@sequenceholdings/orm 2.4.0 → 2.5.0

package/dist/index.cjs

@@ -9,6 +9,7 @@ var promises = require('fs/promises');
 var module$1 = require('module');
 var path = require('path');
 var api = require('drizzle-kit/api');
+var pgParser = require('@supabase/pg-parser');
 var jsYaml = require('js-yaml');
 var customRolesManifest = require('@sequenceholdings/custom-roles-manifest');
 
@@ -157,20 +158,24 @@ var t = {
 };
 
 // src/constants.ts
-var NAMESPACE_PATTERN = /^[a-z][a-z0-9_]{0,40}$/;
+var NAMESPACE_PATTERN = /^(?!(?:events|native_sources)$)[a-z][a-z0-9_]{0,40}$/;
 var ORM_DATA_TOKEN_HEADER = "x-sequence-data-token";
 var ORM_SERVICE_DATA_TOKEN_HEADER = "x-sequence-data-token-service";
 var IDENTIFIER_PATTERN = /^[a-z][a-z0-9_]*$/;
 var COLUMN_IDENTIFIER_PATTERN = /^_?[a-z][a-z0-9_]*$/;
 var MAX_IDENTIFIER_LENGTH = 63;
 var CAPABILITY_KEY_PATTERN = /^(?:org\/|app\/[a-z][a-z0-9-]{0,63}\/)?[a-z0-9-]{1,64}$/;
+var MAX_PERSISTED_READ_ROWS = 50001;
 var CLAIM_KEY_PATTERN = /^[a-z][a-z0-9_]*$/;
 var QUALIFIED_TABLE_PATTERN = /^[a-z][a-z0-9_]{0,62}\.[a-z][a-z0-9_]{0,62}$/;
 var SYNCED_SOURCE_PATTERN = QUALIFIED_TABLE_PATTERN;
 var ORM_SCHEMA_PREFIX = "orm_";
 var CONSUMER_ROLE_SUFFIX = "_consumer";
-var ormSchemaName = (namespace) => `${ORM_SCHEMA_PREFIX}${namespace}`;
-var consumerRoleName = (namespace) => `${ORM_SCHEMA_PREFIX}${namespace}${CONSUMER_ROLE_SUFFIX}`;
+var ormSchemaName = (namespace) => {
+  if (!NAMESPACE_PATTERN.test(namespace)) throw new Error(`invalid or reserved ORM namespace '${namespace}'`);
+  return `${ORM_SCHEMA_PREFIX}${namespace}`;
+};
+var consumerRoleName = (namespace) => `${ormSchemaName(namespace)}${CONSUMER_ROLE_SUFFIX}`;
 var DEFINITION_FILE_EXTENSIONS = [".yml", ".yaml"];
 var NAMESPACE_CONFIG_FILENAMES = /* @__PURE__ */ new Set(["namespace.yaml", "namespace.yml"]);
 var HASH_DOMAIN = "sequence-orm-definitions\0";
@@ -399,10 +404,10 @@ function defineSyncedTable(name2, columnsOrConfig, maybeConfig) {
     if (builder.isPrimaryKey) columnLevelPk.push(propertyName);
   }
   if (entries.length > 0) {
-    const hasConfigPk = config.primaryKey !== void 0 && config.primaryKey.length > 0;
+    const hasConfigPk = config.primaryKey !== void 0;
     if (columnLevelPk.length === 0 && !hasConfigPk) {
       throw new OrmDefinitionError(
-        `synced table "${name2}" declares columns but no primary key \u2014 use .primaryKey() or config.primaryKey`,
+        `synced table "${name2}" declares columns but no primary key \u2014 use .primaryKey(), config.primaryKey, or explicit primaryKey: [] for an unkeyed read-only source`,
         file
       );
     }
@@ -1255,10 +1260,10 @@ function validateResolvedView({ view, tables, views = [] }) {
   const resolved = view.resolved;
   if (!resolved) return [];
   const errors = [];
-  const fail = (message) => errors.push(`resolved table '${view.view}': ${message}`);
+  const fail2 = (message) => errors.push(`resolved table '${view.view}': ${message}`);
   const pkColumn = view.primaryKey?.length === 1 ? view.columns.find((c) => c.columnName === view.primaryKey?.[0]) : void 0;
   if (!pkColumn) {
-    fail("requires exactly one primary-key column");
+    fail2("requires exactly one primary-key column");
     return errors;
   }
   const systemNames = new Set(Object.values(RESOLVED_VIEW_SYSTEM_COLUMNS).map((c) => c.name));
@@ -1268,92 +1273,93 @@ function validateResolvedView({ view, tables, views = [] }) {
     pkColumn,
     dataColumns: new Map(view.columns.filter((c) => !systemNames.has(c.name) && c.cell === void 0).map((c) => [c.name, c])),
     sourceByName: /* @__PURE__ */ new Map(),
-    fail
+    fail: fail2
   };
-  if (resolved.sources.filter((source) => source.kind === "manual").length !== 1) fail("requires exactly one manual source");
+  if (resolved.sources.filter((source) => source.kind === "manual").length !== 1) fail2("requires exactly one manual source");
   const tableByName = new Map(tables.map((table) => [table.table, table]));
   for (const source of resolved.sources) {
-    if (scope.sourceByName.has(source.name)) fail(`duplicate source '${source.name}'`);
+    if (scope.sourceByName.has(source.name)) fail2(`duplicate source '${source.name}'`);
     scope.sourceByName.set(source.name, source);
     const table = tableByName.get(source.table);
-    if (!table) fail(`source '${source.name}' references unknown table '${source.table}'`);
+    if (!table) fail2(`source '${source.name}' references unknown table '${source.table}'`);
     else validateSource({ scope, source, table });
   }
   validateRules(scope);
   validateViewCells(scope);
   if (resolved.materialized) validateMaterialized({ scope, tableByName, views });
   for (const name2 of resolved.deletedBy) {
-    if (scope.sourceByName.get(name2)?.kind !== "manual") fail(`deletedBy '${name2}' must be the manual source`);
+    if (scope.sourceByName.get(name2)?.kind !== "manual") fail2(`deletedBy '${name2}' must be the manual source`);
   }
   return errors;
 }
 function validateSource({ scope, source, table }) {
-  const { fail } = scope;
-  if (source.kind === "etl" && table.source === void 0) fail(`etl source '${source.name}' must reference a synced table`);
+  const { fail: fail2 } = scope;
+  if (source.kind === "etl" && table.source === void 0) fail2(`etl source '${source.name}' must reference a synced table`);
+  if (source.kind === "etl" && table.primaryKey?.length === 0) fail2(`etl source '${source.name}' cannot use an unkeyed synced table for resolved row identity`);
   if (source.kind !== "etl" && (table.internal !== true || table.cellMetadata !== true)) {
-    fail(`${source.kind} source '${source.name}' must reference an internal table with cell metadata`);
+    fail2(`${source.kind} source '${source.name}' must reference an internal table with cell metadata`);
   }
   const hasRev = table.columns.some((column) => column.cell?.part === "rev");
-  if (source.kind === "manual" && !hasRev) fail(`manual source '${source.name}' must carry '__rev' cell columns`);
-  if (source.kind === "prefetch" && hasRev) fail(`prefetch source '${source.name}' must not carry '__rev' cell columns`);
+  if (source.kind === "manual" && !hasRev) fail2(`manual source '${source.name}' must carry '__rev' cell columns`);
+  if (source.kind === "prefetch" && hasRev) fail2(`prefetch source '${source.name}' must not carry '__rev' cell columns`);
   const byName = new Map(table.columns.map((c) => [c.name, c]));
   validateSourceColumns({ scope, source, byName });
   if (source.kind === "etl") {
     const updatedAt = source.updatedAt === void 0 ? void 0 : byName.get(source.updatedAt);
     if (source.updatedAt !== void 0 && updatedAt?.type !== "timestamptz" && updatedAt?.type !== "date") {
-      fail(`etl source '${source.name}' updatedAt must name a timestamptz/date column on '${source.table}'`);
+      fail2(`etl source '${source.name}' updatedAt must name a timestamptz/date column on '${source.table}'`);
