@sequenceholdings/orm 2.9.0 → 2.11.0

package/dist/compiler.cjs

@@ -9,16 +9,21 @@ var pgParser = require('@supabase/pg-parser');
 
 // src/constants.ts
 var NAMESPACE_PATTERN = /^(?!(?:events|native_sources)$)[a-z][a-z0-9_]{0,40}$/;
+var IDENTIFIER_PATTERN = /^[a-z][a-z0-9_]*$/;
 var COLUMN_IDENTIFIER_PATTERN = /^_?[a-z][a-z0-9_]*$/;
 var MAX_IDENTIFIER_LENGTH = 63;
 var CAPABILITY_KEY_PATTERN = /^(?:org\/|app\/[a-z][a-z0-9-]{0,63}\/)?[a-z0-9-]{1,64}$/;
 var MAX_PERSISTED_READ_ROWS = 50001;
+var CLAIM_KEY_PATTERN = /^[a-z][a-z0-9_]*$/;
 var QUALIFIED_TABLE_PATTERN = /^[a-z][a-z0-9_]{0,62}\.[a-z][a-z0-9_]{0,62}$/;
+var SYNCED_SOURCE_PATTERN = QUALIFIED_TABLE_PATTERN;
 var ORM_SCHEMA_PREFIX = "orm_";
 var ormSchemaName = (namespace) => {
   if (!NAMESPACE_PATTERN.test(namespace)) throw new Error(`invalid or reserved ORM namespace '${namespace}'`);
   return `${ORM_SCHEMA_PREFIX}${namespace}`;
 };
+var RESERVED_TABLE_NAMES = /* @__PURE__ */ new Set(["actions", "query"]);
+var RESERVED_COLUMN_NAMES = /* @__PURE__ */ new Set(["select", "order", "limit", "offset"]);
 var CELL_PARTS = ["at", "by", "rev", "source", "conflicts"];
 var CELL_PART_SUFFIX = {
   at: "__at",
@@ -250,6 +255,748 @@ var Parser = class {
 function compileCheckExpression(source, columns) {
   return new Parser(tokenize(source), columns).parse();
 }
+
+// src/predicate/ast.ts
+var COMPARE_OPS = ["=", "!=", "<", "<=", ">", ">="];
+function walkPredicate(predicate, visit2) {
+  visit2(predicate);
+  if (predicate.kind === "and" || predicate.kind === "or") {
+    for (const operand of predicate.operands) walkPredicate(operand, visit2);
+  }
+  if (predicate.kind === "not") walkPredicate(predicate.operand, visit2);
+}
+function predicateOperands(predicate) {
+  const operands = [];
+  walkPredicate(predicate, (node) => {
+    if (node.kind === "compare") operands.push(node.left, node.right);
+  });
+  return operands;
+}
+function referencedColumns(predicate) {
+  const names = predicateOperands(predicate).flatMap(
+    (operand) => operand.kind === "column" ? [operand.name] : []
+  );
+  return [...new Set(names)];
+}
+var identifierSchema = zod.z.string().max(MAX_IDENTIFIER_LENGTH).regex(IDENTIFIER_PATTERN, "must be a lowercase identifier (a-z, 0-9, _)");
+var namespaceSchema = zod.z.string().regex(NAMESPACE_PATTERN, "must be lowercase, start with a letter, and be at most 41 characters");
+var tableReferenceSchema = zod.z.string().refine(
+  (value) => IDENTIFIER_PATTERN.test(value) || QUALIFIED_TABLE_PATTERN.test(value),
+  "must be a table name or a schema-qualified table reference"
+);
+
+// src/schema/columns.ts
+var COLUMN_TYPES = [
+  "uuid",
+  "text",
+  "integer",
+  "bigint",
+  "numeric",
+  "double",
+  "boolean",
+  "timestamptz",
+  "date",
+  "jsonb"
+];
+var columnTypeSchema = zod.z.enum(COLUMN_TYPES);
+var FUNCTION_DEFAULTS = {
+  "gen_random_uuid()": ["uuid"],
+  "now()": ["timestamptz", "date"]
+};
+var CAST_PATTERN = /^([a-z][a-z0-9_]*)::([a-z]+)$/;
+function defaultIssue(value, type) {
+  if (typeof value === "boolean") return type === "boolean" ? null : `boolean default is invalid for type '${type}'`;
+  if (typeof value === "number") {
+    if (!["integer", "bigint", "numeric", "double"].includes(type)) {
+      return `numeric default is invalid for type '${type}'`;
+    }
+    if (["integer", "bigint"].includes(type)) {
+      if (!Number.isInteger(value)) return `default for type '${type}' must be an integer`;
+      if (!Number.isSafeInteger(value)) {
+        return `default for type '${type}' exceeds the safe integer range \u2014 YAML numbers lose precision past 2^53`;
+      }
+    }
+    if (type === "numeric" && Math.abs(value) > Number.MAX_SAFE_INTEGER) {
+      return "numeric default exceeds the safe float range \u2014 write it as a string (e.g. '9007199254740993') to keep exact precision";
+    }
+    return null;
+  }
+  const allowedTypes = FUNCTION_DEFAULTS[value];
+  if (allowedTypes) return allowedTypes.includes(type) ? null : `default '${value}' is invalid for type '${type}'`;
+  return null;
+}
+var columnSchema = zod.z.strictObject({
+  type: columnTypeSchema,
+  primary_key: zod.z.boolean().optional(),
+  nullable: zod.z.boolean().optional(),
+  unique: zod.z.boolean().optional(),
+  default: zod.z.union([zod.z.string(), zod.z.number(), zod.z.boolean()]).optional(),
+  description: zod.z.string().optional(),
+  renamed_from: identifierSchema.optional(),
+  cast: zod.z.string().optional(),
+  deprecated: zod.z.boolean().optional()
+}).superRefine((column, ctx) => {
+  if (column.default !== void 0) {
+    const issue = defaultIssue(column.default, column.type);
+    if (issue) ctx.addIssue({ code: "custom", message: issue, path: ["default"] });
+  }
+  if (column.primary_key && column.nullable) {
+    ctx.addIssue({ code: "custom", message: "a primary key column cannot be nullable", path: ["nullable"] });
+  }
+  if (column.primary_key && column.deprecated) {
+    ctx.addIssue({ code: "custom", message: "a primary key column cannot be deprecated", path: ["deprecated"] });
+  }
+  if (column.cast && !CAST_PATTERN.test(column.cast)) {
+    ctx.addIssue({ code: "custom", message: "cast must have the shape '<column>::<type>'", path: ["cast"] });
+  }
+});
+function castParts(cast) {
+  const match = CAST_PATTERN.exec(cast);
+  if (!match) return null;
+  return { column: match[1], type: match[2] };
+}
+
+// src/errors.ts
+var OrmDefinitionError = class extends Error {
+  constructor(message, file) {
+    super(file ? `${file}: ${message}` : message);
+    this.file = file;
+  }
+  name = "OrmDefinitionError";
+};
+var PredicateParseError = class extends Error {
+  constructor(message, position) {
+    super(`${message} (at position ${position})`);
+    this.position = position;
+  }
+  name = "PredicateParseError";
+};
+
+// src/predicate/parse.ts
+var KEYWORDS = /* @__PURE__ */ new Set(["and", "or", "not", "true", "false", "null", "claim", "capability"]);
+var OPERATOR_PATTERN = /^(!=|<=|>=|<>|=|<|>)/;
+var IDENTIFIER_START = /[a-z_]/;
+var IDENTIFIER_CHAR = /[a-z0-9_.-]/;
+var NUMBER_PATTERN = /^-?\d+(\.\d+)?/;
+function tokenize2(source) {
+  const tokens = [];
+  let position = 0;
+  while (position < source.length) {
+    const char = source[position];
+    if (/\s/.test(char)) {
+      position += 1;
+      continue;
+    }
+    if (char === "(") {
+      tokens.push({ kind: "lparen", value: char, position });
+      position += 1;
+      continue;
+    }
+    if (char === ")") {
+      tokens.push({ kind: "rparen", value: char, position });
+      position += 1;
+      continue;
+    }
+    if (char === ",") {
+      tokens.push({ kind: "comma", value: char, position });
+      position += 1;
+      continue;
+    }
+    if (char === "'") {
+      const { value, end } = readString(source, position);
+      tokens.push({ kind: "string", value, position });
+      position = end;
+      continue;
+    }
+    const operator = OPERATOR_PATTERN.exec(source.slice(position));
+    if (operator) {
+      const value = operator[0] === "<>" ? "!=" : operator[0];
+      tokens.push({ kind: "operator", value, position });
+      position += operator[0].length;
+      continue;
+    }
+    const number = NUMBER_PATTERN.exec(source.slice(position));
+    if (number && !IDENTIFIER_START.test(char)) {
+      tokens.push({ kind: "number", value: number[0], position });
+      position += number[0].length;
+      continue;
+    }
+    if (IDENTIFIER_START.test(char)) {
+      let end = position;
+      while (end < source.length && IDENTIFIER_CHAR.test(source[end])) end += 1;
+      tokens.push({ kind: "identifier", value: source.slice(position, end), position });
