@sequenceholdings/orm 2.4.0 → 2.5.0

package/dist/compiler.d.cts

@@ -5,8 +5,8 @@ export { DynamicInputIssue, DynamicInputResult, NormalizedBoolExp, NormalizedOnC
 export { CompilePolicyInput, CompilePredicateInput, POLICY_COMPARE_OPS, POLICY_MAX_LINK_DEPTH, ParsedPolicy, PolicyAccess, PolicyColumnInfo, PolicyCompareOp, PolicyCompileError, PolicyCompileErrorCode, PolicyLinkInfo, PolicyNode, PolicyOperand, PolicyParseError, PolicyResolver, PolicyTableInfo, assertClaimsOnlyWhen, compilePolicy, compilePredicateV2, parsePolicy, walkPolicy } from './predicate-v2.cjs';
 import { z } from 'zod';
 export { P as PLATFORM_USER_TYPENAME, c as camelCase, g as enumTypeName, p as pascalCase } from './naming-CU9ThP_E.cjs';
-export { S as SqlOperationDefinition, d as defineOperation, s as sqlOperationDefinitionSchema } from './definition-DjfC7Lll.cjs';
-import './constants-C6EG6Wq7.cjs';
+export { S as SqlOperationDefinition, d as defineOperation, s as sqlOperationDefinitionSchema } from './definition-B99BsOAO.cjs';
+import './constants-Dou1RkTo.cjs';
 import './policy-1iZbGnZZ.cjs';
 
 type DiagnosticSeverity = 'error' | 'warning';
@@ -318,6 +318,8 @@ interface RestrictedOperation {
     name: string;
     kind: 'query' | 'mutation';
     requires: CompiledOperation['requires'];
+    /** Literal namespace-author ceiling; never taken from execution variables. */
+    readBudget?: number;
     variables: VariableIr[];
     definition: OperationDefinitionNode;
 }
@@ -339,6 +341,7 @@ declare const MAX_LIMIT = 1000;
 declare class OperationLowerer {
     private readonly ctx;
     private readonly variables;
+    private readonly maxRows;
     constructor(ctx: CompileContext, restricted: RestrictedOperation);
     private meta;
     /** A data column — cell-metadata columns are reachable only through `cells { … }`. */
@@ -495,4 +498,14 @@ declare const DATASET_PREVIEW_LIMIT = 100;
  */
 declare function compileDatasetPreviews(input: CanonicalDefinition): Record<string, CompiledOperation>;
 
-export { type BuildContextResult, COMPILER_MAJOR, CONST_TRUE, type ClientManifest, type ClientManifestOperation, type CompileContext, type CompileNamespaceInput, type CompileNamespaceResult, type CompilerDiagnostic, DATASET_PREVIEW_LIMIT, DEFAULT_LIMIT, type DiagnosticSeverity, DocumentCompileError, MAX_LIMIT, type MutationOp, type MutationRootInfo, NamespaceCompileError, OperationLowerer, PLATFORM_USER_TABLE, type ParseDocumentsResult, type ParsedDocument, type PinnedColumn, type QueryRootInfo, type RestrictedOperation, type SourceDocument, type SqlQueryInput, andPred, buildCompileContext, canonicalOperationText, classifyInputType, collectPinnedColumns, compileDatasetPreviews, compileNamespace, compileNamespaceOrThrow, compileOperationDocuments, compileRuntimeSql, computeOpHash, computeOpsHash, computePinnedColumnsByTable, computeSchemaHash, flattenOperation, injectPolicies, inputTypeName, isSqlOperationDocument, lowerOperation, mutationRootNames, parseDocuments, parseSdl, platformUserMeta, predContains, predContainsExists, queryRootNames, restrictOperation, sqlQueryInputSchema, typeNameForTable, walkPred };
+/**
+ * PostgreSQL omits pinned builtins from pg_depend, so catalog checks cannot
+ * enforce the function boundary alone. Parse every expression before either
+ * admission or DDL, including nested queries and aggregate/window clauses.
+ * Catalog validation remains responsible for resolved functions/operators.