     }
   }
   validatePrefetchFields({ scope, source });
 }
 function validatePrefetchFields({ scope, source }) {
-  const { fail, pkColumn } = scope;
+  const { fail: fail2, pkColumn } = scope;
   if (source.kind !== "prefetch") {
     if (source.key || source.fetch || source.function || source.prefetchDefaults || source.writeback) {
-      fail(`only prefetch sources may declare key/fetch/function/prefetchDefaults/writeback ('${source.name}')`);
+      fail2(`only prefetch sources may declare key/fetch/function/prefetchDefaults/writeback ('${source.name}')`);
     }
     return;
   }
   if (!source.key || !source.fetch || !source.function || !source.prefetchDefaults) {
-    fail(`prefetch source '${source.name}' requires key, fetch, function and prefetchDefaults`);
+    fail2(`prefetch source '${source.name}' requires key, fetch, function and prefetchDefaults`);
   } else if (source.key !== pkColumn.name && !source.columns.includes(source.key)) {
-    fail(`prefetch source '${source.name}' key '${source.key}' must be the primary key or one of its columns`);
+    fail2(`prefetch source '${source.name}' key '${source.key}' must be the primary key or one of its columns`);
   }
   for (const column of source.writeback?.columns ?? []) {
-    if (!source.columns.includes(column)) fail(`prefetch source '${source.name}' writes back '${column}', which it does not supply`);
+    if (!source.columns.includes(column)) fail2(`prefetch source '${source.name}' writes back '${column}', which it does not supply`);
   }
 }
 function validateSourceColumns({ scope, source, byName }) {
-  const { fail, pkColumn, dataColumns } = scope;
+  const { fail: fail2, pkColumn, dataColumns } = scope;
   for (const column of [pkColumn.name, ...source.columns]) {
     const own = column === pkColumn.name ? pkColumn : dataColumns.get(column);
     const theirs = byName.get(column);
-    if (!own) fail(`source '${source.name}' supplies unknown column '${column}'`);
-    else if (!theirs) fail(`source '${source.name}' table '${source.table}' has no column '${column}'`);
-    else if (JSON.stringify(theirs.type) !== JSON.stringify(own.type)) fail(`column '${column}' has a different type on source '${source.name}'`);
+    if (!own) fail2(`source '${source.name}' supplies unknown column '${column}'`);
+    else if (!theirs) fail2(`source '${source.name}' table '${source.table}' has no column '${column}'`);
+    else if (JSON.stringify(theirs.type) !== JSON.stringify(own.type)) fail2(`column '${column}' has a different type on source '${source.name}'`);
   }
 }
-function validateRules({ resolved, pkColumn, dataColumns, sourceByName, fail }) {
+function validateRules({ resolved, pkColumn, dataColumns, sourceByName, fail: fail2 }) {
   const ruled = /* @__PURE__ */ new Set();
   for (const rule of resolved.resolve) {
     if (!dataColumns.has(rule.column) || rule.column === pkColumn.name) {
-      fail(`resolve rule targets unknown column '${rule.column}'`);
+      fail2(`resolve rule targets unknown column '${rule.column}'`);
       continue;
     }
-    if (ruled.has(rule.column)) fail(`column '${rule.column}' has more than one resolve rule`);
+    if (ruled.has(rule.column)) fail2(`column '${rule.column}' has more than one resolve rule`);
     ruled.add(rule.column);
     if (rule.comparator === "custom" !== (rule.orderBy !== void 0)) {
-      fail(`column '${rule.column}': orderBy is required for custom comparators and only allowed there`);
+      fail2(`column '${rule.column}': orderBy is required for custom comparators and only allowed there`);
     }
-    if (new Set(rule.candidates).size !== rule.candidates.length) fail(`column '${rule.column}' repeats a candidate`);
+    if (new Set(rule.candidates).size !== rule.candidates.length) fail2(`column '${rule.column}' repeats a candidate`);
     for (const candidate of rule.candidates) {
       const source = sourceByName.get(candidate);
-      if (!source) fail(`column '${rule.column}' names unknown candidate source '${candidate}'`);
-      else if (!source.columns.includes(rule.column)) fail(`column '${rule.column}' candidate '${candidate}' does not supply it`);
+      if (!source) fail2(`column '${rule.column}' names unknown candidate source '${candidate}'`);
+      else if (!source.columns.includes(rule.column)) fail2(`column '${rule.column}' candidate '${candidate}' does not supply it`);
     }
   }
   for (const column of dataColumns.keys()) {
-    if (column !== pkColumn.name && !ruled.has(column)) fail(`column '${column}' has no resolve rule`);
+    if (column !== pkColumn.name && !ruled.has(column)) fail2(`column '${column}' has no resolve rule`);
   }
 }
 var VIEW_CELL_TYPES = {
@@ -1362,7 +1368,7 @@ var VIEW_CELL_TYPES = {
   by: "text",
   conflicts: "jsonb"
 };
-function validateViewCells({ view, dataColumns, pkColumn, fail }) {
+function validateViewCells({ view, dataColumns, pkColumn, fail: fail2 }) {
   const expected = /* @__PURE__ */ new Map();
   for (const column of dataColumns.values()) {
     if (column.name === pkColumn.name) continue;
@@ -1374,34 +1380,34 @@ function validateViewCells({ view, dataColumns, pkColumn, fail }) {
     if (!column.cell) continue;
     const want = expected.get(column.name);
     if (!want || want.part !== column.cell.part || want.columnName !== column.columnName || cellColumnName(column.cell.of, column.cell.part) !== column.name) {
-      fail(`unexpected cell column '${column.name}'`);
+      fail2(`unexpected cell column '${column.name}'`);
       continue;
     }
-    if (column.type !== VIEW_CELL_TYPES[column.cell.part]) fail(`cell column '${column.name}' must be ${VIEW_CELL_TYPES[column.cell.part]}`);
+    if (column.type !== VIEW_CELL_TYPES[column.cell.part]) fail2(`cell column '${column.name}' must be ${VIEW_CELL_TYPES[column.cell.part]}`);
     expected.delete(column.name);
   }
-  for (const name2 of expected.keys()) fail(`missing cell column '${name2}'`);
+  for (const name2 of expected.keys()) fail2(`missing cell column '${name2}'`);
 }
 var columnSignature = (columns) => JSON.stringify(columns.map((column) => [column.name, column.columnName, column.type]));
 function validateMaterialized({ scope, tableByName, views }) {
-  const { view, resolved, fail } = scope;
+  const { view, resolved, fail: fail2 } = scope;
   const { table: tableName, compute: computeName } = resolved.materialized;
   const table = tableByName.get(tableName);
   if (!table || table.internal !== true || table.materializes !== view.view) {
-    fail(`materialized table '${tableName}' must be an internal table that materializes '${view.view}'`);
+    fail2(`materialized table '${tableName}' must be an internal table that materializes '${view.view}'`);
   } else {
-    if (columnSignature(table.columns) !== columnSignature(view.columns)) fail(`materialized table '${tableName}' must have exactly the view's columns`);