+      position = end;
+      continue;
+    }
+    throw new PredicateParseError(`unexpected character '${char}'`, position);
+  }
+  tokens.push({ kind: "end", value: "", position: source.length });
+  return tokens;
+}
+function readString(source, start) {
+  let value = "";
+  let position = start + 1;
+  while (position < source.length) {
+    const char = source[position];
+    if (char !== "'") {
+      value += char;
+      position += 1;
+      continue;
+    }
+    if (source[position + 1] === "'") {
+      value += "'";
+      position += 2;
+      continue;
+    }
+    return { value, end: position + 1 };
+  }
+  throw new PredicateParseError("unterminated string literal", start);
+}
+var Parser2 = class {
+  constructor(tokens) {
+    this.tokens = tokens;
+  }
+  index = 0;
+  parse() {
+    const predicate = this.parseOr();
+    this.expect("end", "end of expression");
+    return predicate;
+  }
+  parseOr() {
+    const operands = [this.parseAnd()];
+    while (this.matchKeyword("or")) operands.push(this.parseAnd());
+    return operands.length === 1 ? operands[0] : { kind: "or", operands };
+  }
+  parseAnd() {
+    const operands = [this.parseNot()];
+    while (this.matchKeyword("and")) operands.push(this.parseNot());
+    return operands.length === 1 ? operands[0] : { kind: "and", operands };
+  }
+  parseNot() {
+    if (this.matchKeyword("not")) return { kind: "not", operand: this.parseNot() };
+    return this.parsePrimary();
+  }
+  parsePrimary() {
+    if (this.peek().kind === "lparen") {
+      this.advance();
+      const inner = this.parseOr();
+      this.expect("rparen", "')'");
+      return inner;
+    }
+    if (this.peekKeyword("capability")) {
+      const capability = this.parseCapability();
+      const next = this.peek();
+      if (next.kind === "operator") {
+        throw new PredicateParseError("capability() is boolean-valued and cannot appear in a comparison", next.position);
+      }
+      return capability;
+    }
+    return this.parseComparison();
+  }
+  parseCapability() {
+    this.advance();
+    const key = this.parseCallArgument("capability");
+    if (!CAPABILITY_KEY_PATTERN.test(key)) {
+      throw new PredicateParseError(`invalid capability key '${key}'`, this.peek().position);
+    }
+    return { kind: "capability", key };
+  }
+  parseComparison() {
+    const left = this.parseOperand();
+    const operator = this.expect("operator", "a comparison operator");
+    if (!COMPARE_OPS.includes(operator.value)) {
+      throw new PredicateParseError(`unsupported operator '${operator.value}'`, operator.position);
+    }
+    const right = this.parseOperand();
+    return { kind: "compare", op: operator.value, left, right };
+  }
+  parseOperand() {
+    const token = this.peek();
+    if (token.kind === "string") {
+      this.advance();
+      return { kind: "literal", value: token.value };
+    }
+    if (token.kind === "number") {
+      this.advance();
+      const value = Number(token.value);
+      if (!Number.isFinite(value) || Number.isInteger(value) && !Number.isSafeInteger(value)) {
+        throw new PredicateParseError(
+          `numeric literal '${token.value}' exceeds safe integer precision \u2014 quote it as a string`,
+          token.position
+        );
+      }
+      return { kind: "literal", value };
+    }
+    if (token.kind !== "identifier") {
+      throw new PredicateParseError(`expected an operand, got '${token.value || "end"}'`, token.position);
+    }
+    this.advance();
+    if (token.value === "true" || token.value === "false") {
+      return { kind: "literal", value: token.value === "true" };
+    }
+    if (token.value === "null") return { kind: "literal", value: null };
+    if (token.value === "claim") {
+      const key = this.parseCallArgument("claim");
+      if (!CLAIM_KEY_PATTERN.test(key)) {
+        throw new PredicateParseError(`invalid claim key '${key}'`, token.position);
+      }
+      return { kind: "claim", key };
+    }
+    if (token.value === "capability") {
+      throw new PredicateParseError("capability() is boolean-valued and cannot appear in a comparison", token.position);
+    }
+    if (KEYWORDS.has(token.value) || !IDENTIFIER_PATTERN.test(token.value)) {
+      throw new PredicateParseError(`invalid column reference '${token.value}'`, token.position);
+    }
+    return { kind: "column", name: token.value };
+  }
+  parseCallArgument(fn) {
+    this.expect("lparen", `'(' after ${fn}`);
+    const argument = this.expect("string", `a quoted key in ${fn}(...)`);
+    this.expect("rparen", `')' after ${fn} key`);
+    return argument.value;
+  }
+  peek() {
+    return this.tokens[this.index];
+  }
+  peekKeyword(keyword) {
+    const token = this.peek();
+    return token.kind === "identifier" && token.value === keyword;
+  }
+  matchKeyword(keyword) {
+    if (!this.peekKeyword(keyword)) return false;
+    this.advance();
+    return true;
+  }
+  advance() {
+    const token = this.peek();
+    if (token.kind !== "end") this.index += 1;
+    return token;
+  }
+  expect(kind, description) {
+    const token = this.peek();
+    if (token.kind !== kind) {
+      throw new PredicateParseError(`expected ${description}, got '${token.value || "end"}'`, token.position);
+    }
+    return this.advance();
+  }
+};
+function parsePredicate(source) {
+  const trimmed = source.trim();
+  if (trimmed.length === 0) throw new PredicateParseError("empty predicate", 0);
+  return { source: trimmed, ast: new Parser2(tokenize2(trimmed)).parse() };
+}
+
+// src/schema/predicates.ts
+var parsedPredicateSchema = zod.z.string().transform((source, ctx) => {
+  try {
+    return parsePredicate(source);
+  } catch (error) {
+    ctx.addIssue({ code: "custom", message: error instanceof Error ? error.message : String(error) });
+    return zod.z.NEVER;
+  }
+});
+
+// src/schema/actions.ts
+var EXECUTES_VERB_PATTERN = /^\s*(insert|update|delete)\b/i;
+var DOLLAR_QUOTE_PATTERN = /\$[a-zA-Z0-9_]*\$/;
+var RETURNING_PATTERN = /\breturning\b/i;
+var ESCAPE_STRING_PATTERN = /(?<![a-zA-Z0-9_])[Ee]'/;
+var MASKED_CLAIM_CALL_PATTERN = /\b(?:claim|capability)\(\s*''\s*\)/g;
+var BARE_CLAIM_CALL_PATTERN = /\b(?:claim|capability)\s*\(/;
+var EXISTS_ENTRY_PATTERN = /^exists\(\s*'([^']+)'\s*,\s*([a-z][a-z0-9_]*)\s*\)$/;
+var NAMED_PARAM_PATTERN = /(?<!:):([a-z][a-z0-9_]*)/g;
+var QUOTED_STRING_PATTERN = /'(?:[^']|'')*'/g;
+var SQL_COMMENT_PATTERN = /--|\/\*/;
+var actionParamSchema = zod.z.strictObject({
+  type: columnTypeSchema,
+  optional: zod.z.boolean().optional(),
+  description: zod.z.string().optional()
+});
+var validatesEntrySchema = zod.z.string().transform((source, ctx) => {
+  const match = EXISTS_ENTRY_PATTERN.exec(source.trim());
+  if (!match) {
+    ctx.addIssue({ code: "custom", message: "validates entries must have the shape exists('<table>', <param>)" });
+    return zod.z.NEVER;
+  }
+  const table = tableReferenceSchema.safeParse(match[1]);
+  if (!table.success) {
+    ctx.addIssue({ code: "custom", message: `invalid table reference '${match[1]}'` });
+    return zod.z.NEVER;
+  }
+  return { source: source.trim(), table: table.data, param: match[2] };
+});
+var AUDIT_ACTIONS = ["create", "update", "delete"];
+var auditSchema = zod.z.strictObject({
+  action: zod.z.enum(AUDIT_ACTIONS),
+  resource: identifierSchema.optional()
+});
+var actionSchema = zod.z.strictObject({
+  description: zod.z.string().optional(),
+  requires: parsedPredicateSchema.optional(),
+  params: zod.z.record(identifierSchema, actionParamSchema).optional(),
+  validates: zod.z.array(validatesEntrySchema).optional(),
+  // One statement, or an ordered list run atomically in the action function.