+ */
+declare function validateManagedViewQueries({ canonical }: {
+    canonical: CanonicalDefinition;
+}): Promise<void>;
+
+export { type BuildContextResult, COMPILER_MAJOR, CONST_TRUE, type ClientManifest, type ClientManifestOperation, type CompileContext, type CompileNamespaceInput, type CompileNamespaceResult, type CompilerDiagnostic, DATASET_PREVIEW_LIMIT, DEFAULT_LIMIT, type DiagnosticSeverity, DocumentCompileError, MAX_LIMIT, type MutationOp, type MutationRootInfo, NamespaceCompileError, OperationLowerer, PLATFORM_USER_TABLE, type ParseDocumentsResult, type ParsedDocument, type PinnedColumn, type QueryRootInfo, type RestrictedOperation, type SourceDocument, type SqlQueryInput, andPred, buildCompileContext, canonicalOperationText, classifyInputType, collectPinnedColumns, compileDatasetPreviews, compileNamespace, compileNamespaceOrThrow, compileOperationDocuments, compileRuntimeSql, computeOpHash, computeOpsHash, computePinnedColumnsByTable, computeSchemaHash, flattenOperation, injectPolicies, inputTypeName, isSqlOperationDocument, lowerOperation, mutationRootNames, parseDocuments, parseSdl, platformUserMeta, predContains, predContainsExists, queryRootNames, restrictOperation, sqlQueryInputSchema, typeNameForTable, validateManagedViewQueries, walkPred };

package/dist/compiler.d.ts

@@ -5,8 +5,8 @@ export { DynamicInputIssue, DynamicInputResult, NormalizedBoolExp, NormalizedOnC
 export { CompilePolicyInput, CompilePredicateInput, POLICY_COMPARE_OPS, POLICY_MAX_LINK_DEPTH, ParsedPolicy, PolicyAccess, PolicyColumnInfo, PolicyCompareOp, PolicyCompileError, PolicyCompileErrorCode, PolicyLinkInfo, PolicyNode, PolicyOperand, PolicyParseError, PolicyResolver, PolicyTableInfo, assertClaimsOnlyWhen, compilePolicy, compilePredicateV2, parsePolicy, walkPolicy } from './predicate-v2.js';
 import { z } from 'zod';
 export { P as PLATFORM_USER_TYPENAME, c as camelCase, g as enumTypeName, p as pascalCase } from './naming-CPfx7EfF.js';
-export { S as SqlOperationDefinition, d as defineOperation, s as sqlOperationDefinitionSchema } from './definition-DjfC7Lll.js';
-import './constants-C6EG6Wq7.js';
+export { S as SqlOperationDefinition, d as defineOperation, s as sqlOperationDefinitionSchema } from './definition-B99BsOAO.js';
+import './constants-Dou1RkTo.js';
 import './policy-1iZbGnZZ.js';
 
 type DiagnosticSeverity = 'error' | 'warning';
@@ -318,6 +318,8 @@ interface RestrictedOperation {
     name: string;
     kind: 'query' | 'mutation';
     requires: CompiledOperation['requires'];
+    /** Literal namespace-author ceiling; never taken from execution variables. */
+    readBudget?: number;
     variables: VariableIr[];
     definition: OperationDefinitionNode;
 }
@@ -339,6 +341,7 @@ declare const MAX_LIMIT = 1000;
 declare class OperationLowerer {
     private readonly ctx;
     private readonly variables;
+    private readonly maxRows;
     constructor(ctx: CompileContext, restricted: RestrictedOperation);
     private meta;
     /** A data column — cell-metadata columns are reachable only through `cells { … }`. */
@@ -495,4 +498,14 @@ declare const DATASET_PREVIEW_LIMIT = 100;
  */
 declare function compileDatasetPreviews(input: CanonicalDefinition): Record<string, CompiledOperation>;
 
-export { type BuildContextResult, COMPILER_MAJOR, CONST_TRUE, type ClientManifest, type ClientManifestOperation, type CompileContext, type CompileNamespaceInput, type CompileNamespaceResult, type CompilerDiagnostic, DATASET_PREVIEW_LIMIT, DEFAULT_LIMIT, type DiagnosticSeverity, DocumentCompileError, MAX_LIMIT, type MutationOp, type MutationRootInfo, NamespaceCompileError, OperationLowerer, PLATFORM_USER_TABLE, type ParseDocumentsResult, type ParsedDocument, type PinnedColumn, type QueryRootInfo, type RestrictedOperation, type SourceDocument, type SqlQueryInput, andPred, buildCompileContext, canonicalOperationText, classifyInputType, collectPinnedColumns, compileDatasetPreviews, compileNamespace, compileNamespaceOrThrow, compileOperationDocuments, compileRuntimeSql, computeOpHash, computeOpsHash, computePinnedColumnsByTable, computeSchemaHash, flattenOperation, injectPolicies, inputTypeName, isSqlOperationDocument, lowerOperation, mutationRootNames, parseDocuments, parseSdl, platformUserMeta, predContains, predContainsExists, queryRootNames, restrictOperation, sqlQueryInputSchema, typeNameForTable, walkPred };
+/**
+ * PostgreSQL omits pinned builtins from pg_depend, so catalog checks cannot
+ * enforce the function boundary alone. Parse every expression before either
+ * admission or DDL, including nested queries and aggregate/window clauses.
+ * Catalog validation remains responsible for resolved functions/operators.