-    if (JSON.stringify(table.primaryKey ?? []) !== JSON.stringify(view.primaryKey ?? [])) fail(`materialized table '${tableName}' must share the view's primary key`);
+    if (columnSignature(table.columns) !== columnSignature(view.columns)) fail2(`materialized table '${tableName}' must have exactly the view's columns`);
+    if (JSON.stringify(table.primaryKey ?? []) !== JSON.stringify(view.primaryKey ?? [])) fail2(`materialized table '${tableName}' must share the view's primary key`);
   }
   const compute = views.find((candidate) => candidate.view === computeName);
-  if (!compute || compute.internal !== true) fail(`compute view '${computeName}' must be an internal view`);
-  else if (columnSignature(compute.columns) !== columnSignature(view.columns)) fail(`compute view '${computeName}' must have exactly the view's columns`);
+  if (!compute || compute.internal !== true) fail2(`compute view '${computeName}' must be an internal view`);
+  else if (columnSignature(compute.columns) !== columnSignature(view.columns)) fail2(`compute view '${computeName}' must have exactly the view's columns`);
   for (const source of resolved.sources) {
     if (source.kind !== "etl") continue;
     const read = tableByName.get(source.table)?.policies?.read;
     const unconditional = typeof read === "string" ? read.trim() === "true" : read !== void 0 && read.default.trim() === "true" && read.variants.length === 0;
     if (!unconditional) {
-      fail(`etl source '${source.name}' must have read policy 'true' to be materialized (the copy is shared by every caller)`);
+      fail2(`etl source '${source.name}' must have read policy 'true' to be materialized (the copy is shared by every caller)`);
     }
   }
 }
@@ -1738,7 +1744,7 @@ var canonicalTableSchema = zod.z.object({
   /** Synced/reflected read-only tables (`source: schema.table`) — v1 semantics. */
   source: zod.z.string().regex(QUALIFIED_TABLE_PATTERN).optional(),
   columns: zod.z.array(canonicalColumnSchema).default([]),
-  primaryKey: zod.z.array(columnIdentifier).min(1).max(8).optional(),
+  primaryKey: zod.z.array(columnIdentifier).max(8).optional(),
   links: zod.z.array(canonicalLinkSchema).default([]),
   indexes: zod.z.array(canonicalIndexSchema).default([]),
   /** Omitted by old definitions, preserving their existing content hashes. */
@@ -1774,6 +1780,29 @@ var canonicalTableSchema = zod.z.object({
    * data plane. Omitted otherwise.
    */
   materializes: identifier2.optional()
+}).superRefine((table, ctx) => {
+  if (table.primaryKey?.length !== 0) return;
+  const fail2 = (message, path = ["primaryKey"]) => ctx.addIssue({ code: "custom", path, message: `unkeyed table '${table.table}' ${message}` });
+  if (table.source === void 0 || table.columns.length === 0) {
+    fail2("requires a typed synced source");
+  }
+  if ([table.policies.write, table.policies.insert, table.policies.update].some((policy) => policy !== void 0)) {
+    fail2("is read-only and cannot declare write policies", ["policies"]);
+  }
+  const ownedCollections = [table.indexes, table.actions, table.checks, table.foreignKeys, table.cowMutations];
+  const ownedMetadata = [table.cellMetadata, table.internal, table.materializes, table.renamedFrom];
+  if (ownedCollections.some((items) => items !== void 0 && items.length > 0) || ownedMetadata.some((value) => value !== void 0)) {
+    fail2("cannot declare owned storage, constraints or identity operations");
+  }
+  for (const [index3, column] of table.columns.entries()) {
+    const ownedColumnMetadata = [column.default, column.defaultFn, column.onUpdateFn, column.renamedFrom, column.cast, column.cell];
+    if (column.unique || ownedColumnMetadata.some((value) => value !== void 0)) {
+      fail2("cannot declare column uniqueness, mutation defaults or migration metadata", ["columns", index3]);
+    }
+  }
+  for (const [index3, link] of table.links.entries()) {
+    if (link.enforce || link.kind === "toMany") fail2("cannot provide an identity for this link", ["links", index3]);
+  }
 });
 var MAX_VIEW_QUERY = 1e5;
 var MAX_RESOLVED_VIEW_QUERY = 5e6;
@@ -1830,6 +1859,26 @@ var canonicalViewSchema = zod.z.object({
     }
   }
 });
+function validateUnkeyedLinkIdentities({ definition, ctx }) {
+  const tables = new Map(definition.tables.map((table) => [table.table, table]));
+  const relations = [
+    ...definition.tables.map((table, index3) => ({ kind: "tables", index: index3, links: table.links })),
+    ...(definition.views ?? []).map((view, index3) => ({ kind: "views", index: index3, links: view.links }))
+  ];
+  for (const relation of relations) {
+    for (const [linkIndex, link] of relation.links.entries()) {
+      if (link.kind !== "toOne" || link.namespace !== void 0 && link.namespace !== definition.namespace) continue;
+      const target = link.target === void 0 ? void 0 : tables.get(link.target);
+      if (target?.source !== void 0 && target.primaryKey?.length === 0) {
+        ctx.addIssue({
+          code: "custom",
+          path: [relation.kind, relation.index, "links", linkIndex],
+          message: `link '${link.name}' cannot use unkeyed table '${target.table}' as a to-one identity`
+        });
+      }
+    }
+  }
+}
 var CELL_PART_TYPES = {
   at: "timestamptz",
   by: "text",
@@ -1843,49 +1892,49 @@ function trackedCellColumns(table) {
 }
 var SUFFIXES = Object.values(CELL_PART_SUFFIX);
 function validateCellMetadata(table, index3, ctx) {
-  const fail = (message, path = ["tables", index3]) => ctx.addIssue({ code: "custom", path, message });
+  const fail2 = (message, path = ["tables", index3]) => ctx.addIssue({ code: "custom", path, message });
   const cells = table.columns.flatMap((column, position) => column.cell ? [{ column, position, cell: column.cell }] : []);
   if (table.materializes !== void 0) return;
   if (table.cellMetadata !== true) {
-    for (const { position } of cells) fail(`cell-metadata columns require cellMetadata on table '${table.table}'`, ["tables", index3, "columns", position]);
+    for (const { position } of cells) fail2(`cell-metadata columns require cellMetadata on table '${table.table}'`, ["tables", index3, "columns", position]);
     return;
   }
   if (table.source !== void 0) {
-    fail(`synced table '${table.table}' cannot track cell metadata`);
+    fail2(`synced table '${table.table}' cannot track cell metadata`);
     return;
   }
   const tracked = trackedCellColumns(table);
   const byName = new Map(tracked.map((column) => [column.name, column]));
   const withRev = cells.some(({ cell }) => cell.part === "rev");
-  if (withRev && table.internal !== true) fail(`only a resolved table's internal sources carry '__rev' cell columns ('${table.table}')`);
+  if (withRev && table.internal !== true) fail2(`only a resolved table's internal sources carry '__rev' cell columns ('${table.table}')`);
   const seen = /* @__PURE__ */ new Set();
   for (const { column, position, cell } of cells) {
