@sequenceholdings/orm 2.9.0 → 2.11.0

package/dist/predicate-v2.js

@@ -30,11 +30,16 @@ var PolicyCompileError = class extends Error {
 
 // src/constants.ts
 var NAMESPACE_PATTERN = /^(?!(?:events|native_sources)$)[a-z][a-z0-9_]{0,40}$/;
+var IDENTIFIER_PATTERN = /^[a-z][a-z0-9_]*$/;
 var COLUMN_IDENTIFIER_PATTERN = /^_?[a-z][a-z0-9_]*$/;
 var MAX_IDENTIFIER_LENGTH = 63;
 var CAPABILITY_KEY_PATTERN = /^(?:org\/|app\/[a-z][a-z0-9-]{0,63}\/)?[a-z0-9-]{1,64}$/;
 var MAX_PERSISTED_READ_ROWS = 50001;
+var CLAIM_KEY_PATTERN = /^[a-z][a-z0-9_]*$/;
 var QUALIFIED_TABLE_PATTERN = /^[a-z][a-z0-9_]{0,62}\.[a-z][a-z0-9_]{0,62}$/;
+var SYNCED_SOURCE_PATTERN = QUALIFIED_TABLE_PATTERN;
+var RESERVED_TABLE_NAMES = /* @__PURE__ */ new Set(["actions", "query"]);
+var RESERVED_COLUMN_NAMES = /* @__PURE__ */ new Set(["select", "order", "limit", "offset"]);
 var CELL_PARTS = ["at", "by", "rev", "source", "conflicts"];
 var CELL_PART_SUFFIX = {
   at: "__at",
@@ -247,6 +252,741 @@ var Parser = class {
 function compileCheckExpression(source, columns) {
   return new Parser(tokenize(source), columns).parse();
 }
+
+// src/predicate/ast.ts
+var COMPARE_OPS = ["=", "!=", "<", "<=", ">", ">="];
+function walkPredicate(predicate, visit) {
+  visit(predicate);
+  if (predicate.kind === "and" || predicate.kind === "or") {
+    for (const operand of predicate.operands) walkPredicate(operand, visit);
+  }
+  if (predicate.kind === "not") walkPredicate(predicate.operand, visit);
+}
+function predicateOperands(predicate) {
+  const operands = [];
+  walkPredicate(predicate, (node) => {
+    if (node.kind === "compare") operands.push(node.left, node.right);
+  });
+  return operands;
+}
+function referencedColumns(predicate) {
+  const names = predicateOperands(predicate).flatMap(
+    (operand) => operand.kind === "column" ? [operand.name] : []
+  );
+  return [...new Set(names)];
+}
+var identifierSchema = z.string().max(MAX_IDENTIFIER_LENGTH).regex(IDENTIFIER_PATTERN, "must be a lowercase identifier (a-z, 0-9, _)");
+var namespaceSchema = z.string().regex(NAMESPACE_PATTERN, "must be lowercase, start with a letter, and be at most 41 characters");
+var tableReferenceSchema = z.string().refine(
+  (value) => IDENTIFIER_PATTERN.test(value) || QUALIFIED_TABLE_PATTERN.test(value),
+  "must be a table name or a schema-qualified table reference"
+);
+
+// src/schema/columns.ts
+var COLUMN_TYPES = [
+  "uuid",
+  "text",
+  "integer",
+  "bigint",
+  "numeric",
+  "double",
+  "boolean",
+  "timestamptz",
+  "date",
+  "jsonb"
+];
+var columnTypeSchema = z.enum(COLUMN_TYPES);
+var FUNCTION_DEFAULTS = {
+  "gen_random_uuid()": ["uuid"],
+  "now()": ["timestamptz", "date"]
+};
+var CAST_PATTERN = /^([a-z][a-z0-9_]*)::([a-z]+)$/;
+function defaultIssue(value, type) {
+  if (typeof value === "boolean") return type === "boolean" ? null : `boolean default is invalid for type '${type}'`;
+  if (typeof value === "number") {
+    if (!["integer", "bigint", "numeric", "double"].includes(type)) {
+      return `numeric default is invalid for type '${type}'`;
+    }
+    if (["integer", "bigint"].includes(type)) {
+      if (!Number.isInteger(value)) return `default for type '${type}' must be an integer`;
+      if (!Number.isSafeInteger(value)) {
+        return `default for type '${type}' exceeds the safe integer range \u2014 YAML numbers lose precision past 2^53`;
+      }
+    }
+    if (type === "numeric" && Math.abs(value) > Number.MAX_SAFE_INTEGER) {
+      return "numeric default exceeds the safe float range \u2014 write it as a string (e.g. '9007199254740993') to keep exact precision";
+    }
+    return null;
+  }
+  const allowedTypes = FUNCTION_DEFAULTS[value];
+  if (allowedTypes) return allowedTypes.includes(type) ? null : `default '${value}' is invalid for type '${type}'`;
+  return null;
+}
+var columnSchema = z.strictObject({
+  type: columnTypeSchema,
+  primary_key: z.boolean().optional(),
+  nullable: z.boolean().optional(),
+  unique: z.boolean().optional(),
+  default: z.union([z.string(), z.number(), z.boolean()]).optional(),
+  description: z.string().optional(),
+  renamed_from: identifierSchema.optional(),
+  cast: z.string().optional(),
+  deprecated: z.boolean().optional()
+}).superRefine((column, ctx) => {
+  if (column.default !== void 0) {
+    const issue = defaultIssue(column.default, column.type);
+    if (issue) ctx.addIssue({ code: "custom", message: issue, path: ["default"] });
+  }
+  if (column.primary_key && column.nullable) {
+    ctx.addIssue({ code: "custom", message: "a primary key column cannot be nullable", path: ["nullable"] });
+  }
+  if (column.primary_key && column.deprecated) {
+    ctx.addIssue({ code: "custom", message: "a primary key column cannot be deprecated", path: ["deprecated"] });
+  }
+  if (column.cast && !CAST_PATTERN.test(column.cast)) {
+    ctx.addIssue({ code: "custom", message: "cast must have the shape '<column>::<type>'", path: ["cast"] });
+  }
+});
+function castParts(cast) {
+  const match = CAST_PATTERN.exec(cast);
+  if (!match) return null;
