
+  const injector = new PolicyInjector(ctx);
+  const injected = roots.map((root) => injector.injectRoot(root));
+  return { roots: injected, tableSet: collectTableSet(injected, ctx) };
 }
 
 // src/compiler-gql/naming.ts
@@ -1749,16 +2565,92 @@ var NAME_KEY_BY_KIND = {
 function inputTypeName(table, kind) {
   return tableNames(table)[NAME_KEY_BY_KIND[kind]];
 }
-function classifyInputType(name, tableByTypename) {
+function classifyInputType(name2, tableByTypename) {
   for (const [suffix, input] of INPUT_TYPE_SUFFIXES) {
-    if (!name.endsWith(suffix) || name.length <= suffix.length) continue;
-    const table = tableByTypename.get(name.slice(0, -suffix.length));
+    if (!name2.endsWith(suffix) || name2.length <= suffix.length) continue;
+    const table = tableByTypename.get(name2.slice(0, -suffix.length));
     if (table !== void 0) return { input, table };
   }
   return void 0;
 }
 
+// src/errors.ts
+var OrmDefinitionError = class extends Error {
+  constructor(message, file) {
+    super(file ? `${file}: ${message}` : message);
+    this.file = file;
+  }
+  name = "OrmDefinitionError";
+};
+
+// src/canonical/composition.ts
+function localContract(definition) {
+  return normalizeCanonical(localDefinitionSchema.parse(definition));
+}
+function composeNamespace(definition) {
+  const all = [localContract(definition), ...definition.imports ?? []];
+  const owners = /* @__PURE__ */ new Map();
+  const namespaces = /* @__PURE__ */ new Set();
+  const enums = /* @__PURE__ */ new Map();
+  for (const owner of all) {
+    if (namespaces.has(owner.namespace)) throw new OrmDefinitionError(`duplicate imported namespace '${owner.namespace}'`);
+    namespaces.add(owner.namespace);
+    for (const value of owner.enums) {
+      const previous = enums.get(value.name);
+      if (previous && stableJson(previous) !== stableJson(value)) {
+        throw new OrmDefinitionError(`conflicting imported enum '${value.name}'`);
+      }
+      enums.set(value.name, value);
+    }
+    for (const relation of canonicalRelations(owner)) {
+      if (owners.has(relation.table)) throw new OrmDefinitionError(`ambiguous imported relation '${relation.table}'`);
+      owners.set(relation.table, owner);
+    }
+  }
+  for (const owner of definition.imports?.length ? all : []) {
+    for (const relation of canonicalRelations(owner)) {
+      for (const link of relation.links) {
+        if (link.kind === "toPlatformUser") continue;
+        const target = owners.get(link.target ?? "");
+        if (!target || target.namespace !== (link.namespace ?? owner.namespace)) {
+          throw new OrmDefinitionError(`link '${owner.namespace}/${relation.table}.${link.name}' has no matching imported target`);
+        }
+        if (target.namespace !== owner.namespace && !target.exports?.[link.target ?? ""]) {
+          throw new OrmDefinitionError(`target '${target.namespace}/${link.target}' is not exported`);
+        }
+      }
+    }
+  }
+  return {
+    owners,
+    definition: {
+      ...localContract(definition),
+      tables: all.flatMap((item) => item.tables),
+      views: all.flatMap((item) => item.views ?? []),
+      enums: [...enums.values()]
+    }
+  };
+}
+
 // src/compiler-gql/context.ts
+function scopePolicy(pred, namespace) {
+  switch (pred.kind) {
+    case "capability":
+    case "role":
+      return { ...pred, namespace };
+    case "and":
+    case "or":
+      return { ...pred, operands: pred.operands.map((p) => scopePolicy(p, namespace)) };
+    case "not":
+      return { ...pred, operand: scopePolicy(pred.operand, namespace) };
+    case "exists":
+      return { ...pred, where: scopePolicy(pred.where, namespace) };
+    case "aggPredicate":
+      return pred.where ? { ...pred, where: scopePolicy(pred.where, namespace) } : pred;
+    default:
+      return pred;
+  }
+}
 function platformUserMeta() {
   const columns = [
     // `sub` is the view's key (auth0_id, filtered NOT NULL in the view).
@@ -1814,7 +2706,8 @@ function resolveColumnEntries(table, enums, diagnostics) {
       type,
       nullable: column.nullable,
       deprecated: column.deprecated,
-      onUpdateFn: column.onUpdateFn !== void 0
+      onUpdateFn: column.onUpdateFn !== void 0,
+      ...column.cell ? { cell: column.cell } : {}
     };
   });
 }
@@ -1822,7 +2715,8 @@ function logicalColumn(entries, ref) {
   return entries.find((c) => c.name === ref || c.columnName === ref)?.name;
 }
 function buildCompileContext(rawCanonical) {
-  const canonical = normalizeCanonical(canonicalDefinitionSchema.parse(rawCanonical));
+  const normalized = normalizeCanonical(canonicalDefinitionSchema.parse(rawCanonical));
+  const { definition: canonical, owners } = composeNamespace(normalized);
   const diagnostics = [];
   const enums = new Map(canonical.enums.map((e) => [e.name, e]));
   const relations = canonicalRelations(canonical);
@@ -1835,24 +2729,25 @@ function buildCompileContext(rawCanonical) {
   const syncedTableNames = new Set(canonical.tables.filter((t) => t.source !== void 0).map((t) => t.table));
   const viewDependencies = new Map((canonical.views ?? []).map((view) => [view.view, view.dependencies]));
   const claimsGatedMemo = /* @__PURE__ */ new Map();
-  const relationIsClaimsGated = (name) => {
-    if (syncedTableNames.has(name)) return true;
-    const memo = claimsGatedMemo.get(name);
+  const relationIsClaimsGated = (name2) => {
+    if (syncedTableNames.has(name2)) return true;
+    const memo = claimsGatedMemo.get(name2);
     if (memo !== void 0) return memo;
-    claimsGatedMemo.set(name, false);
-    const gated = (viewDependencies.get(name) ?? []).some(relationIsClaimsGated);
-    claimsGatedMemo.set(name, gated);
+    claimsGatedMemo.set(name2, false);
+    const gated = (viewDependencies.get(name2) ?? []).some(relationIsClaimsGated);
+    claimsGatedMemo.set(name2, gated);
     return gated;
   };
   for (const table of relations) {
     const isView = viewNames.has(table.table);
+    const owner = owners.get(table.table);
     const entries = resolveColumnEntries(table, enums, diagnostics);
     columnEntries.set(table.table, entries);
     const pkRefs = table.primaryKey ?? (isView ? [] : ["id"]);
     const primaryKey = [];
     for (const ref of pkRefs) {
-      const resolved = logicalColumn(entries, ref);
-      if (!resolved) {
+      const resolved2 = logicalColumn(entries, ref);
+      if (!resolved2) {
         diagnostics.push({
           severity: "error",
           code: "unknown-pk-column",
@@ -1861,9 +2756,12 @@ function buildCompileContext(rawCanonical) {
         });
         continue;
       }
-      primaryKey.push(resolved);
+      primaryKey.push(resolved2);
     }
-    const active = entries.filter((c) => !c.deprecated);
+    const resolved = isView ? table.resolved : void 0;
+    const data = entries.filter((c) => c.cell === void 0);
+    const cells = cellMap(entries);
+    const active = data.filter((c) => !c.deprecated);
     const touchOnUpdate = isView ? [] : active.filter((c) => c.onUpdateFn).map((c) => c.name);
     const constraints = [];
     if (primaryKey.length > 0) constraints.push({ name: `${table.table}_pkey`, columns: [...primaryKey] });
@@ -1880,7 +2778,10 @@ function buildCompileContext(rawCanonical) {
     }
     tables[table.table] = {
       table: table.table,
-      schema: ormSchemaName(canonical.namespace),
+      schema: ormSchemaName(owner.namespace),
+      namespace: owner.namespace,
+      ...viewDependencies.has(table.table) ? { dependencies: viewDependencies.get(table.table) } : {},
+      ...owner.exports?.[table.table] ? { exportRead: owner.exports[table.table].read, exportWrite: owner.exports[table.table].write } : {},
       typename: typeNameForTable(table.table),
       // Synced twins (and views reading them, resolved transitively below)
       // are claims-gated — see tableMetaIrSchema.claimsGated.
@@ -1888,12 +2789,14 @@ function buildCompileContext(rawCanonical) {
       columns: entries.map(({ deprecated: _deprecated, onUpdateFn: _onUpdateFn, ...column }) => column),
       primaryKey: isView ? primaryKey : primaryKey.length > 0 ? primaryKey : ["id"],
       links: [],
-      filterable: entries.map((c) => c.name),
-      orderable: entries.filter((c) => c.type !== "jsonb").map((c) => c.name),
-      insertable: isView ? [] : active.map((c) => c.name),
-      settable: isView ? [] : active.filter((c) => !c.onUpdateFn).map((c) => c.name),
+      filterable: data.map((c) => c.name),
+      orderable: data.filter((c) => c.type !== "jsonb").map((c) => c.name),
+      insertable: resolved ? resolvedWritable(data) : isView ? [] : active.map((c) => c.name),
+      settable: resolved ? resolvedWritable(data).filter((name2) => !primaryKey.includes(name2)) : isView ? [] : active.filter((c) => !c.onUpdateFn).map((c) => c.name),
       appendable: isView ? [] : active.filter((c) => c.type === "jsonb").map((c) => c.name),
       ...touchOnUpdate.length > 0 ? { touchOnUpdate } : {},
+      ...cells ? { cells } : {},
+      ...resolved ? { resolved: resolvedMeta({ resolved, pk: primaryKey[0] }) } : {},
       constraints: isView ? [] : constraints,
       dynamicFilterMaxDepth: 6,
       dynamicFilterMaxNodes: 64
@@ -1905,7 +2808,7 @@ function buildCompileContext(rawCanonical) {
     for (const link of table.links) {
       const targetName = link.kind === "toPlatformUser" ? PLATFORM_USER_TABLE : link.target;
       const target = targetName === void 0 ? void 0 : tables[targetName];
-      if (!targetName || !target) {
+      if (!targetName || !target || link.namespace !== void 0 && link.namespace !== target.namespace) {
         diagnostics.push({
           severity: "error",
           code: "unknown-link-target",
@@ -1930,6 +2833,11 @@ function buildCompileContext(rawCanonical) {
         continue;
       }
       meta.links.push({ name: link.name, kind: link.kind, target: targetName, on, references });
+      if (link.kind !== "toPlatformUser" && meta.namespace !== target.namespace) {
+        const fkOwner = link.kind === "toMany" ? target : meta;
+        const referenced = link.kind === "toMany" ? table.table : targetName;
+        (fkOwner.foreignReferences ??= []).push({ column: on, target: referenced, targetColumn: references });
+      }
     }
   }
   const readPolicies = /* @__PURE__ */ new Map();
@@ -1947,7 +2855,8 @@ function buildCompileContext(rawCanonical) {
         return;
       }
       try {
-        store.set(table.table, compilePolicy({ expression, table: table.table, resolver }));
+        const pred = compilePolicy({ expression, table: table.table, resolver });
+        store.set(table.table, normalized.imports?.length ? scopePolicy(pred, owners.get(table.table).namespace) : pred);
       } catch (error) {
         if (error instanceof PolicyCompileError || error instanceof PolicyParseError) {
           diagnostics.push({
@@ -1966,7 +2875,7 @@ function buildCompileContext(rawCanonical) {
     compilePolicyFor("write", writePolicies);
     compilePolicyFor("insert", insertPolicies);
     compilePolicyFor("update", updatePolicies);
-    if (isView) {
+    if (isView && table.resolved === void 0) {
       writePolicies.set(table.table, CONST_FALSE);
       insertPolicies.set(table.table, CONST_FALSE);
       updatePolicies.set(table.table, CONST_FALSE);
@@ -2001,10 +2910,47 @@ function buildCompileContext(rawCanonical) {
     updatePolicies.set(PLATFORM_USER_TABLE, { kind: "const", value: false });
     pins.set(PLATFORM_USER_TABLE, []);
   }
+  if (normalized.imports?.length) {
+    const originalReads = new Map(readPolicies);
+    const protect = (pred, table, path) => {
+      switch (pred.kind) {
+        case "and":
+        case "or":
+          return { ...pred, operands: pred.operands.map((p) => protect(p, table, path)) };
+        case "not":
+          return { ...pred, operand: protect(pred.operand, table, path) };
+        case "exists":
+        case "aggPredicate": {
+          const target = tables[table]?.links.find((link) => link.name === pred.link)?.target;
+          if (!target) return pred;
+          let where = pred.where ? protect(pred.where, target, path) : CONST_TRUE;
+          if (tables[table]?.namespace !== tables[target]?.namespace) {
+            if (path.includes(target)) {
+              diagnostics.push({
+                severity: "error",
+                code: "cyclic-cross-namespace-policy",
+                table,
+                message: `cross-namespace read policies form a cycle through '${target}'`
+              });
+              return CONST_FALSE;
+            }
+            where = andPred(where, protect(originalReads.get(target) ?? CONST_TRUE, target, [...path, target]));
+          }
+          return { ...pred, where };
+        }
+        default:
+          return pred;
+      }
+    };
+    for (const policies of [readPolicies, writePolicies, insertPolicies, updatePolicies]) {
+      for (const [table, policy] of policies) policies.set(table, protect(policy, table, [table]));
+    }
+  }
   const tableByTypename = new Map(Object.entries(tables).map(([key, meta]) => [meta.typename, key]));
   const queryRoots = /* @__PURE__ */ new Map();
   const mutationRoots = /* @__PURE__ */ new Map();
   for (const table of relations) {
+    if (table.internal === true) continue;
     const roots = queryRootNames(table.table);
     queryRoots.set(roots.select, { kind: "select", table: table.table });
     if ((tables[table.table]?.primaryKey.length ?? 0) > 0) {
@@ -2020,6 +2966,7 @@ function buildCompileContext(rawCanonical) {
         mutationRoots.set(field, { op, table: table.table });
       }
     }
+    if (table.resolved !== void 0) registerResolvedRoots({ table, mutationRoots });
   }
   for (const table of relations) {
     for (const mutation of table.cowMutations ?? []) {
@@ -2075,6 +3022,7 @@ function buildCompileContext(rawCanonical) {
   return {
     ctx: {
       namespace: canonical.namespace,
+      composed: !!normalized.imports?.length,
       tables,
       tableByTypename,
       queryRoots,
@@ -2090,6 +3038,49 @@ function buildCompileContext(rawCanonical) {
     diagnostics
   };
 }
+function registerResolvedRoots({ table, mutationRoots }) {
+  const names = tableNames(table.table);
+  const canInsert = table.policies.write !== void 0 || table.policies.insert !== void 0;
+  const canUpdate = table.policies.write !== void 0 || table.policies.update !== void 0;
+  const add = (field, action) => mutationRoots.set(field, { op: "resolvedWrite", action, table: table.table });
+  if (canInsert) add(names.insertOneRoot, "insert");
+  if (canUpdate) {
+    add(names.updateByPkRoot, "update");
+    add(names.revertByPkRoot, "revert");
+    if ((table.resolved?.deletedBy.length ?? 0) > 0) add(names.deleteByPkRoot, "delete");
+  }
+}
+function cellMap(entries) {
+  const cells = {};
+  for (const entry of entries) {
+    if (entry.cell) cells[entry.cell.of] = { ...cells[entry.cell.of], [entry.cell.part]: entry.name };
+  }
+  return Object.keys(cells).length > 0 ? cells : void 0;
+}
+function resolvedWritable(entries) {
+  const system = new Set(Object.values(RESOLVED_VIEW_SYSTEM_COLUMNS).map((column) => column.name));
+  return entries.filter((entry) => !entry.deprecated && !system.has(entry.name)).map((entry) => entry.name);
+}
+function resolvedMeta({ resolved, pk }) {
+  const manual = resolved.sources.find((source) => source.kind === "manual");
+  return {
+    pk,
+    manual: manual?.name ?? "",
+    deletedBy: [...resolved.deletedBy],
+    ...resolved.materialized ? { materialized: { ...resolved.materialized } } : {},
+    sources: resolved.sources.map((source) => ({
+      name: source.name,
+      kind: source.kind,
+      table: source.table,
+      columns: [...source.columns],
+      ...source.key !== void 0 ? { key: source.key } : {},
+      ...source.fetch !== void 0 ? { fetch: source.fetch } : {},
+      ...source.function !== void 0 ? { function: source.function } : {},
+      ...source.prefetchDefaults !== void 0 ? { prefetchDefaults: source.prefetchDefaults } : {},
+      ...source.writeback !== void 0 ? { writeback: source.writeback } : {}
+    }))
+  };
+}
 function flattenSelectionSet(selectionSet, fragments, stack) {
   const selections = [];
   for (const selection of selectionSet.selections) {
@@ -2100,18 +3091,18 @@ function flattenSelectionSet(selectionSet, fragments, stack) {
       continue;
     }
     if (selection.kind === Kind.FRAGMENT_SPREAD) {
-      const name = selection.name.value;
+      const name2 = selection.name.value;
       if (selection.directives && selection.directives.length > 0) {
-        throw new DocumentCompileError(`directives on fragment spread '...${name}' are not supported`, "fragment-directive");
+        throw new DocumentCompileError(`directives on fragment spread '...${name2}' are not supported`, "fragment-directive");
       }
-      if (stack.includes(name)) {
-        throw new DocumentCompileError(`fragment cycle detected through '${name}'`, "fragment-cycle");
+      if (stack.includes(name2)) {
+        throw new DocumentCompileError(`fragment cycle detected through '${name2}'`, "fragment-cycle");
       }
-      const fragment = fragments.get(name);
+      const fragment = fragments.get(name2);
       if (!fragment) {
-        throw new DocumentCompileError(`unknown fragment '${name}'`, "unknown-fragment");
+        throw new DocumentCompileError(`unknown fragment '${name2}'`, "unknown-fragment");
       }
-      const inlined2 = flattenSelectionSet(fragment.selectionSet, fragments, [...stack, name]);
+      const inlined2 = flattenSelectionSet(fragment.selectionSet, fragments, [...stack, name2]);
       selections.push(...inlined2.selections);
       continue;
     }
@@ -2147,6 +3138,136 @@ function computeOpsHash(opHashes) {
   const digest = createHash("sha256").update(OPS_HASH_DOMAIN).update([...opHashes].sort().join("\n")).digest("hex");
   return `sha256:${digest}`;
 }
+var SOURCE_DIRECTIVES = /* @__PURE__ */ new Set(["prefetch", "writeback", "localOnly"]);
+var fail = (message, code) => {
+  throw new DocumentCompileError(message, code);
+};
+function readArgs(node, name2) {