     const path = ["tables", index3, "columns", position];
     const owner = byName.get(cell.of);
     if (!owner) {
-      fail(`cell column '${column.name}' belongs to '${cell.of}', which is not a tracked column`, path);
+      fail2(`cell column '${column.name}' belongs to '${cell.of}', which is not a tracked column`, path);
       continue;
     }
-    if (cell.part !== "at" && cell.part !== "by" && cell.part !== "rev") fail(`a table cell column must be part at/by/rev, not '${cell.part}'`, path);
+    if (cell.part !== "at" && cell.part !== "by" && cell.part !== "rev") fail2(`a table cell column must be part at/by/rev, not '${cell.part}'`, path);
     if (column.name !== cellColumnName(owner.name, cell.part) || column.columnName !== cellColumnName(owner.columnName, cell.part)) {
-      fail(`cell column for '${owner.name}' ${cell.part} must be named '${cellColumnName(owner.name, cell.part)}' / '${cellColumnName(owner.columnName, cell.part)}'`, path);
+      fail2(`cell column for '${owner.name}' ${cell.part} must be named '${cellColumnName(owner.name, cell.part)}' / '${cellColumnName(owner.columnName, cell.part)}'`, path);
     }
     if (column.type !== CELL_PART_TYPES[cell.part] || !column.nullable || column.unique || column.default !== void 0 || column.defaultFn !== void 0) {
-      fail(`cell column '${column.name}' must be a nullable, default-less ${CELL_PART_TYPES[cell.part]}`, path);
+      fail2(`cell column '${column.name}' must be a nullable, default-less ${CELL_PART_TYPES[cell.part]}`, path);
     }
     const key = `${cell.of}:${cell.part}`;
-    if (seen.has(key)) fail(`duplicate cell column '${column.name}'`, path);
+    if (seen.has(key)) fail2(`duplicate cell column '${column.name}'`, path);
     seen.add(key);
   }
   for (const column of tracked) {
     if (column.columnName.length > MAX_TRACKED_COLUMN_NAME) {
-      fail(`column '${column.columnName}' is too long to track cell metadata (max ${MAX_TRACKED_COLUMN_NAME} characters)`);
+      fail2(`column '${column.columnName}' is too long to track cell metadata (max ${MAX_TRACKED_COLUMN_NAME} characters)`);
     }
     if (SUFFIXES.some((suffix) => column.columnName.endsWith(suffix))) {
-      fail(`column '${column.columnName}' ends in a reserved cell-metadata suffix (${SUFFIXES.join(", ")})`);
+      fail2(`column '${column.columnName}' ends in a reserved cell-metadata suffix (${SUFFIXES.join(", ")})`);
     }
     for (const part of withRev ? ["at", "by", "rev"] : ["at", "by"]) {
-      if (!seen.has(`${column.name}:${part}`)) fail(`tracked column '${column.name}' is missing its '${cellColumnName(column.columnName, part)}' cell column`);
+      if (!seen.has(`${column.name}:${part}`)) fail2(`tracked column '${column.name}' is missing its '${cellColumnName(column.columnName, part)}' cell column`);
     }
   }
 }
@@ -1893,7 +1942,7 @@ var exportGateSchema = zod.z.union([zod.z.literal(true), zod.z.object({ capabili
 var relationExportSchema = zod.z.object({ read: exportGateSchema, write: exportGateSchema.optional() }).strict();
 var localDefinitionSchema = zod.z.object({
   definition_format: zod.z.literal(CANONICAL_FORMAT),
-  namespace: identifier2.max(41),
+  namespace: identifier2.max(41).regex(NAMESPACE_PATTERN, "invalid or reserved ORM namespace"),
   description: zod.z.string().max(2e3).optional(),
   enums: zod.z.array(canonicalEnumSchema).default([]),
   tables: zod.z.array(canonicalTableSchema).min(0).max(500),
@@ -1927,6 +1976,7 @@ var localDefinitionSchema = zod.z.object({
     }
   }
   const fkTables = new Map(definition.tables.map((table) => [table.table, table]));
+  validateUnkeyedLinkIdentities({ definition, ctx });
   const relations = /* @__PURE__ */ new Set([...fkTables.keys(), ...(definition.views ?? []).map((view) => view.view)]);
   for (const name2 of Object.keys(definition.exports ?? {})) {
     if (!relations.has(name2)) ctx.addIssue({ code: "custom", path: ["exports", name2], message: `export '${name2}' is not a local object` });
@@ -1952,38 +2002,38 @@ var localDefinitionSchema = zod.z.object({
       }
     }
     for (const [index3, check] of (table.checks ?? []).entries()) {
-      const fail = (message) => ctx.addIssue({ code: "custom", path: ["tables", tableIndex, "checks", index3], message });
-      if (table.source) fail("synced tables cannot declare checks");
-      if (names.has(check.name)) fail(`duplicate constraint '${check.name}'`);
+      const fail2 = (message) => ctx.addIssue({ code: "custom", path: ["tables", tableIndex, "checks", index3], message });
+      if (table.source) fail2("synced tables cannot declare checks");
+      if (names.has(check.name)) fail2(`duplicate constraint '${check.name}'`);
       names.add(check.name);
       try {
         compileCheckExpression(check.expression, table.columns);
       } catch (error) {
-        fail(error instanceof Error ? error.message : String(error));
+        fail2(error instanceof Error ? error.message : String(error));
       }
     }
     for (const [index3, fk] of (table.foreignKeys ?? []).entries()) {
-      const fail = (message) => ctx.addIssue({ code: "custom", path: ["tables", tableIndex, "foreignKeys", index3], message });
-      if (names.has(fk.name)) fail(`duplicate foreign key '${fk.name}'`);
+      const fail2 = (message) => ctx.addIssue({ code: "custom", path: ["tables", tableIndex, "foreignKeys", index3], message });
+      if (names.has(fk.name)) fail2(`duplicate foreign key '${fk.name}'`);
       names.add(fk.name);
       const target = fkTables.get(fk.target);
       if (table.source || !target || target.source) {
-        fail("foreign keys must connect owned tables in the same namespace");
+        fail2("foreign keys must connect owned tables in the same namespace");
         continue;
       }
-      if (fk.columns.length !== fk.references.length) fail("foreign key columns and references must have the same number of columns");
-      if (new Set(fk.columns).size !== fk.columns.length || new Set(fk.references).size !== fk.references.length) fail("foreign key columns must not repeat");
+      if (fk.columns.length !== fk.references.length) fail2("foreign key columns and references must have the same number of columns");
+      if (new Set(fk.columns).size !== fk.columns.length || new Set(fk.references).size !== fk.references.length) fail2("foreign key columns must not repeat");
       for (const [position, name2] of fk.columns.entries()) {
         const sourceColumn = table.columns.find((column) => column.columnName === name2);
         const targetColumn = target.columns.find((column) => column.columnName === fk.references[position]);
-        if (!sourceColumn || !targetColumn) fail("foreign key references an unknown column");
-        else if (JSON.stringify(sourceColumn.type) !== JSON.stringify(targetColumn.type)) fail("foreign key column types must match");
+        if (!sourceColumn || !targetColumn) fail2("foreign key references an unknown column");