+  executes: zod.z.union([zod.z.string().min(1), zod.z.array(zod.z.string().min(1)).min(1)]),
+  // Declares the columns the action's RETURNING yields. Present → the
+  // function returns those rows (typed in the client); absent → the action
+  // reports rows_affected only. The column names/types must match the
+  // RETURNING list, which Postgres enforces at CREATE FUNCTION.
+  returns: zod.z.record(identifierSchema, columnTypeSchema).optional(),
+  audit: auditSchema.optional()
+}).superRefine((action, ctx) => {
+  const params = Object.keys(action.params ?? {});
+  if (action.requires && referencedColumns(action.requires.ast).length > 0) {
+    ctx.addIssue({
+      code: "custom",
+      message: "requires may reference claims and capabilities only, not columns",
+      path: ["requires"]
+    });
+  }
+  for (const issue of executesIssues(action.executes, new Set(params), action.returns !== void 0)) {
+    ctx.addIssue({ code: "custom", message: issue, path: ["executes"] });
+  }
+  if (action.returns && Object.keys(action.returns).length === 0) {
+    ctx.addIssue({ code: "custom", message: "returns must declare at least one column", path: ["returns"] });
+  }
+  for (const [index, entry] of (action.validates ?? []).entries()) {
+    if (!params.includes(entry.param)) {
+      ctx.addIssue({
+        code: "custom",
+        message: `validates references undeclared param '${entry.param}'`,
+        path: ["validates", index]
+      });
+    }
+  }
+});
+function extractNamedParams(sql) {
+  const withoutStrings = sql.replace(QUOTED_STRING_PATTERN, "''");
+  const names = [...withoutStrings.matchAll(NAMED_PARAM_PATTERN)].map((match) => match[1]);
+  return [...new Set(names)];
+}
+function actionStatementSources(executes) {
+  return (Array.isArray(executes) ? executes : [executes]).map((statement) => statement.trim());
+}
+function executesIssues(executes, declaredParams, hasReturns) {
+  const issues = [];
+  const statements = actionStatementSources(executes);
+  statements.forEach((statement, index) => {
+    const withoutStrings = statement.replace(QUOTED_STRING_PATTERN, "''");
+    const at = statements.length > 1 ? ` (statement ${index + 1})` : "";
+    if (!EXECUTES_VERB_PATTERN.test(statement)) issues.push(`executes must be INSERT, UPDATE, or DELETE${at}`);
+    if (withoutStrings.replace(/;\s*$/, "").includes(";")) issues.push(`each executes entry must be a single statement${at}`);
+    if (SQL_COMMENT_PATTERN.test(withoutStrings)) issues.push(`executes must not contain SQL comments${at}`);
+    if (DOLLAR_QUOTE_PATTERN.test(withoutStrings)) issues.push(`executes must not use dollar-quoted strings${at}`);
+    if (ESCAPE_STRING_PATTERN.test(withoutStrings)) issues.push(`executes must not use escape strings (E'\u2026')${at}`);
+    if (withoutStrings.includes('"')) issues.push(`executes must not use double-quoted identifiers${at}`);
+    if (BARE_CLAIM_CALL_PATTERN.test(withoutStrings.replace(MASKED_CLAIM_CALL_PATTERN, ""))) {
+      issues.push(`executes has a malformed claim()/capability() call \u2014 use e.g. claim('sub')${at}`);
+    }
+    if (RETURNING_PATTERN.test(withoutStrings) && !(hasReturns && index === statements.length - 1)) {
+      issues.push(
+        hasReturns ? `only the last executes statement may use RETURNING${at}` : `executes must not use RETURNING unless the action declares returns${at}`
+      );
+    }
+  });
+  const last = statements.at(-1);
+  if (hasReturns && last && !RETURNING_PATTERN.test(last.replace(QUOTED_STRING_PATTERN, "''"))) {
+    issues.push("the last executes statement must use RETURNING to populate the declared returns columns");
+  }
+  const undeclared = extractNamedParams(statements.join("\n")).filter((name2) => !declaredParams.has(name2));
+  if (undeclared.length > 0) issues.push(`executes references undeclared params: ${undeclared.join(", ")}`);
+  return issues;
+}
+
+// src/schema/table.ts
+var linkSchema = zod.z.strictObject({
+  to: tableReferenceSchema,
+  on: identifierSchema,
+  enforce: zod.z.boolean().optional(),
+  description: zod.z.string().optional()
+});
+var indexSchema = zod.z.union([
+  zod.z.array(identifierSchema).min(1),
+  zod.z.strictObject({
+    columns: zod.z.array(identifierSchema).min(1),
+    unique: zod.z.boolean().optional(),
+    name: identifierSchema.optional()
+  })
+]).transform((index) => Array.isArray(index) ? { columns: index } : index);
+var policiesSchema = zod.z.strictObject({
+  read: parsedPredicateSchema.optional(),
+  write: parsedPredicateSchema.optional(),
+  insert: parsedPredicateSchema.optional(),
+  update: parsedPredicateSchema.optional()
+});
+zod.z.strictObject({
+  namespace: namespaceSchema,
+  table: identifierSchema,
+  description: zod.z.string().optional(),
+  columns: zod.z.record(identifierSchema, columnSchema).optional(),
+  source: zod.z.string().regex(SYNCED_SOURCE_PATTERN, "source must be a qualified lowercase schema.table identifier").optional(),
+  links: zod.z.record(identifierSchema, linkSchema).optional(),
+  indexes: zod.z.array(indexSchema).optional(),
+  policies: policiesSchema.optional(),
+  actions: zod.z.record(identifierSchema, actionSchema).optional()
+}).superRefine((table, ctx) => {
+  if (RESERVED_TABLE_NAMES.has(table.table)) {
+    ctx.addIssue({ code: "custom", message: `'${table.table}' is a reserved table name`, path: ["table"] });
+  }
+  for (const name2 of Object.keys(table.columns ?? {})) {
+    if (RESERVED_COLUMN_NAMES.has(name2)) {
+      ctx.addIssue({
+        code: "custom",
+        message: `column '${name2}' collides with the Data API's reserved query parameters (select, order, limit, offset) \u2014 it could never be filtered`,
+        path: ["columns", name2]
+      });
+    }
+  }
+  if (table.source) validateSyncedTable(table, ctx);
+  else validateColumnTable(table, ctx);
+  validateLinks(table, ctx);
+  validatePolicyColumns(table, ctx);
+  validateDerivedNameLengths(table, ctx);
+});
+var indexName = (table, definition) => definition.name ?? `ix_${table}_${definition.columns.join("_")}`;
+var policyName = (table, suffix) => `${table}_${suffix}`;
+var foreignKeyName = (table, link) => `fk_${table}_${link}`;
+function validateSyncedTable(table, ctx) {
+  const forbidden = [
+    ["actions", "synced tables are read-only; actions are not allowed"],
+    ["indexes", "v1 synced tables cannot declare indexes; declare them with defineSyncedTable({ indexes }) in a v2 definition"]
+  ];
+  for (const [field, message] of forbidden) {
+    if (table[field] !== void 0) ctx.addIssue({ code: "custom", message, path: [field] });
+  }
+  if (table.policies?.write) {
+    ctx.addIssue({ code: "custom", message: "synced tables are read-only", path: ["policies", "write"] });
+  }
+  if (table.policies?.insert) {
+    ctx.addIssue({ code: "custom", message: "synced tables are read-only", path: ["policies", "insert"] });
+  }
+  if (table.policies?.update) {
+    ctx.addIssue({ code: "custom", message: "synced tables are read-only", path: ["policies", "update"] });
+  }
+  const columns = table.columns ?? {};
+  const names = Object.keys(columns);
+  if (names.length === 0) return;
+  const primaryKeys = names.filter((name2) => columns[name2]?.primary_key);
+  if (primaryKeys.length !== 1) {
+    ctx.addIssue({ code: "custom", message: "exactly one column must be primary_key", path: ["columns"] });
+  }
+  validateRenames(columns, names, ctx);
+  for (const name2 of names) {
+    const column = columns[name2];
+    if (!column) continue;
+    const cast = column.cast ? castParts(column.cast) : null;
+    if (column.cast && cast?.column !== name2) {
+      ctx.addIssue({
+        code: "custom",
