@sequenceholdings/orm 2.3.0 → 2.5.0

package/dist/index.js

@@ -7,6 +7,7 @@ import { realpath, stat, readdir, readFile, mkdir, writeFile } from 'fs/promises
 import { createRequire } from 'module';
 import { join, sep, extname } from 'path';
 import { generateDrizzleJson, upPgSnapshot, generateMigration, pushSchema } from 'drizzle-kit/api';
+import { PgParser } from '@supabase/pg-parser';
 import { load } from 'js-yaml';
 import { capabilityPinsSchema, customRolesBlockSchema, validateCapabilityPins } from '@sequenceholdings/custom-roles-manifest';
 export { capabilityPinsSchema, customRolesBlockSchema, customRolesDeclared, parseCapabilityPin, validateCapabilityPins } from '@sequenceholdings/custom-roles-manifest';
@@ -155,20 +156,24 @@ var t = {
 };
 
 // src/constants.ts
-var NAMESPACE_PATTERN = /^[a-z][a-z0-9_]{0,40}$/;
+var NAMESPACE_PATTERN = /^(?!(?:events|native_sources)$)[a-z][a-z0-9_]{0,40}$/;
 var ORM_DATA_TOKEN_HEADER = "x-sequence-data-token";
 var ORM_SERVICE_DATA_TOKEN_HEADER = "x-sequence-data-token-service";
 var IDENTIFIER_PATTERN = /^[a-z][a-z0-9_]*$/;
 var COLUMN_IDENTIFIER_PATTERN = /^_?[a-z][a-z0-9_]*$/;
 var MAX_IDENTIFIER_LENGTH = 63;
 var CAPABILITY_KEY_PATTERN = /^(?:org\/|app\/[a-z][a-z0-9-]{0,63}\/)?[a-z0-9-]{1,64}$/;
+var MAX_PERSISTED_READ_ROWS = 50001;
 var CLAIM_KEY_PATTERN = /^[a-z][a-z0-9_]*$/;
 var QUALIFIED_TABLE_PATTERN = /^[a-z][a-z0-9_]{0,62}\.[a-z][a-z0-9_]{0,62}$/;
 var SYNCED_SOURCE_PATTERN = QUALIFIED_TABLE_PATTERN;
 var ORM_SCHEMA_PREFIX = "orm_";
 var CONSUMER_ROLE_SUFFIX = "_consumer";
-var ormSchemaName = (namespace) => `${ORM_SCHEMA_PREFIX}${namespace}`;
-var consumerRoleName = (namespace) => `${ORM_SCHEMA_PREFIX}${namespace}${CONSUMER_ROLE_SUFFIX}`;
+var ormSchemaName = (namespace) => {
+  if (!NAMESPACE_PATTERN.test(namespace)) throw new Error(`invalid or reserved ORM namespace '${namespace}'`);
+  return `${ORM_SCHEMA_PREFIX}${namespace}`;
+};
+var consumerRoleName = (namespace) => `${ormSchemaName(namespace)}${CONSUMER_ROLE_SUFFIX}`;
 var DEFINITION_FILE_EXTENSIONS = [".yml", ".yaml"];
 var NAMESPACE_CONFIG_FILENAMES = /* @__PURE__ */ new Set(["namespace.yaml", "namespace.yml"]);
 var HASH_DOMAIN = "sequence-orm-definitions\0";
@@ -397,10 +402,10 @@ function defineSyncedTable(name2, columnsOrConfig, maybeConfig) {
     if (builder.isPrimaryKey) columnLevelPk.push(propertyName);
   }
   if (entries.length > 0) {
-    const hasConfigPk = config.primaryKey !== void 0 && config.primaryKey.length > 0;
+    const hasConfigPk = config.primaryKey !== void 0;
     if (columnLevelPk.length === 0 && !hasConfigPk) {
       throw new OrmDefinitionError(
-        `synced table "${name2}" declares columns but no primary key \u2014 use .primaryKey() or config.primaryKey`,
+        `synced table "${name2}" declares columns but no primary key \u2014 use .primaryKey(), config.primaryKey, or explicit primaryKey: [] for an unkeyed read-only source`,
         file
       );
     }
@@ -1253,10 +1258,10 @@ function validateResolvedView({ view, tables, views = [] }) {
   const resolved = view.resolved;
   if (!resolved) return [];
   const errors = [];
-  const fail = (message) => errors.push(`resolved table '${view.view}': ${message}`);
+  const fail2 = (message) => errors.push(`resolved table '${view.view}': ${message}`);
   const pkColumn = view.primaryKey?.length === 1 ? view.columns.find((c) => c.columnName === view.primaryKey?.[0]) : void 0;
   if (!pkColumn) {
-    fail("requires exactly one primary-key column");
+    fail2("requires exactly one primary-key column");
     return errors;
   }
   const systemNames = new Set(Object.values(RESOLVED_VIEW_SYSTEM_COLUMNS).map((c) => c.name));
@@ -1266,92 +1271,93 @@ function validateResolvedView({ view, tables, views = [] }) {
     pkColumn,
     dataColumns: new Map(view.columns.filter((c) => !systemNames.has(c.name) && c.cell === void 0).map((c) => [c.name, c])),
     sourceByName: /* @__PURE__ */ new Map(),
-    fail
+    fail: fail2
   };
-  if (resolved.sources.filter((source) => source.kind === "manual").length !== 1) fail("requires exactly one manual source");
+  if (resolved.sources.filter((source) => source.kind === "manual").length !== 1) fail2("requires exactly one manual source");
   const tableByName = new Map(tables.map((table) => [table.table, table]));
   for (const source of resolved.sources) {
-    if (scope.sourceByName.has(source.name)) fail(`duplicate source '${source.name}'`);
+    if (scope.sourceByName.has(source.name)) fail2(`duplicate source '${source.name}'`);
     scope.sourceByName.set(source.name, source);
     const table = tableByName.get(source.table);
-    if (!table) fail(`source '${source.name}' references unknown table '${source.table}'`);
+    if (!table) fail2(`source '${source.name}' references unknown table '${source.table}'`);
     else validateSource({ scope, source, table });
   }
   validateRules(scope);
   validateViewCells(scope);
   if (resolved.materialized) validateMaterialized({ scope, tableByName, views });
   for (const name2 of resolved.deletedBy) {
-    if (scope.sourceByName.get(name2)?.kind !== "manual") fail(`deletedBy '${name2}' must be the manual source`);
+    if (scope.sourceByName.get(name2)?.kind !== "manual") fail2(`deletedBy '${name2}' must be the manual source`);
   }
   return errors;
 }
 function validateSource({ scope, source, table }) {
-  const { fail } = scope;
-  if (source.kind === "etl" && table.source === void 0) fail(`etl source '${source.name}' must reference a synced table`);
+  const { fail: fail2 } = scope;
+  if (source.kind === "etl" && table.source === void 0) fail2(`etl source '${source.name}' must reference a synced table`);
+  if (source.kind === "etl" && table.primaryKey?.length === 0) fail2(`etl source '${source.name}' cannot use an unkeyed synced table for resolved row identity`);
   if (source.kind !== "etl" && (table.internal !== true || table.cellMetadata !== true)) {
-    fail(`${source.kind} source '${source.name}' must reference an internal table with cell metadata`);
+    fail2(`${source.kind} source '${source.name}' must reference an internal table with cell metadata`);
   }
   const hasRev = table.columns.some((column) => column.cell?.part === "rev");
-  if (source.kind === "manual" && !hasRev) fail(`manual source '${source.name}' must carry '__rev' cell columns`);
-  if (source.kind === "prefetch" && hasRev) fail(`prefetch source '${source.name}' must not carry '__rev' cell columns`);
+  if (source.kind === "manual" && !hasRev) fail2(`manual source '${source.name}' must carry '__rev' cell columns`);
+  if (source.kind === "prefetch" && hasRev) fail2(`prefetch source '${source.name}' must not carry '__rev' cell columns`);
   const byName = new Map(table.columns.map((c) => [c.name, c]));
   validateSourceColumns({ scope, source, byName });
   if (source.kind === "etl") {
     const updatedAt = source.updatedAt === void 0 ? void 0 : byName.get(source.updatedAt);
     if (source.updatedAt !== void 0 && updatedAt?.type !== "timestamptz" && updatedAt?.type !== "date") {
-      fail(`etl source '${source.name}' updatedAt must name a timestamptz/date column on '${source.table}'`);
+      fail2(`etl source '${source.name}' updatedAt must name a timestamptz/date column on '${source.table}'`);
     }
   }
   validatePrefetchFields({ scope, source });
 }
 function validatePrefetchFields({ scope, source }) {
-  const { fail, pkColumn } = scope;
+  const { fail: fail2, pkColumn } = scope;
   if (source.kind !== "prefetch") {
     if (source.key || source.fetch || source.function || source.prefetchDefaults || source.writeback) {
-      fail(`only prefetch sources may declare key/fetch/function/prefetchDefaults/writeback ('${source.name}')`);
+      fail2(`only prefetch sources may declare key/fetch/function/prefetchDefaults/writeback ('${source.name}')`);
     }
     return;
   }
   if (!source.key || !source.fetch || !source.function || !source.prefetchDefaults) {
-    fail(`prefetch source '${source.name}' requires key, fetch, function and prefetchDefaults`);
+    fail2(`prefetch source '${source.name}' requires key, fetch, function and prefetchDefaults`);
   } else if (source.key !== pkColumn.name && !source.columns.includes(source.key)) {