+ */
+declare function validateManagedViewQueries({ canonical }: {
+    canonical: CanonicalDefinition;
+}): Promise<void>;
+
+export { type BuildContextResult, COMPILER_MAJOR, CONST_TRUE, type ClientManifest, type ClientManifestOperation, type CompileContext, type CompileNamespaceInput, type CompileNamespaceResult, type CompilerDiagnostic, DATASET_PREVIEW_LIMIT, DEFAULT_LIMIT, type DiagnosticSeverity, DocumentCompileError, MAX_LIMIT, type MutationOp, type MutationRootInfo, NamespaceCompileError, OperationLowerer, PLATFORM_USER_TABLE, type ParseDocumentsResult, type ParsedDocument, type PinnedColumn, type QueryRootInfo, type RestrictedOperation, type SourceDocument, type SqlQueryInput, andPred, buildCompileContext, canonicalOperationText, classifyInputType, collectPinnedColumns, compileDatasetPreviews, compileNamespace, compileNamespaceOrThrow, compileOperationDocuments, compileRuntimeSql, computeOpHash, computeOpsHash, computePinnedColumnsByTable, computeSchemaHash, flattenOperation, injectPolicies, inputTypeName, isSqlOperationDocument, lowerOperation, mutationRootNames, parseDocuments, parseSdl, platformUserMeta, predContains, predContainsExists, queryRootNames, restrictOperation, sqlQueryInputSchema, typeNameForTable, validateManagedViewQueries, walkPred };

package/dist/compiler.js

@@ -6,12 +6,17 @@ import { PgParser } from '@supabase/pg-parser';
 // src/compiler-gql/artifact.ts
 
 // src/constants.ts
+var NAMESPACE_PATTERN = /^(?!(?:events|native_sources)$)[a-z][a-z0-9_]{0,40}$/;
 var COLUMN_IDENTIFIER_PATTERN = /^_?[a-z][a-z0-9_]*$/;
 var MAX_IDENTIFIER_LENGTH = 63;
 var CAPABILITY_KEY_PATTERN = /^(?:org\/|app\/[a-z][a-z0-9-]{0,63}\/)?[a-z0-9-]{1,64}$/;
+var MAX_PERSISTED_READ_ROWS = 50001;
 var QUALIFIED_TABLE_PATTERN = /^[a-z][a-z0-9_]{0,62}\.[a-z][a-z0-9_]{0,62}$/;
 var ORM_SCHEMA_PREFIX = "orm_";
-var ormSchemaName = (namespace) => `${ORM_SCHEMA_PREFIX}${namespace}`;
+var ormSchemaName = (namespace) => {
+  if (!NAMESPACE_PATTERN.test(namespace)) throw new Error(`invalid or reserved ORM namespace '${namespace}'`);
+  return `${ORM_SCHEMA_PREFIX}${namespace}`;
+};
 var CELL_PARTS = ["at", "by", "rev", "source", "conflicts"];
 var CELL_PART_SUFFIX = {
   at: "__at",
@@ -387,6 +392,7 @@ function validateResolvedView({ view, tables, views = [] }) {
 function validateSource({ scope, source, table }) {
   const { fail: fail4 } = scope;
   if (source.kind === "etl" && table.source === void 0) fail4(`etl source '${source.name}' must reference a synced table`);
+  if (source.kind === "etl" && table.primaryKey?.length === 0) fail4(`etl source '${source.name}' cannot use an unkeyed synced table for resolved row identity`);
   if (source.kind !== "etl" && (table.internal !== true || table.cellMetadata !== true)) {
     fail4(`${source.kind} source '${source.name}' must reference an internal table with cell metadata`);
   }
@@ -618,6 +624,163 @@ function isSingleViewQuerySql(value) {
   }
   return state === "normal" && !/\$[a-z_0-9]*\$/i.test(query);
 }
+var VIEW_QUERY_FUNCTION_ALLOWLIST = [
+  "abs",
+  "age",
+  "array_agg",
+  "array_append",
+  "array_cat",
+  "array_dims",
+  "array_length",
+  "array_lower",
+  "array_ndims",
+  "array_position",
+  "array_positions",
+  "array_prepend",
+  "array_remove",
+  "array_replace",
+  "array_to_string",
+  "array_trim",
+  "array_upper",
+  "ascii",
+  "avg",
+  "bit_and",
+  "bit_or",
+  "bit_xor",
+  "bool_and",
+  "bool_or",
+  "btrim",
+  "cardinality",
+  "cbrt",
+  "ceil",
+  "ceiling",
+  "char_length",
+  "character_length",
+  "chr",
+  "concat",
+  "concat_ws",
+  "count",
+  "cume_dist",
+  "date_bin",
+  "date_part",
+  "date_trunc",
+  "decode",
+  "degrees",
+  "dense_rank",
+  "encode",
+  "enum_first",
+  "enum_last",
+  "enum_range",
+  "every",
+  "exp",
+  "first_value",
+  "floor",
+  "format",
+  "grouping",
+  "initcap",
+  "json_agg",
+  "json_array_length",
+  "json_build_array",
+  "json_build_object",
+  "json_extract_path",
+  "json_extract_path_text",
+  "json_object_agg",
+  "json_object_keys",
+  "json_strip_nulls",
+  "json_typeof",
+  "jsonb_agg",
+  "jsonb_array_length",
+  "jsonb_build_array",
+  "jsonb_build_object",
+  "jsonb_extract_path",
+  "jsonb_extract_path_text",
+  "jsonb_insert",
+  "jsonb_object_agg",
+  "jsonb_object_keys",
+  "jsonb_path_exists",
+  "jsonb_path_match",
+  "jsonb_path_query",
+  "jsonb_path_query_array",
+  "jsonb_path_query_first",
+  "jsonb_pretty",
+  "jsonb_set",
+  "jsonb_set_lax",
+  "jsonb_strip_nulls",
+  "jsonb_typeof",
+  "justify_days",
+  "justify_hours",
+  "justify_interval",