+        message: "cast must reference the column it is declared on",
+        path: ["columns", name2, "cast"]
+      });
+    }
+    if (cast && cast.type !== column.type) {
+      ctx.addIssue({
+        code: "custom",
+        message: `cast target '${cast.type}' must match the declared type '${column.type}'`,
+        path: ["columns", name2, "cast"]
+      });
+    }
+  }
+}
+function validateRenames(columns, names, ctx) {
+  const renameSources = /* @__PURE__ */ new Map();
+  for (const name2 of names) {
+    const renamedFrom = columns[name2]?.renamed_from;
+    if (!renamedFrom) continue;
+    if (renamedFrom === name2 || names.includes(renamedFrom)) {
+      ctx.addIssue({
+        code: "custom",
+        message: "renamed_from must name a column that no longer exists",
+        path: ["columns", name2, "renamed_from"]
+      });
+    }
+    const claimed = renameSources.get(renamedFrom);
+    if (claimed) {
+      ctx.addIssue({
+        code: "custom",
+        message: `renamed_from '${renamedFrom}' is already claimed by '${claimed}'`,
+        path: ["columns", name2, "renamed_from"]
+      });
+    }
+    renameSources.set(renamedFrom, name2);
+  }
+}
+function validateColumnTable(table, ctx) {
+  const columns = table.columns ?? {};
+  const names = Object.keys(columns);
+  if (names.length === 0) {
+    ctx.addIssue({ code: "custom", message: "a table must declare columns or a source", path: ["columns"] });
+    return;
+  }
+  const primaryKeys = names.filter((name2) => columns[name2]?.primary_key);
+  if (primaryKeys.length !== 1) {
+    ctx.addIssue({ code: "custom", message: "exactly one column must be primary_key", path: ["columns"] });
+  }
+  validateRenames(columns, names, ctx);
+  for (const name2 of names) {
+    const column = columns[name2];
+    if (!column) continue;
+    const cast = column.cast ? castParts(column.cast) : null;
+    if (column.cast && cast?.column !== name2) {
+      ctx.addIssue({
+        code: "custom",
+        message: "cast must reference the column it is declared on",
+        path: ["columns", name2, "cast"]
+      });
+    }
+    if (cast && cast.type !== column.type) {
+      ctx.addIssue({
+        code: "custom",
+        message: `cast target '${cast.type}' must match the declared type '${column.type}'`,
+        path: ["columns", name2, "cast"]
+      });
+    }
+  }
+  for (const [position, index] of (table.indexes ?? []).entries()) {
+    if (new Set(index.columns).size !== index.columns.length) {
+      ctx.addIssue({
+        code: "custom",
+        message: "index names a column more than once",
+        path: ["indexes", position]
+      });
+    }
+    for (const column of index.columns) {
+      if (!names.includes(column)) {
+        ctx.addIssue({
+          code: "custom",
+          message: `index references unknown column '${column}'`,
+          path: ["indexes", position]
+        });
+      }
+    }
+  }
+}
+function validateLinks(table, ctx) {
+  const columnNames = Object.keys(table.columns ?? {});
+  for (const [name2, link] of Object.entries(table.links ?? {})) {
+    if (columnNames.length > 0 && !columnNames.includes(link.on)) {
+      ctx.addIssue({ code: "custom", message: `link references unknown column '${link.on}'`, path: ["links", name2, "on"] });
+    }
+    if (link.enforce && link.to.includes(".")) {
+      ctx.addIssue({
+        code: "custom",
+        message: "enforce is only valid for links inside the namespace; cross-boundary links stay soft",
+        path: ["links", name2, "enforce"]
+      });
+    }
+    if (link.enforce && table.source) {
+      ctx.addIssue({
+        code: "custom",
+        message: "a synced table cannot enforce foreign keys \u2014 its DDL is owned by the sync",
+        path: ["links", name2, "enforce"]
+      });
+    }
+  }
+}
+function validateDerivedNameLengths(table, ctx) {
+  const worstPolicy = policyName(table.table, "insert");
+  if (!table.source && worstPolicy.length > MAX_IDENTIFIER_LENGTH) {
+    ctx.addIssue({
+      code: "custom",
+      message: `table name is too long \u2014 the derived policy name '${worstPolicy}' exceeds Postgres's ${MAX_IDENTIFIER_LENGTH}-byte identifier limit`,
+      path: ["table"]
+    });
+  }
+  for (const [position, index] of (table.indexes ?? []).entries()) {
+    const name2 = indexName(table.table, index);
+    if (name2.length > MAX_IDENTIFIER_LENGTH) {
+      ctx.addIssue({
+        code: "custom",
+        message: `derived index name '${name2}' exceeds Postgres's ${MAX_IDENTIFIER_LENGTH}-byte identifier limit \u2014 set a shorter explicit name`,
+        path: ["indexes", position]
+      });
+    }
+  }
+  for (const [name2, link] of Object.entries(table.links ?? {})) {
+    const constraint = foreignKeyName(table.table, name2);
+    if (link.enforce && constraint.length > MAX_IDENTIFIER_LENGTH) {
+      ctx.addIssue({
+        code: "custom",
+        message: `derived foreign-key name '${constraint}' exceeds Postgres's ${MAX_IDENTIFIER_LENGTH}-byte identifier limit \u2014 shorten the link or table name`,
+        path: ["links", name2]
+      });
+    }
+  }
+  for (const name2 of Object.keys(table.actions ?? {})) {
+    const fnName = `action_${name2}`;
+    if (fnName.length > MAX_IDENTIFIER_LENGTH) {
+      ctx.addIssue({
+        code: "custom",
+        message: `derived action function name '${fnName}' exceeds Postgres's ${MAX_IDENTIFIER_LENGTH}-byte identifier limit \u2014 shorten the action name`,
+        path: ["actions", name2]
+      });
+    }
+  }
+}
+var TYPE_GROUPS = {
+  integer: "numeric",
+  bigint: "numeric",
+  numeric: "numeric",
+  double: "numeric",
+  text: "text",
+  uuid: "uuid",
+  date: "temporal",
+  timestamptz: "temporal",
+  boolean: "boolean",
+  jsonb: "jsonb"
+};
+function validatePolicyColumns(table, ctx) {
+  const columns = table.columns ?? {};
+  const columnNames = Object.keys(columns);
+  if (columnNames.length === 0) return;
+  for (const kind of ["read", "write", "insert", "update"]) {
+    const predicate = table.policies?.[kind];
+    if (!predicate) continue;
+    for (const column of referencedColumns(predicate.ast)) {
+      if (!columnNames.includes(column)) {
+        ctx.addIssue({
+          code: "custom",
+          message: `policy references unknown column '${column}'`,
+          path: ["policies", kind]
+        });
+      }
+    }
+    walkPredicate(predicate.ast, (node) => {
+      if (node.kind !== "compare") return;
+      const issue = comparisonTypeIssue(node.left, node.right, columns);
+      if (issue) ctx.addIssue({ code: "custom", message: issue, path: ["policies", kind] });
+    });
+  }
+}
+function comparisonTypeIssue(left, right, columns) {
+  const groupOf = (operand) => operand.kind === "column" ? columns[operand.name] ? TYPE_GROUPS[columns[operand.name].type] : null : null;
+  if (left.kind === "column" && right.kind === "column") {
+    const leftGroup = groupOf(left);
+    const rightGroup = groupOf(right);
+    if (leftGroup && rightGroup && leftGroup !== rightGroup) {
+      return `policy compares '${left.name}' (${columns[left.name].type}) with '${right.name}' (${columns[right.name].type}) \u2014 incomparable types`;
+    }
+    return null;
+  }
+  const column = left.kind === "column" ? left : right.kind === "column" ? right : null;
+  const literal = left.kind === "literal" ? left : right.kind === "literal" ? right : null;
+  if (!column || !literal || literal.value === null) return null;
+  const columnGroup = groupOf(column);
+  if (!columnGroup) return null;
+  if (typeof literal.value === "string") return null;
+  const literalGroup = typeof literal.value === "number" ? "numeric" : "boolean";