-    fail(`prefetch source '${source.name}' key '${source.key}' must be the primary key or one of its columns`);
+    fail2(`prefetch source '${source.name}' key '${source.key}' must be the primary key or one of its columns`);
   }
   for (const column of source.writeback?.columns ?? []) {
-    if (!source.columns.includes(column)) fail(`prefetch source '${source.name}' writes back '${column}', which it does not supply`);
+    if (!source.columns.includes(column)) fail2(`prefetch source '${source.name}' writes back '${column}', which it does not supply`);
   }
 }
 function validateSourceColumns({ scope, source, byName }) {
-  const { fail, pkColumn, dataColumns } = scope;
+  const { fail: fail2, pkColumn, dataColumns } = scope;
   for (const column of [pkColumn.name, ...source.columns]) {
     const own = column === pkColumn.name ? pkColumn : dataColumns.get(column);
     const theirs = byName.get(column);
-    if (!own) fail(`source '${source.name}' supplies unknown column '${column}'`);
-    else if (!theirs) fail(`source '${source.name}' table '${source.table}' has no column '${column}'`);
-    else if (JSON.stringify(theirs.type) !== JSON.stringify(own.type)) fail(`column '${column}' has a different type on source '${source.name}'`);
+    if (!own) fail2(`source '${source.name}' supplies unknown column '${column}'`);
+    else if (!theirs) fail2(`source '${source.name}' table '${source.table}' has no column '${column}'`);
+    else if (JSON.stringify(theirs.type) !== JSON.stringify(own.type)) fail2(`column '${column}' has a different type on source '${source.name}'`);
   }
 }
-function validateRules({ resolved, pkColumn, dataColumns, sourceByName, fail }) {
+function validateRules({ resolved, pkColumn, dataColumns, sourceByName, fail: fail2 }) {
   const ruled = /* @__PURE__ */ new Set();
   for (const rule of resolved.resolve) {
     if (!dataColumns.has(rule.column) || rule.column === pkColumn.name) {
-      fail(`resolve rule targets unknown column '${rule.column}'`);
+      fail2(`resolve rule targets unknown column '${rule.column}'`);
       continue;
     }
-    if (ruled.has(rule.column)) fail(`column '${rule.column}' has more than one resolve rule`);
+    if (ruled.has(rule.column)) fail2(`column '${rule.column}' has more than one resolve rule`);
     ruled.add(rule.column);
     if (rule.comparator === "custom" !== (rule.orderBy !== void 0)) {
-      fail(`column '${rule.column}': orderBy is required for custom comparators and only allowed there`);
+      fail2(`column '${rule.column}': orderBy is required for custom comparators and only allowed there`);
     }
-    if (new Set(rule.candidates).size !== rule.candidates.length) fail(`column '${rule.column}' repeats a candidate`);
+    if (new Set(rule.candidates).size !== rule.candidates.length) fail2(`column '${rule.column}' repeats a candidate`);
     for (const candidate of rule.candidates) {
       const source = sourceByName.get(candidate);
-      if (!source) fail(`column '${rule.column}' names unknown candidate source '${candidate}'`);
-      else if (!source.columns.includes(rule.column)) fail(`column '${rule.column}' candidate '${candidate}' does not supply it`);
+      if (!source) fail2(`column '${rule.column}' names unknown candidate source '${candidate}'`);
+      else if (!source.columns.includes(rule.column)) fail2(`column '${rule.column}' candidate '${candidate}' does not supply it`);
     }
   }
   for (const column of dataColumns.keys()) {
-    if (column !== pkColumn.name && !ruled.has(column)) fail(`column '${column}' has no resolve rule`);
+    if (column !== pkColumn.name && !ruled.has(column)) fail2(`column '${column}' has no resolve rule`);
   }
 }
 var VIEW_CELL_TYPES = {
@@ -1360,7 +1366,7 @@ var VIEW_CELL_TYPES = {
   by: "text",
   conflicts: "jsonb"
 };
-function validateViewCells({ view, dataColumns, pkColumn, fail }) {
+function validateViewCells({ view, dataColumns, pkColumn, fail: fail2 }) {
   const expected = /* @__PURE__ */ new Map();
   for (const column of dataColumns.values()) {
     if (column.name === pkColumn.name) continue;
@@ -1372,34 +1378,34 @@ function validateViewCells({ view, dataColumns, pkColumn, fail }) {
     if (!column.cell) continue;
     const want = expected.get(column.name);
     if (!want || want.part !== column.cell.part || want.columnName !== column.columnName || cellColumnName(column.cell.of, column.cell.part) !== column.name) {
-      fail(`unexpected cell column '${column.name}'`);
+      fail2(`unexpected cell column '${column.name}'`);
       continue;
     }
-    if (column.type !== VIEW_CELL_TYPES[column.cell.part]) fail(`cell column '${column.name}' must be ${VIEW_CELL_TYPES[column.cell.part]}`);
+    if (column.type !== VIEW_CELL_TYPES[column.cell.part]) fail2(`cell column '${column.name}' must be ${VIEW_CELL_TYPES[column.cell.part]}`);
     expected.delete(column.name);
   }
-  for (const name2 of expected.keys()) fail(`missing cell column '${name2}'`);
+  for (const name2 of expected.keys()) fail2(`missing cell column '${name2}'`);
 }
 var columnSignature = (columns) => JSON.stringify(columns.map((column) => [column.name, column.columnName, column.type]));
 function validateMaterialized({ scope, tableByName, views }) {
-  const { view, resolved, fail } = scope;
+  const { view, resolved, fail: fail2 } = scope;
   const { table: tableName, compute: computeName } = resolved.materialized;
   const table = tableByName.get(tableName);
   if (!table || table.internal !== true || table.materializes !== view.view) {
-    fail(`materialized table '${tableName}' must be an internal table that materializes '${view.view}'`);
+    fail2(`materialized table '${tableName}' must be an internal table that materializes '${view.view}'`);
   } else {
-    if (columnSignature(table.columns) !== columnSignature(view.columns)) fail(`materialized table '${tableName}' must have exactly the view's columns`);
-    if (JSON.stringify(table.primaryKey ?? []) !== JSON.stringify(view.primaryKey ?? [])) fail(`materialized table '${tableName}' must share the view's primary key`);
+    if (columnSignature(table.columns) !== columnSignature(view.columns)) fail2(`materialized table '${tableName}' must have exactly the view's columns`);
+    if (JSON.stringify(table.primaryKey ?? []) !== JSON.stringify(view.primaryKey ?? [])) fail2(`materialized table '${tableName}' must share the view's primary key`);
   }
   const compute = views.find((candidate) => candidate.view === computeName);
-  if (!compute || compute.internal !== true) fail(`compute view '${computeName}' must be an internal view`);
-  else if (columnSignature(compute.columns) !== columnSignature(view.columns)) fail(`compute view '${computeName}' must have exactly the view's columns`);
+  if (!compute || compute.internal !== true) fail2(`compute view '${computeName}' must be an internal view`);
+  else if (columnSignature(compute.columns) !== columnSignature(view.columns)) fail2(`compute view '${computeName}' must have exactly the view's columns`);
   for (const source of resolved.sources) {
     if (source.kind !== "etl") continue;
     const read = tableByName.get(source.table)?.policies?.read;
     const unconditional = typeof read === "string" ? read.trim() === "true" : read !== void 0 && read.default.trim() === "true" && read.variants.length === 0;
     if (!unconditional) {
-      fail(`etl source '${source.name}' must have read policy 'true' to be materialized (the copy is shared by every caller)`);
+      fail2(`etl source '${source.name}' must have read policy 'true' to be materialized (the copy is shared by every caller)`);
     }
   }
 }
@@ -1736,7 +1742,7 @@ var canonicalTableSchema = z.object({
   /** Synced/reflected read-only tables (`source: schema.table`) — v1 semantics. */
   source: z.string().regex(QUALIFIED_TABLE_PATTERN).optional(),
   columns: z.array(canonicalColumnSchema).default([]),
-  primaryKey: z.array(columnIdentifier).min(1).max(8).optional(),
+  primaryKey: z.array(columnIdentifier).max(8).optional(),
   links: z.array(canonicalLinkSchema).default([]),
   indexes: z.array(canonicalIndexSchema).default([]),
   /** Omitted by old definitions, preserving their existing content hashes. */
@@ -1772,6 +1778,29 @@ var canonicalTableSchema = z.object({
    * data plane. Omitted otherwise.