+  return { column: match[1], type: match[2] };
+}
+
+// src/errors.ts
+var PredicateParseError = class extends Error {
+  constructor(message, position) {
+    super(`${message} (at position ${position})`);
+    this.position = position;
+  }
+  name = "PredicateParseError";
+};
+
+// src/predicate/parse.ts
+var KEYWORDS = /* @__PURE__ */ new Set(["and", "or", "not", "true", "false", "null", "claim", "capability"]);
+var OPERATOR_PATTERN = /^(!=|<=|>=|<>|=|<|>)/;
+var IDENTIFIER_START = /[a-z_]/;
+var IDENTIFIER_CHAR = /[a-z0-9_.-]/;
+var NUMBER_PATTERN = /^-?\d+(\.\d+)?/;
+function tokenize2(source) {
+  const tokens = [];
+  let position = 0;
+  while (position < source.length) {
+    const char = source[position];
+    if (/\s/.test(char)) {
+      position += 1;
+      continue;
+    }
+    if (char === "(") {
+      tokens.push({ kind: "lparen", value: char, position });
+      position += 1;
+      continue;
+    }
+    if (char === ")") {
+      tokens.push({ kind: "rparen", value: char, position });
+      position += 1;
+      continue;
+    }
+    if (char === ",") {
+      tokens.push({ kind: "comma", value: char, position });
+      position += 1;
+      continue;
+    }
+    if (char === "'") {
+      const { value, end } = readString(source, position);
+      tokens.push({ kind: "string", value, position });
+      position = end;
+      continue;
+    }
+    const operator = OPERATOR_PATTERN.exec(source.slice(position));
+    if (operator) {
+      const value = operator[0] === "<>" ? "!=" : operator[0];
+      tokens.push({ kind: "operator", value, position });
+      position += operator[0].length;
+      continue;
+    }
+    const number = NUMBER_PATTERN.exec(source.slice(position));
+    if (number && !IDENTIFIER_START.test(char)) {
+      tokens.push({ kind: "number", value: number[0], position });
+      position += number[0].length;
+      continue;
+    }
+    if (IDENTIFIER_START.test(char)) {
+      let end = position;
+      while (end < source.length && IDENTIFIER_CHAR.test(source[end])) end += 1;
+      tokens.push({ kind: "identifier", value: source.slice(position, end), position });
+      position = end;
+      continue;
+    }
+    throw new PredicateParseError(`unexpected character '${char}'`, position);
+  }
+  tokens.push({ kind: "end", value: "", position: source.length });
+  return tokens;
+}
+function readString(source, start) {
+  let value = "";
+  let position = start + 1;
+  while (position < source.length) {
+    const char = source[position];
+    if (char !== "'") {
+      value += char;
+      position += 1;
+      continue;
+    }
+    if (source[position + 1] === "'") {
+      value += "'";
+      position += 2;
+      continue;
+    }
+    return { value, end: position + 1 };
+  }
+  throw new PredicateParseError("unterminated string literal", start);
+}
+var Parser2 = class {
+  constructor(tokens) {
+    this.tokens = tokens;
+  }
+  index = 0;
+  parse() {
+    const predicate = this.parseOr();
+    this.expect("end", "end of expression");
+    return predicate;
+  }
+  parseOr() {
+    const operands = [this.parseAnd()];
+    while (this.matchKeyword("or")) operands.push(this.parseAnd());
+    return operands.length === 1 ? operands[0] : { kind: "or", operands };
+  }
+  parseAnd() {
+    const operands = [this.parseNot()];
+    while (this.matchKeyword("and")) operands.push(this.parseNot());
+    return operands.length === 1 ? operands[0] : { kind: "and", operands };
+  }
+  parseNot() {
+    if (this.matchKeyword("not")) return { kind: "not", operand: this.parseNot() };
+    return this.parsePrimary();
+  }
+  parsePrimary() {
+    if (this.peek().kind === "lparen") {
+      this.advance();
+      const inner = this.parseOr();
+      this.expect("rparen", "')'");
+      return inner;
+    }
+    if (this.peekKeyword("capability")) {
+      const capability = this.parseCapability();
+      const next = this.peek();
+      if (next.kind === "operator") {
+        throw new PredicateParseError("capability() is boolean-valued and cannot appear in a comparison", next.position);
+      }
+      return capability;
+    }
+    return this.parseComparison();
+  }
+  parseCapability() {
+    this.advance();
+    const key = this.parseCallArgument("capability");
+    if (!CAPABILITY_KEY_PATTERN.test(key)) {
+      throw new PredicateParseError(`invalid capability key '${key}'`, this.peek().position);
+    }
+    return { kind: "capability", key };
+  }
+  parseComparison() {
+    const left = this.parseOperand();
+    const operator = this.expect("operator", "a comparison operator");
+    if (!COMPARE_OPS.includes(operator.value)) {
+      throw new PredicateParseError(`unsupported operator '${operator.value}'`, operator.position);
+    }
+    const right = this.parseOperand();
+    return { kind: "compare", op: operator.value, left, right };
+  }
+  parseOperand() {
+    const token = this.peek();
+    if (token.kind === "string") {
+      this.advance();
+      return { kind: "literal", value: token.value };
+    }
+    if (token.kind === "number") {