+  if (literalGroup !== columnGroup) {
+    return `policy compares '${column.name}' (${columns[column.name].type}) with a ${typeof literal.value} literal \u2014 incomparable types`;
+  }
+  return null;
+}
 var policyVariantSchema = zod.z.object({
   /** Claims-only guard (capability()/role()/claim() comparisons — no columns). */
   when: zod.z.string().min(1).max(1e3),
@@ -566,7 +1313,7 @@ var CANONICAL_FORMAT = 2;
 var IDENTIFIER_RE = /^[a-z][a-z0-9_]*$/;
 var identifier2 = zod.z.string().min(1).max(63).regex(IDENTIFIER_RE);
 var columnIdentifier = zod.z.string().min(1).max(63).regex(COLUMN_IDENTIFIER_PATTERN);
-var COLUMN_TYPES = [
+var COLUMN_TYPES2 = [
   "uuid",
   "text",
   "integer",
@@ -578,7 +1325,7 @@ var COLUMN_TYPES = [
   "date",
   "jsonb"
 ];
-var columnTypeSchema = zod.z.enum(COLUMN_TYPES);
+var columnTypeSchema2 = zod.z.enum(COLUMN_TYPES2);
 var canonicalEnumSchema = zod.z.object({
   name: identifier2,
   values: zod.z.array(zod.z.string().min(1).max(63)).min(1).max(100)
@@ -587,7 +1334,7 @@ var canonicalColumnSchema = zod.z.object({
   /** Property name in TS (camelCase); columnName is the Postgres name. */
   name: zod.z.string().min(1).max(63),
   columnName: columnIdentifier,
-  type: zod.z.union([columnTypeSchema, zod.z.object({ enum: identifier2 })]),
+  type: zod.z.union([columnTypeSchema2, zod.z.object({ enum: identifier2 })]),
   nullable: zod.z.boolean().default(true),
   unique: zod.z.boolean().default(false),
   /** Literal default, or one of the allowlisted SQL functions. */
@@ -837,7 +1584,7 @@ var canonicalActionSchema = zod.z.object({
   name: identifier2,
   requires: zod.z.string().max(1e3).optional(),
   params: zod.z.record(zod.z.string(), zod.z.object({
-    type: columnTypeSchema,
+    type: columnTypeSchema2,
     nullable: zod.z.boolean().default(false)
   })).default({}),
   executes: zod.z.string().min(1).max(1e4),
@@ -938,7 +1685,8 @@ var canonicalTableSchema = zod.z.object({
   if ([table.policies.write, table.policies.insert, table.policies.update].some((policy) => policy !== void 0)) {
     fail4("is read-only and cannot declare write policies", ["policies"]);
   }
-  const ownedCollections = [table.indexes, table.actions, table.checks, table.foreignKeys, table.cowMutations];
+  const ownedIndexes = table.source === void 0 ? table.indexes : table.indexes.filter((index) => index.unique);
+  const ownedCollections = [ownedIndexes, table.actions, table.checks, table.foreignKeys, table.cowMutations];
   const ownedMetadata = [table.cellMetadata, table.internal, table.materializes, table.renamedFrom];
   if (ownedCollections.some((items) => items !== void 0 && items.length > 0) || ownedMetadata.some((value) => value !== void 0)) {
     fail4("cannot declare owned storage, constraints or identity operations");
@@ -1040,6 +1788,23 @@ function trackedCellColumns(table) {
   return table.columns.filter((column) => column.cell === void 0 && !pk.has(column.columnName) && column.onUpdateFn === void 0);
 }
 var SUFFIXES = Object.values(CELL_PART_SUFFIX);
+function validateSyncedIndexes(table, tableIndex, ctx) {
+  if (table.source === void 0) return;
+  const columns = new Set(table.columns.map((column) => column.columnName));
+  for (const [position, index] of table.indexes.entries()) {
+    const fail4 = (message) => ctx.addIssue({ code: "custom", path: ["tables", tableIndex, "indexes", position], message: `synced table '${table.table}' ${message}` });
+    if (columns.size === 0) fail4("must declare columns to declare indexes");
+    if (index.unique) fail4("cannot declare a unique index");
+    if (new Set(index.columns).size !== index.columns.length) fail4("index names a column more than once");
+    for (const column of index.columns) {
+      if (columns.size > 0 && !columns.has(column)) fail4(`index references unknown column '${column}'`);
+    }
+    const name2 = indexName(table.table, index);
+    if (name2.length > MAX_IDENTIFIER_LENGTH) {
+      fail4(`derived index name '${name2}' exceeds Postgres's ${MAX_IDENTIFIER_LENGTH}-byte identifier limit \u2014 set a shorter explicit name`);
+    }
+  }
+}
 function validateCellMetadata(table, index, ctx) {
   const fail4 = (message, path = ["tables", index]) => ctx.addIssue({ code: "custom", path, message });
   const cells = table.columns.flatMap((column, position) => column.cell ? [{ column, position, cell: column.cell }] : []);
@@ -1106,12 +1871,24 @@ var localDefinitionSchema = zod.z.object({
   }).default({ uses: [] })
 }).superRefine((definition, ctx) => {
   const seen = /* @__PURE__ */ new Set();
+  const syncedIndexOwners = /* @__PURE__ */ new Map();
   for (const [index, table] of definition.tables.entries()) {
     if (seen.has(table.table)) {
       ctx.addIssue({ code: "custom", path: ["tables", index, "table"], message: `duplicate relation '${table.table}'` });
     }
     seen.add(table.table);
     validateCellMetadata(table, index, ctx);
+    validateSyncedIndexes(table, index, ctx);
+    if (table.source !== void 0) {
+      for (const [position, entry] of table.indexes.entries()) {
+        const name2 = indexName(table.table, entry);
+        const owner = syncedIndexOwners.get(name2);
+        if (owner !== void 0) {
+          ctx.addIssue({ code: "custom", path: ["tables", index, "indexes", position], message: `synced index '${name2}' is also declared on '${owner}'` });
+        }
+        syncedIndexOwners.set(name2, table.table);
+      }
+    }
     if (table.source !== void 0) {
       for (const [columnIndex, column] of table.columns.entries()) {
         if (column.onUpdateFn !== void 0) {
@@ -1653,7 +2430,7 @@ var variableDefaultIrSchema = zod.z.object({
 var variableIrSchema = zod.z.object({
   name: zod.z.string(),
   type: zod.z.union([
-    zod.z.object({ kind: zod.z.literal("scalar"), scalar: zod.z.enum(COLUMN_TYPES) }),
+    zod.z.object({ kind: zod.z.literal("scalar"), scalar: zod.z.enum(COLUMN_TYPES2) }),
     /** `values` is the declared membership whitelist — the executor validates against it. */
     zod.z.object({ kind: zod.z.literal("enum"), name: zod.z.string(), values: zod.z.array(zod.z.string()).min(1) }),
     /** §4f dynamic slot: validated against `tables[table]` whitelists at runtime. */
@@ -1665,19 +2442,20 @@ var variableIrSchema = zod.z.object({
   defaultValue: variableDefaultIrSchema.optional()
 });
 var sqlColumnSchema = zod.z.object({ name: zod.z.string(), type: zod.z.enum(["text", "boolean", "integer", "bigint", "numeric", "double", "uuid", "date", "timestamptz", "jsonb"]), nullable: zod.z.boolean() });
+var sqlObjectIrSchema = zod.z.object({
+  ref: zod.z.string(),
+  table: zod.z.string(),
+  columns: zod.z.array(sqlColumnSchema.extend({ type: zod.z.string() })).min(1),
+  scan: zod.z.string().min(1),
+  read: zod.z.array(zod.z.string()).min(1)
+}).strict();
 var compiledOperationSchema = zod.z.object({
   language: zod.z.literal("sql").optional(),
   /** Server-compiled object catalog and permission ceiling, never caller SQL. */
   sqlQuery: zod.z.object({
     catalog: zod.z.object({
       identity: zod.z.string(),
-      objects: zod.z.array(zod.z.object({
-        ref: zod.z.string(),
-        table: zod.z.string(),
-        columns: zod.z.array(sqlColumnSchema.extend({ type: zod.z.string() })).min(1),
-        scan: zod.z.string().min(1),
-        read: zod.z.array(zod.z.string()).min(1)
-      }).strict()).min(1).max(256)
+      objects: zod.z.array(sqlObjectIrSchema).min(1).max(256)
     }).strict(),
     read: zod.z.array(zod.z.string()).min(1).max(256),
     maxRows: zod.z.number().int().min(1).max(1e4)
@@ -1785,7 +2563,7 @@ var tableMetaIrSchema = zod.z.object({
   columns: zod.z.array(zod.z.object({