+  "lag",
+  "last_value",
+  "lead",
+  "left",
+  "length",
+  "ln",
+  "log",
+  "lower",
+  "lpad",
+  "ltrim",
+  "make_date",
+  "make_interval",
+  "make_time",
+  "make_timestamp",
+  "make_timestamptz",
+  "max",
+  "md5",
+  "min",
+  "mod",
+  "nth_value",
+  "ntile",
+  "octet_length",
+  "percent_rank",
+  "pi",
+  "power",
+  "quote_ident",
+  "quote_literal",
+  "quote_nullable",
+  "radians",
+  "rank",
+  "regexp_count",
+  "regexp_instr",
+  "regexp_like",
+  "regexp_match",
+  "regexp_matches",
+  "regexp_replace",
+  "regexp_split_to_array",
+  "regexp_split_to_table",
+  "repeat",
+  "replace",
+  "reverse",
+  "right",
+  "round",
+  "row_number",
+  "rpad",
+  "rtrim",
+  "sign",
+  "split_part",
+  "sqrt",
+  "starts_with",
+  "string_agg",
+  "string_to_array",
+  "strpos",
+  "substr",
+  "substring",
+  "sum",
+  "timezone",
+  "to_ascii",
+  "to_char",
+  "to_date",
+  "to_hex",
+  "to_json",
+  "to_jsonb",
+  "to_number",
+  "to_timestamp",
+  "translate",
+  "trunc",
+  "unnest",
+  "upper",
+  "width_bucket"
+];
 var canonicalActionSchema = z.object({
   name: identifier2,
   requires: z.string().max(1e3).optional(),
@@ -678,7 +841,7 @@ var canonicalTableSchema = z.object({
   /** Synced/reflected read-only tables (`source: schema.table`) — v1 semantics. */
   source: z.string().regex(QUALIFIED_TABLE_PATTERN).optional(),
   columns: z.array(canonicalColumnSchema).default([]),
-  primaryKey: z.array(columnIdentifier).min(1).max(8).optional(),
+  primaryKey: z.array(columnIdentifier).max(8).optional(),
   links: z.array(canonicalLinkSchema).default([]),
   indexes: z.array(canonicalIndexSchema).default([]),
   /** Omitted by old definitions, preserving their existing content hashes. */
@@ -714,6 +877,29 @@ var canonicalTableSchema = z.object({
    * data plane. Omitted otherwise.
    */
   materializes: identifier2.optional()
+}).superRefine((table, ctx) => {
+  if (table.primaryKey?.length !== 0) return;
+  const fail4 = (message, path = ["primaryKey"]) => ctx.addIssue({ code: "custom", path, message: `unkeyed table '${table.table}' ${message}` });
+  if (table.source === void 0 || table.columns.length === 0) {
+    fail4("requires a typed synced source");
+  }
+  if ([table.policies.write, table.policies.insert, table.policies.update].some((policy) => policy !== void 0)) {
+    fail4("is read-only and cannot declare write policies", ["policies"]);
+  }
+  const ownedCollections = [table.indexes, table.actions, table.checks, table.foreignKeys, table.cowMutations];
+  const ownedMetadata = [table.cellMetadata, table.internal, table.materializes, table.renamedFrom];
+  if (ownedCollections.some((items) => items !== void 0 && items.length > 0) || ownedMetadata.some((value) => value !== void 0)) {
+    fail4("cannot declare owned storage, constraints or identity operations");
+  }
+  for (const [index, column] of table.columns.entries()) {
+    const ownedColumnMetadata = [column.default, column.defaultFn, column.onUpdateFn, column.renamedFrom, column.cast, column.cell];
+    if (column.unique || ownedColumnMetadata.some((value) => value !== void 0)) {
+      fail4("cannot declare column uniqueness, mutation defaults or migration metadata", ["columns", index]);
+    }
+  }
+  for (const [index, link] of table.links.entries()) {
+    if (link.enforce || link.kind === "toMany") fail4("cannot provide an identity for this link", ["links", index]);
+  }
 });
 var MAX_VIEW_QUERY = 1e5;
 var MAX_RESOLVED_VIEW_QUERY = 5e6;
@@ -770,6 +956,26 @@ var canonicalViewSchema = z.object({
     }
   }
 });
+function validateUnkeyedLinkIdentities({ definition, ctx }) {
+  const tables = new Map(definition.tables.map((table) => [table.table, table]));
+  const relations = [
+    ...definition.tables.map((table, index) => ({ kind: "tables", index, links: table.links })),
+    ...(definition.views ?? []).map((view, index) => ({ kind: "views", index, links: view.links }))
+  ];
+  for (const relation of relations) {
+    for (const [linkIndex, link] of relation.links.entries()) {
+      if (link.kind !== "toOne" || link.namespace !== void 0 && link.namespace !== definition.namespace) continue;
+      const target = link.target === void 0 ? void 0 : tables.get(link.target);
+      if (target?.source !== void 0 && target.primaryKey?.length === 0) {
+        ctx.addIssue({
+          code: "custom",
+          path: [relation.kind, relation.index, "links", linkIndex],
+          message: `link '${link.name}' cannot use unkeyed table '${target.table}' as a to-one identity`
+        });
+      }
