I wrote:
> Can we use something else for the magic type here? Or find a way to
> positively forbid such functions from being called from the SQL level?
When I wrote that I was wondering if we'd need a new pg_proc column,
"prodontcallfromsql" or some such. But on further reflection it seems
like it might be sufficient to just hack the parser to forbid any
user-level attempt to call a function that returns internal. The other
side of the coin, functions that take but don't return internal, would
be protected by means of the fact that there'd be no way to construct
matching argument values.
regards, tom lane