    */
   materializes: identifier2.optional()
+}).superRefine((table, ctx) => {
+  if (table.primaryKey?.length !== 0) return;
+  const fail2 = (message, path = ["primaryKey"]) => ctx.addIssue({ code: "custom", path, message: `unkeyed table '${table.table}' ${message}` });
+  if (table.source === void 0 || table.columns.length === 0) {
+    fail2("requires a typed synced source");
+  }
+  if ([table.policies.write, table.policies.insert, table.policies.update].some((policy) => policy !== void 0)) {
+    fail2("is read-only and cannot declare write policies", ["policies"]);
+  }
+  const ownedCollections = [table.indexes, table.actions, table.checks, table.foreignKeys, table.cowMutations];
+  const ownedMetadata = [table.cellMetadata, table.internal, table.materializes, table.renamedFrom];
+  if (ownedCollections.some((items) => items !== void 0 && items.length > 0) || ownedMetadata.some((value) => value !== void 0)) {
+    fail2("cannot declare owned storage, constraints or identity operations");
+  }
+  for (const [index3, column] of table.columns.entries()) {
+    const ownedColumnMetadata = [column.default, column.defaultFn, column.onUpdateFn, column.renamedFrom, column.cast, column.cell];
+    if (column.unique || ownedColumnMetadata.some((value) => value !== void 0)) {
+      fail2("cannot declare column uniqueness, mutation defaults or migration metadata", ["columns", index3]);
+    }
+  }
+  for (const [index3, link] of table.links.entries()) {
+    if (link.enforce || link.kind === "toMany") fail2("cannot provide an identity for this link", ["links", index3]);
+  }
 });
 var MAX_VIEW_QUERY = 1e5;
 var MAX_RESOLVED_VIEW_QUERY = 5e6;
@@ -1828,6 +1857,26 @@ var canonicalViewSchema = z.object({
     }
   }
 });
+function validateUnkeyedLinkIdentities({ definition, ctx }) {
+  const tables = new Map(definition.tables.map((table) => [table.table, table]));
+  const relations = [
+    ...definition.tables.map((table, index3) => ({ kind: "tables", index: index3, links: table.links })),
+    ...(definition.views ?? []).map((view, index3) => ({ kind: "views", index: index3, links: view.links }))
+  ];
+  for (const relation of relations) {
+    for (const [linkIndex, link] of relation.links.entries()) {
+      if (link.kind !== "toOne" || link.namespace !== void 0 && link.namespace !== definition.namespace) continue;
+      const target = link.target === void 0 ? void 0 : tables.get(link.target);
+      if (target?.source !== void 0 && target.primaryKey?.length === 0) {
+        ctx.addIssue({
+          code: "custom",
+          path: [relation.kind, relation.index, "links", linkIndex],
+          message: `link '${link.name}' cannot use unkeyed table '${target.table}' as a to-one identity`
+        });
+      }
+    }
+  }
+}
 var CELL_PART_TYPES = {
   at: "timestamptz",
   by: "text",
@@ -1841,49 +1890,49 @@ function trackedCellColumns(table) {
 }
 var SUFFIXES = Object.values(CELL_PART_SUFFIX);
 function validateCellMetadata(table, index3, ctx) {
-  const fail = (message, path = ["tables", index3]) => ctx.addIssue({ code: "custom", path, message });
+  const fail2 = (message, path = ["tables", index3]) => ctx.addIssue({ code: "custom", path, message });
   const cells = table.columns.flatMap((column, position) => column.cell ? [{ column, position, cell: column.cell }] : []);
   if (table.materializes !== void 0) return;
   if (table.cellMetadata !== true) {
-    for (const { position } of cells) fail(`cell-metadata columns require cellMetadata on table '${table.table}'`, ["tables", index3, "columns", position]);
+    for (const { position } of cells) fail2(`cell-metadata columns require cellMetadata on table '${table.table}'`, ["tables", index3, "columns", position]);
     return;
   }
   if (table.source !== void 0) {
-    fail(`synced table '${table.table}' cannot track cell metadata`);
+    fail2(`synced table '${table.table}' cannot track cell metadata`);
     return;
   }
   const tracked = trackedCellColumns(table);
   const byName = new Map(tracked.map((column) => [column.name, column]));
   const withRev = cells.some(({ cell }) => cell.part === "rev");
-  if (withRev && table.internal !== true) fail(`only a resolved table's internal sources carry '__rev' cell columns ('${table.table}')`);
+  if (withRev && table.internal !== true) fail2(`only a resolved table's internal sources carry '__rev' cell columns ('${table.table}')`);
   const seen = /* @__PURE__ */ new Set();
   for (const { column, position, cell } of cells) {
     const path = ["tables", index3, "columns", position];
     const owner = byName.get(cell.of);
     if (!owner) {
-      fail(`cell column '${column.name}' belongs to '${cell.of}', which is not a tracked column`, path);
+      fail2(`cell column '${column.name}' belongs to '${cell.of}', which is not a tracked column`, path);
       continue;
     }
-    if (cell.part !== "at" && cell.part !== "by" && cell.part !== "rev") fail(`a table cell column must be part at/by/rev, not '${cell.part}'`, path);
+    if (cell.part !== "at" && cell.part !== "by" && cell.part !== "rev") fail2(`a table cell column must be part at/by/rev, not '${cell.part}'`, path);
     if (column.name !== cellColumnName(owner.name, cell.part) || column.columnName !== cellColumnName(owner.columnName, cell.part)) {
-      fail(`cell column for '${owner.name}' ${cell.part} must be named '${cellColumnName(owner.name, cell.part)}' / '${cellColumnName(owner.columnName, cell.part)}'`, path);
+      fail2(`cell column for '${owner.name}' ${cell.part} must be named '${cellColumnName(owner.name, cell.part)}' / '${cellColumnName(owner.columnName, cell.part)}'`, path);
     }
     if (column.type !== CELL_PART_TYPES[cell.part] || !column.nullable || column.unique || column.default !== void 0 || column.defaultFn !== void 0) {
-      fail(`cell column '${column.name}' must be a nullable, default-less ${CELL_PART_TYPES[cell.part]}`, path);
+      fail2(`cell column '${column.name}' must be a nullable, default-less ${CELL_PART_TYPES[cell.part]}`, path);
     }
     const key = `${cell.of}:${cell.part}`;
-    if (seen.has(key)) fail(`duplicate cell column '${column.name}'`, path);
+    if (seen.has(key)) fail2(`duplicate cell column '${column.name}'`, path);
     seen.add(key);
   }
   for (const column of tracked) {
     if (column.columnName.length > MAX_TRACKED_COLUMN_NAME) {
-      fail(`column '${column.columnName}' is too long to track cell metadata (max ${MAX_TRACKED_COLUMN_NAME} characters)`);
+      fail2(`column '${column.columnName}' is too long to track cell metadata (max ${MAX_TRACKED_COLUMN_NAME} characters)`);
     }
     if (SUFFIXES.some((suffix) => column.columnName.endsWith(suffix))) {
-      fail(`column '${column.columnName}' ends in a reserved cell-metadata suffix (${SUFFIXES.join(", ")})`);
+      fail2(`column '${column.columnName}' ends in a reserved cell-metadata suffix (${SUFFIXES.join(", ")})`);
     }
     for (const part of withRev ? ["at", "by", "rev"] : ["at", "by"]) {
-      if (!seen.has(`${column.name}:${part}`)) fail(`tracked column '${column.name}' is missing its '${cellColumnName(column.columnName, part)}' cell column`);
+      if (!seen.has(`${column.name}:${part}`)) fail2(`tracked column '${column.name}' is missing its '${cellColumnName(column.columnName, part)}' cell column`);
     }
   }
 }
@@ -1891,7 +1940,7 @@ var exportGateSchema = z.union([z.literal(true), z.object({ capability: z.string
 var relationExportSchema = z.object({ read: exportGateSchema, write: exportGateSchema.optional() }).strict();
 var localDefinitionSchema = z.object({
   definition_format: z.literal(CANONICAL_FORMAT),
-  namespace: identifier2.max(41),
+  namespace: identifier2.max(41).regex(NAMESPACE_PATTERN, "invalid or reserved ORM namespace"),
   description: z.string().max(2e3).optional(),
   enums: z.array(canonicalEnumSchema).default([]),
   tables: z.array(canonicalTableSchema).min(0).max(500),
@@ -1925,6 +1974,7 @@ var localDefinitionSchema = z.object({
     }
   }
   const fkTables = new Map(definition.tables.map((table) => [table.table, table]));