+    }
+  }
+}
 var CELL_PART_TYPES = {
   at: "timestamptz",
   by: "text",
@@ -833,7 +1039,7 @@ var exportGateSchema = z.union([z.literal(true), z.object({ capability: z.string
 var relationExportSchema = z.object({ read: exportGateSchema, write: exportGateSchema.optional() }).strict();
 var localDefinitionSchema = z.object({
   definition_format: z.literal(CANONICAL_FORMAT),
-  namespace: identifier2.max(41),
+  namespace: identifier2.max(41).regex(NAMESPACE_PATTERN, "invalid or reserved ORM namespace"),
   description: z.string().max(2e3).optional(),
   enums: z.array(canonicalEnumSchema).default([]),
   tables: z.array(canonicalTableSchema).min(0).max(500),
@@ -867,6 +1073,7 @@ var localDefinitionSchema = z.object({
     }
   }
   const fkTables = new Map(definition.tables.map((table) => [table.table, table]));
+  validateUnkeyedLinkIdentities({ definition, ctx });
   const relations = /* @__PURE__ */ new Set([...fkTables.keys(), ...(definition.views ?? []).map((view) => view.view)]);
   for (const name2 of Object.keys(definition.exports ?? {})) {
     if (!relations.has(name2)) ctx.addIssue({ code: "custom", path: ["exports", name2], message: `export '${name2}' is not a local object` });
@@ -1189,7 +1396,7 @@ var limitIrSchema = z.object({
   variable: z.string().optional(),
   value: z.number().int().positive().optional(),
   default: z.number().int().positive(),
-  max: z.number().int().positive()
+  max: z.number().int().positive().max(MAX_PERSISTED_READ_ROWS)
 });
 var selectionIrSchema = z.lazy(
   () => z.object({
@@ -2826,6 +3033,7 @@ function buildCompileContext(rawCanonical) {
   const platformMeta = usesPlatformUsers ? platformUserMeta() : void 0;
   if (platformMeta) tables[PLATFORM_USER_TABLE] = platformMeta;
   const syncedTableNames = new Set(canonical.tables.filter((t) => t.source !== void 0).map((t) => t.table));
+  const unkeyedSyncedTableNames = new Set(relations.filter((table) => table.source !== void 0 && table.primaryKey?.length === 0).map((table) => table.table));
   const viewDependencies = new Map((canonical.views ?? []).map((view) => [view.view, view.dependencies]));
   const claimsGatedMemo = /* @__PURE__ */ new Map();
   const relationIsClaimsGated = (name2) => {
@@ -2839,6 +3047,7 @@ function buildCompileContext(rawCanonical) {
   };
   for (const table of relations) {
     const isView = viewNames.has(table.table);
+    const readOnly = isView || unkeyedSyncedTableNames.has(table.table);
     const owner = owners.get(table.table);
     const entries = resolveColumnEntries(table, enums, diagnostics);
     columnEntries.set(table.table, entries);
@@ -2886,13 +3095,13 @@ function buildCompileContext(rawCanonical) {
       // are claims-gated — see tableMetaIrSchema.claimsGated.
       claimsGated: relationIsClaimsGated(table.table),
       columns: entries.map(({ deprecated: _deprecated, onUpdateFn: _onUpdateFn, ...column }) => column),
-      primaryKey: isView ? primaryKey : primaryKey.length > 0 ? primaryKey : ["id"],
+      primaryKey: isView || unkeyedSyncedTableNames.has(table.table) ? primaryKey : primaryKey.length > 0 ? primaryKey : ["id"],
       links: [],
       filterable: data.map((c) => c.name),
       orderable: data.filter((c) => c.type !== "jsonb").map((c) => c.name),
-      insertable: resolved ? resolvedWritable(data) : isView ? [] : active.map((c) => c.name),
-      settable: resolved ? resolvedWritable(data).filter((name2) => !primaryKey.includes(name2)) : isView ? [] : active.filter((c) => !c.onUpdateFn).map((c) => c.name),
-      appendable: isView ? [] : active.filter((c) => c.type === "jsonb").map((c) => c.name),
+      insertable: resolved ? resolvedWritable(data) : readOnly ? [] : active.map((c) => c.name),
+      settable: resolved ? resolvedWritable(data).filter((name2) => !primaryKey.includes(name2)) : readOnly ? [] : active.filter((c) => !c.onUpdateFn).map((c) => c.name),
+      appendable: readOnly ? [] : active.filter((c) => c.type === "jsonb").map((c) => c.name),
       ...touchOnUpdate.length > 0 ? { touchOnUpdate } : {},
       ...cells ? { cells } : {},
       ...resolved ? { resolved: resolvedMeta({ resolved, pk: primaryKey[0] }) } : {},
@@ -2916,6 +3125,16 @@ function buildCompileContext(rawCanonical) {
         });
         continue;
       }
+      const identityTable = link.kind === "toOne" ? targetName : link.kind === "toMany" ? table.table : void 0;
+      if (identityTable !== void 0 && unkeyedSyncedTableNames.has(identityTable)) {
+        diagnostics.push({
+          severity: "error",
+          code: "unkeyed-link-identity",
