better-supabase 0.11.0 → 0.13.0

package/dist/authorization-CB69cvnA.d.ts

@@ -0,0 +1,1504 @@
+import { t as BlockOptionsSchema } from "./options-CIf3xni7.js";
+//#region src/blocks/access-requests/options.d.ts
+/** `blocks.access-requests.options`. */
+type AccessRequestsSqlOptions = {
+  readonly roles?: unknown;
+  readonly policy?: unknown;
+  readonly maxDuration?: unknown;
+  readonly join?: boolean;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/access/options.d.ts
+/** `blocks.access.options`. */
+type AccessSqlOptions = {
+  readonly platformRoleScope?: string;
+  readonly scope?: string;
+  readonly tenantRoleScope?: string;
+};
+//#endregion
+//#region src/blocks/agents/options.d.ts
+/** `blocks.agents.options`. */
+type AgentsSqlOptions = {
+  readonly maxInstructions?: number;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/ai-cache/options.d.ts
+/** `blocks.ai-cache.options`. */
+type AiCacheSqlOptions = {
+  readonly maxTtl?: number;
+  readonly maxBytes?: number;
+};
+//#endregion
+//#region src/blocks/ai-chat/options.d.ts
+/** `blocks.ai-chat.options`. */
+type AiChatSqlOptions = {
+  readonly topic?: string;
+  readonly listTopic?: string;
+  readonly temporaryTtl?: unknown;
+  readonly staleAfter?: unknown;
+  readonly sandboxIdleAfter?: number;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/ai-files/options.d.ts
+/** `blocks.ai-files.options`. */
+type AiFilesSqlOptions = {
+  readonly bucket?: string;
+  readonly maxSize?: number;
+  readonly allowedMimeTypes?: readonly string[];
+  readonly pendingTtl?: string;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/ai-providers/options.d.ts
+/** `blocks.ai-providers.options`. */
+type AiProvidersSqlOptions = {
+  readonly pollEvery?: number;
+};
+//#endregion
+//#region src/blocks/ai-tasks/options.d.ts
+/** `blocks.ai-tasks.options`. */
+type AiTasksSqlOptions = {
+  readonly queue?: string;
+  readonly staleAfter?: string;
+  readonly maxPrompt?: number;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/announcements/options.d.ts
+/** `blocks.announcements.options`. */
+type AnnouncementsSqlOptions = {
+  readonly topic?: string;
+  readonly event?: string;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/api-keys/options.d.ts
+/** `blocks.api-keys.options`. */
+type ApiKeysSqlOptions = {
+  readonly scopes?: "catalog" | readonly string[];
+  readonly kinds?: readonly string[];
+  readonly touchInterval?: number;
+  readonly prefix?: string;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/approvals/options.d.ts
+/** `blocks.approvals.options`. */
+type ApprovalsSqlOptions = {
+  readonly subjects?: unknown;
+  readonly policies?: unknown;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/attachments/options.d.ts
+/** `blocks.attachments.options`. */
+type AttachmentsSqlOptions = {
+  readonly bucket?: string;
+  readonly requireScan?: boolean;
+  readonly maxSize?: number;
+  readonly allowedMimeTypes?: readonly string[];
+  readonly subjects?: unknown;
+  readonly path?: string;
+  readonly scanBuckets?: readonly string[];
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/audit/options.d.ts
+/** `blocks.audit.options`. */
+type AuditSqlOptions = {
+  readonly appendOnly?: boolean;
+  readonly chain?: boolean;
+  readonly correlationIdHeader?: string;
+  readonly eventCategory?: string;
+  readonly eventRoles?: readonly string[];
+  readonly trustedRoles?: readonly string[];
+  readonly eventSource?: string;
+  readonly exempt?: unknown;
+  readonly impersonators?: string;