+        else if (JSON.stringify(sourceColumn.type) !== JSON.stringify(targetColumn.type)) fail2("foreign key column types must match");
       }
       if (fk.onDelete === "set null" || fk.onUpdate === "set null") {
-        if (fk.columns.some((name2) => table.columns.find((column) => column.columnName === name2)?.nullable === false || table.primaryKey?.includes(name2))) fail("SET NULL requires nullable source columns");
+        if (fk.columns.some((name2) => table.columns.find((column) => column.columnName === name2)?.nullable === false || table.primaryKey?.includes(name2))) fail2("SET NULL requires nullable source columns");
       }
       const uniqueKeys = [target.primaryKey ?? [], ...target.indexes.filter((index4) => index4.unique).map((index4) => index4.columns), ...target.columns.filter((column) => column.unique).map((column) => [column.columnName])];
-      if (!uniqueKeys.some((key) => key.length === fk.references.length && key.every((column) => fk.references.includes(column)))) fail("foreign key target columns must form a unique key");
+      if (!uniqueKeys.some((key) => key.length === fk.references.length && key.every((column) => fk.references.includes(column)))) fail2("foreign key target columns must form a unique key");
     }
   }
   for (const [viewIndex, view] of (definition.views ?? []).entries()) {
@@ -2171,8 +2221,8 @@ function cloneColumn({ builder, property, notNull, primaryKey: primaryKey2 }) {
   return clone;
 }
 function planSource(input) {
-  const { sourceName, input: source, fail } = input;
-  if (!IDENTIFIER_PATTERN.test(sourceName)) fail(`source name "${sourceName}" must match ${IDENTIFIER_PATTERN}`);
+  const { sourceName, input: source, fail: fail2 } = input;
+  if (!IDENTIFIER_PATTERN.test(sourceName)) fail2(`source name "${sourceName}" must match ${IDENTIFIER_PATTERN}`);
   switch (source.kind) {
     case "manual":
       return {
@@ -2208,30 +2258,31 @@ function internalTable(input, supplied, system, options = {}) {
     internal: true
   });
 }
-function assertColumns(input, list, what) {
-  for (const column of list) if (!input.dataColumns.includes(column)) input.fail(`${what} names unknown column "${column}"`);
+function assertColumns(input, list2, what) {
+  for (const column of list2) if (!input.dataColumns.includes(column)) input.fail(`${what} names unknown column "${column}"`);
 }
 function planEtl(input, source) {
-  const { sourceName, pk, dataColumns, fail } = input;
+  const { sourceName, pk, dataColumns, fail: fail2 } = input;
   const table = typeof source.table === "function" ? source.table() : source.table;
-  if (!isSeqTable(table) || table.source === void 0) fail(`etl source "${sourceName}" must reference a defineSyncedTable`);
+  if (!isSeqTable(table) || table.source === void 0) fail2(`etl source "${sourceName}" must reference a defineSyncedTable`);
   const synced = table;
-  if (!(pk in synced.columns)) fail(`etl source "${sourceName}" table "${synced.tableName}" has no "${pk}" column`);
+  if (synced.config.primaryKey?.length === 0) fail2(`etl source "${sourceName}" cannot use an unkeyed synced table for resolved row identity`);
+  if (!(pk in synced.columns)) fail2(`etl source "${sourceName}" table "${synced.tableName}" has no "${pk}" column`);
   const supplied = source.columns ? [...source.columns] : dataColumns.filter((column) => column in synced.columns);
   assertColumns(input, supplied, `etl source "${sourceName}"`);
   if (source.updatedAt !== void 0 && !(source.updatedAt in synced.columns)) {
-    fail(`etl source "${sourceName}" updatedAt "${source.updatedAt}" is not a column of "${synced.tableName}"`);
+    fail2(`etl source "${sourceName}" updatedAt "${source.updatedAt}" is not a column of "${synced.tableName}"`);
   }
   return { name: sourceName, kind: "etl", table: synced, columns: supplied, ...source.updatedAt ? { updatedAt: source.updatedAt } : {} };
 }
 function planPrefetch(input, source) {
-  const { sourceName, pk, fail } = input;
+  const { sourceName, pk, fail: fail2 } = input;
   assertColumns(input, source.columns, `prefetch source "${sourceName}"`);
   if (source.key !== pk && !source.columns.includes(source.key)) {
-    fail(`prefetch source "${sourceName}" key "${source.key}" must be the primary key or one of its columns`);
+    fail2(`prefetch source "${sourceName}" key "${source.key}" must be the primary key or one of its columns`);
   }
   for (const column of source.writeback?.columns ?? []) {
-    if (!source.columns.includes(column)) fail(`prefetch source "${sourceName}" writes back "${column}", which it does not supply`);
+    if (!source.columns.includes(column)) fail2(`prefetch source "${sourceName}" writes back "${column}", which it does not supply`);
   }
   const writeback = source.writeback;
   return {
@@ -2437,34 +2488,34 @@ var SYSTEM_VIEW_COLUMNS = {
 };
 function defineResolvedTable(name2, columns, config) {
   const file = activeAuthoringContext()?.currentFile;
-  const fail = (message) => {
+  const fail2 = (message) => {
     throw new OrmDefinitionError(`resolved table "${name2}": ${message}`, file);
   };
-  if (!IDENTIFIER_PATTERN.test(name2)) fail(`name must match ${IDENTIFIER_PATTERN}`);
+  if (!IDENTIFIER_PATTERN.test(name2)) fail2(`name must match ${IDENTIFIER_PATTERN}`);
   for (const property of Object.keys(columns)) {
     if (RESERVED_RESOLVED_COLUMN_NAMES.has(property) || RESERVED_RESOLVED_COLUMN_NAMES.has(columns[property].columnNameFor(property))) {
-      fail(`column "${property}" collides with a reserved system column`);
+      fail2(`column "${property}" collides with a reserved system column`);
     }
   }
   for (const property of Object.keys(columns)) {
     if (columns[property].columnNameFor(property).length > MAX_TRACKED_COLUMN_NAME) {
-      fail(`column "${property}" is too long for a resolved table (max ${MAX_TRACKED_COLUMN_NAME} characters, room for cell parts)`);
+      fail2(`column "${property}" is too long for a resolved table (max ${MAX_TRACKED_COLUMN_NAME} characters, room for cell parts)`);
     }
   }
   const pkEntries = Object.entries(columns).filter(([, builder]) => builder.isPrimaryKey);
-  if (pkEntries.length !== 1) fail("declare exactly one .primaryKey() column");
+  if (pkEntries.length !== 1) fail2("declare exactly one .primaryKey() column");
   const [pk, pkBuilder] = pkEntries[0];
   const dataColumns = Object.keys(columns).filter((property) => property !== pk);
-  if (dataColumns.length === 0) fail("declare at least one non-key column");
+  if (dataColumns.length === 0) fail2("declare at least one non-key column");
   const sourceEntries = Object.entries(config.sources);
-  if (sourceEntries.filter(([, source]) => source.kind === "manual").length !== 1) fail("declare exactly one manualSource()");
+  if (sourceEntries.filter(([, source]) => source.kind === "manual").length !== 1) fail2("declare exactly one manualSource()");