+  return (node.directives ?? []).filter((directive) => directive.name.value === name2).map((directive) => {
+    const args = {};
+    for (const arg of directive.arguments ?? []) {
+      const key = arg.name.value;
+      if (key === "source" || key === "maxStaleness") {
+        if (arg.value.kind !== Kind.STRING) fail(`@${name2}(${key}:) must be a string literal`, "invalid-source-directive");
+        args[key] = arg.value.value;
+      } else if (key === "mode" && name2 === "writeback") {
+        if (arg.value.kind !== Kind.ENUM || !["SYNC", "ASYNC"].includes(arg.value.value)) {
+          fail("@writeback(mode:) must be SYNC or ASYNC", "invalid-source-directive");
+        }
+        args.mode = arg.value.value === "SYNC" ? "sync" : "async";
+      } else {
+        fail(`@${name2} does not take argument '${key}'`, "invalid-source-directive");
+      }
+    }
+    if (!args.source) fail(`@${name2} needs a source: argument`, "invalid-source-directive");
+    return args;
+  });
+}
+function prefetchSourceFor({ resolved, name: name2, directive, table }) {
+  if (!resolved) return fail(`@${directive} is only valid on resolved tables \u2014 '${table}' is not one`, "invalid-source-directive");
+  const source = resolved.sources.find((entry) => entry.name === name2);
+  if (!source || source.kind !== "prefetch") {
+    const options = resolved.sources.filter((entry) => entry.kind === "prefetch").map((entry) => entry.name);
+    return fail(`@${directive}(source: "${name2}") on '${table}' must name a prefetch source (${options.join(", ") || "none declared"})`, "invalid-source-directive");
+  }
+  return source;
+}
+function applyPrefetchDirectives({ node, root, meta }) {
+  const directives = readArgs(node, "prefetch");
+  for (const name2 of ["writeback", "localOnly"]) {
+    if (readArgs(node, name2).length > 0) fail(`@${name2} is only valid on resolved-table mutation roots`, "invalid-source-directive");
+  }
+  if (directives.length === 0) return root;
+  if (root.kind !== "select" && root.kind !== "byPk") {
+    return fail(`@prefetch is only valid on select and byPk roots, not '${root.alias}'`, "invalid-source-directive");
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const plans = directives.map((directive) => {
+    const source = prefetchSourceFor({ resolved: meta.resolved, name: directive.source, directive: "prefetch", table: root.table });
+    if (seen.has(source.name)) fail(`@prefetch(source: "${source.name}") appears twice on '${root.alias}'`, "invalid-source-directive");
+    seen.add(source.name);
+    const maxStalenessMs = directive.maxStaleness === void 0 ? void 0 : parseDurationMs(directive.maxStaleness);
+    if (directive.maxStaleness !== void 0 && maxStalenessMs === void 0) {
+      fail(`@prefetch(maxStaleness: "${directive.maxStaleness}") must look like '500ms', '30s' or '5m'`, "invalid-source-directive");
+    }
+    const key = root.kind === "byPk" ? { one: root.pk[0].value } : selectKey({ where: root.where, pk: meta.resolved.pk, source, alias: root.alias });
+    return { source: source.name, ...maxStalenessMs !== void 0 ? { maxStalenessMs } : {}, key };
+  });
+  return { ...root, prefetch: plans };
+}
+function selectKey({ where, pk, source, alias }) {
+  const leaves = where.kind === "and" ? where.operands : [where];
+  const pinned = leaves.find((leaf) => leaf.kind === "cmp" && leaf.column === pk && (leaf.op === "eq" || leaf.op === "in"));
+  const shape = source.fetch?.shape ?? "single";
+  if (!pinned || pinned.kind !== "cmp") {
+    return fail(
+      `@prefetch(source: "${source.name}") on '${alias}': the root is not key-addressed \u2014 its where must pin '${pk}' with _eq${shape === "batch" ? " or _in" : ""} (${source.name} supports ${shape === "batch" ? "batch" : "single-key"} fetch)`,
+      "prefetch-shape-mismatch"
+    );
+  }
+  if (pinned.op === "in" && shape !== "batch") {
+    return fail(`@prefetch(source: "${source.name}") on '${alias}': ${source.name} only supports single-key fetch, but the root selects '${pk}' with _in`, "prefetch-shape-mismatch");
+  }
+  return pinned.op === "eq" ? { one: pinned.value } : { many: pinned.value };
+}
+function applyWritebackDirectives({ node, root, meta }) {
+  if (readArgs(node, "prefetch").length > 0) fail("@prefetch is only valid on query roots", "invalid-source-directive");
+  const writebacks = readArgs(node, "writeback");
+  const localOnly = readArgs(node, "localOnly");
+  if (root.kind !== "mutation" || root.op !== "resolvedWrite" || !meta.resolved) {
+    if (writebacks.length + localOnly.length > 0) fail("@writeback/@localOnly are only valid on resolved-table mutation roots", "invalid-source-directive");
+    return root;
+  }
+  const resolved = meta.resolved;
+  const declared = /* @__PURE__ */ new Map();
+  const bindings = [];
+  for (const directive of writebacks) {
+    const source = prefetchSourceFor({ resolved, name: directive.source, directive: "writeback", table: root.table });
+    if (!source.writeback) fail(`@writeback(source: "${source.name}"): source '${source.name}' declares no writeback columns`, "invalid-source-directive");
+    if (root.resolvedAction !== "update") {
+      fail(`@writeback on '${root.alias}': only update roots write back in v1 (use @localOnly for ${root.resolvedAction ?? "this"} roots)`, "writeback-shape-mismatch");
+    }
+    if (declared.has(source.name)) fail(`source '${source.name}' is declared twice on '${root.alias}'`, "invalid-source-directive");
+    declared.set(source.name, "writeback");
+    bindings.push({ source: source.name, mode: directive.mode ?? source.writeback.defaultMode });
+  }
+  for (const directive of localOnly) {
+    const source = prefetchSourceFor({ resolved, name: directive.source, directive: "localOnly", table: root.table });
+    if (declared.has(source.name)) fail(`source '${source.name}' is declared twice on '${root.alias}'`, "invalid-source-directive");
+    declared.set(source.name, "localOnly");
+  }
+  assertWritebacksDeclared({ root, meta, resolved, declared });
+  return {
+    ...root,
+    ...bindings.length > 0 ? { writeback: bindings } : {},
+    ...localOnly.length > 0 ? { localOnly: localOnly.map((directive) => directive.source) } : {}
+  };
+}
+function assertWritebacksDeclared({ root, meta, resolved, declared }) {
+  const written = writtenColumns({ root, meta });
+  for (const source of resolved.sources) {
+    const columns = source.writeback?.columns.filter((column) => written.has(column)) ?? [];
+    if (columns.length > 0 && !declared.has(source.name)) {
+      fail(
+        `'${root.alias}' sets ${columns.map((column) => `'${column}'`).join(", ")}, which source '${source.name}' writes back \u2014 add @writeback(source: "${source.name}") to push the change or @localOnly(source: "${source.name}") to keep it local`,
+        "writeback-undeclared"
+      );
+    }
+  }
+}
+function writtenColumns({ root, meta }) {
+  if (root.resolvedAction === "update") {
+    if (!root.set || "slot" in root.set) return new Set(meta.settable);
+    return new Set(root.set.entries.map((entry) => entry.column));
+  }
+  if (root.resolvedAction === "insert") {
+    if (!root.objects || "slot" in root.objects) return new Set(meta.insertable);
+    return new Set(root.objects.rows.flatMap((row) => row.map((entry) => entry.column)));
+  }
+  return /* @__PURE__ */ new Set();
+}
+
+// src/compiler-gql/lower.ts
 var DEFAULT_LIMIT = 100;
 var MAX_LIMIT = 1e3;
 var MAX_GROUPS = 1e3;
@@ -2184,7 +3305,7 @@ var ORDER_DIRECTIONS = {
   DESC_NULLS_LAST: { direction: "desc", nulls: "last" }
 };
 var NUMERIC_TYPES = /* @__PURE__ */ new Set(["integer", "bigint", "numeric", "double"]);
-function fail(message, code, candidates = []) {
+function fail2(message, code, candidates = []) {
   throw new DocumentCompileError(message, code, candidates);
 }
 function argsByName(field) {
@@ -2192,16 +3313,16 @@ function argsByName(field) {
 }
 function* aggregateBlockFields(selectionSet) {
   for (const node of selectionSet.selections) {
-    if (node.kind !== Kind.FIELD) fail("fragments must be flattened before lowering", "internal");
+    if (node.kind !== Kind.FIELD) fail2("fragments must be flattened before lowering", "internal");
     if (node.name.value === "__typename") continue;
-    if (node.alias) fail(`aliases are not supported inside aggregate blocks ('${node.alias.value}')`, "invalid-aggregate");
+    if (node.alias) fail2(`aliases are not supported inside aggregate blocks ('${node.alias.value}')`, "invalid-aggregate");
     yield node;
   }
 }
 function assertKnownArgs(field, allowed) {
   for (const arg of field.arguments ?? []) {
     if (!allowed.includes(arg.name.value)) {
-      fail(`argument '${arg.name.value}' on '${field.name.value}' is not supported in v2.0`, "unsupported-argument", allowed);
+      fail2(`argument '${arg.name.value}' on '${field.name.value}' is not supported in v2.0`, "unsupported-argument", allowed);
     }
   }
 }
@@ -2214,27 +3335,31 @@ var OperationLowerer = class {
   meta(table) {
     return this.ctx.tables[table];
   }
-  column(table, name) {
-    return this.meta(table).columns.find((c) => c.name === name);
+  /** A data column — cell-metadata columns are reachable only through `cells { … }`. */
+  column(table, name2) {
+    const meta = this.meta(table);
+    const column = meta.columns.find((c) => c.name === name2);
+    return column && !isCellColumn(meta, name2) ? column : void 0;
   }
-  link(table, name) {
-    return this.meta(table).links.find((l) => l.name === name);
+  link(table, name2) {
+    return this.meta(table).links.find((l) => l.name === name2);
   }
   fieldCandidates(table) {
     const meta = this.meta(table);
     return [
-      ...meta.columns.map((c) => c.name),
+      ...meta.columns.filter((c) => !isCellColumn(meta, c.name)).map((c) => c.name),
+      ...meta.cells ? [CELLS_FIELD] : [],
       ...meta.links.map((l) => l.name),
       ...meta.links.filter((l) => l.kind === "toMany").map((l) => `${l.name}Aggregate`)
     ];
   }
   /** Validate that a whole-variable argument is the declared §4f slot for this table. */
-  slot(name, input, table) {
-    const variable = this.variables.get(name);
+  slot(name2, input, table) {
+    const variable = this.variables.get(name2);
     if (!variable || variable.type.kind !== "inputRef" || variable.type.input !== input || variable.type.table !== table) {
-      fail(`variable $${name} must be declared as the ${input} input type for table '${table}'`, "slot-mismatch");
+      fail2(`variable $${name2} must be declared as the ${input} input type for table '${table}'`, "slot-mismatch");
     }
-    return name;
+    return name2;
   }
   // -------------------------------------------------------------------------
   // Values
@@ -2257,14 +3382,14 @@ var OperationLowerer = class {
         const items = node.values.map((item) => {
           const lowered = this.lowerValue(item);
           if (lowered.kind !== "literal" || Array.isArray(lowered.value)) {
-            fail("list literals must contain scalar literals only \u2014 pass the whole list as a variable instead", "unsupported-literal");
+            fail2("list literals must contain scalar literals only \u2014 pass the whole list as a variable instead", "unsupported-literal");
           }
           return lowered.value;
         });
         return { kind: "literal", value: items };
       }
       case Kind.OBJECT:
-        fail("literal JSON objects are not supported in documents \u2014 pass the value via a variable", "unsupported-literal");
+        fail2("literal JSON objects are not supported in documents \u2014 pass the value via a variable", "unsupported-literal");
     }
   }
   // -------------------------------------------------------------------------
@@ -2274,7 +3399,7 @@ var OperationLowerer = class {
     if (node.kind === Kind.VARIABLE) {
       return { kind: "dynamicFilter", slot: this.slot(node.name.value, "boolExp", table) };
     }
-    if (node.kind !== Kind.OBJECT) fail(`a boolean expression on '${table}' must be an object or a variable`, "invalid-boolexp");
+    if (node.kind !== Kind.OBJECT) fail2(`a boolean expression on '${table}' must be an object or a variable`, "invalid-boolexp");
     const operands = [];
     for (const field of node.fields) {
       const key = field.name.value;
@@ -2305,45 +3430,45 @@ var OperationLowerer = class {
           continue;
         }
       }
-      fail(`unknown field '${key}' in a boolean expression on '${table}'`, "unknown-column", this.fieldCandidates(table));
+      fail2(`unknown field '${key}' in a boolean expression on '${table}'`, "unknown-column", this.fieldCandidates(table));
     }
     if (operands.length === 0) return CONST_TRUE;
     return operands.length === 1 ? operands[0] : { kind: "and", operands };
   }
   lowerComparison(node, column, table) {
     if (node.kind !== Kind.OBJECT) {
-      fail(`comparison on '${table}.${column}' must be an object like { _eq: \u2026 }`, "invalid-comparison", Object.keys(BOOLEXP_OPS));
+      fail2(`comparison on '${table}.${column}' must be an object like { _eq: \u2026 }`, "invalid-comparison", Object.keys(BOOLEXP_OPS));
     }
     return node.fields.map((field) => {
       const op = BOOLEXP_OPS[field.name.value];
       if (!op) {
-        fail(`unknown comparison operator '${field.name.value}' on '${table}.${column}'`, "unknown-operator", Object.keys(BOOLEXP_OPS));
+        fail2(`unknown comparison operator '${field.name.value}' on '${table}.${column}'`, "unknown-operator", Object.keys(BOOLEXP_OPS));
       }
       return { kind: "cmp", op, column, value: this.lowerValue(field.value) };
     });
   }
   /** Hasura aggregation predicate: `{ count: { predicate: { _gt: 2 }, filter: {…} } }`. */
   lowerAggPredicate(node, link, target) {
-    if (node.kind !== Kind.OBJECT) fail(`aggregate predicate through '${link}' must be an object`, "invalid-agg-predicate");
+    if (node.kind !== Kind.OBJECT) fail2(`aggregate predicate through '${link}' must be an object`, "invalid-agg-predicate");
     const countField = node.fields.find((f) => f.name.value === "count");
     if (!countField || node.fields.length !== 1) {
-      fail(`aggregate predicates support { count: \u2026 } only in v2.0 (through '${link}')`, "invalid-agg-predicate", ["count"]);
+      fail2(`aggregate predicates support { count: \u2026 } only in v2.0 (through '${link}')`, "invalid-agg-predicate", ["count"]);
     }
-    if (countField.value.kind !== Kind.OBJECT) fail(`count predicate through '${link}' must be an object`, "invalid-agg-predicate");
+    if (countField.value.kind !== Kind.OBJECT) fail2(`count predicate through '${link}' must be an object`, "invalid-agg-predicate");
     let predicate;
     let where;
     for (const field of countField.value.fields) {
       if (field.name.value === "predicate") {
         if (field.value.kind !== Kind.OBJECT || field.value.fields.length !== 1) {
-          fail(`count predicate through '${link}' needs exactly one operator`, "invalid-agg-predicate", [...AGG_PREDICATE_OPS]);
+          fail2(`count predicate through '${link}' needs exactly one operator`, "invalid-agg-predicate", [...AGG_PREDICATE_OPS]);
         }
         const opField = field.value.fields[0];
         const opName = opField.name.value;
         if (!AGG_PREDICATE_OPS.includes(opName)) {
-          fail(`aggregate count predicates support ${AGG_PREDICATE_OPS.join("/")} only, got '${opName}'`, "invalid-agg-predicate");
+          fail2(`aggregate count predicates support ${AGG_PREDICATE_OPS.join("/")} only, got '${opName}'`, "invalid-agg-predicate");
         }
         if (opField.value.kind !== Kind.INT) {
-          fail(`aggregate count predicate value must be an integer literal`, "invalid-agg-predicate");
+          fail2(`aggregate count predicate value must be an integer literal`, "invalid-agg-predicate");
         }
         predicate = { op: opName.slice(1), value: Number(opField.value.value) };
         continue;
@@ -2352,9 +3477,9 @@ var OperationLowerer = class {
         where = this.lowerBoolExp(field.value, target);
         continue;
       }
-      fail(`unknown key '${field.name.value}' in a count predicate`, "invalid-agg-predicate", ["predicate", "filter"]);
+      fail2(`unknown key '${field.name.value}' in a count predicate`, "invalid-agg-predicate", ["predicate", "filter"]);
     }
-    if (!predicate) fail(`count predicate through '${link}' needs a { predicate: { _gt: n } }`, "invalid-agg-predicate");
+    if (!predicate) fail2(`count predicate through '${link}' needs a { predicate: { _gt: n } }`, "invalid-agg-predicate");
     return { kind: "aggPredicate", link, fn: "count", op: predicate.op, value: predicate.value, ...where ? { where } : {} };
   }
   lowerOrderBy(node, table) {
@@ -2364,7 +3489,7 @@ var OperationLowerer = class {
     const items = node.kind === Kind.LIST ? node.values : [node];
     const lowered = [];
     for (const item of items) {
-      if (item.kind !== Kind.OBJECT) fail(`orderBy entries on '${table}' must be objects`, "invalid-orderby");
+      if (item.kind !== Kind.OBJECT) fail2(`orderBy entries on '${table}' must be objects`, "invalid-orderby");
       for (const field of item.fields) {
         const key = field.name.value;
         const column = this.column(table, key);
@@ -2375,25 +3500,25 @@ var OperationLowerer = class {
         const link = this.link(table, key);
         if (link && link.kind !== "toMany") {
           if (field.value.kind !== Kind.OBJECT || field.value.fields.length !== 1) {
-            fail(`orderBy through '${key}' needs exactly one target column`, "invalid-orderby");
+            fail2(`orderBy through '${key}' needs exactly one target column`, "invalid-orderby");
           }
           const inner = field.value.fields[0];
           const targetColumn = this.column(link.target, inner.name.value);
           if (!targetColumn) {
-            fail(`unknown column '${inner.name.value}' on '${link.target}' in orderBy`, "unknown-column", this.meta(link.target).columns.map((c) => c.name));
+            fail2(`unknown column '${inner.name.value}' on '${link.target}' in orderBy`, "unknown-column", this.meta(link.target).columns.map((c) => c.name));