+      this.advance();
+      const value = Number(token.value);
+      if (!Number.isFinite(value) || Number.isInteger(value) && !Number.isSafeInteger(value)) {
+        throw new PredicateParseError(
+          `numeric literal '${token.value}' exceeds safe integer precision \u2014 quote it as a string`,
+          token.position
+        );
+      }
+      return { kind: "literal", value };
+    }
+    if (token.kind !== "identifier") {
+      throw new PredicateParseError(`expected an operand, got '${token.value || "end"}'`, token.position);
+    }
+    this.advance();
+    if (token.value === "true" || token.value === "false") {
+      return { kind: "literal", value: token.value === "true" };
+    }
+    if (token.value === "null") return { kind: "literal", value: null };
+    if (token.value === "claim") {
+      const key = this.parseCallArgument("claim");
+      if (!CLAIM_KEY_PATTERN.test(key)) {
+        throw new PredicateParseError(`invalid claim key '${key}'`, token.position);
+      }
+      return { kind: "claim", key };
+    }
+    if (token.value === "capability") {
+      throw new PredicateParseError("capability() is boolean-valued and cannot appear in a comparison", token.position);
+    }
+    if (KEYWORDS.has(token.value) || !IDENTIFIER_PATTERN.test(token.value)) {
+      throw new PredicateParseError(`invalid column reference '${token.value}'`, token.position);
+    }
+    return { kind: "column", name: token.value };
+  }
+  parseCallArgument(fn) {
+    this.expect("lparen", `'(' after ${fn}`);
+    const argument = this.expect("string", `a quoted key in ${fn}(...)`);
+    this.expect("rparen", `')' after ${fn} key`);
+    return argument.value;
+  }
+  peek() {
+    return this.tokens[this.index];
+  }
+  peekKeyword(keyword) {
+    const token = this.peek();
+    return token.kind === "identifier" && token.value === keyword;
+  }
+  matchKeyword(keyword) {
+    if (!this.peekKeyword(keyword)) return false;
+    this.advance();
+    return true;
+  }
+  advance() {
+    const token = this.peek();
+    if (token.kind !== "end") this.index += 1;
+    return token;
+  }
+  expect(kind, description) {
+    const token = this.peek();
+    if (token.kind !== kind) {
+      throw new PredicateParseError(`expected ${description}, got '${token.value || "end"}'`, token.position);
+    }
+    return this.advance();
+  }
+};
+function parsePredicate(source) {
+  const trimmed = source.trim();
+  if (trimmed.length === 0) throw new PredicateParseError("empty predicate", 0);
+  return { source: trimmed, ast: new Parser2(tokenize2(trimmed)).parse() };
+}
+
+// src/schema/predicates.ts
+var parsedPredicateSchema = z.string().transform((source, ctx) => {
+  try {
+    return parsePredicate(source);
+  } catch (error) {
+    ctx.addIssue({ code: "custom", message: error instanceof Error ? error.message : String(error) });
+    return z.NEVER;
+  }
+});
+
+// src/schema/actions.ts
+var EXECUTES_VERB_PATTERN = /^\s*(insert|update|delete)\b/i;
+var DOLLAR_QUOTE_PATTERN = /\$[a-zA-Z0-9_]*\$/;
+var RETURNING_PATTERN = /\breturning\b/i;
+var ESCAPE_STRING_PATTERN = /(?<![a-zA-Z0-9_])[Ee]'/;
+var MASKED_CLAIM_CALL_PATTERN = /\b(?:claim|capability)\(\s*''\s*\)/g;
+var BARE_CLAIM_CALL_PATTERN = /\b(?:claim|capability)\s*\(/;
+var EXISTS_ENTRY_PATTERN = /^exists\(\s*'([^']+)'\s*,\s*([a-z][a-z0-9_]*)\s*\)$/;
+var NAMED_PARAM_PATTERN = /(?<!:):([a-z][a-z0-9_]*)/g;
+var QUOTED_STRING_PATTERN = /'(?:[^']|'')*'/g;
+var SQL_COMMENT_PATTERN = /--|\/\*/;
+var actionParamSchema = z.strictObject({
+  type: columnTypeSchema,
+  optional: z.boolean().optional(),
+  description: z.string().optional()
+});
+var validatesEntrySchema = z.string().transform((source, ctx) => {
+  const match = EXISTS_ENTRY_PATTERN.exec(source.trim());
+  if (!match) {
+    ctx.addIssue({ code: "custom", message: "validates entries must have the shape exists('<table>', <param>)" });
+    return z.NEVER;
+  }
+  const table = tableReferenceSchema.safeParse(match[1]);
+  if (!table.success) {
+    ctx.addIssue({ code: "custom", message: `invalid table reference '${match[1]}'` });
+    return z.NEVER;
+  }
+  return { source: source.trim(), table: table.data, param: match[2] };
+});
+var AUDIT_ACTIONS = ["create", "update", "delete"];
+var auditSchema = z.strictObject({
+  action: z.enum(AUDIT_ACTIONS),
+  resource: identifierSchema.optional()
+});
+var actionSchema = z.strictObject({
+  description: z.string().optional(),
+  requires: parsedPredicateSchema.optional(),
+  params: z.record(identifierSchema, actionParamSchema).optional(),
+  validates: z.array(validatesEntrySchema).optional(),
+  // One statement, or an ordered list run atomically in the action function.
+  executes: z.union([z.string().min(1), z.array(z.string().min(1)).min(1)]),
+  // Declares the columns the action's RETURNING yields. Present → the
+  // function returns those rows (typed in the client); absent → the action
+  // reports rows_affected only. The column names/types must match the
+  // RETURNING list, which Postgres enforces at CREATE FUNCTION.