   const plans = sourceEntries.map(
-    ([sourceName, input]) => planSource({ viewName: name2, sourceName, input, columns, pk, pkBuilder, dataColumns, fail })
+    ([sourceName, input]) => planSource({ viewName: name2, sourceName, input, columns, pk, pkBuilder, dataColumns, fail: fail2 })
   );
-  const rules = planRules({ config, plans, dataColumns, fail });
+  const rules = planRules({ config, plans, dataColumns, fail: fail2 });
   const deletedBy = [...config.rows?.deletedBy ?? []];
   for (const source of deletedBy) {
-    if (plans.find((plan) => plan.name === source)?.kind !== "manual") fail(`rows.deletedBy "${source}" must be the manual source`);
+    if (plans.find((plan) => plan.name === source)?.kind !== "manual") fail2(`rows.deletedBy "${source}" must be the manual source`);
   }
   const partType = { source: t.text, at: t.timestamptz, by: t.text, conflicts: t.jsonb };
   const viewColumns = {};
@@ -2527,11 +2578,11 @@ function defineResolvedTable(name2, columns, config) {
     }
   });
 }
-function planRules({ config, plans, dataColumns, fail }) {
+function planRules({ config, plans, dataColumns, fail: fail2 }) {
   const kindOrder = { manual: 0, prefetch: 1, etl: 2 };
   const fallback = config.default ?? priority([...plans].sort((a, b) => kindOrder[a.kind] - kindOrder[b.kind]).map((plan) => plan.name));
   for (const column of Object.keys(config.resolve ?? {})) {
-    if (!dataColumns.includes(column)) fail(`resolve names unknown column "${column}"`);
+    if (!dataColumns.includes(column)) fail2(`resolve names unknown column "${column}"`);
   }
   return dataColumns.map((column) => {
     const explicit = config.resolve?.[column];
@@ -2539,11 +2590,11 @@ function planRules({ config, plans, dataColumns, fail }) {
     const candidates = explicit ? [...explicit.candidates] : comparator.candidates.filter((name2) => plans.find((plan) => plan.name === name2)?.columns.includes(column));
     for (const candidate of candidates) {
       const plan = plans.find((entry) => entry.name === candidate);
-      if (!plan) fail(`column "${column}" names unknown source "${candidate}"`);
-      else if (!plan.columns.includes(column)) fail(`column "${column}" candidate "${candidate}" does not supply it`);
+      if (!plan) fail2(`column "${column}" names unknown source "${candidate}"`);
+      else if (!plan.columns.includes(column)) fail2(`column "${column}" candidate "${candidate}" does not supply it`);
     }
-    if (candidates.length === 0) fail(`column "${column}" has no candidate source`);
-    if (comparator.kind === "custom") assertSafeOrderBy({ orderBy: comparator.orderBy ?? "", column, fail });
+    if (candidates.length === 0) fail2(`column "${column}" has no candidate source`);
+    if (comparator.kind === "custom") assertSafeOrderBy({ orderBy: comparator.orderBy ?? "", column, fail: fail2 });
     return {
       column,
       comparator: comparator.kind,
@@ -2594,18 +2645,18 @@ var ORDER_BY_KEYWORDS = /* @__PURE__ */ new Set([
 ]);
 var ALLOWED_FUNCTIONS = new Set(VIEW_QUERY_FUNCTION_ALLOWLIST);
 var ORDER_BY_TOKEN = /\s+|'(?:[^']|'')*'|\d+(?:\.\d+)?|[a-z_][a-z0-9_]*|::|<=|>=|<>|!=|[-+*/%<>=(),|]/giy;
-function assertSafeOrderBy({ orderBy, column, fail }) {
+function assertSafeOrderBy({ orderBy, column, fail: fail2 }) {
   ORDER_BY_TOKEN.lastIndex = 0;
   let consumed = 0;
   for (let match = ORDER_BY_TOKEN.exec(orderBy); match; match = ORDER_BY_TOKEN.exec(orderBy)) {
     consumed = ORDER_BY_TOKEN.lastIndex;
     const token = match[0].toLowerCase();
     if (/^[a-z_]/.test(token) && !ORDER_BY_KEYWORDS.has(token) && !ALLOWED_FUNCTIONS.has(token)) {
-      fail(`column "${column}" custom orderBy uses "${match[0]}" \u2014 only value, updated_at, source, actor, ord, SQL keywords and allowlisted functions`);
+      fail2(`column "${column}" custom orderBy uses "${match[0]}" \u2014 only value, updated_at, source, actor, ord, SQL keywords and allowlisted functions`);
     }
   }
   if (consumed !== orderBy.length || orderBy.trim() === "") {
-    fail(`column "${column}" custom orderBy contains an unsupported character near "${orderBy.slice(consumed, consumed + 10)}"`);
+    fail2(`column "${column}" custom orderBy contains an unsupported character near "${orderBy.slice(consumed, consumed + 10)}"`);
   }
 }
 function stableJson(value) {
@@ -3133,17 +3184,17 @@ function buildCanonicalLink({
 }) {
   const ownerKind = relationKind(relation);
   const ownerName = relationName(relation);
-  const fail = (message) => {
+  const fail2 = (message) => {
     throw new OrmDefinitionError(`${ownerKind} "${ownerName}": link "${linkName}" ${message}`, relation.file);
   };
   if (link.enforce && link.linkKind !== "toOne") {
-    return fail("sets enforce: true, which is only supported on toOne links");
+    return fail2("sets enforce: true, which is only supported on toOne links");
   }
   if ((link.onDelete !== void 0 || link.onUpdate !== void 0) && !link.enforce) {
-    return fail("sets a referential action without enforce: true");
+    return fail2("sets a referential action without enforce: true");
   }
   if (link.linkKind === "toPlatformUser") {
-    if (link.target !== void 0) return fail("is toPlatformUser and must not declare a target table");
+    if (link.target !== void 0) return fail2("is toPlatformUser and must not declare a target table");
     return {
       name: linkName,
       kind: "toPlatformUser",
@@ -3154,7 +3205,7 @@ function buildCanonicalLink({
     };
   }
   if (typeof link.target === "object" && link.target?.kind === "seq-external-object") {
-    if (link.enforce) return fail("cannot enforce a cross-namespace physical foreign key; use an ORM link without enforce");
+    if (link.enforce) return fail2("cannot enforce a cross-namespace physical foreign key; use an ORM link without enforce");
     return {
       name: linkName,
       kind: link.linkKind,
@@ -3166,13 +3217,13 @@ function buildCanonicalLink({
       ...link.description !== void 0 ? { description: link.description } : {}
     };
   }
-  const target = resolveRelationRef({ ref: link.target, fail });
+  const target = resolveRelationRef({ ref: link.target, fail: fail2 });
   const targetName = relationName(target);
   if (!relationsByName.has(targetName)) {
-    return fail(`targets ${relationKind(target)} "${targetName}" which is not part of this namespace`);
+    return fail2(`targets ${relationKind(target)} "${targetName}" which is not part of this namespace`);
   }
   if (link.enforce && (!isSeqTable(relation) || !isSeqTable(target))) {
-    return fail("cannot enforce a PostgreSQL foreign key involving a view");
+    return fail2("cannot enforce a PostgreSQL foreign key involving a view");
   }
   const owningSide = link.linkKind === "toOne" ? relation : target;
   const referencedSide = link.linkKind === "toOne" ? target : relation;
@@ -3188,19 +3239,19 @@ function buildCanonicalLink({