+          table: table.table,
+          message: `link '${link.name}' cannot use unkeyed table '${identityTable}' as a row identity`
+        });
+        continue;
+      }
       const targetEntries = targetName === PLATFORM_USER_TABLE ? target.columns.map((c) => ({ ...c, deprecated: false, onUpdateFn: false })) : columnEntries.get(targetName);
       const onEntries = link.kind === "toMany" ? targetEntries : entries;
       const referencesEntries = link.kind === "toMany" ? entries : targetEntries;
@@ -2981,7 +3200,7 @@ function buildCompileContext(rawCanonical) {
     compilePolicyFor("write", writePolicies);
     compilePolicyFor("insert", insertPolicies);
     compilePolicyFor("update", updatePolicies);
-    if (isView && table.resolved === void 0) {
+    if (isView && table.resolved === void 0 || unkeyedSyncedTableNames.has(table.table)) {
       writePolicies.set(table.table, CONST_FALSE);
       insertPolicies.set(table.table, CONST_FALSE);
       updatePolicies.set(table.table, CONST_FALSE);
@@ -3056,7 +3275,7 @@ function buildCompileContext(rawCanonical) {
   const queryRoots = /* @__PURE__ */ new Map();
   const mutationRoots = /* @__PURE__ */ new Map();
   for (const table of relations) {
-    if (table.internal === true) continue;
+    if (table.internal === true || unkeyedSyncedTableNames.has(table.table)) continue;
     const roots = queryRootNames(table.table);
     queryRoots.set(roots.select, { kind: "select", table: table.table });
     if ((tables[table.table]?.primaryKey.length ?? 0) > 0) {
@@ -3436,8 +3655,10 @@ var OperationLowerer = class {
   constructor(ctx, restricted) {
     this.ctx = ctx;
     this.variables = new Map(restricted.variables.map((v) => [v.name, v]));
+    this.maxRows = restricted.readBudget ?? MAX_LIMIT;
   }
   variables;
+  maxRows;
   meta(table) {
     return this.ctx.tables[table];
   }
@@ -3641,13 +3862,13 @@ var OperationLowerer = class {
     });
   }
   lowerLimit(node) {
-    const base2 = { default: DEFAULT_LIMIT, max: MAX_LIMIT };
+    const base2 = { default: DEFAULT_LIMIT, max: this.maxRows };
     if (!node) return base2;
     if (node.kind === Kind.VARIABLE) return { ...base2, variable: node.name.value };
     if (node.kind === Kind.INT) {
       const value = Number(node.value);
       if (value < 1) fail2("limit must be a positive integer", "invalid-limit");
-      return { ...base2, value: Math.min(value, MAX_LIMIT) };
+      return { ...base2, value: Math.min(value, this.maxRows) };
     }
     fail2("limit must be an integer literal or a variable", "invalid-limit");
   }
@@ -4446,7 +4667,13 @@ var OperationLowerer = class {
 };
 function lowerOperation({ restricted, ctx }) {
   const lowerer = new OperationLowerer(ctx, restricted);
-  return lowerer.lowerRoots(restricted.definition, restricted.kind);
+  const roots = lowerer.lowerRoots(restricted.definition, restricted.kind);
+  if (restricted.readBudget === void 0) return roots;
+  const root = roots[0];
+  if (restricted.kind !== "query" || restricted.definition.selectionSet.selections.length !== 1 || roots.length !== 1 || root?.kind !== "select" || root.selection.relations.length > 0 || root.selection.aggregates.length > 0 || root.selection.cells !== void 0 || root.prefetch?.length) {
+    fail2("@readBudget requires one flat select root without related selections, aggregates, cells, or prefetch", "invalid-read-budget");
+  }
+  return roots;
 }
 function isCellColumn(meta, name2) {
   if (!meta.cells) return false;
@@ -4505,6 +4732,19 @@ function parseDocuments({
   }
   return { documents: parsed, diagnostics };
 }
+function parseReadBudget(operation) {
+  const directives = operation.directives?.filter((directive) => directive.name.value === "readBudget") ?? [];
+  if (directives.length === 0) return void 0;
+  const value = directives[0]?.arguments?.find((argument) => argument.name.value === "maxRows")?.value;
+  if (operation.operation !== "query" || directives.length !== 1 || value?.kind !== Kind.INT) {
+    throw new DocumentCompileError("@readBudget requires a literal maxRows on a query", "invalid-read-budget");
+  }
+  const maxRows = Number(value.value);
+  if (!Number.isSafeInteger(maxRows) || maxRows < 1 || maxRows > MAX_PERSISTED_READ_ROWS) {
+    throw new DocumentCompileError(`@readBudget(maxRows:) must be between 1 and ${MAX_PERSISTED_READ_ROWS}`, "invalid-read-budget");
+  }
+  return maxRows;
+}
 function unwrapType(node, variable) {
   let nullable = true;
   let list2 = false;
@@ -4665,6 +4905,7 @@ function restrictOperation({
     name: name2,