+  returns: z.record(identifierSchema, columnTypeSchema).optional(),
+  audit: auditSchema.optional()
+}).superRefine((action, ctx) => {
+  const params = Object.keys(action.params ?? {});
+  if (action.requires && referencedColumns(action.requires.ast).length > 0) {
+    ctx.addIssue({
+      code: "custom",
+      message: "requires may reference claims and capabilities only, not columns",
+      path: ["requires"]
+    });
+  }
+  for (const issue of executesIssues(action.executes, new Set(params), action.returns !== void 0)) {
+    ctx.addIssue({ code: "custom", message: issue, path: ["executes"] });
+  }
+  if (action.returns && Object.keys(action.returns).length === 0) {
+    ctx.addIssue({ code: "custom", message: "returns must declare at least one column", path: ["returns"] });
+  }
+  for (const [index, entry] of (action.validates ?? []).entries()) {
+    if (!params.includes(entry.param)) {
+      ctx.addIssue({
+        code: "custom",
+        message: `validates references undeclared param '${entry.param}'`,
+        path: ["validates", index]
+      });
+    }
+  }
+});
+function extractNamedParams(sql) {
+  const withoutStrings = sql.replace(QUOTED_STRING_PATTERN, "''");
+  const names = [...withoutStrings.matchAll(NAMED_PARAM_PATTERN)].map((match) => match[1]);
+  return [...new Set(names)];
+}
+function actionStatementSources(executes) {
+  return (Array.isArray(executes) ? executes : [executes]).map((statement) => statement.trim());
+}
+function executesIssues(executes, declaredParams, hasReturns) {
+  const issues = [];
+  const statements = actionStatementSources(executes);
+  statements.forEach((statement, index) => {
+    const withoutStrings = statement.replace(QUOTED_STRING_PATTERN, "''");
+    const at = statements.length > 1 ? ` (statement ${index + 1})` : "";
+    if (!EXECUTES_VERB_PATTERN.test(statement)) issues.push(`executes must be INSERT, UPDATE, or DELETE${at}`);
+    if (withoutStrings.replace(/;\s*$/, "").includes(";")) issues.push(`each executes entry must be a single statement${at}`);
+    if (SQL_COMMENT_PATTERN.test(withoutStrings)) issues.push(`executes must not contain SQL comments${at}`);
+    if (DOLLAR_QUOTE_PATTERN.test(withoutStrings)) issues.push(`executes must not use dollar-quoted strings${at}`);
+    if (ESCAPE_STRING_PATTERN.test(withoutStrings)) issues.push(`executes must not use escape strings (E'\u2026')${at}`);
+    if (withoutStrings.includes('"')) issues.push(`executes must not use double-quoted identifiers${at}`);
+    if (BARE_CLAIM_CALL_PATTERN.test(withoutStrings.replace(MASKED_CLAIM_CALL_PATTERN, ""))) {
+      issues.push(`executes has a malformed claim()/capability() call \u2014 use e.g. claim('sub')${at}`);
+    }
+    if (RETURNING_PATTERN.test(withoutStrings) && !(hasReturns && index === statements.length - 1)) {
+      issues.push(
+        hasReturns ? `only the last executes statement may use RETURNING${at}` : `executes must not use RETURNING unless the action declares returns${at}`
+      );
+    }
+  });
+  const last = statements.at(-1);
+  if (hasReturns && last && !RETURNING_PATTERN.test(last.replace(QUOTED_STRING_PATTERN, "''"))) {
+    issues.push("the last executes statement must use RETURNING to populate the declared returns columns");
+  }
+  const undeclared = extractNamedParams(statements.join("\n")).filter((name) => !declaredParams.has(name));
+  if (undeclared.length > 0) issues.push(`executes references undeclared params: ${undeclared.join(", ")}`);
+  return issues;
+}
+
+// src/schema/table.ts
+var linkSchema = z.strictObject({
+  to: tableReferenceSchema,
+  on: identifierSchema,
+  enforce: z.boolean().optional(),
+  description: z.string().optional()
+});
+var indexSchema = z.union([
+  z.array(identifierSchema).min(1),
+  z.strictObject({
+    columns: z.array(identifierSchema).min(1),
+    unique: z.boolean().optional(),
+    name: identifierSchema.optional()
+  })
+]).transform((index) => Array.isArray(index) ? { columns: index } : index);
+var policiesSchema = z.strictObject({
+  read: parsedPredicateSchema.optional(),
+  write: parsedPredicateSchema.optional(),
+  insert: parsedPredicateSchema.optional(),
+  update: parsedPredicateSchema.optional()
+});
+z.strictObject({
+  namespace: namespaceSchema,
+  table: identifierSchema,
+  description: z.string().optional(),
+  columns: z.record(identifierSchema, columnSchema).optional(),
+  source: z.string().regex(SYNCED_SOURCE_PATTERN, "source must be a qualified lowercase schema.table identifier").optional(),
+  links: z.record(identifierSchema, linkSchema).optional(),
+  indexes: z.array(indexSchema).optional(),
+  policies: policiesSchema.optional(),
+  actions: z.record(identifierSchema, actionSchema).optional()
+}).superRefine((table, ctx) => {
+  if (RESERVED_TABLE_NAMES.has(table.table)) {
+    ctx.addIssue({ code: "custom", message: `'${table.table}' is a reserved table name`, path: ["table"] });
+  }
+  for (const name of Object.keys(table.columns ?? {})) {
+    if (RESERVED_COLUMN_NAMES.has(name)) {
+      ctx.addIssue({
+        code: "custom",
+        message: `column '${name}' collides with the Data API's reserved query parameters (select, order, limit, offset) \u2014 it could never be filtered`,
+        path: ["columns", name]
+      });
+    }
+  }
+  if (table.source) validateSyncedTable(table, ctx);