     name: zod.z.string(),
     columnName: zod.z.string(),
-    type: zod.z.union([zod.z.enum(COLUMN_TYPES), zod.z.object({ enum: zod.z.string(), values: zod.z.array(zod.z.string()) })]),
+    type: zod.z.union([zod.z.enum(COLUMN_TYPES2), zod.z.object({ enum: zod.z.string(), values: zod.z.array(zod.z.string()) })]),
     nullable: zod.z.boolean()
   })),
   /** Empty for keyless read-only views; keyed tables and views list logical columns. */
@@ -1922,7 +2700,7 @@ function graphqlScalarFor(type) {
 }
 var COLUMN_TYPE_BY_SCALAR = new Map([
   ["ID", "text"],
-  ...COLUMN_TYPES.map((type) => [graphqlScalarFor(type), type])
+  ...COLUMN_TYPES2.map((type) => [graphqlScalarFor(type), type])
 ]);
 function columnTypeForScalar(scalarName) {
   return COLUMN_TYPE_BY_SCALAR.get(scalarName);
@@ -2023,14 +2801,14 @@ var PolicyCompileError = class extends Error {
 };
 
 // src/predicate-v2/parse.ts
-var KEYWORDS = /* @__PURE__ */ new Set(["and", "or", "not", "true", "false", "null", "claim", "capability", "role", "exists"]);
-var OPERATOR_PATTERN = /^(!=|<=|>=|<>|=|<|>)/;
-var IDENTIFIER_START = /[a-zA-Z_]/;
-var IDENTIFIER_CHAR = /[a-zA-Z0-9_]/;
-var NUMBER_PATTERN = /^-?\d+(\.\d+)?/;
+var KEYWORDS2 = /* @__PURE__ */ new Set(["and", "or", "not", "true", "false", "null", "claim", "capability", "role", "exists"]);
+var OPERATOR_PATTERN2 = /^(!=|<=|>=|<>|=|<|>)/;
+var IDENTIFIER_START2 = /[a-zA-Z_]/;
+var IDENTIFIER_CHAR2 = /[a-zA-Z0-9_]/;
+var NUMBER_PATTERN2 = /^-?\d+(\.\d+)?/;
 var SCALAR_CLAIM_KEYS = Object.entries(CLAIMS_CONTRACT).filter(([, type]) => !type.endsWith("[]")).map(([key]) => key);
 var ARRAY_CLAIM_KEYS = Object.entries(CLAIMS_CONTRACT).filter(([, type]) => type.endsWith("[]")).map(([key]) => key);
-function tokenize2(source) {
+function tokenize3(source) {
   const tokens = [];
   let position = 0;
   while (position < source.length) {
@@ -2060,27 +2838,27 @@ function tokenize2(source) {
       continue;
     }
     if (char === "'") {
-      const { value, end } = readString(source, position);
+      const { value, end } = readString2(source, position);
       tokens.push({ kind: "string", value, position });
       position = end;
       continue;
     }
-    const operator = OPERATOR_PATTERN.exec(source.slice(position));
+    const operator = OPERATOR_PATTERN2.exec(source.slice(position));
     if (operator) {
       const value = operator[0] === "<>" ? "!=" : operator[0];
       tokens.push({ kind: "operator", value, position });
       position += operator[0].length;
       continue;
     }
-    const number = NUMBER_PATTERN.exec(source.slice(position));
-    if (number && !IDENTIFIER_START.test(char)) {
+    const number = NUMBER_PATTERN2.exec(source.slice(position));
+    if (number && !IDENTIFIER_START2.test(char)) {
       tokens.push({ kind: "number", value: number[0], position });
       position += number[0].length;
       continue;
     }
-    if (IDENTIFIER_START.test(char)) {
+    if (IDENTIFIER_START2.test(char)) {
       let end = position;
-      while (end < source.length && IDENTIFIER_CHAR.test(source[end])) end += 1;
+      while (end < source.length && IDENTIFIER_CHAR2.test(source[end])) end += 1;
       tokens.push({ kind: "identifier", value: source.slice(position, end), position });
       position = end;
       continue;
@@ -2090,7 +2868,7 @@ function tokenize2(source) {
   tokens.push({ kind: "end", value: "", position: source.length });
   return tokens;
 }
-function readString(source, start) {
+function readString2(source, start) {
   let value = "";
   let position = start + 1;
   while (position < source.length) {
@@ -2109,7 +2887,7 @@ function readString(source, start) {
   }
   throw new PolicyParseError("unterminated string literal", start);
 }
-var Parser2 = class {
+var Parser3 = class {
   constructor(tokens) {
     this.tokens = tokens;
   }
@@ -2251,7 +3029,7 @@ var Parser2 = class {
   /** `ident(.ident)*` — first segment must not be a keyword; later segments may be (e.g. `author.role`). */
   parsePath(description) {
     const first = this.peek();
-    if (first.kind !== "identifier" || KEYWORDS.has(first.value)) {
+    if (first.kind !== "identifier" || KEYWORDS2.has(first.value)) {
       throw new PolicyParseError(`expected ${description}, got '${first.value || "end"}'`, first.position);
     }
     this.advance();
@@ -2297,7 +3075,7 @@ var Parser2 = class {
 function parsePolicy(source) {
   const trimmed = source.trim();
   if (trimmed.length === 0) throw new PolicyParseError("empty policy expression", 0);
-  return { source: trimmed, ast: new Parser2(tokenize2(trimmed)).parse() };
+  return { source: trimmed, ast: new Parser3(tokenize3(trimmed)).parse() };
 }
 
 // src/predicate-v2/compile.ts
@@ -2337,6 +3115,7 @@ var FLIPPED = {
   ">=": "<="
 };
 function resolveTable(resolver, table) {
+  resolver.onTable?.(table);
   const info = resolver.tables[table];
   if (!info) {
     throw new PolicyCompileError(`unknown table '${table}'`, "unknown-table", Object.keys(resolver.tables));
@@ -2981,15 +3760,6 @@ function classifyInputType(name2, tableByTypename) {
   return void 0;
 }
 
-// src/errors.ts
-var OrmDefinitionError = class extends Error {
-  constructor(message, file) {
-    super(file ? `${file}: ${message}` : message);
-    this.file = file;
-  }
-  name = "OrmDefinitionError";
-};
-
 // src/canonical/composition.ts
 function localContract(definition) {
   return normalizeCanonical(localDefinitionSchema.parse(definition));
@@ -3560,12 +4330,12 @@ function computeOpHash({
   definition,
   schemaHash
 }) {
-  const digest = crypto.createHash("sha256").update(OP_HASH_DOMAIN).update(`${COMPILER_MAJOR}\0${schemaHash}\0`).update(canonicalOperationText(definition)).digest("hex");
-  return `sha256:${digest}`;
+  const digest2 = crypto.createHash("sha256").update(OP_HASH_DOMAIN).update(`${COMPILER_MAJOR}\0${schemaHash}\0`).update(canonicalOperationText(definition)).digest("hex");
+  return `sha256:${digest2}`;
 }
 function computeOpsHash(opHashes) {
-  const digest = crypto.createHash("sha256").update(OPS_HASH_DOMAIN).update([...opHashes].sort().join("\n")).digest("hex");
-  return `sha256:${digest}`;
+  const digest2 = crypto.createHash("sha256").update(OPS_HASH_DOMAIN).update([...opHashes].sort().join("\n")).digest("hex");
+  return `sha256:${digest2}`;
 }
 var SOURCE_DIRECTIVES = /* @__PURE__ */ new Set(["prefetch", "writeback", "localOnly"]);
 var fail = (message, code) => {
@@ -5020,8 +5790,8 @@ function restrictOperation({
 // src/compiler-gql/artifact.ts
 var SCHEMA_HASH_DOMAIN = "sequence-orm-canonical-v2\0";
 function computeSchemaHash(canonical) {
-  const digest = crypto.createHash("sha256").update(SCHEMA_HASH_DOMAIN).update(stableJson(canonical)).digest("hex");
-  return `sha256:${digest}`;
+  const digest2 = crypto.createHash("sha256").update(SCHEMA_HASH_DOMAIN).update(stableJson(canonical)).digest("hex");
+  return `sha256:${digest2}`;
 }
 function compileNamespace({ canonical, sdl, documents }) {
   const { ctx, diagnostics } = buildCompileContext(canonical);
@@ -6475,10 +7245,13 @@ function sqlHash(value) {
   return `sha256:${crypto.createHash("sha256").update(value).digest("hex")}`;
 }
 function createSqlCatalog({ canonical, publishedObjects, executionTarget }) {
-  if (!publishedObjects.length || new Set(publishedObjects).size !== publishedObjects.length) throw new Error("SQL objects must be explicitly declared and unique");
   const { ctx, diagnostics } = buildCompileContext(canonical);
   if (diagnostics.some((d) => d.severity === "error")) throw new Error(diagnostics.map((d) => d.message).join("; "));
-  const identity = sqlHash(`ontology-sql-v1\0${computeSchemaHash(canonical)}\0${executionTarget}`);