     ...link.description !== void 0 ? { description: link.description } : {}
   };
 }
-function resolveRelationRef({ ref, fail }) {
-  if (ref === void 0) return fail("declares no target relation");
+function resolveRelationRef({ ref, fail: fail2 }) {
+  if (ref === void 0) return fail2("declares no target relation");
   if (typeof ref !== "function") return ref;
   let resolved;
   try {
     resolved = ref();
   } catch (error) {
-    return fail(
+    return fail2(
       `target thunk threw (${error instanceof Error ? error.message : String(error)}) \u2014 lazy refs resolve at serialize time; make sure the target module ran`
     );
   }
   if (!isSeqTable(resolved) && !isSeqView(resolved)) {
-    return fail("target thunk did not return a relation defined with defineTable/defineView");
+    return fail2("target thunk did not return a relation defined with defineTable/defineView");
   }
   return resolved;
 }
@@ -3303,9 +3354,9 @@ function extractOrmSyncedTableContract({
     );
   }
   const primaryKey2 = table.primaryKey;
-  if (primaryKey2 === void 0 || primaryKey2.length === 0) {
+  if (primaryKey2 === void 0) {
     throw new OrmDefinitionError(
-      `synced table "${table.table}" has no primary key \u2014 typed synced contracts require a primary key`
+      `synced table "${table.table}" has no primary key contract \u2014 declare a key or explicit primaryKey: []`
     );
   }
   const pkSet = new Set(primaryKey2);
@@ -4110,9 +4161,9 @@ function buildActionParamsSchema(action) {
   for (const [name2, param] of entries) {
     shape[name2] = param.optional ? PARAM_SCHEMAS[param.type].nullish() : PARAM_SCHEMAS[param.type];
   }
-  return zod.z.strictObject(shape).superRefine((obj, ctx) => {
+  return zod.z.strictObject(shape).superRefine((obj2, ctx) => {
     for (const [name2, param] of entries) {
-      if (!param.optional && param.type === "jsonb" && obj[name2] === void 0) {
+      if (!param.optional && param.type === "jsonb" && obj2[name2] === void 0) {
         ctx.addIssue({ code: "custom", message: "Required", path: [name2] });
       }
     }
@@ -4770,6 +4821,17 @@ function syncedViewStatements({
     const viewName = `${schema}.${quoteIdentifier(table.table)}`;
     const physical2 = splitPhysicalRelation(backing.physicalRelation);
     const physicalTarget = `${quoteIdentifier(physical2.schema)}.${quoteIdentifier(physical2.table)}`;
+    const declaredColumns = Object.keys(table.columns ?? {});
+    const projection = declaredColumns.length > 0 ? declaredColumns.map(quoteIdentifier).join(", ") : "*";
+    if (backing.selectColumns) {
+      if (declaredColumns.length === 0) {
+        throw new OrmDefinitionError(`synced backing for "${table.table}" requires declared columns`);
+      }
+      const approved = new Set(backing.selectColumns);
+      if (declaredColumns.some((column) => !approved.has(column))) {
+        throw new OrmDefinitionError(`synced backing for "${table.table}" projects outside its approved column ceiling`);
+      }
+    }
     const columnTypes = mergeSyncedViewColumnTypes({
       table,
       canonicalColumnTypes: columnTypesByTable?.get(table.table),
@@ -4778,23 +4840,26 @@ function syncedViewStatements({
     });
     const readPolicyIr = readPolicyIrByTable?.get(table.table);
     const readPolicy = table.policies?.read;
-    const whereClause = readPolicyIr ? ` WHERE ${compilePredIrToSql(readPolicyIr, {
+    const policyClause = readPolicyIr ? ` WHERE ${compilePredIrToSql(readPolicyIr, {
       namespace: definition.namespace,
       columnTypes,
       columnNames: columnNamesByTable?.get(table.table)
     })}` : readPolicy ? ` WHERE ${compilePredicate(readPolicy.ast, narrowToV1ColumnTypes(columnTypes))}` : " WHERE false";
     if (backingPrivileges === "grant") {
+      const selectPrivilege = backing.selectColumns ? `SELECT (${backing.selectColumns.map(quoteIdentifier).join(", ")})` : "SELECT";
+      const hasSelectPrivilege = backing.selectColumns ? backing.selectColumns.map((column) => `pg_catalog.has_column_privilege(${quoteLiteral(executionOwnerRole)}, ${quoteLiteral(physicalTarget)}, ${quoteLiteral(column)}, 'SELECT')`).join("\n    AND ") : `pg_catalog.has_table_privilege(${quoteLiteral(executionOwnerRole)}, ${quoteLiteral(physicalTarget)}, 'SELECT')`;
       statements.push(`GRANT USAGE ON SCHEMA ${quoteIdentifier(physical2.schema)} TO ${owner}`);
-      statements.push(`GRANT SELECT ON ${physicalTarget} TO ${owner}`);
+      statements.push(`GRANT ${selectPrivilege} ON ${physicalTarget} TO ${owner}`);
       statements.push(`DO ${quoteLiteral(`BEGIN
   IF NOT (pg_catalog.has_schema_privilege(${quoteLiteral(executionOwnerRole)}, ${quoteLiteral(physical2.schema)}, 'USAGE')
-    AND pg_catalog.has_table_privilege(${quoteLiteral(executionOwnerRole)}, ${quoteLiteral(physicalTarget)}, 'SELECT')) THEN
+    AND ${hasSelectPrivilege}) THEN
     RAISE EXCEPTION 'Synced backing owner lacks effective USAGE/SELECT; repair managed serving reader access before ORM apply' USING ERRCODE = '42501';
   END IF;
 END`)}`);
     }
+    const whereClause = backing.readGuard ? ` WHERE (SELECT orm_native_sources.require_read_guard(${quoteLiteral(backing.readGuard)})) AND (${policyClause.slice(" WHERE ".length)})` : policyClause;
     statements.push(
-      `CREATE OR REPLACE VIEW ${viewName} AS SELECT * FROM ${physicalTarget}${whereClause}`
+      `CREATE OR REPLACE VIEW ${viewName} AS SELECT ${projection} FROM ${physicalTarget}${whereClause}`
     );
     statements.push(`GRANT SELECT ON ${viewName} TO ${role}`);
   }
@@ -5065,10 +5130,142 @@ function snapshotTableNames(snapshot, schema) {
   return Object.values(tables).filter((entry) => entry.schema === schema).map((entry) => entry.name);
 }
 
+// src/sql/ast.ts
+function obj(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("unsupported SQL node");
+  return value;
+}
+function list(value) {
+  return value === void 0 ? [] : Array.isArray(value) ? value : fail("expected SQL list");
+}
+function str(value) {
+  return typeof value === "string" ? value : fail("expected SQL name");
+}
+function fail(message) {
+  throw new Error(message);
+}
+function strings(value) {
+  return list(value).map((v) => str(obj(obj(v).String).sval));
+}
+
+// src/canonical/view-query.ts
+var parser;
+var functions = new Set(VIEW_QUERY_FUNCTION_ALLOWLIST);
+var scalarTypes = /* @__PURE__ */ new Set([
+  "bool",
+  "boolean",
+  "int2",
+  "int4",
+  "int8",
+  "integer",
+  "bigint",
+  "smallint",
+  "numeric",
+  "decimal",
+  "float4",
+  "float8",
+  "real",
+  "text",
+  "varchar",
+  "bpchar",
+  "uuid",
+  "date",
+  "timestamp",
+  "timestamptz",
+  "time",
+  "timetz",
+  "interval",
+  "json",
+  "jsonb",
+  "bytea"
+]);
+var sqlValues = /* @__PURE__ */ new Set([
+  "SVFOP_CURRENT_DATE",
+  "SVFOP_CURRENT_TIME",
+  "SVFOP_CURRENT_TIME_N",
+  "SVFOP_CURRENT_TIMESTAMP",
+  "SVFOP_CURRENT_TIMESTAMP_N",
+  "SVFOP_LOCALTIME",
+  "SVFOP_LOCALTIME_N",
+  "SVFOP_LOCALTIMESTAMP",