+  readonly keepMappedMetadata?: boolean;
+  readonly metadataColumns?: unknown;
+  readonly partitioned?: boolean;
+  readonly readPolicy?: boolean;
+  readonly requestIdHeader?: string;
+  readonly restricted?: boolean;
+  readonly tenantColumn?: string;
+  readonly tenantLabel?: unknown;
+  readonly tenantLabelKey?: string;
+  readonly values?: unknown;
+};
+//#endregion
+//#region src/blocks/billing/options.d.ts
+/** `blocks.billing.options`. */
+type BillingSqlOptions = {
+  readonly seatRoles?: readonly string[];
+  readonly plans?: unknown;
+  readonly tenantKey?: unknown;
+  /** Where subscriptions are read from. Default `sync-engine`. */
+  readonly subscriptions?: string;
+};
+//#endregion
+//#region src/blocks/bookings/options.d.ts
+/** `blocks.bookings.options`. */
+type BookingsSqlOptions = {
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/bulk/options.d.ts
+/** `blocks.bulk.options`. */
+type BulkSqlOptions = {
+  readonly limit?: number;
+  readonly actions?: unknown;
+};
+//#endregion
+//#region src/blocks/calendar/options.d.ts
+/** `blocks.calendar.options`. */
+type CalendarSqlOptions = {
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/catalog/options.d.ts
+/** `blocks.catalog.options`. */
+type CatalogSqlOptions = {
+  readonly storefront?: string;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/collections/options.d.ts
+/** `blocks.collections.options`. */
+type CollectionsSqlOptions = {
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/comments/options.d.ts
+/** `blocks.comments.options`. */
+type CommentsSqlOptions = {
+  readonly subjects?: unknown;
+  readonly maxBodyLength?: number;
+  readonly documentSchema?: unknown;
+  readonly notify?: boolean;
+  readonly follow?: boolean;
+  readonly mentionGroups?: unknown;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/connectors/options.d.ts
+/** `blocks.connectors.options`. */
+type ConnectorsSqlOptions = {
+  readonly allowHttp?: boolean;
+  readonly trustFirstUse?: boolean;
+  readonly sessionTtl?: string;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/credentials/options.d.ts
+/** `blocks.credentials.options`. */
+type CredentialsSqlOptions = {
+  readonly secretStorage?: string;
+};
+//#endregion
+//#region src/blocks/custom-fields/options.d.ts
+/** `blocks.custom-fields.options`. */
+type CustomFieldsSqlOptions = {
+  readonly layout?: string;
+};
+//#endregion
+//#region src/blocks/data-lifecycle/options.d.ts
+/** `blocks.data-lifecycle.options`. */
+type DataLifecycleSqlOptions = {
+  readonly bucket?: string;
+  readonly grace?: string;
+  readonly exportTtl?: string;
+  readonly tables?: unknown;
+  readonly autoTables?: unknown;
+  readonly tenantRow?: unknown;
+  readonly anonymize?: unknown;
+  readonly omitPattern?: unknown;
+};
+//#endregion
+//#region src/blocks/deals/options.d.ts
+/** `blocks.deals.options`. */
+type DealsSqlOptions = {
+  readonly company?: string;
+  readonly contact?: string;
+  readonly motions?: unknown;
+  readonly priorities?: unknown;
+  readonly prefix?: string;
+  readonly readAll?: boolean;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/documents/options.d.ts
+/** `blocks.documents.options`. */
+type DocumentsSqlOptions = {
+  readonly subjects?: unknown;
+  readonly topic?: string;
+  readonly maxUpdateBytes?: number;
+  readonly compactAfter?: number;
+};
+//#endregion
+//#region src/blocks/domains/options.d.ts
+/** `blocks.domains.options`. */
+type DomainsSqlOptions = {
+  /**
+   * The app's own domain: one label below it is a subdomain verified when
+   * added.