+  return createSqlCatalogFromContext({ canonical, publishedObjects, executionTarget, ctx });
+}
+function createSqlCatalogFromContext({ canonical, publishedObjects, executionTarget, ctx, identity: suppliedIdentity }) {
+  if (!publishedObjects.length || new Set(publishedObjects).size !== publishedObjects.length) throw new Error("SQL objects must be explicitly declared and unique");
+  const identity = suppliedIdentity ?? sqlHash(`ontology-sql-v1\0${computeSchemaHash(canonical)}\0${executionTarget}`);
   const logicalNames = new Map(Object.entries(ctx.tables).map(([key, meta]) => [meta, key]));
   const refOf = (meta) => `${meta.namespace ?? canonical.namespace}/${logicalNames.get(meta)}`;
   const definitions = [canonical, ...canonical.imports ?? []];
@@ -6615,9 +7388,10 @@ var SqlEmitter = class {
         only(cte, ["ctename", "ctequery", "ctematerialized", "location"]);
         const name2 = str(cte.ctename);
         if (scope.ctes.has(name2)) fail3("duplicate CTE");
+        const materialization = cte.ctematerialized === "CTEMaterializeAlways" ? "MATERIALIZED " : cte.ctematerialized === "CTEMaterializeNever" ? "NOT MATERIALIZED " : cte.ctematerialized === "CTEMaterializeDefault" ? "" : fail3("unsupported CTE materialization");
         const result2 = this.select(obj(cte.ctequery), { ...parent, ctes: scope.ctes });
         scope.ctes.set(name2, result2);
-        ctes.push(`${quoteIdentifier(name2)} AS (${result2.text})`);
+        ctes.push(`${quoteIdentifier(name2)} AS ${materialization}(${result2.text})`);
       }
     }
     const result = node.op === "SETOP_UNION" ? this.union(node, scope) : this.projection(node, scope);
@@ -7223,7 +7997,7 @@ function compileBuiltinSqlArtifact({ namespace, definitions, read, unbackedObjec
     if (owner !== namespace && selected.some((identity) => !definition.exports?.[identity.slice(owner.length + 1)]?.read)) {
       throw new Error("SQL object is not exported");
     }
-    objects.push(...createSqlCatalog({ canonical: definition, publishedObjects: selected, executionTarget }).objects);
+    objects.push(...createSqlCatalogFromContext({ canonical: definition, publishedObjects: selected, executionTarget, ctx }).objects);
   }
   if (objects.length !== read.length) throw new Error("SQL object is unavailable");
   const actualRead = [...new Set(objects.flatMap((object) => object.read))].sort();
@@ -7261,6 +8035,177 @@ function compileBuiltinSqlArtifact({ namespace, definitions, read, unbackedObjec
     } }
   });
 }
+var OBJECT_METADATA_FORMAT = 1;
+var digest = zod.z.string().regex(/^sha256:[a-f0-9]{64}$/u);
+var objectSqlBundleSchema = zod.z.object({
+  format: zod.z.literal(OBJECT_METADATA_FORMAT),
+  dependencies: zod.z.record(zod.z.string(), digest),
+  object: sqlObjectIrSchema,
+  tables: zod.z.record(zod.z.string(), tableMetaIrSchema),
+  readPolicies: zod.z.record(zod.z.string(), predIrSchema)
+}).strict();
+function contractHashes(canonical) {
+  const hashes = /* @__PURE__ */ new Map();
+  for (const owner of [canonical, ...canonical.imports ?? []]) {
+    for (const relation of [...owner.tables, ...owner.views ?? []]) {
+      const name2 = "table" in relation ? relation.table : relation.view;
+      hashes.set(`${owner.namespace}/${name2}`, sqlHash(stableJson([
+        "orm-object-contract-v1",
+        owner.namespace,
+        relation,
+        owner.enums,
+        owner.exports?.[name2]
+      ])));
+    }
+  }
+  return hashes;
+}
+function objectClosure({ roots, tables, policies, sourceDependencies }) {
+  const required = /* @__PURE__ */ new Set(), links = /* @__PURE__ */ new Map();
+  const walk = (pred, table) => {
+    if (!pred) return;
+    if (pred.kind === "and" || pred.kind === "or") for (const operand of pred.operands) walk(operand, table);
+    else if (pred.kind === "not") walk(pred.operand, table);
+    else if (pred.kind === "exists" || pred.kind === "aggPredicate") {
+      const link = tables[table]?.links.find((candidate) => candidate.name === pred.link);
+      if (!link) throw new Error("object policy dependency is unavailable");
+      const used = links.get(table) ?? /* @__PURE__ */ new Set();
+      used.add(link.name);
+      links.set(table, used);
+      visit2(link.target);
+      walk(pred.where, link.target);
+    }
+  };
+  const visit2 = (ref) => {
+    if (required.has(ref)) return;
+    const meta = tables[ref];
+    if (!meta) throw new Error("object dependency is unavailable");
+    required.add(ref);
+    if (required.size > 1024) throw new Error("object dependency budget exceeded");
+    walk(policies[ref], ref);
+    for (const dependency of sourceDependencies.get(ref) ?? []) visit2(dependency);
+    for (const backing of meta.dependencies ?? []) visit2(backing);
+  };
+  for (const root of roots) visit2(root);
+  return { required: [...required].sort(), links };
+}
+async function compileObjectMetadata({ canonical: raw }) {
+  const canonical = normalizeCanonical(canonicalDefinitionSchema.parse(raw));
+  await validateManagedViewQueries({ canonical });
+  const context = buildCompileContext(canonical);
+  if (context.diagnostics.some((item) => item.severity === "error")) throw new Error("invalid object metadata definition");
+  const { ctx } = context;
+  const hashes = contractHashes(canonical);
+  const ref = (key) => {
+    const meta = ctx.tables[key];
+    if (!meta) throw new Error("object dependency is unavailable");
+    return `${meta.namespace ?? canonical.namespace}/${key}`;
+  };
+  const tables = {}, policies = {};
+  const sourceDependencies = /* @__PURE__ */ new Map();
+  const relations = [canonical, ...canonical.imports ?? []].flatMap(canonicalRelations);
+  const expressions = new Map(relations.map((relation) => [relation.table, relation.policies.read]));
+  for (const [key, meta] of Object.entries(ctx.tables)) {
+    tables[ref(key)] = {
+      ...meta,
+      namespace: meta.namespace ?? canonical.namespace,
+      links: meta.links.map((link) => ({ ...link, target: ref(link.target) })),
+      ...meta.dependencies ? { dependencies: meta.dependencies.map(ref) } : {},
+      ...meta.foreignReferences ? { foreignReferences: meta.foreignReferences.map((link) => ({ ...link, target: ref(link.target) })) } : {}
+    };
+    const policy = ctx.readPolicies.get(key);
+    if (policy) policies[ref(key)] = policy;
+    const expression = expressions.get(key);
+    if (expression !== void 0) {
+      const consulted = /* @__PURE__ */ new Set();
+      compilePolicy({ expression, table: key, access: "read", resolver: {
+        tables: ctx.tables,
+        onTable: (table) => {
+          consulted.add(ref(table));
+        },
+        readPolicy: (table) => expressions.get(table),
+        policyNamespace: (table) => ctx.tables[table]?.namespace
+      } });
+      sourceDependencies.set(ref(key), [...consulted]);
+    }
+  }
+  const objects = [];
+  for (const relation of [...canonical.tables, ...canonical.views ?? []]) {
+    const name2 = "table" in relation ? relation.table : relation.view;
+    const identity = `${canonical.namespace}/${name2}`, contractHash = hashes.get(identity);
+    let bundle = null;
+    if (!relation.internal) {
+      const object = createSqlCatalogFromContext({
+        canonical,
+        ctx,
+        identity: contractHash,
+        publishedObjects: [identity],
+        executionTarget: "default"
+      }).objects[0];
+      const closure = objectClosure({ roots: object.read, tables, policies, sourceDependencies });
+      bundle = objectSqlBundleSchema.parse({
+        format: OBJECT_METADATA_FORMAT,
+        object,
+        // platformUsers is compiler-owned metadata, pinned by the format above.