     kind: operation.operation === "mutation" ? "mutation" : "query",
     requires: parseRequires(operation),
+    readBudget: parseReadBudget(operation),
     variables,
     definition: operation
   };
@@ -5705,6 +5946,118 @@ function bindNamedParameters({ sql, names }) {
   }
   return result;
 }
+var parser2;
+var functions = new Set(VIEW_QUERY_FUNCTION_ALLOWLIST);
+var scalarTypes = /* @__PURE__ */ new Set([
+  "bool",
+  "boolean",
+  "int2",
+  "int4",
+  "int8",
+  "integer",
+  "bigint",
+  "smallint",
+  "numeric",
+  "decimal",
+  "float4",
+  "float8",
+  "real",
+  "text",
+  "varchar",
+  "bpchar",
+  "uuid",
+  "date",
+  "timestamp",
+  "timestamptz",
+  "time",
+  "timetz",
+  "interval",
+  "json",
+  "jsonb",
+  "bytea"
+]);
+var sqlValues = /* @__PURE__ */ new Set([
+  "SVFOP_CURRENT_DATE",
+  "SVFOP_CURRENT_TIME",
+  "SVFOP_CURRENT_TIME_N",
+  "SVFOP_CURRENT_TIMESTAMP",
+  "SVFOP_CURRENT_TIMESTAMP_N",
+  "SVFOP_LOCALTIME",
+  "SVFOP_LOCALTIME_N",
+  "SVFOP_LOCALTIMESTAMP",
+  "SVFOP_LOCALTIMESTAMP_N",
+  "SVFOP_CURRENT_ROLE",
+  "SVFOP_CURRENT_USER",
+  "SVFOP_USER",
+  "SVFOP_SESSION_USER",
+  "SVFOP_CURRENT_CATALOG",
+  "SVFOP_CURRENT_SCHEMA"
+]);
+async function validateManagedViewQueries({ canonical }) {
+  for (const definition of [canonical, ...canonical.imports ?? []]) {
+    for (const view of definition.views ?? []) {
+      const fail4 = (message) => {
+        throw new OrmDefinitionError(`managed view '${definition.namespace}/${view.view}': ${message}`);
+      };
+      parser2 ??= new PgParser({ version: 17 });
+      const parsed = await parser2.parse(view.query);
+      if (parsed.error || !parsed.tree) fail4("invalid SELECT query");
+      const statements = list(obj(parsed.tree).stmts);
+      if (statements.length !== 1 || !obj(obj(statements[0]).stmt).SelectStmt) fail4("one SELECT query is required");
+      validateTree({ tree: parsed.tree, schema: ormSchemaName(definition.namespace), enums: definition.enums.map((entry) => entry.name), fail: fail4 });
+    }
+  }
+}
+function pgCatalogName(parts) {
+  if (parts.length === 1) return parts[0];
+  if (parts.length === 2 && parts[0] === "pg_catalog") return parts[1];
+  return void 0;
+}
+function reviewedFunctionName({ parts, format }) {
+  return format === "COERCE_SQL_SYNTAX" && parts.length === 2 && parts[0] === "pg_catalog" && parts[1] === "position" ? "strpos" : pgCatalogName(parts);
+}
+function validateTree({ tree, ...scope }) {
+  const pending = [tree];
+  while (pending.length) {
+    const value = pending.pop();
+    if (Array.isArray(value)) {
+      pending.push(...value);
+      continue;
+    }
+    if (!value || typeof value !== "object") continue;
+    const node = obj(value);
+    for (const [kind, child] of Object.entries(node)) {
+      validateNode({ kind, child, scope });
+      pending.push(child);
+    }
+  }
+}
+function validateNode({ kind, child, scope }) {
+  const { fail: fail4 } = scope;
+  if (kind.endsWith("Stmt") && kind !== "SelectStmt") fail4("only SELECT statements are permitted");
+  if (kind === "FuncCall") {
+    const call = obj(child);
+    const parts = strings(call.funcname);
+    const name2 = reviewedFunctionName({ parts, format: call.funcformat });
+    if (!name2 || !functions.has(name2)) fail4(`only explicitly allowlisted pg_catalog functions are permitted (found '${parts.join(".")}')`);
+  }
+  if (kind === "typeName" || kind === "TypeName") validateType({ node: obj(child), ...scope });
+  if (kind === "A_Expr" && pgCatalogName(strings(obj(child).name)) === void 0) fail4("only pg_catalog operators are permitted");
+  if (kind === "SortBy" && list(obj(child).useOp).length && pgCatalogName(strings(obj(child).useOp)) === void 0) fail4("only pg_catalog sort operators are permitted");
+  if (kind === "SQLValueFunction" && !sqlValues.has(String(obj(child).op))) fail4("unsupported SQL value expression");
+  if (kind === "ParamRef") fail4("view queries cannot contain parameters");
+  if (kind === "A_Indirection" && list(obj(child).indirection).some((entry) => !obj(entry).A_Indices)) {
+    fail4("composite field notation is not permitted in managed views");
+  }
+}
+function validateType({ node, schema, enums, fail: fail4 }) {
+  const parts = strings(node.names);
+  const builtin = pgCatalogName(parts);
+  const managedEnum = parts.length === 1 && enums.includes(parts[0]) || parts.length === 2 && parts[0] === schema && enums.includes(parts[1]);
+  if (node.setof || node.pct_type || !managedEnum && (!builtin || !scalarTypes.has(builtin))) {