           }
           lowered.push({ kind: "column", column: inner.name.value, link: key, ...this.lowerDirection(inner.value, link.target, inner.name.value) });
           continue;
         }
-        fail(`unknown orderBy key '${key}' on '${table}' (to-one links only)`, "invalid-orderby", this.fieldCandidates(table));
+        fail2(`unknown orderBy key '${key}' on '${table}' (to-one links only)`, "invalid-orderby", this.fieldCandidates(table));
       }
     }
     return lowered;
   }
   lowerDirection(node, table, column) {
-    if (node.kind !== Kind.ENUM) fail(`orderBy direction on '${table}.${column}' must be a direction enum`, "invalid-orderby", Object.keys(ORDER_DIRECTIONS));
+    if (node.kind !== Kind.ENUM) fail2(`orderBy direction on '${table}.${column}' must be a direction enum`, "invalid-orderby", Object.keys(ORDER_DIRECTIONS));
     const direction = ORDER_DIRECTIONS[node.value];
-    if (!direction) fail(`unknown orderBy direction '${node.value}'`, "invalid-orderby", Object.keys(ORDER_DIRECTIONS));
+    if (!direction) fail2(`unknown orderBy direction '${node.value}'`, "invalid-orderby", Object.keys(ORDER_DIRECTIONS));
     return direction.nulls ? { direction: direction.direction, nulls: direction.nulls } : { direction: direction.direction };
   }
   lowerDistinctOn(node, table) {
@@ -2402,29 +3527,29 @@ var OperationLowerer = class {
     }
     const items = node.kind === Kind.LIST ? node.values : [node];
     return items.map((item) => {
-      if (item.kind !== Kind.ENUM) fail(`distinctOn entries on '${table}' must be select-column enum values`, "invalid-distinct-on");
+      if (item.kind !== Kind.ENUM) fail2(`distinctOn entries on '${table}' must be select-column enum values`, "invalid-distinct-on");
       if (!this.column(table, item.value)) {
-        fail(`unknown distinctOn column '${item.value}' on '${table}'`, "unknown-column", this.meta(table).columns.map((c) => c.name));
+        fail2(`unknown distinctOn column '${item.value}' on '${table}'`, "unknown-column", this.meta(table).columns.map((c) => c.name));
       }
       return item.value;
     });
   }
   lowerLimit(node) {
-    const base = { default: DEFAULT_LIMIT, max: MAX_LIMIT };
-    if (!node) return base;
-    if (node.kind === Kind.VARIABLE) return { ...base, variable: node.name.value };
+    const base2 = { default: DEFAULT_LIMIT, max: MAX_LIMIT };
+    if (!node) return base2;
+    if (node.kind === Kind.VARIABLE) return { ...base2, variable: node.name.value };
     if (node.kind === Kind.INT) {
       const value = Number(node.value);
-      if (value < 1) fail("limit must be a positive integer", "invalid-limit");
-      return { ...base, value: Math.min(value, MAX_LIMIT) };
+      if (value < 1) fail2("limit must be a positive integer", "invalid-limit");
+      return { ...base2, value: Math.min(value, MAX_LIMIT) };
     }
-    fail("limit must be an integer literal or a variable", "invalid-limit");
+    fail2("limit must be an integer literal or a variable", "invalid-limit");
   }
   lowerOffset(node) {
     if (!node) return void 0;
     if (node.kind === Kind.VARIABLE) return { variable: node.name.value };
     if (node.kind === Kind.INT) return { value: Number(node.value) };
-    fail("offset must be an integer literal or a variable", "invalid-offset");
+    fail2("offset must be an integer literal or a variable", "invalid-offset");
   }
   // -------------------------------------------------------------------------
   // Selections
@@ -2433,27 +3558,32 @@ var OperationLowerer = class {
     const meta = this.meta(table);
     const selection = { typename: meta.typename, columns: [], relations: [], aggregates: [] };
     for (const node of selectionSet.selections) {
-      if (node.kind !== Kind.FIELD) fail("fragments must be flattened before lowering", "internal");
+      if (node.kind !== Kind.FIELD) fail2("fragments must be flattened before lowering", "internal");
       if (node.directives && node.directives.length > 0) {
-        fail(`@include/@skip are supported on root fields only ('${node.name.value}' is nested)`, "nested-directive");
+        fail2(`@include/@skip are supported on root fields only ('${node.name.value}' is nested)`, "nested-directive");
       }
-      const name = node.name.value;
-      if (name === "__typename") continue;
-      const alias = node.alias?.value ?? name;
-      const column = this.column(table, name);
+      const name2 = node.name.value;
+      if (name2 === "__typename") continue;
+      const alias = node.alias?.value ?? name2;
+      const column = this.column(table, name2);
       if (column) {
         if (node.arguments !== void 0 && node.arguments.length > 0 || node.selectionSet !== void 0) {
-          fail(`column '${table}.${name}' takes no arguments or sub-selection`, "invalid-selection");
+          fail2(`column '${table}.${name2}' takes no arguments or sub-selection`, "invalid-selection");
         }
-        selection.columns.push({ alias, column: name });
+        selection.columns.push({ alias, column: name2 });
+        continue;
+      }
+      if (name2 === CELLS_FIELD && meta.cells) {
+        if (selection.cells) fail2(`'${CELLS_FIELD}' may be selected once per object`, "invalid-selection");
+        selection.cells = this.lowerCells(node, table, alias);
         continue;
       }
-      const link = this.link(table, name);
+      const link = this.link(table, name2);
       if (link) {
-        if (!node.selectionSet) fail(`link '${table}.${name}' needs a selection set`, "invalid-selection");
+        if (!node.selectionSet) fail2(`link '${table}.${name2}' needs a selection set`, "invalid-selection");
         const relation = {
           alias,
-          link: name,
+          link: name2,
           selection: this.lowerSelection(node.selectionSet, link.target)
         };
         if (link.kind === "toMany") {
@@ -2469,15 +3599,15 @@ var OperationLowerer = class {
             if (offset) relation.offset = offset;
           }
         } else if (node.arguments && node.arguments.length > 0) {
-          fail(`to-one link '${table}.${name}' takes no arguments`, "invalid-selection");
+          fail2(`to-one link '${table}.${name2}' takes no arguments`, "invalid-selection");
         }
         selection.relations.push(relation);
         continue;
       }
-      if (name.endsWith("Aggregate")) {
-        const aggLink = this.link(table, name.slice(0, -"Aggregate".length));
+      if (name2.endsWith("Aggregate")) {
+        const aggLink = this.link(table, name2.slice(0, -"Aggregate".length));
         if (aggLink && aggLink.kind === "toMany") {
-          if (!node.selectionSet) fail(`'${name}' needs a selection set`, "invalid-selection");
+          if (!node.selectionSet) fail2(`'${name2}' needs a selection set`, "invalid-selection");
           assertKnownArgs(node, ["where"]);
           const whereArg = argsByName(node).get("where");
           const aggregate = this.lowerAggregateSelection(node.selectionSet, aggLink.target);
@@ -2490,28 +3620,75 @@ var OperationLowerer = class {
           continue;
         }
       }
-      fail(`unknown field '${name}' on '${table}'`, "unknown-field", this.fieldCandidates(table));
+      fail2(`unknown field '${name2}' on '${table}'`, "unknown-field", this.fieldCandidates(table));
     }
     return selection;
   }
+  /**
+   * `cells { <column> { at by … } }` — typed per-cell metadata. Plain tables
+   * offer `at`/`by`; resolved tables add the winning `source` and newer
+   * `conflicts { source at value }`.
+   */
+  lowerCells(node, table, alias) {
+    const meta = this.meta(table);
+    const cells = meta.cells ?? {};
+    if (node.arguments && node.arguments.length > 0) fail2(`'${CELLS_FIELD}' takes no arguments`, "invalid-selection");
+    if (!node.selectionSet) fail2(`'${CELLS_FIELD}' needs a selection set`, "invalid-selection");
+    const fields = [];
+    for (const cellNode of fieldNodes(node.selectionSet)) {
+      const column = cellNode.name.value;
+      const parts = cells[column];
+      if (!parts || parts.at === void 0 && parts.source === void 0) {
+        fail2(`unknown cell '${column}' on '${table}'`, "unknown-field", Object.keys(cells));
+      }
+      if (!cellNode.selectionSet) fail2(`cell '${column}' needs a selection set`, "invalid-selection");
+      const resolved = parts.source !== void 0;
+      const allowed = resolved ? ["source", "at", "by", "conflicts"] : ["at", "by"];
+      const selected = [];
+      for (const partNode of fieldNodes(cellNode.selectionSet)) {
+        const part = partNode.name.value;
+        if (!allowed.includes(part)) fail2(`unknown field '${part}' on cell '${column}'`, "unknown-field", allowed);
+        const partAlias = partNode.alias?.value ?? part;
+        if (part !== "conflicts") {
+          if (partNode.selectionSet) fail2(`cell field '${part}' takes no sub-selection`, "invalid-selection");
+          selected.push({ alias: partAlias, part });
+          continue;
+        }
+        if (!partNode.selectionSet) fail2(`'conflicts' needs a selection set`, "invalid-selection");
+        const conflictFields = fieldNodes(partNode.selectionSet).map((fieldNode) => {
+          const field = fieldNode.name.value;
+          if (field !== "source" && field !== "at" && field !== "value") fail2(`unknown field '${field}' on a cell conflict`, "unknown-field", ["source", "at", "value"]);
+          return { alias: fieldNode.alias?.value ?? field, field };
+        });
+        selected.push({ alias: partAlias, part: "conflicts", fields: conflictFields, typename: CELL_TYPENAMES.conflict });
+      }
+      fields.push({
+        alias: cellNode.alias?.value ?? column,
+        column,
+        typename: resolved ? CELL_TYPENAMES.resolved : CELL_TYPENAMES.stamp,
+        parts: selected
+      });
+    }
+    return { alias, typename: cellsTypename(meta.typename), fields };
+  }
   /** The `{ aggregate { count sum {…} avg {…} } nodes {…} }` block shared by roots and relations. */
   lowerAggregateSelection(selectionSet, table) {
     const result = {};
     let sawAggregate = false;
     for (const node of aggregateBlockFields(selectionSet)) {
-      const name = node.name.value;
-      if (name === "nodes") {
-        if (!node.selectionSet) fail("'nodes' needs a selection set", "invalid-aggregate");
+      const name2 = node.name.value;
+      if (name2 === "nodes") {
+        if (!node.selectionSet) fail2("'nodes' needs a selection set", "invalid-aggregate");
         result.nodes = this.lowerSelection(node.selectionSet, table);
         continue;
       }
-      if (name !== "aggregate") fail(`unknown aggregate field '${name}'`, "invalid-aggregate", ["aggregate", "nodes"]);
-      if (sawAggregate) fail("one aggregate block per field \u2014 alias the root instead", "invalid-aggregate");
+      if (name2 !== "aggregate") fail2(`unknown aggregate field '${name2}'`, "invalid-aggregate", ["aggregate", "nodes"]);
+      if (sawAggregate) fail2("one aggregate block per field \u2014 alias the root instead", "invalid-aggregate");
       sawAggregate = true;
-      if (!node.selectionSet) fail("'aggregate' needs a selection set", "invalid-aggregate");
+      if (!node.selectionSet) fail2("'aggregate' needs a selection set", "invalid-aggregate");
       Object.assign(result, this.lowerAggregateFields(node.selectionSet, table));
     }
-    if (!sawAggregate && !result.nodes) fail("aggregate selection needs an aggregate or nodes block", "invalid-aggregate");
+    if (!sawAggregate && !result.nodes) fail2("aggregate selection needs an aggregate or nodes block", "invalid-aggregate");
     return result;
   }
   /**
@@ -2526,26 +3703,26 @@ var OperationLowerer = class {
     let sawAggregate = false;
     let sawKey = false;
     for (const node of aggregateBlockFields(selectionSet)) {
-      const name = node.name.value;
-      if (name === "key") {
-        if (sawKey) fail("one key block per grouped aggregate", "invalid-aggregate");
+      const name2 = node.name.value;
+      if (name2 === "key") {
+        if (sawKey) fail2("one key block per grouped aggregate", "invalid-aggregate");
         sawKey = true;
-        if (!node.selectionSet) fail("'key' needs a selection set", "invalid-aggregate");
+        if (!node.selectionSet) fail2("'key' needs a selection set", "invalid-aggregate");
         result.key = this.lowerGroupKeySelection(node.selectionSet, table, groupColumns);
         continue;
       }
-      if (name === "nodes") {
-        fail("'nodes' is not available on a grouped aggregate \u2014 query the rows separately", "invalid-aggregate", ["key", "aggregate"]);
+      if (name2 === "nodes") {
+        fail2("'nodes' is not available on a grouped aggregate \u2014 query the rows separately", "invalid-aggregate", ["key", "aggregate"]);
       }
-      if (name !== "aggregate") fail(`unknown grouped-aggregate field '${name}'`, "invalid-aggregate", ["key", "aggregate"]);
-      if (sawAggregate) fail("one aggregate block per field \u2014 alias the root instead", "invalid-aggregate");
+      if (name2 !== "aggregate") fail2(`unknown grouped-aggregate field '${name2}'`, "invalid-aggregate", ["key", "aggregate"]);
+      if (sawAggregate) fail2("one aggregate block per field \u2014 alias the root instead", "invalid-aggregate");
       sawAggregate = true;
-      if (!node.selectionSet) fail("'aggregate' needs a selection set", "invalid-aggregate");
+      if (!node.selectionSet) fail2("'aggregate' needs a selection set", "invalid-aggregate");
       Object.assign(result, this.lowerAggregateFields(node.selectionSet, table));
     }
     const rendersAggregate = result.count !== void 0 || (result.sum?.length ?? 0) > 0 || (result.avg?.length ?? 0) > 0;
     if (result.key.length === 0 && !rendersAggregate) {
-      fail(
+      fail2(
         "grouped aggregate needs at least one key column or an aggregate \u2014 a block selecting only __typename produces nothing",
         "invalid-aggregate",
         ["key", "aggregate"]
@@ -2562,20 +3739,20 @@ var OperationLowerer = class {
   lowerGroupKeySelection(selectionSet, table, groupColumns) {
     const key = [];
     for (const node of selectionSet.selections) {
-      if (node.kind !== Kind.FIELD) fail("fragments must be flattened before lowering", "internal");
-      const name = node.name.value;
-      if (name === "__typename") continue;
-      if (!this.column(table, name)) {
-        fail(`unknown key column '${name}' on '${table}'`, "unknown-column", [...groupColumns]);
-      }
-      if (!groupColumns.has(name)) {
-        fail(
-          `key column '${name}' is not one of this query's groupBy keys \u2014 it has no single value within a group`,
+      if (node.kind !== Kind.FIELD) fail2("fragments must be flattened before lowering", "internal");
+      const name2 = node.name.value;
+      if (name2 === "__typename") continue;
+      if (!this.column(table, name2)) {
+        fail2(`unknown key column '${name2}' on '${table}'`, "unknown-column", [...groupColumns]);
+      }
+      if (!groupColumns.has(name2)) {
+        fail2(
+          `key column '${name2}' is not one of this query's groupBy keys \u2014 it has no single value within a group`,
           "invalid-group-key",
           [...groupColumns]
         );
       }
-      key.push({ alias: node.alias?.value ?? name, column: name });
+      key.push({ alias: node.alias?.value ?? name2, column: name2 });
     }
     return key;
   }
@@ -2592,21 +3769,21 @@ var OperationLowerer = class {
         if (columns) count.columns = this.lowerDistinctOn(columns.value, table);
         const distinct = args.get("distinct");
         if (distinct) {
-          if (distinct.value.kind !== Kind.BOOLEAN) fail("count(distinct:) must be a boolean literal", "invalid-aggregate");
+          if (distinct.value.kind !== Kind.BOOLEAN) fail2("count(distinct:) must be a boolean literal", "invalid-aggregate");
           count.distinct = distinct.value.value;
         }
         result.count = count;
         continue;
       }
       if (aggName === "sum" || aggName === "avg") {
-        if (!aggField.selectionSet) fail(`'${aggName}' needs a column selection`, "invalid-aggregate");
+        if (!aggField.selectionSet) fail2(`'${aggName}' needs a column selection`, "invalid-aggregate");
         const columns = [];
         for (const columnField of aggField.selectionSet.selections) {
-          if (columnField.kind !== Kind.FIELD) fail("fragments must be flattened before lowering", "internal");
+          if (columnField.kind !== Kind.FIELD) fail2("fragments must be flattened before lowering", "internal");
           if (columnField.name.value === "__typename") continue;
           const column = this.column(table, columnField.name.value);
           if (!column || typeof column.type !== "string" || !NUMERIC_TYPES.has(column.type)) {
-            fail(
+            fail2(
               `'${aggName}' supports numeric columns only, got '${columnField.name.value}' on '${table}'`,
               "invalid-aggregate",
               this.meta(table).columns.filter((c) => typeof c.type === "string" && NUMERIC_TYPES.has(c.type)).map((c) => c.name)
@@ -2617,7 +3794,7 @@ var OperationLowerer = class {
         result[aggName] = columns;
         continue;
       }
-      fail(`aggregate '${aggName}' is not supported in v2.0 (count/sum/avg only)`, "invalid-aggregate", ["count", "sum", "avg"]);
+      fail2(`aggregate '${aggName}' is not supported in v2.0 (count/sum/avg only)`, "invalid-aggregate", ["count", "sum", "avg"]);
     }
     return result;
   }
@@ -2627,41 +3804,43 @@ var OperationLowerer = class {
   lowerRoots(operation, kind) {
     const roots = [];
     for (const node of operation.selectionSet.selections) {
-      if (node.kind !== Kind.FIELD) fail("fragments are not supported at the operation root", "invalid-root");
+      if (node.kind !== Kind.FIELD) fail2("fragments are not supported at the operation root", "invalid-root");
       if (node.selectionSet) visit(node.selectionSet, {
         Directive(directive) {
           if (directive.name.value === "assertAffectedRows") {