+  validateUnkeyedLinkIdentities({ definition, ctx });
   const relations = /* @__PURE__ */ new Set([...fkTables.keys(), ...(definition.views ?? []).map((view) => view.view)]);
   for (const name2 of Object.keys(definition.exports ?? {})) {
     if (!relations.has(name2)) ctx.addIssue({ code: "custom", path: ["exports", name2], message: `export '${name2}' is not a local object` });
@@ -1950,38 +2000,38 @@ var localDefinitionSchema = z.object({
       }
     }
     for (const [index3, check] of (table.checks ?? []).entries()) {
-      const fail = (message) => ctx.addIssue({ code: "custom", path: ["tables", tableIndex, "checks", index3], message });
-      if (table.source) fail("synced tables cannot declare checks");
-      if (names.has(check.name)) fail(`duplicate constraint '${check.name}'`);
+      const fail2 = (message) => ctx.addIssue({ code: "custom", path: ["tables", tableIndex, "checks", index3], message });
+      if (table.source) fail2("synced tables cannot declare checks");
+      if (names.has(check.name)) fail2(`duplicate constraint '${check.name}'`);
       names.add(check.name);
       try {
         compileCheckExpression(check.expression, table.columns);
       } catch (error) {
-        fail(error instanceof Error ? error.message : String(error));
+        fail2(error instanceof Error ? error.message : String(error));
       }
     }
     for (const [index3, fk] of (table.foreignKeys ?? []).entries()) {
-      const fail = (message) => ctx.addIssue({ code: "custom", path: ["tables", tableIndex, "foreignKeys", index3], message });
-      if (names.has(fk.name)) fail(`duplicate foreign key '${fk.name}'`);
+      const fail2 = (message) => ctx.addIssue({ code: "custom", path: ["tables", tableIndex, "foreignKeys", index3], message });
+      if (names.has(fk.name)) fail2(`duplicate foreign key '${fk.name}'`);
       names.add(fk.name);
       const target = fkTables.get(fk.target);
       if (table.source || !target || target.source) {
-        fail("foreign keys must connect owned tables in the same namespace");
+        fail2("foreign keys must connect owned tables in the same namespace");
         continue;
       }
-      if (fk.columns.length !== fk.references.length) fail("foreign key columns and references must have the same number of columns");
-      if (new Set(fk.columns).size !== fk.columns.length || new Set(fk.references).size !== fk.references.length) fail("foreign key columns must not repeat");
+      if (fk.columns.length !== fk.references.length) fail2("foreign key columns and references must have the same number of columns");
+      if (new Set(fk.columns).size !== fk.columns.length || new Set(fk.references).size !== fk.references.length) fail2("foreign key columns must not repeat");
       for (const [position, name2] of fk.columns.entries()) {
         const sourceColumn = table.columns.find((column) => column.columnName === name2);
         const targetColumn = target.columns.find((column) => column.columnName === fk.references[position]);
-        if (!sourceColumn || !targetColumn) fail("foreign key references an unknown column");
-        else if (JSON.stringify(sourceColumn.type) !== JSON.stringify(targetColumn.type)) fail("foreign key column types must match");
+        if (!sourceColumn || !targetColumn) fail2("foreign key references an unknown column");
+        else if (JSON.stringify(sourceColumn.type) !== JSON.stringify(targetColumn.type)) fail2("foreign key column types must match");
       }
       if (fk.onDelete === "set null" || fk.onUpdate === "set null") {
-        if (fk.columns.some((name2) => table.columns.find((column) => column.columnName === name2)?.nullable === false || table.primaryKey?.includes(name2))) fail("SET NULL requires nullable source columns");
+        if (fk.columns.some((name2) => table.columns.find((column) => column.columnName === name2)?.nullable === false || table.primaryKey?.includes(name2))) fail2("SET NULL requires nullable source columns");
       }
       const uniqueKeys = [target.primaryKey ?? [], ...target.indexes.filter((index4) => index4.unique).map((index4) => index4.columns), ...target.columns.filter((column) => column.unique).map((column) => [column.columnName])];
-      if (!uniqueKeys.some((key) => key.length === fk.references.length && key.every((column) => fk.references.includes(column)))) fail("foreign key target columns must form a unique key");
+      if (!uniqueKeys.some((key) => key.length === fk.references.length && key.every((column) => fk.references.includes(column)))) fail2("foreign key target columns must form a unique key");
     }
   }
   for (const [viewIndex, view] of (definition.views ?? []).entries()) {
@@ -2169,8 +2219,8 @@ function cloneColumn({ builder, property, notNull, primaryKey: primaryKey2 }) {
   return clone;
 }
 function planSource(input) {
-  const { sourceName, input: source, fail } = input;
-  if (!IDENTIFIER_PATTERN.test(sourceName)) fail(`source name "${sourceName}" must match ${IDENTIFIER_PATTERN}`);
+  const { sourceName, input: source, fail: fail2 } = input;
+  if (!IDENTIFIER_PATTERN.test(sourceName)) fail2(`source name "${sourceName}" must match ${IDENTIFIER_PATTERN}`);
   switch (source.kind) {
     case "manual":
       return {
@@ -2206,30 +2256,31 @@ function internalTable(input, supplied, system, options = {}) {
     internal: true
   });
 }
-function assertColumns(input, list, what) {
-  for (const column of list) if (!input.dataColumns.includes(column)) input.fail(`${what} names unknown column "${column}"`);
+function assertColumns(input, list2, what) {
+  for (const column of list2) if (!input.dataColumns.includes(column)) input.fail(`${what} names unknown column "${column}"`);
 }
 function planEtl(input, source) {
-  const { sourceName, pk, dataColumns, fail } = input;
+  const { sourceName, pk, dataColumns, fail: fail2 } = input;
   const table = typeof source.table === "function" ? source.table() : source.table;
-  if (!isSeqTable(table) || table.source === void 0) fail(`etl source "${sourceName}" must reference a defineSyncedTable`);
+  if (!isSeqTable(table) || table.source === void 0) fail2(`etl source "${sourceName}" must reference a defineSyncedTable`);
   const synced = table;
-  if (!(pk in synced.columns)) fail(`etl source "${sourceName}" table "${synced.tableName}" has no "${pk}" column`);
+  if (synced.config.primaryKey?.length === 0) fail2(`etl source "${sourceName}" cannot use an unkeyed synced table for resolved row identity`);
+  if (!(pk in synced.columns)) fail2(`etl source "${sourceName}" table "${synced.tableName}" has no "${pk}" column`);
   const supplied = source.columns ? [...source.columns] : dataColumns.filter((column) => column in synced.columns);
   assertColumns(input, supplied, `etl source "${sourceName}"`);
   if (source.updatedAt !== void 0 && !(source.updatedAt in synced.columns)) {
-    fail(`etl source "${sourceName}" updatedAt "${source.updatedAt}" is not a column of "${synced.tableName}"`);
+    fail2(`etl source "${sourceName}" updatedAt "${source.updatedAt}" is not a column of "${synced.tableName}"`);
   }
   return { name: sourceName, kind: "etl", table: synced, columns: supplied, ...source.updatedAt ? { updatedAt: source.updatedAt } : {} };
 }
 function planPrefetch(input, source) {
-  const { sourceName, pk, fail } = input;
+  const { sourceName, pk, fail: fail2 } = input;
   assertColumns(input, source.columns, `prefetch source "${sourceName}"`);
   if (source.key !== pk && !source.columns.includes(source.key)) {
-    fail(`prefetch source "${sourceName}" key "${source.key}" must be the primary key or one of its columns`);
+    fail2(`prefetch source "${sourceName}" key "${source.key}" must be the primary key or one of its columns`);
   }
   for (const column of source.writeback?.columns ?? []) {
-    if (!source.columns.includes(column)) fail(`prefetch source "${sourceName}" writes back "${column}", which it does not supply`);
+    if (!source.columns.includes(column)) fail2(`prefetch source "${sourceName}" writes back "${column}", which it does not supply`);