+        dependencies: Object.fromEntries(closure.required.filter((key) => hashes.has(key)).map((key) => [key, hashes.get(key)])),
+        tables: Object.fromEntries(closure.required.map((key) => {
+          const { foreignReferences: _writeReferences, ...meta } = tables[key];
+          return [key, { ...meta, links: meta.links.filter((link) => closure.links.get(key)?.has(link.name)) }];
+        })),
+        readPolicies: Object.fromEntries(closure.required.filter((key) => policies[key]).map((key) => [key, policies[key]]))
+      });
+    }
+    objects.push({ name: name2, contractHash, bundle });
+  }
+  return {
+    format: OBJECT_METADATA_FORMAT,
+    objects,
+    relations: Object.values(ctx.tables).map(({ schema, table }) => ({ schema, table }))
+  };
+}
+function composeObjectSqlArtifact({ namespace, bundles }) {
+  const tables = {}, readPolicies = {};
+  const pins = /* @__PURE__ */ new Map();
+  const objects = bundles.map((bundle) => {
+    if (!bundle.object.ref.startsWith(`${namespace}/`) && !bundle.tables[bundle.object.ref]?.exportRead) throw new Error("SQL object is not exported");
+    for (const [ref, hash] of Object.entries(bundle.dependencies)) {
+      if (pins.has(ref) && pins.get(ref) !== hash) throw new Error("inconsistent object contracts");
+      pins.set(ref, hash);
+    }
+    for (const [ref, meta] of Object.entries(bundle.tables)) {
+      const previous = tables[ref];
+      const links = new Map([...previous?.links ?? [], ...meta.links].map((link) => [link.name, link]));
+      tables[ref] = { ...meta, links: [...links.values()] };
+    }
+    Object.assign(readPolicies, bundle.readPolicies);
+    return bundle.object;
+  });
+  const read = [...new Set(objects.flatMap((object) => object.read))].sort();
+  const identity = sqlHash(stableJson(["orm-object-sql-v1", namespace, bundles]));
+  return normalizeIr({
+    irVersion: usesServicePrincipal(readPolicies) ? SERVICE_PRINCIPAL_IR_VERSION : RUNTIME_SQL_IR_VERSION,
+    namespace,
+    schemaHash: identity,
+    opsHash: BUILTIN_SQL_READ_HASH,
+    tables,
+    readPolicies,
+    operations: { BuiltinSqlRead: {
+      irVersion: RUNTIME_SQL_IR_VERSION,
+      name: "BuiltinSqlRead",
+      opHash: BUILTIN_SQL_READ_HASH,
+      language: "sql",
+      kind: "query",
+      requires: null,
+      roots: [],
+      tableSet: read,
+      variables: [
+        { name: "sql", type: { kind: "scalar", scalar: "text" }, nullable: false, list: false },
+        { name: "parameters", type: { kind: "scalar", scalar: "jsonb" }, nullable: true, list: false }
+      ],
+      sqlQuery: { catalog: { identity, objects }, read, maxRows: 1e3 }
+    } }
+  });
+}
 var DATASET_PREVIEW_LIMIT = 100;
 function compileDatasetPreviews(input) {
   const canonical = normalizeCanonical(input);
@@ -7306,6 +8251,64 @@ function compileDatasetPreviews(input) {
   return operations;
 }
 
+// src/compiler-gql/operation-metadata.ts
+var OPERATION_METADATA_FORMAT = 1;
+function projectOperationMetadata({ artifact, operation }) {
+  const required = /* @__PURE__ */ new Set(), dynamic = /* @__PURE__ */ new Set();
+  const visit2 = (table) => {
+    if (required.has(table)) return;
+    const meta = artifact.tables[table];
+    if (!meta) throw new Error(`operation metadata references missing table '${table}'`);
+    required.add(table);
+    walk(artifact.readPolicies?.[table], table);
+    for (const dependency of meta.dependencies ?? []) visit2(dependency);
+  };
+  const walk = (value, table) => {
+    if (Array.isArray(value)) {
+      for (const child of value) walk(child, table);
+      return;
+    }
+    if (!value || typeof value !== "object") return;
+    const node = value;
+    let scope = typeof node.table === "string" && artifact.tables[node.table] ? node.table : table;
+    if (scope !== table) visit2(scope);
+    if (typeof node.link === "string") {
+      const link = artifact.tables[scope]?.links.find((candidate) => candidate.name === node.link);
+      if (!link) throw new Error("operation metadata has an unresolved relationship");
+      scope = link.target;
+      visit2(scope);
+    }
+    for (const [key, child] of Object.entries(node)) {
+      if (["value", "objects", "set", "inc", "append", "pk", "onConflict"].includes(key)) continue;
+      walk(child, scope);
+    }
+  };
+  const visitDynamic = (table) => {
+    if (dynamic.has(table)) return;
+    dynamic.add(table);
+    visit2(table);
+    for (const link of artifact.tables[table].links) visitDynamic(link.target);
+  };
+  for (const table of operation.tableSet) visit2(table);
+  for (const root of operation.roots) {
+    visit2(root.table);
+    walk(root, root.table);
+    if (root.kind === "mutation" && !["delete", "deleteByPk", "cowRevert"].includes(root.op)) {
+      for (const reference of artifact.tables[root.table].foreignReferences ?? []) visit2(reference.target);
+    }
+  }
+  for (const variable of operation.variables) if (variable.type.kind === "inputRef") {
+    visit2(variable.type.table);
+    if (["boolExp", "orderBy"].includes(variable.type.input)) visitDynamic(variable.type.table);
+  }
+  return normalizeIr({
+    ...artifact,
+    tables: Object.fromEntries([...required].sort().map((table) => [table, artifact.tables[table]])),
+    readPolicies: Object.fromEntries([...required].filter((table) => artifact.readPolicies?.[table]).map((table) => [table, artifact.readPolicies[table]])),
+    operations: { [operation.name]: operation }
+  });
+}
+
 exports.COMPILER_MAJOR = COMPILER_MAJOR;
 exports.CONST_TRUE = CONST_TRUE;
 exports.DATASET_PREVIEW_LIMIT = DATASET_PREVIEW_LIMIT;
@@ -7313,6 +8316,8 @@ exports.DEFAULT_LIMIT = DEFAULT_LIMIT;
 exports.DocumentCompileError = DocumentCompileError;
 exports.MAX_LIMIT = MAX_LIMIT;
 exports.NamespaceCompileError = NamespaceCompileError;
+exports.OBJECT_METADATA_FORMAT = OBJECT_METADATA_FORMAT;
+exports.OPERATION_METADATA_FORMAT = OPERATION_METADATA_FORMAT;
 exports.ORDER_BY_DIRECTIONS = ORDER_BY_DIRECTIONS;
 exports.OperationLowerer = OperationLowerer;
 exports.PLATFORM_USER_TABLE = PLATFORM_USER_TABLE;
@@ -7336,10 +8341,12 @@ exports.compileDatasetPreviews = compileDatasetPreviews;
 exports.compileDefaultOperations = compileDefaultOperations;
 exports.compileNamespace = compileNamespace;
 exports.compileNamespaceOrThrow = compileNamespaceOrThrow;
+exports.compileObjectMetadata = compileObjectMetadata;
 exports.compileOperationDocuments = compileOperationDocuments;
 exports.compilePolicy = compilePolicy;
 exports.compilePredicateV2 = compilePredicateV2;
 exports.compileRuntimeSql = compileRuntimeSql;
+exports.composeObjectSqlArtifact = composeObjectSqlArtifact;
 exports.computeOpHash = computeOpHash;
 exports.computeOpsHash = computeOpsHash;
 exports.computePinnedColumnsByTable = computePinnedColumnsByTable;
@@ -7353,6 +8360,7 @@ exports.inputTypeName = inputTypeName;
 exports.isSqlOperationDocument = isSqlOperationDocument;
 exports.lowerOperation = lowerOperation;
 exports.mutationRootNames = mutationRootNames;
+exports.objectSqlBundleSchema = objectSqlBundleSchema;
 exports.parseDocuments = parseDocuments;
 exports.parsePolicy = parsePolicy;
 exports.parseSdl = parseSdl;
@@ -7360,6 +8368,7 @@ exports.pascalCase = pascalCase;
 exports.platformUserMeta = platformUserMeta;
 exports.predContains = predContains;
 exports.predContainsExists = predContainsExists;
+exports.projectOperationMetadata = projectOperationMetadata;
 exports.queryRootNames = queryRootNames;
 exports.referencedSqlObjects = referencedSqlObjects;
 exports.restrictOperation = restrictOperation;