-            fail("@assertAffectedRows is supported on mutation roots only", "invalid-affected-row-assertion");
+            fail2("@assertAffectedRows is supported on mutation roots only", "invalid-affected-row-assertion");
           }
         }
       });
       const assertion = this.parseAffectedRowAssertion(node, kind);
       const gate = this.parseRootDirectives(node);
       if (gate.omit) continue;
-      const root = kind === "query" ? this.lowerQueryRoot(node) : this.lowerMutationRoot(node);
+      const lowered = kind === "query" ? this.lowerQueryRoot(node) : this.lowerMutationRoot(node);
+      const meta = this.meta(lowered.table);
+      const root = kind === "query" ? applyPrefetchDirectives({ node, root: lowered, meta }) : applyWritebackDirectives({ node, root: lowered, meta });
       const guarded = root.kind === "mutation" && assertion !== void 0 ? { ...root, assertAffectedRows: assertion } : root;
       roots.push(gate.includeIf ? { ...guarded, includeIf: gate.includeIf } : guarded);
     }
-    if (roots.length === 0) fail("operation has no roots (all statically skipped?)", "invalid-root");
+    if (roots.length === 0) fail2("operation has no roots (all statically skipped?)", "invalid-root");
     return roots;
   }
   parseAffectedRowAssertion(node, kind) {
     const assertions = node.directives?.filter((directive) => directive.name.value === "assertAffectedRows") ?? [];
     if (!assertions.length) return void 0;
     if (kind !== "mutation" || assertions.length !== 1) {
-      fail("@assertAffectedRows is supported once per mutation root", "invalid-affected-row-assertion");
+      fail2("@assertAffectedRows is supported once per mutation root", "invalid-affected-row-assertion");
     }
     if (node.directives?.some((directive) => ["include", "skip"].includes(directive.name.value))) {
-      fail("an @assertAffectedRows root cannot use @include or @skip", "invalid-affected-row-assertion");
+      fail2("an @assertAffectedRows root cannot use @include or @skip", "invalid-affected-row-assertion");
     }
     const args = assertions[0].arguments;
     const arg = args?.[0];
     if (args?.length !== 1 || arg?.name.value !== "exactly" || arg.value.kind !== Kind.INT) {
-      fail("@assertAffectedRows(exactly:) requires a document-authored nonnegative Int literal", "invalid-affected-row-assertion");
+      fail2("@assertAffectedRows(exactly:) requires a document-authored nonnegative Int literal", "invalid-affected-row-assertion");
     }
     const count = Number(arg.value.value);
     if (!Number.isInteger(count) || count < 0 || count > 2147483647) {
-      fail("@assertAffectedRows(exactly:) must be between 0 and 2147483647", "invalid-affected-row-assertion");
+      fail2("@assertAffectedRows(exactly:) must be between 0 and 2147483647", "invalid-affected-row-assertion");
     }
     return count;
   }
@@ -2669,34 +3848,35 @@ var OperationLowerer = class {
     let includeIf;
     let omit = false;
     for (const directive of node.directives ?? []) {
-      const name = directive.name.value;
-      if (name === "assertAffectedRows") continue;
-      if (name !== "include" && name !== "skip") {
-        fail(`directive @${name} is not supported on fields`, "unknown-directive", ["include", "skip"]);
+      const name2 = directive.name.value;
+      if (name2 === "assertAffectedRows") continue;
+      if (SOURCE_DIRECTIVES.has(name2)) continue;
+      if (name2 !== "include" && name2 !== "skip") {
+        fail2(`directive @${name2} is not supported on fields`, "unknown-directive", ["include", "skip"]);
       }
       const ifArg = directive.arguments?.find((a) => a.name.value === "if");
-      if (!ifArg) fail(`@${name} needs an if: argument`, "invalid-directive");
+      if (!ifArg) fail2(`@${name2} needs an if: argument`, "invalid-directive");
       if (ifArg.value.kind === Kind.BOOLEAN) {
-        const keep = name === "include" ? ifArg.value.value : !ifArg.value.value;
+        const keep = name2 === "include" ? ifArg.value.value : !ifArg.value.value;
         if (!keep) omit = true;
         continue;
       }
-      if (ifArg.value.kind !== Kind.VARIABLE) fail(`@${name}(if:) must be a boolean literal or variable`, "invalid-directive");
-      if (includeIf) fail("at most one of @include/@skip per root field", "invalid-directive");
-      includeIf = { variable: ifArg.value.name.value, negated: name === "skip" };
+      if (ifArg.value.kind !== Kind.VARIABLE) fail2(`@${name2}(if:) must be a boolean literal or variable`, "invalid-directive");
+      if (includeIf) fail2("at most one of @include/@skip per root field", "invalid-directive");
+      includeIf = { variable: ifArg.value.name.value, negated: name2 === "skip" };
     }
     return omit ? { omit: true } : { includeIf, omit: false };
   }
   lowerQueryRoot(node) {
-    const name = node.name.value;
-    const alias = node.alias?.value ?? name;
-    const rootInfo = this.ctx.queryRoots.get(name);
-    if (!rootInfo) fail(`unknown query root '${name}'`, "unknown-root", [...this.ctx.queryRoots.keys()]);
+    const name2 = node.name.value;
+    const alias = node.alias?.value ?? name2;
+    const rootInfo = this.ctx.queryRoots.get(name2);
+    if (!rootInfo) fail2(`unknown query root '${name2}'`, "unknown-root", [...this.ctx.queryRoots.keys()]);
     const { table } = rootInfo;
     const args = argsByName(node);
     if (rootInfo.kind === "select") {
       assertKnownArgs(node, ["where", "orderBy", "distinctOn", "limit", "offset"]);
-      if (!node.selectionSet) fail(`'${name}' needs a selection set`, "invalid-selection");
+      if (!node.selectionSet) fail2(`'${name2}' needs a selection set`, "invalid-selection");
       const where = args.get("where");
       const orderBy = args.get("orderBy");
       const distinctOn = args.get("distinctOn");
@@ -2715,7 +3895,7 @@ var OperationLowerer = class {
       };
     }
     if (rootInfo.kind === "byPk") {
-      if (!node.selectionSet) fail(`'${name}' needs a selection set`, "invalid-selection");
+      if (!node.selectionSet) fail2(`'${name2}' needs a selection set`, "invalid-selection");
       const pk = this.lowerPkArgs(node, table);
       return { kind: "byPk", alias, table, selection: this.lowerSelection(node.selectionSet, table), pk, where: CONST_TRUE };
     }
@@ -2723,7 +3903,7 @@ var OperationLowerer = class {
       return this.lowerAggregateGroupsRoot(node, { alias, table });
     }
     assertKnownArgs(node, ["where"]);
-    if (!node.selectionSet) fail(`'${name}' needs a selection set`, "invalid-selection");
+    if (!node.selectionSet) fail2(`'${name2}' needs a selection set`, "invalid-selection");
     const whereArg = args.get("where");
     const aggregate = this.lowerAggregateSelection(node.selectionSet, table);
     return {
@@ -2737,10 +3917,10 @@ var OperationLowerer = class {
   /** `<t>AggregateGroups(where:, groupBy:, limit:, offset:)` → an aggregateGroups root. */
   lowerAggregateGroupsRoot(node, { alias, table }) {
     assertKnownArgs(node, ["where", "groupBy", "limit", "offset"]);
-    if (!node.selectionSet) fail(`'${node.name.value}' needs a selection set`, "invalid-selection");
+    if (!node.selectionSet) fail2(`'${node.name.value}' needs a selection set`, "invalid-selection");
     const args = argsByName(node);
     const groupByArg = args.get("groupBy");
-    if (!groupByArg) fail(`'${node.name.value}' requires a 'groupBy' argument`, "missing-group-by");
+    if (!groupByArg) fail2(`'${node.name.value}' requires a 'groupBy' argument`, "missing-group-by");
     const whereArg = args.get("where");
     const groupBy = this.lowerGroupBy(groupByArg.value, table);
     const aggregate = this.lowerGroupedAggregateSelection(node.selectionSet, table, groupBy);
@@ -2770,55 +3950,55 @@ var OperationLowerer = class {
    */
   lowerGroupBy(node, table) {
     if (node.kind === Kind.VARIABLE) {
-      fail(
+      fail2(
         `groupBy on '${table}' must be written in the document \u2014 it cannot come from a variable`,
         "dynamic-group-by"
       );
     }
     const items = node.kind === Kind.LIST ? node.values : [node];
-    if (items.length === 0) fail(`groupBy on '${table}' needs at least one key`, "invalid-group-by");
+    if (items.length === 0) fail2(`groupBy on '${table}' needs at least one key`, "invalid-group-by");
     const seen = /* @__PURE__ */ new Set();
     return items.map((item) => {
       if (item.kind !== Kind.OBJECT) {
-        fail(`groupBy entries on '${table}' must be objects like { column: foo }`, "invalid-group-by");
+        fail2(`groupBy entries on '${table}' must be objects like { column: foo }`, "invalid-group-by");
       }
       const fields = new Map(item.fields.map((field) => [field.name.value, field.value]));
       for (const key of fields.keys()) {
         if (key !== "column" && key !== "bucket") {
-          fail(`unknown groupBy field '${key}' on '${table}'`, "invalid-group-by", ["column", "bucket"]);
+          fail2(`unknown groupBy field '${key}' on '${table}'`, "invalid-group-by", ["column", "bucket"]);
         }
       }
       const columnNode = fields.get("column");
-      if (!columnNode) fail(`groupBy entries on '${table}' need a 'column'`, "invalid-group-by");
+      if (!columnNode) fail2(`groupBy entries on '${table}' need a 'column'`, "invalid-group-by");
       if (columnNode.kind !== Kind.ENUM) {
-        fail(`groupBy column on '${table}' must be a group-by column enum value`, "invalid-group-by");
+        fail2(`groupBy column on '${table}' must be a group-by column enum value`, "invalid-group-by");
       }
       const column = this.column(table, columnNode.value);
       if (!column) {
-        fail(`unknown groupBy column '${columnNode.value}' on '${table}'`, "unknown-column", this.meta(table).columns.map((c) => c.name));
+        fail2(`unknown groupBy column '${columnNode.value}' on '${table}'`, "unknown-column", this.meta(table).columns.map((c) => c.name));
       }
       if (column.type === "jsonb") {
-        fail(`groupBy column '${table}.${columnNode.value}' is jsonb and cannot be a group key`, "invalid-group-by");
+        fail2(`groupBy column '${table}.${columnNode.value}' is jsonb and cannot be a group key`, "invalid-group-by");
       }
       const bucketNode = fields.get("bucket");
       let bucket;
       if (bucketNode) {
         if (bucketNode.kind !== Kind.ENUM) {
-          fail(`groupBy bucket on '${table}.${columnNode.value}' must be a DateBucket enum value`, "invalid-group-by", Object.keys(DATE_BUCKET_BY_ENUM));
+          fail2(`groupBy bucket on '${table}.${columnNode.value}' must be a DateBucket enum value`, "invalid-group-by", Object.keys(DATE_BUCKET_BY_ENUM));
         }
         bucket = DATE_BUCKET_BY_ENUM[bucketNode.value];
         if (!bucket) {
-          fail(`unknown DateBucket '${bucketNode.value}'`, "invalid-group-by", Object.keys(DATE_BUCKET_BY_ENUM));
+          fail2(`unknown DateBucket '${bucketNode.value}'`, "invalid-group-by", Object.keys(DATE_BUCKET_BY_ENUM));
         }
         if (typeof column.type !== "string" || !BUCKETABLE_TYPES.has(column.type)) {
-          fail(
+          fail2(
             `groupBy bucket is only valid on date/timestamptz columns \u2014 '${table}.${columnNode.value}' is ${typeof column.type === "string" ? column.type : "an enum"}`,
             "invalid-group-by"
           );
         }
       }
       if (seen.has(columnNode.value)) {
-        fail(`duplicate groupBy column '${columnNode.value}' on '${table}'`, "invalid-group-by");
+        fail2(`duplicate groupBy column '${columnNode.value}' on '${table}'`, "invalid-group-by");
       }
       seen.add(columnNode.value);
       return bucket ? { column: columnNode.value, bucket } : { column: columnNode.value };
@@ -2826,15 +4006,15 @@ var OperationLowerer = class {
   }
   /** Like lowerLimit, but bounded by MAX_GROUPS and defaulting to it. */
   lowerGroupLimit(node) {
-    const base = { default: MAX_GROUPS, max: MAX_GROUPS };
-    if (!node) return base;
-    if (node.kind === Kind.VARIABLE) return { ...base, variable: node.name.value };
+    const base2 = { default: MAX_GROUPS, max: MAX_GROUPS };
+    if (!node) return base2;
+    if (node.kind === Kind.VARIABLE) return { ...base2, variable: node.name.value };
     if (node.kind === Kind.INT) {
       const value = Number(node.value);
-      if (value < 1) fail("limit must be a positive integer", "invalid-limit");
-      return { ...base, value: Math.min(value, MAX_GROUPS) };
+      if (value < 1) fail2("limit must be a positive integer", "invalid-limit");
+      return { ...base2, value: Math.min(value, MAX_GROUPS) };
     }
-    fail("limit must be an integer literal or a variable", "invalid-limit");
+    fail2("limit must be an integer literal or a variable", "invalid-limit");
   }
   /** byPk-style pk arguments: one argument per primary-key column, exactly. */
   lowerPkArgs(node, table) {
@@ -2843,7 +4023,7 @@ var OperationLowerer = class {
     assertKnownArgs(node, meta.primaryKey);
     return meta.primaryKey.map((column) => {
       const arg = args.get(column);
-      if (!arg) fail(`'${node.name.value}' is missing primary-key argument '${column}'`, "missing-pk-argument", meta.primaryKey);
+      if (!arg) fail2(`'${node.name.value}' is missing primary-key argument '${column}'`, "missing-pk-argument", meta.primaryKey);
       return { column, value: this.lowerValue(arg.value) };
     });
   }
@@ -2851,25 +4031,28 @@ var OperationLowerer = class {
   // Mutations
   // -------------------------------------------------------------------------
   lowerMutationRoot(node) {
-    const name = node.name.value;
-    const alias = node.alias?.value ?? name;
-    const rootInfo = this.ctx.mutationRoots.get(name);
-    if (!rootInfo) fail(`unknown mutation root '${name}'`, "unknown-root", [...this.ctx.mutationRoots.keys()]);
+    const name2 = node.name.value;
+    const alias = node.alias?.value ?? name2;
+    const rootInfo = this.ctx.mutationRoots.get(name2);
+    if (!rootInfo) fail2(`unknown mutation root '${name2}'`, "unknown-root", [...this.ctx.mutationRoots.keys()]);
     if (rootInfo.op === "cowOverride" || rootInfo.op === "cowRevert") {
       return this.lowerCowRoot(node, rootInfo);
     }
+    if (rootInfo.op === "resolvedWrite") {
+      return this.lowerResolvedRoot(node, rootInfo);
+    }
     const { op, table } = rootInfo;
     const args = argsByName(node);
-    if (!node.selectionSet) fail(`'${name}' needs a selection set`, "invalid-selection");
-    const base = { kind: "mutation", op, alias, table, pinnedColumns: [], affectedRows: false };
+    if (!node.selectionSet) fail2(`'${name2}' needs a selection set`, "invalid-selection");
+    const base2 = { kind: "mutation", op, alias, table, pinnedColumns: [], affectedRows: false };
     switch (op) {
       case "insert": {
         assertKnownArgs(node, ["objects", "onConflict"]);
         const objects = args.get("objects");
-        if (!objects) fail(`'${name}' needs objects:`, "missing-argument");
+        if (!objects) fail2(`'${name2}' needs objects:`, "missing-argument");
         const response = this.lowerMutationResponse(node.selectionSet, table);
         return {
-          ...base,
+          ...base2,
           ...response,
           objects: this.lowerInsertObjects(objects.value, table, { list: true }),
           ...this.lowerOnConflictArg(args.get("onConflict"), table)
@@ -2878,9 +4061,9 @@ var OperationLowerer = class {
       case "insertOne": {
         assertKnownArgs(node, ["object", "onConflict"]);
         const object = args.get("object");
-        if (!object) fail(`'${name}' needs object:`, "missing-argument");
+        if (!object) fail2(`'${name2}' needs object:`, "missing-argument");
         return {
-          ...base,
+          ...base2,
           objects: this.lowerInsertObjects(object.value, table, { list: false }),
           ...this.lowerOnConflictArg(args.get("onConflict"), table),
           returning: this.lowerSelection(node.selectionSet, table)
@@ -2889,9 +4072,9 @@ var OperationLowerer = class {
       case "update": {
         assertKnownArgs(node, ["where", "_set", "_append", "_inc"]);
         const where = args.get("where");
-        if (!where) fail(`'${name}' needs where: (bulk updates without a filter are not allowed)`, "missing-argument");
+        if (!where) fail2(`'${name2}' needs where: (bulk updates without a filter are not allowed)`, "missing-argument");
         return {
-          ...base,
+          ...base2,
           ...this.lowerMutationResponse(node.selectionSet, table),
           where: this.lowerBoolExp(where.value, table),
           ...this.lowerWriteValues(args, table)
@@ -2900,9 +4083,9 @@ var OperationLowerer = class {
       case "updateByPk": {
         assertKnownArgs(node, ["pkColumns", "_set", "_append", "_inc"]);
         const pkColumns = args.get("pkColumns");
-        if (!pkColumns) fail(`'${name}' needs pkColumns:`, "missing-argument");
+        if (!pkColumns) fail2(`'${name2}' needs pkColumns:`, "missing-argument");
         return {
-          ...base,
+          ...base2,
           pk: this.lowerPkColumnsArg(pkColumns.value, table),
           ...this.lowerWriteValues(args, table),
           returning: this.lowerSelection(node.selectionSet, table)
@@ -2911,16 +4094,16 @@ var OperationLowerer = class {
       case "delete": {
         assertKnownArgs(node, ["where"]);
         const where = args.get("where");
-        if (!where) fail(`'${name}' needs where: (bulk deletes without a filter are not allowed)`, "missing-argument");
+        if (!where) fail2(`'${name2}' needs where: (bulk deletes without a filter are not allowed)`, "missing-argument");
         return {
-          ...base,
+          ...base2,
           ...this.lowerMutationResponse(node.selectionSet, table),
           where: this.lowerBoolExp(where.value, table)
         };
       }
       case "deleteByPk": {
         return {
-          ...base,
+          ...base2,
           pk: this.lowerPkArgs(node, table),
           returning: this.lowerSelection(node.selectionSet, table)
         };
@@ -2935,16 +4118,16 @@ var OperationLowerer = class {
    * the structured fields, never from authored statements.