+  else validateColumnTable(table, ctx);
+  validateLinks(table, ctx);
+  validatePolicyColumns(table, ctx);
+  validateDerivedNameLengths(table, ctx);
+});
+var indexName = (table, definition) => definition.name ?? `ix_${table}_${definition.columns.join("_")}`;
+var policyName = (table, suffix) => `${table}_${suffix}`;
+var foreignKeyName = (table, link) => `fk_${table}_${link}`;
+function validateSyncedTable(table, ctx) {
+  const forbidden = [
+    ["actions", "synced tables are read-only; actions are not allowed"],
+    ["indexes", "v1 synced tables cannot declare indexes; declare them with defineSyncedTable({ indexes }) in a v2 definition"]
+  ];
+  for (const [field, message] of forbidden) {
+    if (table[field] !== void 0) ctx.addIssue({ code: "custom", message, path: [field] });
+  }
+  if (table.policies?.write) {
+    ctx.addIssue({ code: "custom", message: "synced tables are read-only", path: ["policies", "write"] });
+  }
+  if (table.policies?.insert) {
+    ctx.addIssue({ code: "custom", message: "synced tables are read-only", path: ["policies", "insert"] });
+  }
+  if (table.policies?.update) {
+    ctx.addIssue({ code: "custom", message: "synced tables are read-only", path: ["policies", "update"] });
+  }
+  const columns = table.columns ?? {};
+  const names = Object.keys(columns);
+  if (names.length === 0) return;
+  const primaryKeys = names.filter((name) => columns[name]?.primary_key);
+  if (primaryKeys.length !== 1) {
+    ctx.addIssue({ code: "custom", message: "exactly one column must be primary_key", path: ["columns"] });
+  }
+  validateRenames(columns, names, ctx);
+  for (const name of names) {
+    const column = columns[name];
+    if (!column) continue;
+    const cast = column.cast ? castParts(column.cast) : null;
+    if (column.cast && cast?.column !== name) {
+      ctx.addIssue({
+        code: "custom",
+        message: "cast must reference the column it is declared on",
+        path: ["columns", name, "cast"]
+      });
+    }
+    if (cast && cast.type !== column.type) {
+      ctx.addIssue({
+        code: "custom",
+        message: `cast target '${cast.type}' must match the declared type '${column.type}'`,
+        path: ["columns", name, "cast"]
+      });
+    }
+  }
+}
+function validateRenames(columns, names, ctx) {
+  const renameSources = /* @__PURE__ */ new Map();
+  for (const name of names) {
+    const renamedFrom = columns[name]?.renamed_from;
+    if (!renamedFrom) continue;
+    if (renamedFrom === name || names.includes(renamedFrom)) {
+      ctx.addIssue({
+        code: "custom",
+        message: "renamed_from must name a column that no longer exists",
+        path: ["columns", name, "renamed_from"]
+      });
+    }
+    const claimed = renameSources.get(renamedFrom);
+    if (claimed) {
+      ctx.addIssue({
+        code: "custom",
+        message: `renamed_from '${renamedFrom}' is already claimed by '${claimed}'`,
+        path: ["columns", name, "renamed_from"]
+      });
+    }
+    renameSources.set(renamedFrom, name);
+  }
+}
+function validateColumnTable(table, ctx) {
+  const columns = table.columns ?? {};
+  const names = Object.keys(columns);
+  if (names.length === 0) {
+    ctx.addIssue({ code: "custom", message: "a table must declare columns or a source", path: ["columns"] });
+    return;
+  }
+  const primaryKeys = names.filter((name) => columns[name]?.primary_key);
+  if (primaryKeys.length !== 1) {
+    ctx.addIssue({ code: "custom", message: "exactly one column must be primary_key", path: ["columns"] });
+  }
+  validateRenames(columns, names, ctx);
+  for (const name of names) {
+    const column = columns[name];
+    if (!column) continue;
+    const cast = column.cast ? castParts(column.cast) : null;
+    if (column.cast && cast?.column !== name) {
+      ctx.addIssue({
+        code: "custom",
+        message: "cast must reference the column it is declared on",
+        path: ["columns", name, "cast"]
+      });
+    }
+    if (cast && cast.type !== column.type) {
+      ctx.addIssue({
+        code: "custom",
+        message: `cast target '${cast.type}' must match the declared type '${column.type}'`,
+        path: ["columns", name, "cast"]
+      });
+    }
+  }
+  for (const [position, index] of (table.indexes ?? []).entries()) {
+    if (new Set(index.columns).size !== index.columns.length) {
+      ctx.addIssue({
+        code: "custom",
+        message: "index names a column more than once",
+        path: ["indexes", position]
+      });
+    }
+    for (const column of index.columns) {
+      if (!names.includes(column)) {
+        ctx.addIssue({
+          code: "custom",
+          message: `index references unknown column '${column}'`,
+          path: ["indexes", position]
+        });
+      }
+    }
+  }
+}
+function validateLinks(table, ctx) {
+  const columnNames = Object.keys(table.columns ?? {});
+  for (const [name, link] of Object.entries(table.links ?? {})) {
+    if (columnNames.length > 0 && !columnNames.includes(link.on)) {
+      ctx.addIssue({ code: "custom", message: `link references unknown column '${link.on}'`, path: ["links", name, "on"] });
+    }
+    if (link.enforce && link.to.includes(".")) {
+      ctx.addIssue({
+        code: "custom",
+        message: "enforce is only valid for links inside the namespace; cross-boundary links stay soft",
+        path: ["links", name, "enforce"]