   }
   const writeback = source.writeback;
   return {
@@ -2435,34 +2486,34 @@ var SYSTEM_VIEW_COLUMNS = {
 };
 function defineResolvedTable(name2, columns, config) {
   const file = activeAuthoringContext()?.currentFile;
-  const fail = (message) => {
+  const fail2 = (message) => {
     throw new OrmDefinitionError(`resolved table "${name2}": ${message}`, file);
   };
-  if (!IDENTIFIER_PATTERN.test(name2)) fail(`name must match ${IDENTIFIER_PATTERN}`);
+  if (!IDENTIFIER_PATTERN.test(name2)) fail2(`name must match ${IDENTIFIER_PATTERN}`);
   for (const property of Object.keys(columns)) {
     if (RESERVED_RESOLVED_COLUMN_NAMES.has(property) || RESERVED_RESOLVED_COLUMN_NAMES.has(columns[property].columnNameFor(property))) {
-      fail(`column "${property}" collides with a reserved system column`);
+      fail2(`column "${property}" collides with a reserved system column`);
     }
   }
   for (const property of Object.keys(columns)) {
     if (columns[property].columnNameFor(property).length > MAX_TRACKED_COLUMN_NAME) {
-      fail(`column "${property}" is too long for a resolved table (max ${MAX_TRACKED_COLUMN_NAME} characters, room for cell parts)`);
+      fail2(`column "${property}" is too long for a resolved table (max ${MAX_TRACKED_COLUMN_NAME} characters, room for cell parts)`);
     }
   }
   const pkEntries = Object.entries(columns).filter(([, builder]) => builder.isPrimaryKey);
-  if (pkEntries.length !== 1) fail("declare exactly one .primaryKey() column");
+  if (pkEntries.length !== 1) fail2("declare exactly one .primaryKey() column");
   const [pk, pkBuilder] = pkEntries[0];
   const dataColumns = Object.keys(columns).filter((property) => property !== pk);
-  if (dataColumns.length === 0) fail("declare at least one non-key column");
+  if (dataColumns.length === 0) fail2("declare at least one non-key column");
   const sourceEntries = Object.entries(config.sources);
-  if (sourceEntries.filter(([, source]) => source.kind === "manual").length !== 1) fail("declare exactly one manualSource()");
+  if (sourceEntries.filter(([, source]) => source.kind === "manual").length !== 1) fail2("declare exactly one manualSource()");
   const plans = sourceEntries.map(
-    ([sourceName, input]) => planSource({ viewName: name2, sourceName, input, columns, pk, pkBuilder, dataColumns, fail })
+    ([sourceName, input]) => planSource({ viewName: name2, sourceName, input, columns, pk, pkBuilder, dataColumns, fail: fail2 })
   );
-  const rules = planRules({ config, plans, dataColumns, fail });
+  const rules = planRules({ config, plans, dataColumns, fail: fail2 });
   const deletedBy = [...config.rows?.deletedBy ?? []];
   for (const source of deletedBy) {
-    if (plans.find((plan) => plan.name === source)?.kind !== "manual") fail(`rows.deletedBy "${source}" must be the manual source`);
+    if (plans.find((plan) => plan.name === source)?.kind !== "manual") fail2(`rows.deletedBy "${source}" must be the manual source`);
   }
   const partType = { source: t.text, at: t.timestamptz, by: t.text, conflicts: t.jsonb };
   const viewColumns = {};
@@ -2525,11 +2576,11 @@ function defineResolvedTable(name2, columns, config) {
     }
   });
 }
-function planRules({ config, plans, dataColumns, fail }) {
+function planRules({ config, plans, dataColumns, fail: fail2 }) {
   const kindOrder = { manual: 0, prefetch: 1, etl: 2 };
   const fallback = config.default ?? priority([...plans].sort((a, b) => kindOrder[a.kind] - kindOrder[b.kind]).map((plan) => plan.name));
   for (const column of Object.keys(config.resolve ?? {})) {
-    if (!dataColumns.includes(column)) fail(`resolve names unknown column "${column}"`);
+    if (!dataColumns.includes(column)) fail2(`resolve names unknown column "${column}"`);
   }
   return dataColumns.map((column) => {
     const explicit = config.resolve?.[column];
@@ -2537,11 +2588,11 @@ function planRules({ config, plans, dataColumns, fail }) {
     const candidates = explicit ? [...explicit.candidates] : comparator.candidates.filter((name2) => plans.find((plan) => plan.name === name2)?.columns.includes(column));
     for (const candidate of candidates) {
       const plan = plans.find((entry) => entry.name === candidate);
-      if (!plan) fail(`column "${column}" names unknown source "${candidate}"`);
-      else if (!plan.columns.includes(column)) fail(`column "${column}" candidate "${candidate}" does not supply it`);
+      if (!plan) fail2(`column "${column}" names unknown source "${candidate}"`);
+      else if (!plan.columns.includes(column)) fail2(`column "${column}" candidate "${candidate}" does not supply it`);
     }
-    if (candidates.length === 0) fail(`column "${column}" has no candidate source`);
-    if (comparator.kind === "custom") assertSafeOrderBy({ orderBy: comparator.orderBy ?? "", column, fail });
+    if (candidates.length === 0) fail2(`column "${column}" has no candidate source`);
+    if (comparator.kind === "custom") assertSafeOrderBy({ orderBy: comparator.orderBy ?? "", column, fail: fail2 });
     return {
       column,
       comparator: comparator.kind,
@@ -2592,18 +2643,18 @@ var ORDER_BY_KEYWORDS = /* @__PURE__ */ new Set([
 ]);
 var ALLOWED_FUNCTIONS = new Set(VIEW_QUERY_FUNCTION_ALLOWLIST);
 var ORDER_BY_TOKEN = /\s+|'(?:[^']|'')*'|\d+(?:\.\d+)?|[a-z_][a-z0-9_]*|::|<=|>=|<>|!=|[-+*/%<>=(),|]/giy;
-function assertSafeOrderBy({ orderBy, column, fail }) {
+function assertSafeOrderBy({ orderBy, column, fail: fail2 }) {
   ORDER_BY_TOKEN.lastIndex = 0;
   let consumed = 0;
   for (let match = ORDER_BY_TOKEN.exec(orderBy); match; match = ORDER_BY_TOKEN.exec(orderBy)) {
     consumed = ORDER_BY_TOKEN.lastIndex;
     const token = match[0].toLowerCase();
     if (/^[a-z_]/.test(token) && !ORDER_BY_KEYWORDS.has(token) && !ALLOWED_FUNCTIONS.has(token)) {
-      fail(`column "${column}" custom orderBy uses "${match[0]}" \u2014 only value, updated_at, source, actor, ord, SQL keywords and allowlisted functions`);
+      fail2(`column "${column}" custom orderBy uses "${match[0]}" \u2014 only value, updated_at, source, actor, ord, SQL keywords and allowlisted functions`);
     }
   }
   if (consumed !== orderBy.length || orderBy.trim() === "") {
-    fail(`column "${column}" custom orderBy contains an unsupported character near "${orderBy.slice(consumed, consumed + 10)}"`);
+    fail2(`column "${column}" custom orderBy contains an unsupported character near "${orderBy.slice(consumed, consumed + 10)}"`);
   }
 }
 function stableJson(value) {
@@ -3131,17 +3182,17 @@ function buildCanonicalLink({
 }) {
   const ownerKind = relationKind(relation);
   const ownerName = relationName(relation);
-  const fail = (message) => {
+  const fail2 = (message) => {
     throw new OrmDefinitionError(`${ownerKind} "${ownerName}": link "${linkName}" ${message}`, relation.file);
   };
   if (link.enforce && link.linkKind !== "toOne") {
-    return fail("sets enforce: true, which is only supported on toOne links");
+    return fail2("sets enforce: true, which is only supported on toOne links");
   }
   if ((link.onDelete !== void 0 || link.onUpdate !== void 0) && !link.enforce) {
-    return fail("sets a referential action without enforce: true");
+    return fail2("sets a referential action without enforce: true");
   }
   if (link.linkKind === "toPlatformUser") {
-    if (link.target !== void 0) return fail("is toPlatformUser and must not declare a target table");
+    if (link.target !== void 0) return fail2("is toPlatformUser and must not declare a target table");
     return {
       name: linkName,
       kind: "toPlatformUser",
@@ -3152,7 +3203,7 @@ function buildCanonicalLink({
     };
   }
   if (typeof link.target === "object" && link.target?.kind === "seq-external-object") {
-    if (link.enforce) return fail("cannot enforce a cross-namespace physical foreign key; use an ORM link without enforce");
+    if (link.enforce) return fail2("cannot enforce a cross-namespace physical foreign key; use an ORM link without enforce");
     return {
       name: linkName,