    */
   lowerCowRoot(node, rootInfo) {
-    const name = node.name.value;
-    const alias = node.alias?.value ?? name;
+    const name2 = node.name.value;
+    const alias = node.alias?.value ?? name2;
     const { table } = rootInfo;
-    if (!node.selectionSet) fail(`'${name}' needs a selection set`, "invalid-selection");
+    if (!node.selectionSet) fail2(`'${name2}' needs a selection set`, "invalid-selection");
     const meta = this.meta(table);
     const args = argsByName(node);
     const pkArg = args.get(rootInfo.pk);
-    if (!pkArg) fail(`'${name}' is missing primary-key argument '${rootInfo.pk}'`, "missing-pk-argument", [rootInfo.pk]);
+    if (!pkArg) fail2(`'${name2}' is missing primary-key argument '${rootInfo.pk}'`, "missing-pk-argument", [rootInfo.pk]);
     const pk = [{ column: rootInfo.pk, value: this.lowerValue(pkArg.value) }];
-    const base = {
+    const base2 = {
       kind: "mutation",
       op: rootInfo.op,
       alias,
@@ -2957,65 +4140,119 @@ var OperationLowerer = class {
     };
     if (rootInfo.op === "cowRevert") {
       assertKnownArgs(node, [rootInfo.pk]);
-      return base;
+      return base2;
     }
     assertKnownArgs(node, [rootInfo.pk, ...rootInfo.set]);
     const entries = rootInfo.set.map((column) => {
       const arg = args.get(column);
       if (!arg) {
-        fail(
-          `'${name}' is missing set argument '${column}' \u2014 a cow override writes every declared set column (pass null to clear a nullable one)`,
+        fail2(
+          `'${name2}' is missing set argument '${column}' \u2014 a cow override writes every declared set column (pass null to clear a nullable one)`,
           "missing-argument",
           [...rootInfo.set]
         );
       }
       if (!meta.settable.includes(column)) {
-        fail(`column '${table}.${column}' is not updatable (pinned by the write policy or deprecated)`, "column-not-settable", meta.settable);
+        fail2(`column '${table}.${column}' is not updatable (pinned by the write policy or deprecated)`, "column-not-settable", meta.settable);
       }
       return { column, value: this.lowerValue(arg.value) };
     });
-    return { ...base, set: { entries }, cowCopyColumns: [...rootInfo.copyColumns] };
+    return { ...base2, set: { entries }, cowCopyColumns: [...rootInfo.copyColumns] };
+  }
+  /**
+   * Resolved-table roots: insertOne(object), updateByPk(pkColumns, _set),
+   * deleteByPk(pk…), revertByPk(pkColumns, columns). The executor writes only
+   * the touched cells into the manual source; `returning` reads the view.
+   */
+  lowerResolvedRoot(node, rootInfo) {
+    const name2 = node.name.value;
+    const alias = node.alias?.value ?? name2;
+    const { table, action } = rootInfo;
+    if (!node.selectionSet) fail2(`'${name2}' needs a selection set`, "invalid-selection");
+    const args = argsByName(node);
+    const base2 = {
+      kind: "mutation",
+      op: "resolvedWrite",
+      resolvedAction: action,
+      alias,
+      table,
+      pinnedColumns: [],
+      affectedRows: false,
+      returning: this.lowerSelection(node.selectionSet, table)
+    };
+    switch (action) {
+      case "insert": {
+        assertKnownArgs(node, ["object"]);
+        const object = args.get("object");
+        if (!object) fail2(`'${name2}' needs object:`, "missing-argument");
+        return { ...base2, objects: this.lowerInsertObjects(object.value, table, { list: false }) };
+      }
+      case "update": {
+        assertKnownArgs(node, ["pkColumns", "_set"]);
+        const pkColumns = args.get("pkColumns");
+        if (!pkColumns || !args.get("_set")) fail2(`'${name2}' needs pkColumns: and _set:`, "missing-argument");
+        return { ...base2, pk: this.lowerPkColumnsArg(pkColumns.value, table), ...this.lowerWriteValues(args, table) };
+      }
+      case "delete":
+        return { ...base2, pk: this.lowerPkArgs(node, table) };
+      case "revert": {
+        assertKnownArgs(node, ["pkColumns", "columns"]);
+        const pkColumns = args.get("pkColumns");
+        const columns = args.get("columns");
+        if (!pkColumns || !columns) fail2(`'${name2}' needs pkColumns: and columns:`, "missing-argument");
+        const items = columns.value.kind === Kind.LIST ? columns.value.values : [columns.value];
+        const meta = this.meta(table);
+        const revertColumns = items.map((item) => {
+          if (item.kind !== Kind.ENUM || !meta.settable.includes(item.value)) {
+            fail2(`'${name2}' columns: must list update-column enum values written in the document`, "invalid-revert-columns", meta.settable);
+          }
+          return item.value;
+        });
+        if (revertColumns.length === 0) fail2(`'${name2}' columns: must name at least one column`, "invalid-revert-columns");
+        return { ...base2, pk: this.lowerPkColumnsArg(pkColumns.value, table), revertColumns: [...new Set(revertColumns)] };
+      }
+    }
   }
   lowerMutationResponse(selectionSet, table) {
     let affectedRows = false;
     let returning = null;
     for (const node of selectionSet.selections) {
-      if (node.kind !== Kind.FIELD) fail("fragments must be flattened before lowering", "internal");
-      const name = node.name.value;
-      if (name === "__typename") continue;
-      if (name === "affectedRows") {
+      if (node.kind !== Kind.FIELD) fail2("fragments must be flattened before lowering", "internal");
+      const name2 = node.name.value;
+      if (name2 === "__typename") continue;
+      if (name2 === "affectedRows") {
         affectedRows = true;
         continue;
       }
-      if (name === "returning") {
-        if (!node.selectionSet) fail("'returning' needs a selection set", "invalid-selection");
+      if (name2 === "returning") {
+        if (!node.selectionSet) fail2("'returning' needs a selection set", "invalid-selection");
         returning = this.lowerSelection(node.selectionSet, table);
         continue;
       }
-      fail(`unknown mutation-response field '${name}'`, "invalid-selection", ["affectedRows", "returning"]);
+      fail2(`unknown mutation-response field '${name2}'`, "invalid-selection", ["affectedRows", "returning"]);
     }
     return { affectedRows, returning };
   }
-  lowerInsertObjects(node, table, { list }) {
+  lowerInsertObjects(node, table, { list: list2 }) {
     if (node.kind === Kind.VARIABLE) return { slot: this.slot(node.name.value, "insertInput", table) };
-    if (list) {
-      if (node.kind !== Kind.LIST) fail(`objects: must be a list literal or a variable`, "invalid-insert");
+    if (list2) {
+      if (node.kind !== Kind.LIST) fail2(`objects: must be a list literal or a variable`, "invalid-insert");
       return { rows: node.values.map((item) => this.lowerInsertRow(item, table)) };
     }
     return { rows: [this.lowerInsertRow(node, table)] };
   }
   lowerInsertRow(node, table) {
-    if (node.kind !== Kind.OBJECT) fail(`insert rows on '${table}' must be objects`, "invalid-insert");
+    if (node.kind !== Kind.OBJECT) fail2(`insert rows on '${table}' must be objects`, "invalid-insert");
     const meta = this.meta(table);
     return node.fields.map((field) => {
       const key = field.name.value;
       if (this.link(table, key)) {
-        fail(`nested inserts are not supported in v2.0 \u2014 '${key}' is a link on '${table}'`, "nested-insert-unsupported");
+        fail2(`nested inserts are not supported in v2.0 \u2014 '${key}' is a link on '${table}'`, "nested-insert-unsupported");
       }
       if (!meta.insertable.includes(key)) {
         const column = this.column(table, key);
-        if (column) fail(`column '${table}.${key}' is not insertable (pinned by the write policy or deprecated)`, "column-not-insertable", meta.insertable);
-        fail(`unknown column '${key}' in an insert on '${table}'`, "unknown-column", meta.insertable);
+        if (column) fail2(`column '${table}.${key}' is not insertable (pinned by the write policy or deprecated)`, "column-not-insertable", meta.insertable);
+        fail2(`unknown column '${key}' in an insert on '${table}'`, "unknown-column", meta.insertable);
       }
       return { column: key, value: this.lowerValue(field.value) };
     });
@@ -3024,32 +4261,32 @@ var OperationLowerer = class {
     if (!arg) return {};
     const node = arg.value;
     if (node.kind === Kind.VARIABLE) return { onConflict: { slot: this.slot(node.name.value, "onConflict", table) } };
-    if (node.kind !== Kind.OBJECT) fail("onConflict: must be an object literal or a variable", "invalid-on-conflict");
+    if (node.kind !== Kind.OBJECT) fail2("onConflict: must be an object literal or a variable", "invalid-on-conflict");
     const meta = this.meta(table);
     let constraint;
     const updateColumns = [];
     for (const field of node.fields) {
       if (field.name.value === "constraint") {
-        if (field.value.kind !== Kind.ENUM) fail("onConflict.constraint must be a constraint enum value", "invalid-on-conflict");
+        if (field.value.kind !== Kind.ENUM) fail2("onConflict.constraint must be a constraint enum value", "invalid-on-conflict");
         constraint = field.value.value;
         continue;
       }
       if (field.name.value === "updateColumns") {
         const items = field.value.kind === Kind.LIST ? field.value.values : [field.value];
         for (const item of items) {
-          if (item.kind !== Kind.ENUM) fail("onConflict.updateColumns must be update-column enum values", "invalid-on-conflict");
+          if (item.kind !== Kind.ENUM) fail2("onConflict.updateColumns must be update-column enum values", "invalid-on-conflict");
           if (!meta.settable.includes(item.value)) {
-            fail(`onConflict.updateColumns: '${item.value}' is not updatable on '${table}'`, "invalid-on-conflict", meta.settable);
+            fail2(`onConflict.updateColumns: '${item.value}' is not updatable on '${table}'`, "invalid-on-conflict", meta.settable);
           }
           updateColumns.push(item.value);
         }
         continue;
       }
-      fail(`unknown onConflict key '${field.name.value}'`, "invalid-on-conflict", ["constraint", "updateColumns"]);
+      fail2(`unknown onConflict key '${field.name.value}'`, "invalid-on-conflict", ["constraint", "updateColumns"]);
     }
-    if (!constraint) fail("onConflict needs a constraint", "invalid-on-conflict", meta.constraints.map((c) => c.name));
+    if (!constraint) fail2("onConflict needs a constraint", "invalid-on-conflict", meta.constraints.map((c) => c.name));
     if (!meta.constraints.some((c) => c.name === constraint)) {
-      fail(`unknown constraint '${constraint}' on '${table}'`, "invalid-on-conflict", meta.constraints.map((c) => c.name));
+      fail2(`unknown constraint '${constraint}' on '${table}'`, "invalid-on-conflict", meta.constraints.map((c) => c.name));
     }
     return { onConflict: { constraint, updateColumns } };
   }
@@ -3067,36 +4304,36 @@ var OperationLowerer = class {
     const inc = args.get("_inc");
     if (inc) {
       if (inc.value.kind === Kind.VARIABLE) {
-        fail("_inc has no dynamic input type \u2014 inline the columns with variable leaf values", "invalid-inc");
+        fail2("_inc has no dynamic input type \u2014 inline the columns with variable leaf values", "invalid-inc");
       }
       const numeric = meta.columns.filter((c) => typeof c.type === "string" && NUMERIC_TYPES.has(c.type) && meta.settable.includes(c.name)).map((c) => c.name);
       result.inc = { entries: this.lowerColumnEntries(inc.value, table, numeric, "_inc") };
     }
     if (!result.set && !result.append && !result.inc) {
-      fail(`an update on '${table}' needs at least one of _set/_append/_inc`, "missing-argument");
+      fail2(`an update on '${table}' needs at least one of _set/_append/_inc`, "missing-argument");
     }
     return result;
   }
   lowerColumnEntries(node, table, whitelist, argName) {
-    if (node.kind !== Kind.OBJECT) fail(`${argName} on '${table}' must be an object literal or a variable`, "invalid-write-values");
+    if (node.kind !== Kind.OBJECT) fail2(`${argName} on '${table}' must be an object literal or a variable`, "invalid-write-values");
     return node.fields.map((field) => {
       const key = field.name.value;
       if (!whitelist.includes(key)) {
-        fail(`${argName}: column '${key}' is not allowed on '${table}'`, "column-not-settable", [...whitelist]);
+        fail2(`${argName}: column '${key}' is not allowed on '${table}'`, "column-not-settable", [...whitelist]);
       }
       return { column: key, value: this.lowerValue(field.value) };
     });
   }
   lowerPkColumnsArg(node, table) {
-    if (node.kind !== Kind.OBJECT) fail(`pkColumns on '${table}' must be an object literal`, "invalid-pk-columns");
+    if (node.kind !== Kind.OBJECT) fail2(`pkColumns on '${table}' must be an object literal`, "invalid-pk-columns");
     const meta = this.meta(table);
     const provided = new Map(node.fields.map((field) => [field.name.value, field.value]));
     for (const key of provided.keys()) {
-      if (!meta.primaryKey.includes(key)) fail(`pkColumns: '${key}' is not a primary-key column of '${table}'`, "invalid-pk-columns", meta.primaryKey);
+      if (!meta.primaryKey.includes(key)) fail2(`pkColumns: '${key}' is not a primary-key column of '${table}'`, "invalid-pk-columns", meta.primaryKey);
     }
     return meta.primaryKey.map((column) => {
       const value = provided.get(column);
-      if (!value) fail(`pkColumns is missing '${column}'`, "invalid-pk-columns", meta.primaryKey);
+      if (!value) fail2(`pkColumns is missing '${column}'`, "invalid-pk-columns", meta.primaryKey);
       return { column, value: this.lowerValue(value) };
     });
   }
@@ -3105,6 +4342,19 @@ function lowerOperation({ restricted, ctx }) {
   const lowerer = new OperationLowerer(ctx, restricted);
   return lowerer.lowerRoots(restricted.definition, restricted.kind);
 }
+function isCellColumn(meta, name2) {
+  if (!meta.cells) return false;
+  return Object.values(meta.cells).some((parts) => Object.values(parts).includes(name2));
+}
+function fieldNodes(selectionSet) {
+  const out = [];
+  for (const node of selectionSet.selections) {
+    if (node.kind !== Kind.FIELD) fail2("fragments must be flattened before lowering", "internal");
+    if (node.directives && node.directives.length > 0) fail2(`@include/@skip are supported on root fields only ('${node.name.value}' is nested)`, "nested-directive");
+    if (node.name.value !== "__typename") out.push(node);
+  }
+  return out;
+}
 function parseSdl(sdl) {
   return buildSchema(sdl);
 }
@@ -3151,7 +4401,7 @@ function parseDocuments({
 }
 function unwrapType(node, variable) {
   let nullable = true;
-  let list = false;
+  let list2 = false;
   let current = node;
   for (; ; ) {
     if (current.kind === Kind.NON_NULL_TYPE) {
@@ -3160,17 +4410,17 @@ function unwrapType(node, variable) {
       continue;
     }
     if (current.kind === Kind.LIST_TYPE) {
-      if (list) {
+      if (list2) {
         throw new DocumentCompileError(`variable $${variable}: nested list types are not supported`, "unsupported-variable-type");
       }
-      list = true;
+      list2 = true;
       current = current.type;
       continue;
     }
-    return { named: current.name.value, list, nullable };
+    return { named: current.name.value, list: list2, nullable };
   }
 }
-function classifyVariableType({ named, list }, variable, ctx) {
+function classifyVariableType({ named, list: list2 }, variable, ctx) {
   const inputRef = classifyInputType(named, ctx.tableByTypename);
   if (inputRef) {
     const listable = {
@@ -3183,13 +4433,13 @@ function classifyVariableType({ named, list }, variable, ctx) {
       insertInput: "either"
     };
     const rule = listable[inputRef.input];
-    if (rule === "must" && !list) {
+    if (rule === "must" && !list2) {
       throw new DocumentCompileError(
         `variable $${variable}: ${named} must be used as a list (e.g. [${named}!])`,
         "unsupported-variable-type"
       );
     }
-    if (rule === "never" && list) {