+  "SVFOP_LOCALTIMESTAMP_N",
+  "SVFOP_CURRENT_ROLE",
+  "SVFOP_CURRENT_USER",
+  "SVFOP_USER",
+  "SVFOP_SESSION_USER",
+  "SVFOP_CURRENT_CATALOG",
+  "SVFOP_CURRENT_SCHEMA"
+]);
+async function validateManagedViewQueries({ canonical }) {
+  for (const definition of [canonical, ...canonical.imports ?? []]) {
+    for (const view of definition.views ?? []) {
+      const fail2 = (message) => {
+        throw new OrmDefinitionError(`managed view '${definition.namespace}/${view.view}': ${message}`);
+      };
+      parser ??= new pgParser.PgParser({ version: 17 });
+      const parsed = await parser.parse(view.query);
+      if (parsed.error || !parsed.tree) fail2("invalid SELECT query");
+      const statements = list(obj(parsed.tree).stmts);
+      if (statements.length !== 1 || !obj(obj(statements[0]).stmt).SelectStmt) fail2("one SELECT query is required");
+      validateTree({ tree: parsed.tree, schema: ormSchemaName(definition.namespace), enums: definition.enums.map((entry) => entry.name), fail: fail2 });
+    }
+  }
+}
+function pgCatalogName(parts) {
+  if (parts.length === 1) return parts[0];
+  if (parts.length === 2 && parts[0] === "pg_catalog") return parts[1];
+  return void 0;
+}
+function reviewedFunctionName({ parts, format }) {
+  return format === "COERCE_SQL_SYNTAX" && parts.length === 2 && parts[0] === "pg_catalog" && parts[1] === "position" ? "strpos" : pgCatalogName(parts);
+}
+function validateTree({ tree, ...scope }) {
+  const pending = [tree];
+  while (pending.length) {
+    const value = pending.pop();
+    if (Array.isArray(value)) {
+      pending.push(...value);
+      continue;
+    }
+    if (!value || typeof value !== "object") continue;
+    const node = obj(value);
+    for (const [kind, child] of Object.entries(node)) {
+      validateNode({ kind, child, scope });
+      pending.push(child);
+    }
+  }
+}
+function validateNode({ kind, child, scope }) {
+  const { fail: fail2 } = scope;
+  if (kind.endsWith("Stmt") && kind !== "SelectStmt") fail2("only SELECT statements are permitted");
+  if (kind === "FuncCall") {
+    const call = obj(child);
+    const parts = strings(call.funcname);
+    const name2 = reviewedFunctionName({ parts, format: call.funcformat });
+    if (!name2 || !functions.has(name2)) fail2(`only explicitly allowlisted pg_catalog functions are permitted (found '${parts.join(".")}')`);
+  }
+  if (kind === "typeName" || kind === "TypeName") validateType({ node: obj(child), ...scope });
+  if (kind === "A_Expr" && pgCatalogName(strings(obj(child).name)) === void 0) fail2("only pg_catalog operators are permitted");
+  if (kind === "SortBy" && list(obj(child).useOp).length && pgCatalogName(strings(obj(child).useOp)) === void 0) fail2("only pg_catalog sort operators are permitted");
+  if (kind === "SQLValueFunction" && !sqlValues.has(String(obj(child).op))) fail2("unsupported SQL value expression");
+  if (kind === "ParamRef") fail2("view queries cannot contain parameters");
+  if (kind === "A_Indirection" && list(obj(child).indirection).some((entry) => !obj(entry).A_Indices)) {
+    fail2("composite field notation is not permitted in managed views");
+  }
+}
+function validateType({ node, schema, enums, fail: fail2 }) {
+  const parts = strings(node.names);
+  const builtin = pgCatalogName(parts);
+  const managedEnum = parts.length === 1 && enums.includes(parts[0]) || parts.length === 2 && parts[0] === schema && enums.includes(parts[1]);
+  if (node.setof || node.pct_type || !managedEnum && (!builtin || !scalarTypes.has(builtin))) {
+    fail2(`casts may only use supported pg_catalog scalar types or declared enums (found '${parts.join(".")}')`);
+  }
+}
+
 // src/engine/materialized-refresh.ts
 function materializedRefreshFunctions(canonical) {
   const schema = ormSchemaName(canonical.namespace);
-  const functions = /* @__PURE__ */ new Map();
+  const functions2 = /* @__PURE__ */ new Map();
   for (const view of canonical.views ?? []) {
     const materialized = view.resolved?.materialized;
     if (!materialized) continue;
@@ -5077,7 +5274,7 @@ function materializedRefreshFunctions(canonical) {
     if (!table || pk.length === 0) {
       throw new OrmDefinitionError(`materialized resolved table '${view.view}' needs its table and primary key`);
     }
-    functions.set(view.view, refreshFunctionSql({
+    functions2.set(view.view, refreshFunctionSql({
       schema,
       name: view.view,
       table: materialized.table,
@@ -5086,13 +5283,13 @@ function materializedRefreshFunctions(canonical) {
       pk
     }));
   }
-  return functions;
+  return functions2;
 }
 function refreshFunctionSql({ schema, name: name2, table, compute, columns, pk }) {
   const fn = `${quoteIdentifier(schema)}.${quoteIdentifier(materializedRefreshFunctionName(name2))}`;
   const target = `${quoteIdentifier(schema)}.${quoteIdentifier(table)}`;
   const source = `${quoteIdentifier(schema)}.${quoteIdentifier(compute)}`;
-  const list = columns.map(quoteIdentifier).join(", ");
+  const list2 = columns.map(quoteIdentifier).join(", ");
   const others = columns.filter((column) => !pk.includes(column));
   const keys = pk.map(quoteIdentifier).join(", ");
   const matches = pk.map((column) => `c.${quoteIdentifier(column)} = m.${quoteIdentifier(column)}`).join(" AND ");
@@ -5118,8 +5315,8 @@ BEGIN
   PERFORM set_config('request.jwt.claims', ${quoteLiteral(MATERIALIZE_CLAIMS_JSON)}, true);
   RETURN QUERY
     WITH up AS (
-      INSERT INTO ${target} AS m (${list})
-      SELECT ${list} FROM ${source}
+      INSERT INTO ${target} AS m (${list2})
+      SELECT ${list2} FROM ${source}
       ON CONFLICT (${keys}) ${onConflict}
       RETURNING 1
     ), gone AS (
@@ -5730,6 +5927,7 @@ async function planWithViewRecreation({
   previousSnapshot,
   viewRecreation
 }) {
+  await validateManagedViewQueries({ canonical });
   const schema = ormSchemaName(canonical.namespace);
   const previous = previousSnapshot ? normalizeSnapshot(previousSnapshot) : emptySnapshot(canonical.namespace);
   assertValidViewDependencies(canonical);
@@ -6428,7 +6626,7 @@ var limitIrSchema = zod.z.object({
   variable: zod.z.string().optional(),
   value: zod.z.number().int().positive().optional(),
   default: zod.z.number().int().positive(),
-  max: zod.z.number().int().positive()
+  max: zod.z.number().int().positive().max(MAX_PERSISTED_READ_ROWS)
 });
 var selectionIrSchema = zod.z.lazy(
   () => zod.z.object({
@@ -8104,6 +8302,7 @@ exports.MATERIALIZE_CLAIMS_JSON = MATERIALIZE_CLAIMS_JSON;
 exports.MAX_DEFINITION_FILE_BYTES = MAX_DEFINITION_FILE_BYTES;
 exports.MAX_GENERATED_SDL_BYTES = MAX_GENERATED_SDL_BYTES;
 exports.MAX_IDENTIFIER_LENGTH = MAX_IDENTIFIER_LENGTH;
+exports.MAX_PERSISTED_READ_ROWS = MAX_PERSISTED_READ_ROWS;
 exports.MAX_TRACKED_COLUMN_NAME = MAX_TRACKED_COLUMN_NAME;
 exports.MIGRATIONS_DIRNAME = MIGRATIONS_DIRNAME;
 exports.NAMESPACE_CONFIG_BRAND = NAMESPACE_CONFIG_BRAND;