       kind: link.linkKind,
@@ -3164,13 +3215,13 @@ function buildCanonicalLink({
       ...link.description !== void 0 ? { description: link.description } : {}
     };
   }
-  const target = resolveRelationRef({ ref: link.target, fail });
+  const target = resolveRelationRef({ ref: link.target, fail: fail2 });
   const targetName = relationName(target);
   if (!relationsByName.has(targetName)) {
-    return fail(`targets ${relationKind(target)} "${targetName}" which is not part of this namespace`);
+    return fail2(`targets ${relationKind(target)} "${targetName}" which is not part of this namespace`);
   }
   if (link.enforce && (!isSeqTable(relation) || !isSeqTable(target))) {
-    return fail("cannot enforce a PostgreSQL foreign key involving a view");
+    return fail2("cannot enforce a PostgreSQL foreign key involving a view");
   }
   const owningSide = link.linkKind === "toOne" ? relation : target;
   const referencedSide = link.linkKind === "toOne" ? target : relation;
@@ -3186,19 +3237,19 @@ function buildCanonicalLink({
     ...link.description !== void 0 ? { description: link.description } : {}
   };
 }
-function resolveRelationRef({ ref, fail }) {
-  if (ref === void 0) return fail("declares no target relation");
+function resolveRelationRef({ ref, fail: fail2 }) {
+  if (ref === void 0) return fail2("declares no target relation");
   if (typeof ref !== "function") return ref;
   let resolved;
   try {
     resolved = ref();
   } catch (error) {
-    return fail(
+    return fail2(
       `target thunk threw (${error instanceof Error ? error.message : String(error)}) \u2014 lazy refs resolve at serialize time; make sure the target module ran`
     );
   }
   if (!isSeqTable(resolved) && !isSeqView(resolved)) {
-    return fail("target thunk did not return a relation defined with defineTable/defineView");
+    return fail2("target thunk did not return a relation defined with defineTable/defineView");
   }
   return resolved;
 }
@@ -3301,9 +3352,9 @@ function extractOrmSyncedTableContract({
     );
   }
   const primaryKey2 = table.primaryKey;
-  if (primaryKey2 === void 0 || primaryKey2.length === 0) {
+  if (primaryKey2 === void 0) {
     throw new OrmDefinitionError(
-      `synced table "${table.table}" has no primary key \u2014 typed synced contracts require a primary key`
+      `synced table "${table.table}" has no primary key contract \u2014 declare a key or explicit primaryKey: []`
     );
   }
   const pkSet = new Set(primaryKey2);
@@ -4108,9 +4159,9 @@ function buildActionParamsSchema(action) {
   for (const [name2, param] of entries) {
     shape[name2] = param.optional ? PARAM_SCHEMAS[param.type].nullish() : PARAM_SCHEMAS[param.type];
   }
-  return z.strictObject(shape).superRefine((obj, ctx) => {
+  return z.strictObject(shape).superRefine((obj2, ctx) => {
     for (const [name2, param] of entries) {
-      if (!param.optional && param.type === "jsonb" && obj[name2] === void 0) {
+      if (!param.optional && param.type === "jsonb" && obj2[name2] === void 0) {
         ctx.addIssue({ code: "custom", message: "Required", path: [name2] });
       }
     }
@@ -4768,6 +4819,17 @@ function syncedViewStatements({
     const viewName = `${schema}.${quoteIdentifier(table.table)}`;
     const physical2 = splitPhysicalRelation(backing.physicalRelation);
     const physicalTarget = `${quoteIdentifier(physical2.schema)}.${quoteIdentifier(physical2.table)}`;
+    const declaredColumns = Object.keys(table.columns ?? {});
+    const projection = declaredColumns.length > 0 ? declaredColumns.map(quoteIdentifier).join(", ") : "*";
+    if (backing.selectColumns) {
+      if (declaredColumns.length === 0) {
+        throw new OrmDefinitionError(`synced backing for "${table.table}" requires declared columns`);
+      }
+      const approved = new Set(backing.selectColumns);
+      if (declaredColumns.some((column) => !approved.has(column))) {
+        throw new OrmDefinitionError(`synced backing for "${table.table}" projects outside its approved column ceiling`);
+      }
+    }
     const columnTypes = mergeSyncedViewColumnTypes({
       table,
       canonicalColumnTypes: columnTypesByTable?.get(table.table),
@@ -4776,23 +4838,26 @@ function syncedViewStatements({
     });
     const readPolicyIr = readPolicyIrByTable?.get(table.table);
     const readPolicy = table.policies?.read;
-    const whereClause = readPolicyIr ? ` WHERE ${compilePredIrToSql(readPolicyIr, {
+    const policyClause = readPolicyIr ? ` WHERE ${compilePredIrToSql(readPolicyIr, {
       namespace: definition.namespace,
       columnTypes,
       columnNames: columnNamesByTable?.get(table.table)
     })}` : readPolicy ? ` WHERE ${compilePredicate(readPolicy.ast, narrowToV1ColumnTypes(columnTypes))}` : " WHERE false";
     if (backingPrivileges === "grant") {
+      const selectPrivilege = backing.selectColumns ? `SELECT (${backing.selectColumns.map(quoteIdentifier).join(", ")})` : "SELECT";
+      const hasSelectPrivilege = backing.selectColumns ? backing.selectColumns.map((column) => `pg_catalog.has_column_privilege(${quoteLiteral(executionOwnerRole)}, ${quoteLiteral(physicalTarget)}, ${quoteLiteral(column)}, 'SELECT')`).join("\n    AND ") : `pg_catalog.has_table_privilege(${quoteLiteral(executionOwnerRole)}, ${quoteLiteral(physicalTarget)}, 'SELECT')`;
       statements.push(`GRANT USAGE ON SCHEMA ${quoteIdentifier(physical2.schema)} TO ${owner}`);
-      statements.push(`GRANT SELECT ON ${physicalTarget} TO ${owner}`);
+      statements.push(`GRANT ${selectPrivilege} ON ${physicalTarget} TO ${owner}`);
       statements.push(`DO ${quoteLiteral(`BEGIN
   IF NOT (pg_catalog.has_schema_privilege(${quoteLiteral(executionOwnerRole)}, ${quoteLiteral(physical2.schema)}, 'USAGE')
-    AND pg_catalog.has_table_privilege(${quoteLiteral(executionOwnerRole)}, ${quoteLiteral(physicalTarget)}, 'SELECT')) THEN
+    AND ${hasSelectPrivilege}) THEN
     RAISE EXCEPTION 'Synced backing owner lacks effective USAGE/SELECT; repair managed serving reader access before ORM apply' USING ERRCODE = '42501';
   END IF;
 END`)}`);
     }
+    const whereClause = backing.readGuard ? ` WHERE (SELECT orm_native_sources.require_read_guard(${quoteLiteral(backing.readGuard)})) AND (${policyClause.slice(" WHERE ".length)})` : policyClause;
     statements.push(
-      `CREATE OR REPLACE VIEW ${viewName} AS SELECT * FROM ${physicalTarget}${whereClause}`
+      `CREATE OR REPLACE VIEW ${viewName} AS SELECT ${projection} FROM ${physicalTarget}${whereClause}`
     );
     statements.push(`GRANT SELECT ON ${viewName} TO ${role}`);
   }
@@ -5063,10 +5128,142 @@ function snapshotTableNames(snapshot, schema) {
   return Object.values(tables).filter((entry) => entry.schema === schema).map((entry) => entry.name);
 }
 
+// src/sql/ast.ts
+function obj(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("unsupported SQL node");
+  return value;
+}
+function list(value) {
+  return value === void 0 ? [] : Array.isArray(value) ? value : fail("expected SQL list");
+}
+function str(value) {
+  return typeof value === "string" ? value : fail("expected SQL name");
+}
+function fail(message) {
+  throw new Error(message);
+}
+function strings(value) {
+  return list(value).map((v) => str(obj(obj(v).String).sval));
+}
+
+// src/canonical/view-query.ts
+var parser;
+var functions = new Set(VIEW_QUERY_FUNCTION_ALLOWLIST);
+var scalarTypes = /* @__PURE__ */ new Set([
+  "bool",
+  "boolean",
+  "int2",
+  "int4",
+  "int8",
+  "integer",
+  "bigint",
+  "smallint",
+  "numeric",
+  "decimal",
+  "float4",
+  "float8",
+  "real",
+  "text",
+  "varchar",
+  "bpchar",
+  "uuid",
+  "date",
+  "timestamp",
+  "timestamptz",
+  "time",
+  "timetz",
+  "interval",
+  "json",
+  "jsonb",
+  "bytea"
+]);
+var sqlValues = /* @__PURE__ */ new Set([
+  "SVFOP_CURRENT_DATE",
+  "SVFOP_CURRENT_TIME",
+  "SVFOP_CURRENT_TIME_N",
+  "SVFOP_CURRENT_TIMESTAMP",
+  "SVFOP_CURRENT_TIMESTAMP_N",
+  "SVFOP_LOCALTIME",
+  "SVFOP_LOCALTIME_N",
+  "SVFOP_LOCALTIMESTAMP",
+  "SVFOP_LOCALTIMESTAMP_N",
+  "SVFOP_CURRENT_ROLE",