+    if (rule === "never" && list2) {
       throw new DocumentCompileError(
         `variable $${variable}: ${named} cannot be used as a list`,
         "unsupported-variable-type"
@@ -3226,7 +4476,7 @@ function restrictDefault({
   node,
   variable,
   type,
-  list,
+  list: list2,
   nullable
 }) {
   if (type.kind === "inputRef") {
@@ -3246,7 +4496,7 @@ function restrictDefault({
     return { value: null };
   }
   if (Array.isArray(value)) {
-    if (!list) {
+    if (!list2) {
       throw new DocumentCompileError(
         `variable $${variable}: default for a non-list variable must not be a list`,
         "unsupported-variable-default"
@@ -3254,7 +4504,7 @@ function restrictDefault({
     }
     return { value: value.map((item) => restrictDefaultLiteral(item, variable, type)) };
   }
-  if (list) {
+  if (list2) {
     throw new DocumentCompileError(
       `variable $${variable}: default for a list variable must be a list`,
       "unsupported-variable-default"
@@ -3289,8 +4539,8 @@ function restrictOperation({
   if (operation.operation === "subscription") {
     throw new DocumentCompileError("subscriptions are not supported in v2.0 \u2014 poll a query instead", "subscription-unsupported");
   }
-  const name = operation.name?.value;
-  if (!name) {
+  const name2 = operation.name?.value;
+  if (!name2) {
     throw new DocumentCompileError(
       "anonymous operations are not supported \u2014 every operation must be named (the name keys the registry)",
       "anonymous-operation"
@@ -3299,14 +4549,14 @@ function restrictOperation({
   const variables = (operation.variableDefinitions ?? []).map((definition) => {
     const variable = definition.variable.name.value;
     const unwrapped = unwrapType(definition.type, variable);
-    const { list, nullable } = unwrapped;
+    const { list: list2, nullable } = unwrapped;
     const type = classifyVariableType(unwrapped, variable, ctx);
-    const ir = { name: variable, type, nullable, list };
+    const ir = { name: variable, type, nullable, list: list2 };
     if (definition.defaultValue === void 0) return ir;
-    return { ...ir, defaultValue: restrictDefault({ node: definition.defaultValue, variable, type, list, nullable }) };
+    return { ...ir, defaultValue: restrictDefault({ node: definition.defaultValue, variable, type, list: list2, nullable }) };
   });
   return {
-    name,
+    name: name2,
     kind: operation.operation === "mutation" ? "mutation" : "query",
     requires: parseRequires(operation),
     variables,
@@ -3344,8 +4594,20 @@ function compileNamespace({ canonical, sdl, documents }) {
         }
         const loweredRoots = lowerOperation({ restricted: { ...restricted, definition: flattened }, ctx });
         const { roots, tableSet } = injectPolicies({ roots: loweredRoots, ctx });
+        for (const table of tableSet) {
+          const meta = ctx.tables[table];
+          if (meta.namespace && meta.namespace !== ctx.namespace && !meta.exportRead) {
+            throw new DocumentCompileError(`object '${meta.namespace}/${table}' is not exported for reads`, "unexported-object");
+          }
+        }
+        for (const root of roots) {
+          const meta = ctx.tables[root.table];
+          if (root.kind === "mutation" && meta.namespace && meta.namespace !== ctx.namespace && !meta.exportWrite) {
+            throw new DocumentCompileError(`object '${meta.namespace}/${root.table}' is not exported for writes`, "unexported-object");
+          }
+        }
         operations[restricted.name] = {
-          irVersion: roots.some((root) => root.kind === "mutation" && root.assertAffectedRows !== void 0) ? IR_VERSION : LEGACY_IR_VERSION,
+          irVersion: canonical.imports?.length ? COMPOSED_IR_VERSION : roots.some((root) => root.kind === "mutation" && root.assertAffectedRows !== void 0) ? GUARDED_IR_VERSION : LEGACY_IR_VERSION,
           name: restricted.name,
           opHash: computeOpHash({ definition: flattened, schemaHash }),
           kind: restricted.kind,
@@ -3372,9 +4634,14 @@ function compileNamespace({ canonical, sdl, documents }) {
   }
   if (diagnostics.some((d) => d.severity === "error")) return { ok: false, diagnostics };
   const artifact = {
-    irVersion: requiredArtifactIrVersion(Object.values(operations)),
+    irVersion: canonical.imports?.length ? COMPOSED_IR_VERSION : requiredArtifactIrVersion(Object.values(operations)),
     namespace: ctx.namespace,
     schemaHash,
+    ownSchemaHash: computeSchemaHash(localContract(canonical)),
+    ...canonical.imports?.length ? {
+      dependencies: Object.fromEntries(canonical.imports.map((owner) => [owner.namespace, computeSchemaHash(localContract(owner))]))
+    } : {},
+    readPolicies: Object.fromEntries(ctx.readPolicies),
     opsHash: computeOpsHash(Object.values(operations).map((op) => op.opHash)),
     tables: ctx.tables,
     operations
@@ -3437,9 +4704,10 @@ function allowedOps(type) {
     case "text":
       return ["eq", "neq", "gt", "gte", "lt", "lte", "in", "nin", "like", "ilike", "isNull"];
     case "uuid":
-      return ["eq", "neq", "in", "nin", "isNull"];
+      return ["eq", "neq", "in", "nin", "like", "ilike", "isNull"];
     case "integer":
     case "bigint":
+      return ["eq", "neq", "gt", "gte", "lt", "lte", "in", "nin", "like", "ilike", "isNull"];
     case "numeric":
     case "double":
     case "timestamptz":
@@ -3657,12 +4925,12 @@ function validateSelectColumns({ table, value }) {
 function validateInsertInput({
   table,
   value,
-  list,
+  list: list2,
   maxRows
 }) {
   const collector = new IssueCollector();
   const rowCap = maxRows ?? 1e3;
-  const rows = list ? value : [value];
+  const rows = list2 ? value : [value];
   if (!Array.isArray(rows)) {
     collector.add("invalid-shape", "$", "objects must be an array of rows");
     return { ok: false, issues: collector.issues };
@@ -3673,7 +4941,7 @@ function validateInsertInput({
   }
   const normalized = [];
   rows.forEach((row, index) => {
-    const path = list ? `$[${index}]` : "$";
+    const path = list2 ? `$[${index}]` : "$";
     if (!isPlainObject(row)) {
       collector.add("invalid-shape", path, "insert rows must be objects");
       return;
@@ -3783,6 +5051,744 @@ function validateOnConflictInput({
   return finish(collector, { constraint, updateColumns });
 }
 
-export { COMPILER_MAJOR, CONST_TRUE, DEFAULT_LIMIT, DocumentCompileError, MAX_LIMIT, NamespaceCompileError, ORDER_BY_DIRECTIONS, OperationLowerer, PLATFORM_USER_TABLE, PLATFORM_USER_TYPENAME, POLICY_COMPARE_OPS, POLICY_MAX_LINK_DEPTH, PolicyCompileError, PolicyParseError, allowedBoolExpOperators, allowedOps, andPred, assertClaimsOnlyWhen, buildCompileContext, camelCase, canonicalOperationText, classifyInputType, collectPinnedColumns, compileNamespace, compileNamespaceOrThrow, compilePolicy, compilePredicateV2, computeOpHash, computeOpsHash, computePinnedColumnsByTable, computeSchemaHash, enumTypeName, flattenOperation, injectPolicies, inputTypeName, lowerOperation, mutationRootNames, parseDocuments, parsePolicy, parseSdl, pascalCase, platformUserMeta, predContains, predContainsExists, queryRootNames, restrictOperation, typeNameForTable, validateAppendInput, validateBoolExpInput, validateInsertInput, validateOnConflictInput, validateOrderByInput, validateSelectColumns, validateSetInput, walkPolicy, walkPred };
+// src/engine/types.ts
+var SQL_TYPE_NAMES = {
+  double: "double precision",
+  timestamptz: "timestamp with time zone"
+};
+var sqlTypeName = (type) => SQL_TYPE_NAMES[type] ?? type;
+
+// src/compiler/pred-ir-sql.ts
+function compilePredIrToSql(pred, options = {}) {
+  switch (pred.kind) {
+    case "const":
+      return pred.value ? "TRUE" : "FALSE";
+    case "and":
+      return `(${pred.operands.map((operand) => compilePredIrToSql(operand, options)).join(" AND ")})`;
+    case "or":
+      return `(${pred.operands.map((operand) => compilePredIrToSql(operand, options)).join(" OR ")})`;
+    case "not":
+      return `(NOT ${compilePredIrToSql(pred.operand, options)})`;
+    case "cmp":
+      return compileCmp(pred.op, pred.column, pred.value, options);
+    case "capability":
+      return `(${capabilityExpression(pred.key, pred.namespace ?? options.namespace)})`;
+    case "role":
+      return `(${roleExpression(pred.key, pred.namespace ?? options.namespace)})`;
+    case "exists":
+      if (options.exists) return options.exists(pred);
+      throw new OrmDefinitionError("synced view read policy cannot use 'exists' without a relationship resolver");
+    case "aggPredicate":
+    case "dynamicFilter":
+      throw new OrmDefinitionError(
+        `synced view read policy cannot use '${pred.kind}' \u2014 use row filters and claim/capability/role checks only`
+      );
+    default: {
+      const exhausted = pred;
+      throw new OrmDefinitionError(`unsupported synced view predicate kind '${String(exhausted)}'`);
+    }
+  }
+}
+function physicalColumn(logical, options) {
+  return options.columnNames?.[logical] ?? logical;
+}
+function compileCmp(op, column, value, options) {
+  const physical = physicalColumn(column, options);
+  const declared = options.columnTypes?.[physical] ?? options.columnTypes?.[column];
+  const isEnum = typeof declared === "object" && declared !== null;
+  const qualified = options.alias ? `${quoteIdentifier(options.alias)}.${quoteIdentifier(physical)}` : quoteIdentifier(physical);
+  const col = isEnum ? `${qualified}::text` : qualified;
+  const columnType = isEnum ? "text" : declared;
+  switch (op) {
+    case "eq":
+      return compileEquality(col, value, columnType, false);
+    case "neq":
+      return compileEquality(col, value, columnType, true);
+    case "gt":
+      return `${col} > ${compileValue(value, columnType)}`;
+    case "gte":
+      return `${col} >= ${compileValue(value, columnType)}`;
+    case "lt":
+      return `${col} < ${compileValue(value, columnType)}`;
+    case "lte":
+      return `${col} <= ${compileValue(value, columnType)}`;
+    case "in":
+      return `${col} = ANY(${compileArrayValue(value, columnType)})`;
+    case "nin":
+      return `${col} <> ALL(${compileArrayValue(value, columnType)})`;
+    case "like":
+      return `${col} LIKE ${compileValue(value, columnType)}`;
+    case "ilike":
+      return `${col} ILIKE ${compileValue(value, columnType)}`;
+    case "isNull":
+      return value.kind === "literal" && value.value === true ? `${col} IS NULL` : `${col} IS NOT NULL`;
+    case "contains":
+    case "hasKey":
+      throw new OrmDefinitionError(`synced view read policy cannot use json operator '${op}'`);
+    default: {
+      const exhausted = op;
+      throw new OrmDefinitionError(`unsupported synced view comparison '${String(exhausted)}'`);
+    }
+  }
+}
+function compileEquality(col, value, columnType, negated, options) {
+  if (value.kind === "literal" && value.value === null) {
+    return negated ? `${col} IS NOT NULL` : `${col} IS NULL`;
+  }
+  const rhs = compileValue(value, columnType);
+  return negated ? `${col} <> ${rhs}` : `${col} = ${rhs}`;
+}
+function compileValue(value, columnType, _options) {
+  switch (value.kind) {
+    case "literal": {
+      const literal = value.value;
+      if (literal === null) return "NULL";
+      if (typeof literal === "string") return quoteLiteral(literal);
+      if (typeof literal === "boolean") return literal ? "TRUE" : "FALSE";
+      return String(literal);
+    }
+    case "claim": {
+      const expression = claimExpression(value.key);
+      return columnType && columnType !== "text" ? `(${expression})::${sqlTypeName(columnType)}` : expression;
+    }
+    case "variable":
+      throw new OrmDefinitionError("synced view read policy cannot reference operation variables");
+    default: {
+      const exhausted = value;
+      throw new OrmDefinitionError(`unsupported synced view value kind '${String(exhausted)}'`);
+    }
+  }
+}
+function compileArrayValue(value, columnType, _options) {
+  if (value.kind !== "literal" || !Array.isArray(value.value)) {
+    throw new OrmDefinitionError("synced view IN/NIN comparisons require literal arrays");
+  }
+  const entries = value.value.map((entry) => {
+    if (entry === null) return "NULL";
+    if (typeof entry === "string") return quoteLiteral(entry);
+    if (typeof entry === "boolean") return entry ? "TRUE" : "FALSE";
+    return String(entry);
+  });
+  const array = `ARRAY[${entries.join(", ")}]`;
+  return columnType ? `${array}::${sqlTypeName(columnType)}[]` : array;
+}
+
+// src/sql/catalog.ts
+function sqlHash(value) {
+  return `sha256:${createHash("sha256").update(value).digest("hex")}`;
+}
+function createSqlCatalog({ canonical, publishedObjects, executionTarget }) {
+  if (!publishedObjects.length || new Set(publishedObjects).size !== publishedObjects.length) throw new Error("SQL objects must be explicitly declared and unique");
+  const { ctx, diagnostics } = buildCompileContext(canonical);
+  if (diagnostics.some((d) => d.severity === "error")) throw new Error(diagnostics.map((d) => d.message).join("; "));
+  const identity = sqlHash(`ontology-sql-v1\0${computeSchemaHash(canonical)}\0${executionTarget}`);
+  const refOf = (meta) => `${meta.namespace ?? canonical.namespace}/${meta.table}`;
+  const definitions = [canonical, ...canonical.imports ?? []];
+  const internal = new Set(definitions.flatMap((owner) => [
+    ...owner.tables.filter((t) => t.internal).map((t) => `${owner.namespace}/${t.table}`),
+    ...(owner.views ?? []).filter((v) => v.internal).map((v) => `${owner.namespace}/${v.view}`)
+  ]));
+  const objects = publishedObjects.map((ref) => {
+    const meta = Object.values(ctx.tables).find((table) => refOf(table) === ref);
+    if (!meta || internal.has(ref) || meta.namespace !== canonical.namespace && !meta.exportRead) throw new Error(`SQL object not published: ${ref}`);
+    const reads = /* @__PURE__ */ new Set([ref]);
+    let sequence = 0;
+    const predicate = (table, pred, alias) => compilePredIrToSql(pred, {
+      alias,
+      namespace: table.namespace ?? canonical.namespace,
+      columnNames: Object.fromEntries(table.columns.map((c) => [c.name, c.columnName])),
+      columnTypes: Object.fromEntries(table.columns.map((c) => [c.name, c.type])),
+      exists: (node) => {
+        const link = table.links.find((candidate) => candidate.name === node.link);
+        const target = link?.target ? ctx.tables[link.target] : void 0;
+        if (!link || !target) throw new Error("SQL policy link is unavailable");
+        reads.add(refOf(target));
+        const child = `p${++sequence}`;
+        const col = (t, a, name2) => {
+          const c = t.columns.find((c2) => c2.name === name2 || c2.columnName === name2);
+          if (!c) throw new Error("SQL policy column is unavailable");
+          return `${quoteIdentifier(a)}.${quoteIdentifier(c.columnName)}`;
+        };
+        const join = link.kind === "toMany" ? `${col(target, child, link.on)} = ${col(table, alias, link.references)}` : `${col(table, alias, link.on)} = ${col(target, child, link.references)}`;
+        return `EXISTS (SELECT 1 FROM ${quoteIdentifier(target.schema)}.${quoteIdentifier(target.table)} AS ${quoteIdentifier(child)} WHERE ${join} AND (${predicate(target, node.where, child)}))`;
+      }
+    });
+    const columns = meta.columns.filter((c) => meta.filterable.includes(c.name)).map((c) => ({
+      name: c.name,
+      type: typeof c.type === "string" ? c.type : "text",
+      nullable: c.nullable
+    }));
+    const projection = columns.map((c) => {
+      const physical = meta.columns.find((m) => m.name === c.name);
+      return `${quoteIdentifier("p0")}.${quoteIdentifier(physical.columnName)}${typeof physical.type === "object" ? "::text" : ""} AS ${quoteIdentifier(c.name)}`;
+    }).join(", ");
+    const policy = ctx.readPolicies.get(meta.table) ?? { kind: "const", value: true };
+    const scan = `SELECT ${projection} FROM ${quoteIdentifier(meta.schema)}.${quoteIdentifier(meta.table)} AS ${quoteIdentifier("p0")} WHERE ${predicate(meta, policy, "p0")}`;
