I wrote: > Can we use something else for the magic type here? Or find a way to > positively forbid such functions from being called from the SQL level?
When I wrote that I was wondering if we'd need a new pg_proc column, "prodontcallfromsql" or some such. But on further reflection it seems like it might be sufficient to just hack the parser to forbid any user-level attempt to call a function that returns internal. The other side of the coin, functions that take but don't return internal, would be protected by means of the fact that there'd be no way to construct matching argument values.