+      });
+    }
+    if (link.enforce && table.source) {
+      ctx.addIssue({
+        code: "custom",
+        message: "a synced table cannot enforce foreign keys \u2014 its DDL is owned by the sync",
+        path: ["links", name, "enforce"]
+      });
+    }
+  }
+}
+function validateDerivedNameLengths(table, ctx) {
+  const worstPolicy = policyName(table.table, "insert");
+  if (!table.source && worstPolicy.length > MAX_IDENTIFIER_LENGTH) {
+    ctx.addIssue({
+      code: "custom",
+      message: `table name is too long \u2014 the derived policy name '${worstPolicy}' exceeds Postgres's ${MAX_IDENTIFIER_LENGTH}-byte identifier limit`,
+      path: ["table"]
+    });
+  }
+  for (const [position, index] of (table.indexes ?? []).entries()) {
+    const name = indexName(table.table, index);
+    if (name.length > MAX_IDENTIFIER_LENGTH) {
+      ctx.addIssue({
+        code: "custom",
+        message: `derived index name '${name}' exceeds Postgres's ${MAX_IDENTIFIER_LENGTH}-byte identifier limit \u2014 set a shorter explicit name`,
+        path: ["indexes", position]
+      });
+    }
+  }
+  for (const [name, link] of Object.entries(table.links ?? {})) {
+    const constraint = foreignKeyName(table.table, name);
+    if (link.enforce && constraint.length > MAX_IDENTIFIER_LENGTH) {
+      ctx.addIssue({
+        code: "custom",
+        message: `derived foreign-key name '${constraint}' exceeds Postgres's ${MAX_IDENTIFIER_LENGTH}-byte identifier limit \u2014 shorten the link or table name`,
+        path: ["links", name]
+      });
+    }
+  }
+  for (const name of Object.keys(table.actions ?? {})) {
+    const fnName = `action_${name}`;
+    if (fnName.length > MAX_IDENTIFIER_LENGTH) {
+      ctx.addIssue({
+        code: "custom",
+        message: `derived action function name '${fnName}' exceeds Postgres's ${MAX_IDENTIFIER_LENGTH}-byte identifier limit \u2014 shorten the action name`,
+        path: ["actions", name]
+      });
+    }
+  }
+}
+var TYPE_GROUPS = {
+  integer: "numeric",
+  bigint: "numeric",
+  numeric: "numeric",
+  double: "numeric",
+  text: "text",
+  uuid: "uuid",
+  date: "temporal",
+  timestamptz: "temporal",
+  boolean: "boolean",
+  jsonb: "jsonb"
+};
+function validatePolicyColumns(table, ctx) {
+  const columns = table.columns ?? {};
+  const columnNames = Object.keys(columns);
+  if (columnNames.length === 0) return;
+  for (const kind of ["read", "write", "insert", "update"]) {
+    const predicate = table.policies?.[kind];
+    if (!predicate) continue;
+    for (const column of referencedColumns(predicate.ast)) {
+      if (!columnNames.includes(column)) {
+        ctx.addIssue({
+          code: "custom",
+          message: `policy references unknown column '${column}'`,
+          path: ["policies", kind]
+        });
+      }
+    }
+    walkPredicate(predicate.ast, (node) => {
+      if (node.kind !== "compare") return;
+      const issue = comparisonTypeIssue(node.left, node.right, columns);
+      if (issue) ctx.addIssue({ code: "custom", message: issue, path: ["policies", kind] });
+    });
+  }
+}
+function comparisonTypeIssue(left, right, columns) {
+  const groupOf = (operand) => operand.kind === "column" ? columns[operand.name] ? TYPE_GROUPS[columns[operand.name].type] : null : null;
+  if (left.kind === "column" && right.kind === "column") {
+    const leftGroup = groupOf(left);
+    const rightGroup = groupOf(right);
+    if (leftGroup && rightGroup && leftGroup !== rightGroup) {
+      return `policy compares '${left.name}' (${columns[left.name].type}) with '${right.name}' (${columns[right.name].type}) \u2014 incomparable types`;
+    }
+    return null;
+  }
+  const column = left.kind === "column" ? left : right.kind === "column" ? right : null;
+  const literal = left.kind === "literal" ? left : right.kind === "literal" ? right : null;
+  if (!column || !literal || literal.value === null) return null;
+  const columnGroup = groupOf(column);
+  if (!columnGroup) return null;
+  if (typeof literal.value === "string") return null;
+  const literalGroup = typeof literal.value === "number" ? "numeric" : "boolean";
+  if (literalGroup !== columnGroup) {
+    return `policy compares '${column.name}' (${columns[column.name].type}) with a ${typeof literal.value} literal \u2014 incomparable types`;
+  }
+  return null;
+}
 var policyVariantSchema = z.object({
   /** Claims-only guard (capability()/role()/claim() comparisons — no columns). */
   when: z.string().min(1).max(1e3),
@@ -555,7 +1295,7 @@ var CANONICAL_FORMAT = 2;
 var IDENTIFIER_RE = /^[a-z][a-z0-9_]*$/;
 var identifier2 = z.string().min(1).max(63).regex(IDENTIFIER_RE);
 var columnIdentifier = z.string().min(1).max(63).regex(COLUMN_IDENTIFIER_PATTERN);
-var COLUMN_TYPES = [
+var COLUMN_TYPES2 = [
   "uuid",
   "text",
   "integer",
@@ -567,7 +1307,7 @@ var COLUMN_TYPES = [
   "date",
   "jsonb"
 ];
-var columnTypeSchema = z.enum(COLUMN_TYPES);
+var columnTypeSchema2 = z.enum(COLUMN_TYPES2);
 var canonicalEnumSchema = z.object({
   name: identifier2,
   values: z.array(z.string().min(1).max(63)).min(1).max(100)
@@ -576,7 +1316,7 @@ var canonicalColumnSchema = z.object({
   /** Property name in TS (camelCase); columnName is the Postgres name. */
   name: z.string().min(1).max(63),
   columnName: columnIdentifier,
-  type: z.union([columnTypeSchema, z.object({ enum: identifier2 })]),