+  "SVFOP_CURRENT_USER",
+  "SVFOP_USER",
+  "SVFOP_SESSION_USER",
+  "SVFOP_CURRENT_CATALOG",
+  "SVFOP_CURRENT_SCHEMA"
+]);
+async function validateManagedViewQueries({ canonical }) {
+  for (const definition of [canonical, ...canonical.imports ?? []]) {
+    for (const view of definition.views ?? []) {
+      const fail2 = (message) => {
+        throw new OrmDefinitionError(`managed view '${definition.namespace}/${view.view}': ${message}`);
+      };
+      parser ??= new PgParser({ version: 17 });
+      const parsed = await parser.parse(view.query);
+      if (parsed.error || !parsed.tree) fail2("invalid SELECT query");
+      const statements = list(obj(parsed.tree).stmts);
+      if (statements.length !== 1 || !obj(obj(statements[0]).stmt).SelectStmt) fail2("one SELECT query is required");
+      validateTree({ tree: parsed.tree, schema: ormSchemaName(definition.namespace), enums: definition.enums.map((entry) => entry.name), fail: fail2 });
+    }
+  }
+}
+function pgCatalogName(parts) {
+  if (parts.length === 1) return parts[0];
+  if (parts.length === 2 && parts[0] === "pg_catalog") return parts[1];
+  return void 0;
+}
+function reviewedFunctionName({ parts, format }) {
+  return format === "COERCE_SQL_SYNTAX" && parts.length === 2 && parts[0] === "pg_catalog" && parts[1] === "position" ? "strpos" : pgCatalogName(parts);
+}
+function validateTree({ tree, ...scope }) {
+  const pending = [tree];
+  while (pending.length) {
+    const value = pending.pop();
+    if (Array.isArray(value)) {
+      pending.push(...value);
+      continue;
+    }
+    if (!value || typeof value !== "object") continue;
+    const node = obj(value);
+    for (const [kind, child] of Object.entries(node)) {
+      validateNode({ kind, child, scope });
+      pending.push(child);
+    }
+  }
+}
+function validateNode({ kind, child, scope }) {
+  const { fail: fail2 } = scope;
+  if (kind.endsWith("Stmt") && kind !== "SelectStmt") fail2("only SELECT statements are permitted");
+  if (kind === "FuncCall") {
+    const call = obj(child);
+    const parts = strings(call.funcname);
+    const name2 = reviewedFunctionName({ parts, format: call.funcformat });
+    if (!name2 || !functions.has(name2)) fail2(`only explicitly allowlisted pg_catalog functions are permitted (found '${parts.join(".")}')`);
+  }
+  if (kind === "typeName" || kind === "TypeName") validateType({ node: obj(child), ...scope });
+  if (kind === "A_Expr" && pgCatalogName(strings(obj(child).name)) === void 0) fail2("only pg_catalog operators are permitted");
+  if (kind === "SortBy" && list(obj(child).useOp).length && pgCatalogName(strings(obj(child).useOp)) === void 0) fail2("only pg_catalog sort operators are permitted");
+  if (kind === "SQLValueFunction" && !sqlValues.has(String(obj(child).op))) fail2("unsupported SQL value expression");
+  if (kind === "ParamRef") fail2("view queries cannot contain parameters");
+  if (kind === "A_Indirection" && list(obj(child).indirection).some((entry) => !obj(entry).A_Indices)) {
+    fail2("composite field notation is not permitted in managed views");
+  }
+}
+function validateType({ node, schema, enums, fail: fail2 }) {
+  const parts = strings(node.names);
+  const builtin = pgCatalogName(parts);
+  const managedEnum = parts.length === 1 && enums.includes(parts[0]) || parts.length === 2 && parts[0] === schema && enums.includes(parts[1]);
+  if (node.setof || node.pct_type || !managedEnum && (!builtin || !scalarTypes.has(builtin))) {
+    fail2(`casts may only use supported pg_catalog scalar types or declared enums (found '${parts.join(".")}')`);
+  }
+}
+
 // src/engine/materialized-refresh.ts
 function materializedRefreshFunctions(canonical) {
   const schema = ormSchemaName(canonical.namespace);
-  const functions = /* @__PURE__ */ new Map();
+  const functions2 = /* @__PURE__ */ new Map();
   for (const view of canonical.views ?? []) {
     const materialized = view.resolved?.materialized;
     if (!materialized) continue;
@@ -5075,7 +5272,7 @@ function materializedRefreshFunctions(canonical) {
     if (!table || pk.length === 0) {
       throw new OrmDefinitionError(`materialized resolved table '${view.view}' needs its table and primary key`);
     }
-    functions.set(view.view, refreshFunctionSql({
+    functions2.set(view.view, refreshFunctionSql({
       schema,
       name: view.view,
       table: materialized.table,
@@ -5084,13 +5281,13 @@ function materializedRefreshFunctions(canonical) {
       pk
     }));
   }
-  return functions;
+  return functions2;
 }
 function refreshFunctionSql({ schema, name: name2, table, compute, columns, pk }) {
   const fn = `${quoteIdentifier(schema)}.${quoteIdentifier(materializedRefreshFunctionName(name2))}`;
   const target = `${quoteIdentifier(schema)}.${quoteIdentifier(table)}`;
   const source = `${quoteIdentifier(schema)}.${quoteIdentifier(compute)}`;
-  const list = columns.map(quoteIdentifier).join(", ");
+  const list2 = columns.map(quoteIdentifier).join(", ");
   const others = columns.filter((column) => !pk.includes(column));
   const keys = pk.map(quoteIdentifier).join(", ");
   const matches = pk.map((column) => `c.${quoteIdentifier(column)} = m.${quoteIdentifier(column)}`).join(" AND ");
@@ -5116,8 +5313,8 @@ BEGIN
   PERFORM set_config('request.jwt.claims', ${quoteLiteral(MATERIALIZE_CLAIMS_JSON)}, true);
   RETURN QUERY
     WITH up AS (
-      INSERT INTO ${target} AS m (${list})
-      SELECT ${list} FROM ${source}
+      INSERT INTO ${target} AS m (${list2})
+      SELECT ${list2} FROM ${source}
       ON CONFLICT (${keys}) ${onConflict}
       RETURNING 1
     ), gone AS (
@@ -5728,6 +5925,7 @@ async function planWithViewRecreation({
   previousSnapshot,
   viewRecreation
 }) {
+  await validateManagedViewQueries({ canonical });
   const schema = ormSchemaName(canonical.namespace);
   const previous = previousSnapshot ? normalizeSnapshot(previousSnapshot) : emptySnapshot(canonical.namespace);
   assertValidViewDependencies(canonical);
@@ -6426,7 +6624,7 @@ var limitIrSchema = z.object({
   variable: z.string().optional(),
   value: z.number().int().positive().optional(),
   default: z.number().int().positive(),
-  max: z.number().int().positive()
+  max: z.number().int().positive().max(MAX_PERSISTED_READ_ROWS)
 });
 var selectionIrSchema = z.lazy(
   () => z.object({
@@ -8042,6 +8240,6 @@ function resumeArguments({
   return [literal2.sql];
 }
 
-export { ACTION_REQUIRES_DENIED_SQLSTATE, ACTION_VALIDATES_FAILED_SQLSTATE, AUDIT_ACTIONS, CANONICAL_FORMAT, CAPABILITIES_CLAIM_KEY, CAPABILITY_KEY_PATTERN, CELLS_FIELD, CELL_PARTS, CELL_PART_SUFFIX, CLAIMS_CONTRACT, CLAIMS_SETTING, CLAIM_KEY_PATTERN, CMP_OPS, COLUMN_BRAND, COLUMN_DEFAULT_FNS, COLUMN_IDENTIFIER_PATTERN, COLUMN_TYPES2 as COLUMN_TYPES, COMPARE_OPS, COMPOSED_IR_VERSION, CONSUMER_ROLE_SUFFIX, ColumnBuilder, DATE_BUCKETS, DEFINITION_FILE_EXTENSIONS, ENUM_BRAND, EXTERNAL_POLICY_CLAIM_KEYS, GUARDED_IR_VERSION, HASH_DOMAIN, IDENTIFIER_PATTERN, IDENTIFIER_RE, IMPORT_CONFLICT_MODES, INPUT_REF_KINDS, IR_VERSION, IrVersionError, LEGACY_IR_VERSION, LINK_BRAND, MATERIALIZE_ACTOR, MATERIALIZE_CLAIMS_JSON, MAX_DEFINITION_FILE_BYTES, MAX_GENERATED_SDL_BYTES, MAX_IDENTIFIER_LENGTH, MAX_TRACKED_COLUMN_NAME, MIGRATIONS_DIRNAME, NAMESPACE_CONFIG_BRAND, NAMESPACE_CONFIG_FILE, NAMESPACE_CONFIG_FILENAMES, NAMESPACE_PATTERN, ORM_DATA_TOKEN_HEADER, ORM_MIGRATION_EXPORT_FILE, ORM_MIGRATION_EXPORT_MAX_BYTES, ORM_REGISTRATION_MAX_BYTES, ORM_SCHEMA_PREFIX, ORM_SERVICE_DATA_TOKEN_HEADER, ORM_TO_PIPELINE_TYPE, OrmDefinitionError, PredicateParseError, QUALIFIED_TABLE_PATTERN, RESERVED_COLUMN_NAMES, RESERVED_TABLE_NAMES, ROLES_CLAIM_KEY, RUNTIME_SQL_IR_VERSION, SCHEMA_DIR, SQL_IR_VERSION, STATEMENT_KINDS, SYNCED_CONTRACT_HASH_DOMAIN, SYNCED_SOURCE_PATTERN, SYNCED_VIEW_EXECUTION_OWNER_ROLE, TABLE_BRAND, VIEW_BRAND, actionFunctionName, actionFunctionStatements, actionParamArg, actionParamOrder, actionParamSchema, actionPrepareChecks, actionSchema, actionWriteTargets, actionsInterfaceName, activeAuthoringContext, applyMigrationHints, applyMigrationHintsV2, beginAuthoringContext, buildActionParamsSchema, buildDrizzleEntities, buildDrizzleEntitiesV2, buildNamespaceDefinition, buildRebaseJournalEntry, canonicalActionSchema, canonicalColumnSchema, canonicalDefinitionSchema, canonicalEnumSchema, canonicalIndexSchema, canonicalLinkSchema, canonicalPoliciesSchema, canonicalRelations, canonicalTableSchema, canonicalViewSchema, canonicalizeDefinition, capabilityExpression, castParts, cellColumnName, checksumOf, claimExpression, classifyDestructive, columnSchema, columnTypeSchema2 