+    return { ref, table: meta.table, columns, scan, read: [...reads].sort() };
+  });
+  return { identity, objects };
+}
+
+// src/sql/ast.ts
+function obj(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("unsupported SQL node");
+  return value;
+}
+function list(value) {
+  return value === void 0 ? [] : Array.isArray(value) ? value : fail3("expected SQL list");
+}
+function str(value) {
+  return typeof value === "string" ? value : fail3("expected SQL name");
+}
+function fail3(message) {
+  throw new Error(message);
+}
+function strings(value) {
+  return list(value).map((v) => str(obj(obj(v).String).sval));
+}
+function only(node, keys) {
+  for (const [key, value] of Object.entries(node)) {
+    if (!keys.includes(key) && value !== void 0 && value !== null && value !== false && value !== "" && value !== 0 && !(Array.isArray(value) && value.length === 0)) {
+      fail3(`unsupported SQL clause: ${key}`);
+    }
+  }
+}
+
+// src/sql/compiler.ts
+var parser;
+var SQL_TYPES = ["text", "boolean", "integer", "bigint", "numeric", "double", "uuid", "date", "timestamptz"];
+var pgType = (type) => type === "double" ? "double precision" : SQL_TYPES.some((t) => t === type) ? type : fail3("unsupported SQL type");
+async function compileOntologySql({ catalog, sql, parameterTypes = [], maxRows = 1e3 }) {
+  if (!Number.isInteger(maxRows) || maxRows < 1 || maxRows > 1e4 || Buffer.byteLength(sql) > 65536) fail3("SQL limit exceeded");
+  parser ??= new PgParser({ version: 17 });
+  const parsed = await parser.parse(sql);
+  if (parsed.error || !parsed.tree) fail3("invalid SQL");
+  const statements = list(obj(parsed.tree).stmts);
+  if (statements.length !== 1) fail3("one SQL SELECT is required");
+  const emitter = new SqlEmitter({ catalog, parameterTypes });
+  const result = emitter.select(obj(obj(statements[0]).stmt), { relations: [], ctes: /* @__PURE__ */ new Map() });
+  if (emitter.used.size !== parameterTypes.length) fail3("SQL parameters must be used exactly as declared");
+  if (!emitter.read.size) fail3("SQL operation must read an ontology object");
+  return {
+    ...result,
+    read: [...emitter.read].sort(),
+    maxRows,
+    queryHash: sqlHash(JSON.stringify(["ontology-sql-v1", catalog.identity, result.text, parameterTypes, maxRows]))
+  };
+}
+var SqlEmitter = class {
+  constructor(input) {
+    this.input = input;
+  }
+  read = /* @__PURE__ */ new Set();
+  used = /* @__PURE__ */ new Set();
+  nodes = 0;
+  depth = 0;
+  budget() {
+    if (++this.nodes > 5e3 || this.depth > 48) fail3("SQL complexity limit exceeded");
+  }
+  select(wrapper, parent, resolveUnknown = true) {
+    this.budget();
+    this.depth++;
+    const node = obj(wrapper.SelectStmt);
+    only(node, ["targetList", "fromClause", "whereClause", "groupClause", "havingClause", "sortClause", "limitCount", "limitOffset", "limitOption", "op", "withClause", "all", "larg", "rarg"]);
+    if (!["SETOP_NONE", "SETOP_UNION"].includes(str(node.op))) fail3("unsupported SQL set operation");
+    if (node.op === "SETOP_NONE" && (node.all || node.larg || node.rarg)) fail3("invalid SQL set operation");
+    if (node.limitOption && !["LIMIT_OPTION_DEFAULT", "LIMIT_OPTION_COUNT"].includes(str(node.limitOption))) fail3("unsupported SQL limit");
+    const scope = { relations: [], parent, ctes: new Map(parent.ctes) };
+    const ctes = [];
+    if (node.withClause) {
+      const withNode = obj(node.withClause);
+      only(withNode, ["ctes", "location"]);
+      for (const entry of list(withNode.ctes)) {
+        const cte = obj(obj(entry).CommonTableExpr);
+        only(cte, ["ctename", "ctequery", "ctematerialized", "location"]);
+        const name2 = str(cte.ctename);
+        if (scope.ctes.has(name2)) fail3("duplicate CTE");
+        const result2 = this.select(obj(cte.ctequery), { ...parent, ctes: scope.ctes });
+        scope.ctes.set(name2, result2);
+        ctes.push(`${quoteIdentifier(name2)} AS (${result2.text})`);
+      }
+    }
+    const result = node.op === "SETOP_UNION" ? this.union(node, scope) : this.projection(node, scope);
+    const { columns } = result;
+    let text = `${ctes.length ? `WITH ${ctes.join(", ")} ` : ""}${result.text}`;
+    if (list(node.sortClause).length) text += ` ORDER BY ${list(node.sortClause).map((n) => {
+      const sort = obj(obj(n).SortBy);
+      only(sort, ["node", "sortby_dir", "sortby_nulls", "location"]);
+      const direction = sort.sortby_dir === "SORTBY_DESC" ? "DESC" : sort.sortby_dir === "SORTBY_ASC" || sort.sortby_dir === "SORTBY_DEFAULT" ? "ASC" : fail3("unsupported SQL sort");
+      const nulls = sort.sortby_nulls === "SORTBY_NULLS_FIRST" ? " NULLS FIRST" : sort.sortby_nulls === "SORTBY_NULLS_LAST" ? " NULLS LAST" : "";
+      const value = obj(sort.node);
+      const reference = value.ColumnRef ? strings(obj(value.ColumnRef).fields) : [];
+      const projected = reference.length === 1 ? columns.filter((c) => c.name === reference[0]) : [];
+      return `${projected.length === 1 ? quoteIdentifier(projected[0].name) : this.expr(value, scope).text} ${direction}${nulls}`;
+    }).join(", ")}`;
+    for (const [key, keyword] of [["limitCount", "LIMIT"], ["limitOffset", "OFFSET"]]) {
+      if (node[key]) text += ` ${keyword} ${this.expr(obj(node[key]), scope).text}`;
+    }
+    this.depth--;
+    return { text, columns: resolveUnknown ? columns.map((c) => c.type === "unknown" ? { ...c, type: "text" } : c) : columns };
+  }
+  union(node, scope) {
+    for (const key of ["targetList", "fromClause", "whereClause", "groupClause", "havingClause"]) {
+      if (node[key]) fail3("unsupported UNION clause");
+    }
+    const left = this.select({ SelectStmt: obj(node.larg) }, scope, false);
+    const right = this.select({ SelectStmt: obj(node.rarg) }, scope, false);
+    if (left.columns.length !== right.columns.length) fail3("UNION branches must have the same column count");
+    const numeric = ["integer", "bigint", "numeric", "double"];
+    const columns = left.columns.map((column, index) => {
+      const other = right.columns[index];
+      const type = column.type === "unknown" && other.type === "unknown" ? "text" : column.type === "unknown" ? other.type : other.type === "unknown" ? column.type : column.type === other.type ? column.type : numeric.includes(column.type) && numeric.includes(other.type) ? numeric[Math.max(numeric.indexOf(column.type), numeric.indexOf(other.type))] : fail3("UNION columns require compatible types; use explicit casts");
+      return { name: column.name, type, nullable: column.nullable || other.nullable };
+    });
+    return { text: `(${left.text}) UNION${node.all ? " ALL" : ""} (${right.text})`, columns };
+  }
+  projection(node, scope) {
+    const from = list(node.fromClause).map((n) => this.from(obj(n), scope)).join(", ");
+    const columns = [];
+    const targets = [];
+    for (const item of list(node.targetList)) {
+      const target = obj(obj(item).ResTarget);
+      only(target, ["name", "val", "location"]);
+      const value = obj(target.val);
+      const fields = value.ColumnRef ? list(obj(value.ColumnRef).fields) : [];
+      if (fields.length && obj(fields[fields.length - 1]).A_Star) {
+        const matches = fields.length === 1 ? scope.relations : scope.relations.filter((r) => r.alias === strings(fields.slice(0, -1))[0]);
+        if (!matches.length || fields.length > 2 || target.name) fail3("invalid wildcard");
+        for (const relation of matches) for (const column of relation.columns) {
+          columns.push(column);
+          targets.push(`${quoteIdentifier(relation.alias)}.${quoteIdentifier(column.name)}`);
+        }
+      } else {
+        const expression = this.expr(value, scope);
+        const name2 = typeof target.name === "string" && target.name ? target.name : expression.name ?? `column${columns.length + 1}`;
+        columns.push({ name: name2, type: expression.type, nullable: true });
+        targets.push(`${expression.text} AS ${quoteIdentifier(name2)}`);
+      }
+    }
+    if (!targets.length || targets.length > 256) fail3("invalid SQL projection");
+    let text = `SELECT ${targets.join(", ")}${from ? ` FROM ${from}` : ""}`;
+    if (node.whereClause) text += ` WHERE ${this.expr(obj(node.whereClause), scope).text}`;
+    if (list(node.groupClause).length) text += ` GROUP BY ${list(node.groupClause).map((n) => this.expr(obj(n), scope).text).join(", ")}`;
+    if (node.havingClause) text += ` HAVING ${this.expr(obj(node.havingClause), scope).text}`;
+    return { text, columns };
+  }
+  from(node, scope) {
+    this.budget();
+    this.depth++;
+    try {
+      return this.relation(node, scope);
+    } finally {
+      this.depth--;
+    }
+  }
+  relation(node, scope) {
+    if (node.RangeVar) {
+      const range = obj(node.RangeVar);
+      only(range, ["schemaname", "relname", "inh", "relpersistence", "alias", "location"]);
+      if (range.inh !== true) fail3("ONLY is not supported for ontology objects");
+      const name2 = str(range.relname);
+      const alias = range.alias ? str(obj(range.alias).aliasname) : name2;
+      if (range.alias) only(obj(range.alias), ["aliasname"]);
+      if (scope.relations.some((r) => r.alias === alias)) fail3("duplicate SQL alias");
+      const cte = !range.schemaname ? scope.ctes.get(name2) : void 0;
+      if (cte) {
+        scope.relations.push({ alias, columns: cte.columns });
+        return `${quoteIdentifier(name2)} AS ${quoteIdentifier(alias)}`;
+      }
+      const object = this.input.catalog.objects.find((o) => o.ref === `${range.schemaname}/${name2}`);
+      if (!object) fail3("SQL object is not declared or available");
+      for (const ref of object.read) this.read.add(ref);
+      scope.relations.push({ alias, columns: object.columns });
+      const source = `(WITH ${quoteIdentifier("__orm_scan")} AS MATERIALIZED (${object.scan}) SELECT * FROM ${quoteIdentifier("__orm_scan")})`;
+      return `${source} AS ${quoteIdentifier(alias)}`;
+    }
+    if (node.JoinExpr) {
+      const join = obj(node.JoinExpr);
+      only(join, ["jointype", "larg", "rarg", "quals"]);
+      if (!["JOIN_INNER", "JOIN_LEFT", "JOIN_RIGHT", "JOIN_FULL"].includes(str(join.jointype))) fail3("unsupported SQL join");
+      const start = scope.relations.length;
+      const left = this.from(obj(join.larg), scope);
+      const middle = scope.relations.length;
+      const right = this.from(obj(join.rarg), scope);
+      const nullable = (relations) => {
+        for (const relation of relations) relation.columns = relation.columns.map((c) => ({ ...c, nullable: true }));
+      };
+      if (["JOIN_RIGHT", "JOIN_FULL"].includes(str(join.jointype))) nullable(scope.relations.slice(start, middle));
+      if (["JOIN_LEFT", "JOIN_FULL"].includes(str(join.jointype))) nullable(scope.relations.slice(middle));
+      const kind = str(join.jointype).slice("JOIN_".length);
+      return `(${left} ${kind} JOIN ${right} ON ${join.quals ? this.expr(obj(join.quals), scope).text : "TRUE"})`;
+    }
+    if (node.RangeSubselect) {
+      const range = obj(node.RangeSubselect);
+      only(range, ["subquery", "alias"]);
+      const alias = str(obj(range.alias).aliasname);
+      only(obj(range.alias), ["aliasname"]);
+      if (scope.relations.some((r) => r.alias === alias)) fail3("duplicate SQL alias");
+      const result = this.select(obj(range.subquery), { relations: [], ctes: scope.ctes });
+      scope.relations.push({ alias, columns: result.columns });
+      return `(${result.text}) AS ${quoteIdentifier(alias)}`;
+    }
+    return fail3("unsupported SQL relation");
+  }
+  column(fields, scope) {
+    if (fields.length !== 1 && fields.length !== 2) fail3("unsupported column reference");
+    const name2 = fields[fields.length - 1];
+    const matches = scope.relations.flatMap((r) => fields.length === 2 && r.alias !== fields[0] ? [] : r.columns.filter((c) => c.name === name2).map((c) => ({ r, c })));
+    if (matches.length > 1) fail3("ambiguous SQL column");
+    if (matches.length === 1) return { text: `${quoteIdentifier(matches[0].r.alias)}.${quoteIdentifier(name2)}`, type: matches[0].c.type, name: name2 };
+    if (scope.parent && !(fields.length === 2 && scope.relations.some((r) => r.alias === fields[0]))) return this.column(fields, scope.parent);
+    return fail3("unknown ontology property");
+  }
+  expr(node, scope) {
+    this.budget();
+    this.depth++;
+    try {
+      return this.expression(node, scope);
+    } finally {
+      this.depth--;
+    }
+  }
+  expression(node, scope) {
+    if (node.ColumnRef) return this.column(strings(obj(node.ColumnRef).fields), scope);
+    if (node.ParamRef) {
+      const number = obj(node.ParamRef).number;
+      if (typeof number !== "number" || !Number.isInteger(number) || number < 1 || number > this.input.parameterTypes.length) fail3("undeclared SQL parameter");
+      this.used.add(number);
+      const type = this.input.parameterTypes[number - 1];
+      return { text: `$${number}::${pgType(type)}`, type };
+    }
+    if (node.A_Const) {
+      const literal = obj(node.A_Const);
+      if (literal.isnull) return { text: "NULL", type: "unknown" };
+      if (literal.sval) return { text: quoteLiteral(str(obj(literal.sval).sval)), type: "unknown" };
+      if (literal.boolval) return { text: obj(literal.boolval).boolval ? "TRUE" : "FALSE", type: "boolean" };
+      const value = literal.ival ? obj(literal.ival).ival : obj(literal.fval).fval;
+      if (!/^-?\d+(\.\d+)?([eE][+-]?\d+)?$/.test(String(value))) fail3("unsupported SQL constant");
+      return { text: String(value), type: literal.ival ? "integer" : "numeric" };
+    }
+    if (node.A_Expr) {
+      const value = obj(node.A_Expr);
+      only(value, ["kind", "name", "lexpr", "rexpr", "location"]);
+      const names = strings(value.name);
+      if (names.length !== 1 || value.kind !== "AEXPR_OP") fail3("unsupported SQL operator");
+      const operator = names[0];
+      if (!["=", "<>", "!=", "<", ">", "<=", ">=", "+", "-", "*", "/"].includes(operator)) fail3("unsupported SQL operator");
+      const left = this.expr(obj(value.lexpr), scope), right = this.expr(obj(value.rexpr), scope);
+      const numericTypes = ["integer", "bigint", "numeric", "double"];
+      const arithmetic = ["+", "-", "*", "/"].includes(operator);
+      if (arithmetic && (!numericTypes.includes(left.type) || !numericTypes.includes(right.type))) fail3("arithmetic requires numeric operands");
+      const type = arithmetic ? numericTypes[Math.max(numericTypes.indexOf(left.type), numericTypes.indexOf(right.type))] : "boolean";
+      return { text: `(${left.text} OPERATOR(pg_catalog.${operator}) ${right.text})`, type };
+    }
+    if (node.BoolExpr) {
+      const value = obj(node.BoolExpr);
+      const args = list(value.args).map((a) => this.expr(obj(a), scope).text);
+      if (value.boolop === "NOT_EXPR" && args.length === 1) return { text: `(NOT ${args[0]})`, type: "boolean" };
+      if (!["AND_EXPR", "OR_EXPR"].includes(str(value.boolop))) fail3("unsupported boolean expression");
+      return { text: `(${args.join(value.boolop === "AND_EXPR" ? " AND " : " OR ")})`, type: "boolean" };
+    }
+    if (node.NullTest) {
+      const value = obj(node.NullTest);
+      only(value, ["arg", "nulltesttype", "location"]);
+      if (!["IS_NULL", "IS_NOT_NULL"].includes(str(value.nulltesttype))) fail3("invalid null comparison");
+      return { text: `(${this.expr(obj(value.arg), scope).text} IS ${value.nulltesttype === "IS_NOT_NULL" ? "NOT " : ""}NULL)`, type: "boolean" };
+    }
+    if (node.SubLink) {
+      const value = obj(node.SubLink);
+      only(value, ["subLinkType", "subselect", "location"]);
+      if (value.subLinkType !== "EXISTS_SUBLINK") fail3("only EXISTS subqueries are supported");
+      return { text: `EXISTS (${this.select(obj(value.subselect), scope).text})`, type: "boolean" };
+    }
+    if (node.TypeCast) {
+      const value = obj(node.TypeCast), typeName2 = obj(value.typeName);
+      only(typeName2, ["names", "typemod", "location"]);
+      const names = strings(typeName2.names);