+    fail4(`casts may only use supported pg_catalog scalar types or declared enums (found '${parts.join(".")}')`);
+  }
+}
 
 // src/sql/operations.ts
 function isSqlOperationDocument(path, contents) {
@@ -5720,7 +6073,13 @@ function isSqlOperationDocument(path, contents) {
 async function compileOperationDocuments(input) {
   const sqlDocuments = input.documents.filter((d) => isSqlOperationDocument(d.path, d.contents));
   const result = compileNamespace({ ...input, documents: input.documents.filter((d) => !isSqlOperationDocument(d.path, d.contents)) });
-  if (!result.ok || !sqlDocuments.length) return result;
+  if (!result.ok) return result;
+  const viewDiagnostics = await managedViewDiagnostics(input.canonical);
+  if (viewDiagnostics.length) return { ok: false, diagnostics: [...result.diagnostics, ...viewDiagnostics] };
+  if (!sqlDocuments.length) return result;
+  return compileSqlDocuments({ input, result, sqlDocuments });
+}
+async function compileSqlDocuments({ input, result, sqlDocuments }) {
   for (const document of sqlDocuments) {
     try {
       const definition = defineOperation(JSON.parse(document.contents));
@@ -5814,6 +6173,18 @@ async function compileOperationDocuments(input) {
   result.manifest.opsHash = result.artifact.opsHash;
   return { ...result, artifact: normalizeIr(result.artifact) };
 }
+async function managedViewDiagnostics(canonical) {
+  try {
+    await validateManagedViewQueries({ canonical });
+    return [];
+  } catch (error) {
+    return [{
+      severity: "error",
+      code: "invalid-view-query",
+      message: error instanceof Error ? error.message : "invalid managed view query"
+    }];
+  }
+}
 var parameterName = z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).max(63).refine((value) => !["__proto__", "prototype", "constructor"].includes(value), "reserved parameter name");
 var parameter = z.discriminatedUnion("type", [
   z.object({ type: z.literal("text"), value: z.string().nullable() }).strict(),
@@ -5895,6 +6266,6 @@ function compileDatasetPreviews(input) {
   return operations;
 }
 
-export { COMPILER_MAJOR, CONST_TRUE, DATASET_PREVIEW_LIMIT, DEFAULT_LIMIT, DocumentCompileError, MAX_LIMIT, NamespaceCompileError, ORDER_BY_DIRECTIONS, OperationLowerer, PLATFORM_USER_TABLE, PLATFORM_USER_TYPENAME, POLICY_COMPARE_OPS, POLICY_MAX_LINK_DEPTH, PolicyCompileError, PolicyParseError, allowedBoolExpOperators, allowedOps, andPred, assertClaimsOnlyWhen, buildCompileContext, camelCase, canonicalOperationText, classifyInputType, collectPinnedColumns, compileDatasetPreviews, compileNamespace, compileNamespaceOrThrow, compileOperationDocuments, compilePolicy, compilePredicateV2, compileRuntimeSql, computeOpHash, computeOpsHash, computePinnedColumnsByTable, computeSchemaHash, defineOperation, enumTypeName, flattenOperation, injectPolicies, inputTypeName, isSqlOperationDocument, lowerOperation, mutationRootNames, parseDocuments, parsePolicy, parseSdl, pascalCase, platformUserMeta, predContains, predContainsExists, queryRootNames, restrictOperation, sqlOperationDefinitionSchema, sqlQueryInputSchema, typeNameForTable, validateAppendInput, validateBoolExpInput, validateInsertInput, validateOnConflictInput, validateOrderByInput, validateSelectColumns, validateSetInput, walkPolicy, walkPred };
+export { COMPILER_MAJOR, CONST_TRUE, DATASET_PREVIEW_LIMIT, DEFAULT_LIMIT, DocumentCompileError, MAX_LIMIT, NamespaceCompileError, ORDER_BY_DIRECTIONS, OperationLowerer, PLATFORM_USER_TABLE, PLATFORM_USER_TYPENAME, POLICY_COMPARE_OPS, POLICY_MAX_LINK_DEPTH, PolicyCompileError, PolicyParseError, allowedBoolExpOperators, allowedOps, andPred, assertClaimsOnlyWhen, buildCompileContext, camelCase, canonicalOperationText, classifyInputType, collectPinnedColumns, compileDatasetPreviews, compileNamespace, compileNamespaceOrThrow, compileOperationDocuments, compilePolicy, compilePredicateV2, compileRuntimeSql, computeOpHash, computeOpsHash, computePinnedColumnsByTable, computeSchemaHash, defineOperation, enumTypeName, flattenOperation, injectPolicies, inputTypeName, isSqlOperationDocument, lowerOperation, mutationRootNames, parseDocuments, parsePolicy, parseSdl, pascalCase, platformUserMeta, predContains, predContainsExists, queryRootNames, restrictOperation, sqlOperationDefinitionSchema, sqlQueryInputSchema, typeNameForTable, validateAppendInput, validateBoolExpInput, validateInsertInput, validateManagedViewQueries, validateOnConflictInput, validateOrderByInput, validateSelectColumns, validateSetInput, walkPolicy, walkPred };
 //# sourceMappingURL=compiler.js.map
 //# sourceMappingURL=compiler.js.map