as columnTypeSchema, compileActionRequires, compileActionStatements, compileNamespace, compilePredIrToSql, compilePredicate, compiledArtifactSchema, compiledOperationSchema, computeCanonicalHash, computeDefinitionHash, computeSyncedContractHash, consumerRoleName, convertV1DefinitionToCanonical, createOrmMigrationExport, custom, declaredCapabilityKeys, defineEnum, defineNamespace, defineOperation, defineResolvedTable, defineSyncedTable, defineTable, defineView, deriveColumnName, diffCommand, diffStatements, emptyJournal, emptySnapshot, endAuthoringContext, etlSource, extractNamedParams, extractOrmSyncedTableContract, generateNamespaceTypes, generateSnapshot, generateSnapshotV2, highest, identifierSchema, importSpecSchema, indexByHash, isColumnBuilder, isEnumRef, isExternalPolicyClaimKey, isFunctionDefault, isOwnedStatement, isOwnedStatementV2, isQualifiedReference, isSeqLink, isSeqNamespaceConfig, isSeqTable, isSeqView, latest, limitIrSchema, loadCommittedMigrations, loadCommittedTipMigration, loadNamespaceDefinition, loadNamespaceFromDir, lowest, managedFn, manualSource, materializeLockKey, materializedRefreshFunctionName, migrationName, namespaceConfigSchema, namespaceSchema, nonNullFirst, normalizeCanonical, normalizeIr, normalizeSnapshot, objectRef, ontologyContractSchema, orderIrSchema, ormMigrationExportSchema, ormSchemaName, overlayWinsUnion, overrideRowMutation, parseCanonicalDefinition, parseDefinitionSources, parseOrmMigrationExport, parsePredicate, parseTableFile, parsedPredicateSchema, pendingKitStatements, pendingKitStatementsV2, planCommittedMigrationV2, planMigration, planMigrationV2, planTableImport, policyExpressionSchema, policyVariantSchema, predIrSchema, predicateOperands, prefetchPlanIrSchema, prefetchSource, priority, quoteIdentifier, quoteLiteral, readMigrationSql, readMigrationWorkspace, readOntologyContract, readSnapshot, rebaseViolations, referencedCapabilities, referencedColumns, renderMigrationSql, renderOrmMigrationExport, requiredArtifactIrVersion, resolvedMetaIrSchema, resolvedSourceIrSchema, revertOverlayMutation, rewriteSyncedSourceRelationsInViewQuery, roleExpression, rootIrSchema, securityStatements, selectionIrSchema, serializeNamespace, sqlTypeName, stableJson, syncedBackingRevokeStatements, syncedContractSurface, syncedTables, syncedViewDropStatements, syncedViewStatements, t, tableFileSchema, tableMetaIrSchema, tableReferenceSchema, toMany, toOne, toPlatformUser, typesInterfaceName, validateNamespaceCatalog, validateViewCatalogStatement, valueIrSchema, variableDefaultIrSchema, variableIrSchema, verifyRebaseIsNoop, walkPredicate, writeMigration };
+export { ACTION_REQUIRES_DENIED_SQLSTATE, ACTION_VALIDATES_FAILED_SQLSTATE, AUDIT_ACTIONS, CANONICAL_FORMAT, CAPABILITIES_CLAIM_KEY, CAPABILITY_KEY_PATTERN, CELLS_FIELD, CELL_PARTS, CELL_PART_SUFFIX, CLAIMS_CONTRACT, CLAIMS_SETTING, CLAIM_KEY_PATTERN, CMP_OPS, COLUMN_BRAND, COLUMN_DEFAULT_FNS, COLUMN_IDENTIFIER_PATTERN, COLUMN_TYPES2 as COLUMN_TYPES, COMPARE_OPS, COMPOSED_IR_VERSION, CONSUMER_ROLE_SUFFIX, ColumnBuilder, DATE_BUCKETS, DEFINITION_FILE_EXTENSIONS, ENUM_BRAND, EXTERNAL_POLICY_CLAIM_KEYS, GUARDED_IR_VERSION, HASH_DOMAIN, IDENTIFIER_PATTERN, IDENTIFIER_RE, IMPORT_CONFLICT_MODES, INPUT_REF_KINDS, IR_VERSION, IrVersionError, LEGACY_IR_VERSION, LINK_BRAND, MATERIALIZE_ACTOR, MATERIALIZE_CLAIMS_JSON, MAX_DEFINITION_FILE_BYTES, MAX_GENERATED_SDL_BYTES, MAX_IDENTIFIER_LENGTH, MAX_PERSISTED_READ_ROWS, MAX_TRACKED_COLUMN_NAME, MIGRATIONS_DIRNAME, NAMESPACE_CONFIG_BRAND, NAMESPACE_CONFIG_FILE, NAMESPACE_CONFIG_FILENAMES, NAMESPACE_PATTERN, ORM_DATA_TOKEN_HEADER, ORM_MIGRATION_EXPORT_FILE, ORM_MIGRATION_EXPORT_MAX_BYTES, ORM_REGISTRATION_MAX_BYTES, ORM_SCHEMA_PREFIX, ORM_SERVICE_DATA_TOKEN_HEADER, ORM_TO_PIPELINE_TYPE, OrmDefinitionError, PredicateParseError, QUALIFIED_TABLE_PATTERN, RESERVED_COLUMN_NAMES, RESERVED_TABLE_NAMES, ROLES_CLAIM_KEY, RUNTIME_SQL_IR_VERSION, SCHEMA_DIR, SQL_IR_VERSION, STATEMENT_KINDS, SYNCED_CONTRACT_HASH_DOMAIN, SYNCED_SOURCE_PATTERN, SYNCED_VIEW_EXECUTION_OWNER_ROLE, TABLE_BRAND, VIEW_BRAND, actionFunctionName, actionFunctionStatements, actionParamArg, actionParamOrder, actionParamSchema, actionPrepareChecks, actionSchema, actionWriteTargets, actionsInterfaceName, activeAuthoringContext, applyMigrationHints, applyMigrationHintsV2, beginAuthoringContext, buildActionParamsSchema, buildDrizzleEntities, buildDrizzleEntitiesV2, buildNamespaceDefinition, buildRebaseJournalEntry, canonicalActionSchema, canonicalColumnSchema, canonicalDefinitionSchema, canonicalEnumSchema, canonicalIndexSchema, canonicalLinkSchema, canonicalPoliciesSchema, canonicalRelations, canonicalTableSchema, canonicalViewSchema, canonicalizeDefinition, capabilityExpression, castParts, cellColumnName, checksumOf, claimExpression, classifyDestructive, columnSchema, columnTypeSchema2 as columnTypeSchema, compileActionRequires, compileActionStatements, compileNamespace, compilePredIrToSql, compilePredicate, compiledArtifactSchema, compiledOperationSchema, computeCanonicalHash, computeDefinitionHash, computeSyncedContractHash, consumerRoleName, convertV1DefinitionToCanonical, createOrmMigrationExport, custom, declaredCapabilityKeys, defineEnum, defineNamespace, defineOperation, defineResolvedTable, defineSyncedTable, defineTable, defineView, deriveColumnName, diffCommand, diffStatements, emptyJournal, emptySnapshot, endAuthoringContext, etlSource, extractNamedParams, extractOrmSyncedTableContract, generateNamespaceTypes, generateSnapshot, generateSnapshotV2, highest, identifierSchema, importSpecSchema, indexByHash, isColumnBuilder, isEnumRef, isExternalPolicyClaimKey, isFunctionDefault, isOwnedStatement, isOwnedStatementV2, isQualifiedReference, isSeqLink, isSeqNamespaceConfig, isSeqTable, isSeqView, latest, limitIrSchema, loadCommittedMigrations, loadCommittedTipMigration, loadNamespaceDefinition, loadNamespaceFromDir, lowest, managedFn, manualSource, materializeLockKey, materializedRefreshFunctionName, migrationName, namespaceConfigSchema, namespaceSchema, nonNullFirst, normalizeCanonical, normalizeIr, normalizeSnapshot, objectRef, ontologyContractSchema, orderIrSchema, ormMigrationExportSchema, ormSchemaName, overlayWinsUnion, overrideRowMutation, parseCanonicalDefinition, parseDefinitionSources, parseOrmMigrationExport, parsePredicate, parseTableFile, parsedPredicateSchema, pendingKitStatements, pendingKitStatementsV2, planCommittedMigrationV2, planMigration, planMigrationV2, planTableImport, policyExpressionSchema, policyVariantSchema, predIrSchema, predicateOperands, prefetchPlanIrSchema, prefetchSource, priority, quoteIdentifier, quoteLiteral, readMigrationSql, readMigrationWorkspace, readOntologyContract, readSnapshot, rebaseViolations, referencedCapabilities, referencedColumns, renderMigrationSql, renderOrmMigrationExport, requiredArtifactIrVersion, resolvedMetaIrSchema, resolvedSourceIrSchema, revertOverlayMutation, rewriteSyncedSourceRelationsInViewQuery, roleExpression, rootIrSchema, securityStatements, selectionIrSchema, serializeNamespace, sqlTypeName, stableJson, syncedBackingRevokeStatements, syncedContractSurface, syncedTables, syncedViewDropStatements, syncedViewStatements, t, tableFileSchema, tableMetaIrSchema, tableReferenceSchema, toMany, toOne, toPlatformUser, typesInterfaceName, validateNamespaceCatalog, validateViewCatalogStatement, valueIrSchema, variableDefaultIrSchema, variableIrSchema, verifyRebaseIsNoop, walkPredicate, writeMigration };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map