+      if (names.length > 2 || names.length === 2 && names[0] !== "pg_catalog") fail3("unsupported SQL cast");
+      const aliases = { int4: "integer", int8: "bigint", float8: "double", bool: "boolean" };
+      const name2 = names[names.length - 1], type = aliases[name2] ?? name2;
+      return { text: `(${this.expr(obj(value.arg), scope).text})::${pgType(type)}`, type };
+    }
+    if (node.FuncCall) {
+      const value = obj(node.FuncCall);
+      only(value, ["funcname", "args", "agg_star", "agg_distinct", "funcformat", "location"]);
+      const names = strings(value.funcname);
+      if (names.length !== 1) fail3("SQL function qualification is not supported");
+      const name2 = names[0];
+      if (!["count", "sum", "avg", "min", "max", "lower", "upper", "length"].includes(name2)) fail3("SQL function is not allowed");
+      const args = list(value.args).map((a) => this.expr(obj(a), scope));
+      if (value.agg_star && (name2 !== "count" || args.length) || !value.agg_star && args.length !== 1) fail3("unsupported SQL function arguments");
+      const argType = args[0]?.type ?? "integer";
+      if (["lower", "upper", "length"].includes(name2) && !["text", "unknown"].includes(argType)) fail3("text function requires text");
+      if (["sum", "avg"].includes(name2) && !["integer", "bigint", "numeric", "double"].includes(argType)) fail3("aggregate requires numeric input");
+      const type = name2 === "count" ? "bigint" : name2 === "length" ? "integer" : ["lower", "upper"].includes(name2) ? "text" : name2 === "avg" ? argType === "double" ? "double" : "numeric" : name2 === "sum" ? argType === "integer" ? "bigint" : argType === "bigint" ? "numeric" : argType : argType;
+      return { text: `pg_catalog.${name2}(${value.agg_distinct ? "DISTINCT " : ""}${value.agg_star ? "*" : args.map((a) => a.text).join(", ")})`, type, name: name2 };
+    }
+    return fail3(`unsupported SQL expression: ${Object.keys(node).join(",")}`);
+  }
+};
+var sqlScalarSchema = z.enum(["text", "boolean", "integer", "bigint", "numeric", "double", "uuid", "date", "timestamptz"]);
+var name = z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).max(63).refine((value) => !["__proto__", "prototype", "constructor"].includes(value), "reserved name");
+var base = z.object({
+  name,
+  namespace: name,
+  language: z.literal("sql"),
+  kind: z.literal("query"),
+  requires: z.object({ capability: z.string().min(1).max(128) }).strict(),
+  ontology: z.object({ read: z.array(z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*\/[A-Za-z_][A-Za-z0-9_]*$/)).min(1).max(256) }).strict(),
+  maxRows: z.number().int().min(1).max(1e4).default(1e3)
+});
+var fixed = base.extend({
+  parameters: z.record(name, z.object({ type: sqlScalarSchema, required: z.boolean().default(true) }).strict()).default({}),
+  sql: z.string().min(1).max(65536)
+}).strict();
+var runtime = base.extend({ mode: z.literal("runtime") }).strict();
+var sqlOperationDefinitionSchema = z.union([fixed, runtime]);
+function defineOperation(input) {
+  return sqlOperationDefinitionSchema.parse(input);
+}
+
+// src/sql/parameters.ts
+function bindNamedParameters({ sql, names }) {
+  let result = "", i = 0;
+  while (i < sql.length) {
+    const start = i;
+    if (sql.startsWith("--", i)) {
+      i = sql.indexOf("\n", i);
+      if (i < 0) i = sql.length;
+    } else if (sql.startsWith("/*", i)) {
+      i += 2;
+      let depth = 1;
+      while (i < sql.length && depth) {
+        if (sql.startsWith("/*", i)) {
+          depth++;
+          i += 2;
+        } else if (sql.startsWith("*/", i)) {
+          depth--;
+          i += 2;
+        } else i++;
+      }
+      if (depth) throw new Error("unterminated SQL comment");
+    } else if (sql[i] === "'" || sql[i] === '"') {
+      const escapes = sql[i] === "'" && /[eE]/.test(sql[i - 1] ?? "") && !/[A-Za-z0-9_$]/.test(sql[i - 2] ?? "");
+      const quote = sql[i++];
+      while (i < sql.length) {
+        if (sql[i] === quote) {
+          if (sql[i + 1] === quote) i += 2;
+          else {
+            i++;
+            break;
+          }
+        } else if (escapes && sql[i] === "\\") i += 2;
+        else i++;
+      }
+    } else if (sql[i] === "$" && /^\$(?:[A-Za-z_][A-Za-z0-9_]*)?\$/.test(sql.slice(i))) {
+      const marker = /^\$(?:[A-Za-z_][A-Za-z0-9_]*)?\$/.exec(sql.slice(i))[0];
+      const end = sql.indexOf(marker, i + marker.length);
+      if (end < 0) throw new Error("unterminated SQL string");
+      i = end + marker.length;
+    } else if (sql[i] === ":" && sql[i - 1] !== ":" && sql[i + 1] !== ":") {
+      const name2 = /^[A-Za-z_][A-Za-z0-9_]*/.exec(sql.slice(i + 1))?.[0];
+      if (!name2 || !names.includes(name2)) throw new Error("undeclared named SQL parameter");
+      result += `$${names.indexOf(name2) + 1}`;
+      i += name2.length + 1;
+      continue;
+    } else i++;
+    result += sql.slice(start, i);
+  }
+  return result;
+}
+
+// src/sql/operations.ts
+function isSqlOperationDocument(path, contents) {
+  if (path.endsWith(".operation.json")) return true;
+  if (!contents?.trimStart().startsWith("{")) return false;
+  try {
+    const value = JSON.parse(contents);
+    return !!value && typeof value === "object" && "language" in value && value.language === "sql";
+  } catch {
+    return false;
+  }
+}
+async function compileOperationDocuments(input) {
+  const sqlDocuments = input.documents.filter((d) => isSqlOperationDocument(d.path, d.contents));
+  const result = compileNamespace({ ...input, documents: input.documents.filter((d) => !isSqlOperationDocument(d.path, d.contents)) });
+  if (!result.ok || !sqlDocuments.length) return result;
+  for (const document of sqlDocuments) {
+    try {
+      const definition = defineOperation(JSON.parse(document.contents));
+      if (definition.namespace !== input.canonical.namespace) throw new Error("SQL operation namespace does not match its owner");
+      if (result.artifact.operations[definition.name]) throw new Error("duplicate operation name");
+      const roles = input.canonical.capabilities.roles;
+      const localCapabilities = roles && typeof roles === "object" && "capabilities" in roles ? roles.capabilities : void 0;
+      const declaredLocally = localCapabilities && typeof localCapabilities === "object" && Object.hasOwn(localCapabilities, definition.requires.capability);
+      if (!declaredLocally && !input.canonical.capabilities.uses.includes(definition.requires.capability)) throw new Error("SQL operation capability is not declared by its namespace");
+      const read = [...definition.ontology.read].sort();
+      const catalog = createSqlCatalog({ canonical: input.canonical, publishedObjects: read, executionTarget: "registered-operation" });
+      if ("mode" in definition) {
+        if (catalog.objects.some((object) => object.read.some((ref) => !read.includes(ref)))) throw new Error("SQL policy accesses an undeclared ontology object");
+        const opHash2 = sqlHash(JSON.stringify([
+          "sequence-runtime-sql-operation-v1",
+          definition.name,
+          definition.namespace,
+          definition.requires.capability,
+          read,
+          catalog.identity,
+          definition.maxRows
+        ]));
+        result.artifact.operations[definition.name] = compiledOperationSchema.parse({
+          irVersion: RUNTIME_SQL_IR_VERSION,
+          language: "sql",
+          name: definition.name,
+          opHash: opHash2,
+          kind: "query",
+          requires: definition.requires,
+          variables: [
+            { name: "sql", type: { kind: "scalar", scalar: "text" }, nullable: false, list: false },
+            { name: "parameters", type: { kind: "scalar", scalar: "jsonb" }, nullable: true, list: false }
+          ],
+          roots: [],
+          tableSet: read.map((ref) => ref.split("/")[1]).sort(),
+          sqlQuery: { catalog, read, maxRows: definition.maxRows }
+        });
+        result.manifest.operations[definition.name] = { opHash: opHash2, kind: "query", requires: definition.requires };
+        continue;
+      }
+      const names = Object.keys(definition.parameters).sort();
+      if (names.length > 128) throw new Error("too many SQL parameters");
+      const plan = await compileOntologySql({
+        catalog,
+        sql: bindNamedParameters({ sql: definition.sql, names }),
+        parameterTypes: names.map((name2) => definition.parameters[name2].type),
+        maxRows: definition.maxRows
+      });
+      if (plan.read.some((ref) => !read.includes(ref))) throw new Error("SQL policy/query accesses an undeclared ontology object");
+      const variables = names.map((name2) => ({
+        name: name2,
+        type: { kind: "scalar", scalar: definition.parameters[name2].type },
+        nullable: !definition.parameters[name2].required,
+        list: false
+      }));
+      const opHash = sqlHash(JSON.stringify([
+        "sequence-sql-operation-v1",
+        definition.name,
+        definition.namespace,
+        definition.requires.capability,
+        read,
+        variables,
+        plan.queryHash
+      ]));
+      const operation = compiledOperationSchema.parse({
+        irVersion: SQL_IR_VERSION,
+        language: "sql",
+        name: definition.name,
+        opHash,
+        kind: "query",
+        requires: definition.requires,
+        variables,
+        roots: [],
+        tableSet: plan.read.map((ref) => ref.split("/")[1]).sort(),
+        sql: { text: plan.text, columns: plan.columns, parameters: names, read, maxRows: plan.maxRows }
+      });
+      result.artifact.operations[definition.name] = operation;
+      result.manifest.operations[definition.name] = { opHash, kind: "query", requires: definition.requires };
+    } catch (error) {
+      return { ok: false, diagnostics: [...result.diagnostics, {
+        severity: "error",
+        code: "invalid-sql-operation",
+        document: document.path,
+        message: error instanceof Error ? error.message : "invalid SQL operation"
+      }] };
+    }
+  }
+  const required = requiredArtifactIrVersion(Object.values(result.artifact.operations));
+  if (required > result.artifact.irVersion) result.artifact.irVersion = required;
+  result.artifact.opsHash = computeOpsHash(Object.values(result.artifact.operations).map((op) => op.opHash));
+  result.manifest.opsHash = result.artifact.opsHash;
+  return { ...result, artifact: normalizeIr(result.artifact) };
+}
+var parameterName = z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).max(63).refine((value) => !["__proto__", "prototype", "constructor"].includes(value), "reserved parameter name");
+var parameter = z.discriminatedUnion("type", [
+  z.object({ type: z.literal("text"), value: z.string().nullable() }).strict(),
+  z.object({ type: z.literal("uuid"), value: z.guid().nullable() }).strict(),
+  z.object({ type: z.literal("date"), value: z.string().nullable() }).strict(),
+  z.object({ type: z.literal("timestamptz"), value: z.string().nullable() }).strict(),
+  z.object({ type: z.literal("numeric"), value: z.string().regex(/^-?\d+(\.\d+)?$/).nullable() }).strict(),
+  z.object({ type: z.literal("bigint"), value: z.string().regex(/^-?\d+$/).nullable() }).strict(),
+  z.object({ type: z.literal("integer"), value: z.number().int().min(-2147483648).max(2147483647).nullable() }).strict(),
+  z.object({ type: z.literal("double"), value: z.number().nullable() }).strict(),
+  z.object({ type: z.literal("boolean"), value: z.boolean().nullable() }).strict()
+]);
+var sqlQueryInputSchema = z.object({
+  sql: z.string().min(1).max(65536).refine((value) => Buffer.byteLength(value) <= 65536, "SQL exceeds 64 KiB"),
+  parameters: z.record(parameterName, parameter).refine((value) => Object.keys(value).length <= 128, "too many SQL parameters").default({})
+}).strict();
+async function compileRuntimeSql({ operation, input }) {
+  const contract = operation.sqlQuery;
+  if (!contract) throw new Error("missing runtime SQL contract");
+  const names = Object.keys(input.parameters).sort();
+  const plan = await compileOntologySql({
+    catalog: contract.catalog,
+    sql: bindNamedParameters({ sql: input.sql, names }),
+    parameterTypes: names.map((name2) => input.parameters[name2].type),
+    maxRows: contract.maxRows
+  });
+  if (plan.read.some((ref) => !contract.read.includes(ref))) throw new Error("SQL accesses an undeclared ontology object");
+  return compiledOperationSchema.parse({
+    ...operation,
+    sqlQuery: void 0,
+    irVersion: SQL_IR_VERSION,
+    variables: names.map((name2) => ({ name: name2, type: { kind: "scalar", scalar: input.parameters[name2].type }, nullable: true, list: false })),
+    tableSet: plan.read.map((ref) => ref.split("/")[1]).sort(),
+    sql: { text: plan.text, columns: plan.columns, parameters: names, read: plan.read, maxRows: plan.maxRows }
+  });
+}
+var DATASET_PREVIEW_LIMIT = 100;
+function compileDatasetPreviews(input) {
+  const canonical = normalizeCanonical(input);
+  const { ctx, diagnostics } = buildCompileContext(canonical);
+  if (diagnostics.some((diagnostic) => diagnostic.severity === "error")) throw new NamespaceCompileError(diagnostics);
+  const schemaHash = computeSchemaHash(canonical);
+  const operations = {};
+  for (const relation of canonicalRelations(canonical)) {
+    if (relation.internal || relation.source !== void 0) continue;
+    const columns = relation.columns.filter((column) => column.cell === void 0);
+    const { roots, tableSet } = injectPolicies({ ctx, roots: [{
+      kind: "select",
+      table: relation.table,
+      alias: "rows",
+      where: { kind: "const", value: true },
+      orderBy: [],
+      limit: { value: DATASET_PREVIEW_LIMIT, default: DATASET_PREVIEW_LIMIT, max: DATASET_PREVIEW_LIMIT },
+      selection: {
+        typename: ctx.tables[relation.table].typename,
+        columns: columns.map((column) => ({ column: column.name, alias: column.name })),
+        relations: [],
+        aggregates: []
+      }
+    }] });
+    for (const table of tableSet) {
+      const meta = ctx.tables[table];
+      if (meta.namespace && meta.namespace !== ctx.namespace && !meta.exportRead) {
+        throw new DocumentCompileError(`object '${meta.namespace}/${table}' is not exported for reads`, "unexported-object");
+      }
+    }
+    const hash = createHash("sha256").update("sequence-orm-dataset-preview-v1\0").update(stableJson({ schemaHash, roots, tableSet })).digest("hex");
+    operations[relation.table] = compiledOperationSchema.parse({
+      irVersion: canonical.imports?.length ? COMPOSED_IR_VERSION : LEGACY_IR_VERSION,
+      name: `DatasetPreview_${relation.table}`,
+      opHash: `sha256:${hash}`,
+      kind: "query",
+      requires: null,
+      variables: [],
+      tableSet,
+      roots
+    });
+  }
+  return operations;
+}
+
+export { COMPILER_MAJOR, CONST_TRUE, DATASET_PREVIEW_LIMIT, DEFAULT_LIMIT, DocumentCompileError, MAX_LIMIT, NamespaceCompileError, ORDER_BY_DIRECTIONS, OperationLowerer, PLATFORM_USER_TABLE, PLATFORM_USER_TYPENAME, POLICY_COMPARE_OPS, POLICY_MAX_LINK_DEPTH, PolicyCompileError, PolicyParseError, allowedBoolExpOperators, allowedOps, andPred, assertClaimsOnlyWhen, buildCompileContext, camelCase, canonicalOperationText, classifyInputType, collectPinnedColumns, compileDatasetPreviews, compileNamespace, compileNamespaceOrThrow, compileOperationDocuments, compilePolicy, compilePredicateV2, compileRuntimeSql, computeOpHash, computeOpsHash, computePinnedColumnsByTable, computeSchemaHash, defineOperation, enumTypeName, flattenOperation, injectPolicies, inputTypeName, isSqlOperationDocument, lowerOperation, mutationRootNames, parseDocuments, parsePolicy, parseSdl, pascalCase, platformUserMeta, predContains, predContainsExists, queryRootNames, restrictOperation, sqlOperationDefinitionSchema, sqlQueryInputSchema, typeNameForTable, validateAppendInput, validateBoolExpInput, validateInsertInput, validateOnConflictInput, validateOrderByInput, validateSelectColumns, validateSetInput, walkPolicy, walkPred };
 //# sourceMappingURL=compiler.js.map
 //# sourceMappingURL=compiler.js.map