+  type: z.union([columnTypeSchema2, z.object({ enum: identifier2 })]),
   nullable: z.boolean().default(true),
   unique: z.boolean().default(false),
   /** Literal default, or one of the allowlisted SQL functions. */
@@ -669,7 +1409,7 @@ var canonicalActionSchema = z.object({
   name: identifier2,
   requires: z.string().max(1e3).optional(),
   params: z.record(z.string(), z.object({
-    type: columnTypeSchema,
+    type: columnTypeSchema2,
     nullable: z.boolean().default(false)
   })).default({}),
   executes: z.string().min(1).max(1e4),
@@ -770,7 +1510,8 @@ var canonicalTableSchema = z.object({
   if ([table.policies.write, table.policies.insert, table.policies.update].some((policy) => policy !== void 0)) {
     fail("is read-only and cannot declare write policies", ["policies"]);
   }
-  const ownedCollections = [table.indexes, table.actions, table.checks, table.foreignKeys, table.cowMutations];
+  const ownedIndexes = table.source === void 0 ? table.indexes : table.indexes.filter((index) => index.unique);
+  const ownedCollections = [ownedIndexes, table.actions, table.checks, table.foreignKeys, table.cowMutations];
   const ownedMetadata = [table.cellMetadata, table.internal, table.materializes, table.renamedFrom];
   if (ownedCollections.some((items) => items !== void 0 && items.length > 0) || ownedMetadata.some((value) => value !== void 0)) {
     fail("cannot declare owned storage, constraints or identity operations");
@@ -872,6 +1613,23 @@ function trackedCellColumns(table) {
   return table.columns.filter((column) => column.cell === void 0 && !pk.has(column.columnName) && column.onUpdateFn === void 0);
 }
 var SUFFIXES = Object.values(CELL_PART_SUFFIX);
+function validateSyncedIndexes(table, tableIndex, ctx) {
+  if (table.source === void 0) return;
+  const columns = new Set(table.columns.map((column) => column.columnName));
+  for (const [position, index] of table.indexes.entries()) {
+    const fail = (message) => ctx.addIssue({ code: "custom", path: ["tables", tableIndex, "indexes", position], message: `synced table '${table.table}' ${message}` });
+    if (columns.size === 0) fail("must declare columns to declare indexes");
+    if (index.unique) fail("cannot declare a unique index");
+    if (new Set(index.columns).size !== index.columns.length) fail("index names a column more than once");
+    for (const column of index.columns) {
+      if (columns.size > 0 && !columns.has(column)) fail(`index references unknown column '${column}'`);
+    }
+    const name = indexName(table.table, index);
+    if (name.length > MAX_IDENTIFIER_LENGTH) {
+      fail(`derived index name '${name}' exceeds Postgres's ${MAX_IDENTIFIER_LENGTH}-byte identifier limit \u2014 set a shorter explicit name`);
+    }
+  }
+}
 function validateCellMetadata(table, index, ctx) {
   const fail = (message, path = ["tables", index]) => ctx.addIssue({ code: "custom", path, message });
   const cells = table.columns.flatMap((column, position) => column.cell ? [{ column, position, cell: column.cell }] : []);
@@ -938,12 +1696,24 @@ var localDefinitionSchema = z.object({
   }).default({ uses: [] })
 }).superRefine((definition, ctx) => {
   const seen = /* @__PURE__ */ new Set();
+  const syncedIndexOwners = /* @__PURE__ */ new Map();
   for (const [index, table] of definition.tables.entries()) {
     if (seen.has(table.table)) {
       ctx.addIssue({ code: "custom", path: ["tables", index, "table"], message: `duplicate relation '${table.table}'` });
     }
     seen.add(table.table);
     validateCellMetadata(table, index, ctx);
+    validateSyncedIndexes(table, index, ctx);
+    if (table.source !== void 0) {
+      for (const [position, entry] of table.indexes.entries()) {
+        const name = indexName(table.table, entry);
+        const owner = syncedIndexOwners.get(name);
+        if (owner !== void 0) {
+          ctx.addIssue({ code: "custom", path: ["tables", index, "indexes", position], message: `synced index '${name}' is also declared on '${owner}'` });
+        }
+        syncedIndexOwners.set(name, table.table);
+      }
+    }
     if (table.source !== void 0) {
       for (const [columnIndex, column] of table.columns.entries()) {
         if (column.onUpdateFn !== void 0) {
@@ -1426,7 +2196,7 @@ var variableDefaultIrSchema = z.object({
 var variableIrSchema = z.object({
   name: z.string(),
   type: z.union([
-    z.object({ kind: z.literal("scalar"), scalar: z.enum(COLUMN_TYPES) }),
+    z.object({ kind: z.literal("scalar"), scalar: z.enum(COLUMN_TYPES2) }),
     /** `values` is the declared membership whitelist — the executor validates against it. */
     z.object({ kind: z.literal("enum"), name: z.string(), values: z.array(z.string()).min(1) }),
     /** §4f dynamic slot: validated against `tables[table]` whitelists at runtime. */
@@ -1438,19 +2208,20 @@ var variableIrSchema = z.object({
   defaultValue: variableDefaultIrSchema.optional()
 });
 var sqlColumnSchema = z.object({ name: z.string(), type: z.enum(["text", "boolean", "integer", "bigint", "numeric", "double", "uuid", "date", "timestamptz", "jsonb"]), nullable: z.boolean() });
+var sqlObjectIrSchema = z.object({
+  ref: z.string(),
+  table: z.string(),
+  columns: z.array(sqlColumnSchema.extend({ type: z.string() })).min(1),
+  scan: z.string().min(1),
+  read: z.array(z.string()).min(1)
+}).strict();
 var compiledOperationSchema = z.object({
   language: z.literal("sql").optional(),
   /** Server-compiled object catalog and permission ceiling, never caller SQL. */
   sqlQuery: z.object({
     catalog: z.object({
       identity: z.string(),
-      objects: z.array(z.object({
-        ref: z.string(),
-        table: z.string(),
-        columns: z.array(sqlColumnSchema.extend({ type: z.string() })).min(1),
-        scan: z.string().min(1),
-        read: z.array(z.string()).min(1)
-      }).strict()).min(1).max(256)
+      objects: z.array(sqlObjectIrSchema).min(1).max(256)
     }).strict(),
     read: z.array(z.string()).min(1).max(256),
     maxRows: z.number().int().min(1).max(1e4)
@@ -1558,7 +2329,7 @@ var tableMetaIrSchema = z.object({
   columns: z.array(z.object({
     name: z.string(),
     columnName: z.string(),
-    type: z.union([z.enum(COLUMN_TYPES), z.object({ enum: z.string(), values: z.array(z.string()) })]),
+    type: z.union([z.enum(COLUMN_TYPES2), z.object({ enum: z.string(), values: z.array(z.string()) })]),
     nullable: z.boolean()
   })),
   /** Empty for keyless read-only views; keyed tables and views list logical columns. */
@@ -1629,14 +2400,14 @@ z.object({
 });
 
 // src/predicate-v2/parse.ts
-var KEYWORDS = /* @__PURE__ */ new Set(["and", "or", "not", "true", "false", "null", "claim", "capability", "role", "exists"]);
-var OPERATOR_PATTERN = /^(!=|<=|>=|<>|=|<|>)/;
-var IDENTIFIER_START = /[a-zA-Z_]/;
-var IDENTIFIER_CHAR = /[a-zA-Z0-9_]/;
-var NUMBER_PATTERN = /^-?\d+(\.\d+)?/;
+var KEYWORDS2 = /* @__PURE__ */ new Set(["and", "or", "not", "true", "false", "null", "claim", "capability", "role", "exists"]);
+var OPERATOR_PATTERN2 = /^(!=|<=|>=|<>|=|<|>)/;
+var IDENTIFIER_START2 = /[a-zA-Z_]/;
+var IDENTIFIER_CHAR2 = /[a-zA-Z0-9_]/;
+var NUMBER_PATTERN2 = /^-?\d+(\.\d+)?/;
 var SCALAR_CLAIM_KEYS = Object.entries(CLAIMS_CONTRACT).filter(([, type]) => !type.endsWith("[]")).map(([key]) => key);
 var ARRAY_CLAIM_KEYS = Object.entries(CLAIMS_CONTRACT).filter(([, type]) => type.endsWith("[]")).map(([key]) => key);
-function tokenize2(source) {
+function tokenize3(source) {
   const tokens = [];
   let position = 0;
   while (position < source.length) {
@@ -1666,27 +2437,27 @@ function tokenize2(source) {
       continue;
     }
     if (char === "'") {
-      const { value, end } = readString(source, position);
+      const { value, end } = readString2(source, position);
       tokens.push({ kind: "string", value, position });
       position = end;
       continue;
     }
-    const operator = OPERATOR_PATTERN.exec(source.slice(position));
+    const operator = OPERATOR_PATTERN2.exec(source.slice(position));
     if (operator) {
       const value = operator[0] === "<>" ? "!=" : operator[0];
       tokens.push({ kind: "operator", value, position });
       position += operator[0].length;
       continue;
     }
-    const number = NUMBER_PATTERN.exec(source.slice(position));
-    if (number && !IDENTIFIER_START.test(char)) {
+    const number = NUMBER_PATTERN2.exec(source.slice(position));
+    if (number && !IDENTIFIER_START2.test(char)) {
       tokens.push({ kind: "number", value: number[0], position });
       position += number[0].length;
       continue;
     }
-    if (IDENTIFIER_START.test(char)) {
+    if (IDENTIFIER_START2.test(char)) {
       let end = position;
-      while (end < source.length && IDENTIFIER_CHAR.test(source[end])) end += 1;
+      while (end < source.length && IDENTIFIER_CHAR2.test(source[end])) end += 1;
       tokens.push({ kind: "identifier", value: source.slice(position, end), position });
       position = end;
       continue;
@@ -1696,7 +2467,7 @@ function tokenize2(source) {
   tokens.push({ kind: "end", value: "", position: source.length });
   return tokens;
 }
-function readString(source, start) {
+function readString2(source, start) {
   let value = "";
   let position = start + 1;
   while (position < source.length) {
@@ -1715,7 +2486,7 @@ function readString(source, start) {
   }
   throw new PolicyParseError("unterminated string literal", start);
 }
-var Parser2 = class {
+var Parser3 = class {
   constructor(tokens) {
     this.tokens = tokens;
   }
@@ -1857,7 +2628,7 @@ var Parser2 = class {
   /** `ident(.ident)*` — first segment must not be a keyword; later segments may be (e.g. `author.role`). */
   parsePath(description) {
     const first = this.peek();
-    if (first.kind !== "identifier" || KEYWORDS.has(first.value)) {
+    if (first.kind !== "identifier" || KEYWORDS2.has(first.value)) {
       throw new PolicyParseError(`expected ${description}, got '${first.value || "end"}'`, first.position);
     }
     this.advance();
@@ -1903,7 +2674,7 @@ var Parser2 = class {
 function parsePolicy(source) {
   const trimmed = source.trim();
   if (trimmed.length === 0) throw new PolicyParseError("empty policy expression", 0);
-  return { source: trimmed, ast: new Parser2(tokenize2(trimmed)).parse() };
+  return { source: trimmed, ast: new Parser3(tokenize3(trimmed)).parse() };
 }
 
 // src/predicate-v2/compile.ts
@@ -1943,6 +2714,7 @@ var FLIPPED = {
   ">=": "<="
 };
 function resolveTable(resolver, table) {
+  resolver.onTable?.(table);
   const info = resolver.tables[table];
   if (!info) {
     throw new PolicyCompileError(`unknown table '${table}'`, "unknown-table", Object.keys(resolver.tables));