+   */
+  readonly platformDomain?: string;
+  /** The TXT record name's first label: `<txtPrefix>.<hostname>`. */
+  readonly txtPrefix?: string;
+};
+//#endregion
+//#region src/blocks/drive/options.d.ts
+/** `blocks.drive.options`. */
+type DriveSqlOptions = {
+  readonly roles?: readonly string[];
+  readonly writeRole?: unknown;
+  readonly shareRole?: unknown;
+  readonly memberRole?: unknown;
+  readonly subjectType?: string;
+  readonly conflict?: string;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/employees/options.d.ts
+/** `blocks.employees.options`. */
+type EmployeesSqlOptions = {
+  readonly employmentTypes?: readonly string[];
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/engagements/options.d.ts
+/** `blocks.engagements.options`. */
+type EngagementsSqlOptions = {
+  readonly types?: readonly string[];
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/flags/options.d.ts
+/**
+ * A custom context's source: the table and column that hold a tenant's value,
+ * and the column with the tenant id (`id` by default).
+ */
+interface FlagContextColumn {
+  readonly table: string;
+  readonly column: string;
+  readonly tenant?: string;
+}
+/** `blocks.flags.options`. */
+type FlagsSqlOptions = {
+  /**
+   * Custom contexts by name, e.g. `{ brand: { table: "public.organizations",
+   * column: "brand_id" } }`.
+   */
+  readonly contexts?: Readonly<Record<string, FlagContextColumn>>;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/forms/options.d.ts
+/** `blocks.forms.options`. */
+type FormsSqlOptions = {
+  readonly subjects?: unknown;
+  readonly handlers?: unknown;
+  readonly publicLimit?: unknown;
+  readonly extraColumns?: unknown;
+};
+/** `blocks.signatures.options`. */
+type SignaturesSqlOptions = {
+  readonly subjects?: unknown;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/grants/options.d.ts
+/** `blocks.grants.options`. */
+type GrantsSqlOptions = {
+  readonly fromPolicies?: unknown;
+};
+//#endregion
+//#region src/blocks/hiring/options.d.ts
+/** `blocks.hiring.options`. */
+type HiringSqlOptions = {
+  readonly candidate?: string;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/identities/options.d.ts
+/** `blocks.identities.options`. */
+type IdentitiesSqlOptions = {
+  readonly codeMinutes?: number;
+  readonly verifiedEmails?: boolean;
+};
+//#endregion
+//#region src/blocks/inbox/options.d.ts
+/** `blocks.inbox.options`. */
+type InboxSqlOptions = {
+  readonly topic?: string;
+  readonly bucket?: string;
+  readonly maxBodyLength?: number;
+  readonly botQueue?: unknown;
+  readonly outboundQueue?: unknown;
+  readonly notify?: boolean;
+};
+//#endregion
+//#region src/blocks/inventory/options.d.ts
+/** `blocks.inventory.options`. */
+type InventorySqlOptions = {
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/invoices/options.d.ts
+/** `blocks.invoices.options`. */
+type InvoicesSqlOptions = {
+  readonly company?: string;
+  readonly contact?: string;
+  readonly prefix?: string;
+  readonly creditPrefix?: string;
+  readonly termsDays?: number;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/jobs/options.d.ts
+/** `blocks.jobs.options`. */
+type JobsSqlOptions = {
+  readonly backend?: string;
+  readonly scheduler?: string;
+};
+/** `blocks.rate-limit.options`. */
+type RateLimitSqlOptions = {
+  readonly preRequest?: boolean;
+};
+/** `blocks.webhook-inbox.options`. */
+type WebhookInboxSqlOptions = {
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/knowledge/options.d.ts
+/** `blocks.knowledge.options`. */
+type KnowledgeSqlOptions = {
+  readonly dimensions?: number;
+  readonly type?: string;
+  readonly textSearch?: string;
+  readonly embedQueue?: string;
+};
+//#endregion
+//#region src/blocks/leave/options.d.ts
+/** `blocks.leave.options`. */
+type LeaveSqlOptions = {
+  readonly policy?: unknown;
+  readonly workingDays?: readonly string[];
+  readonly allowNegative?: boolean;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/memory/options.d.ts
+/** `blocks.memory.options`. */
+type MemorySqlOptions = {
+  readonly dimensions?: unknown;
+  readonly type?: unknown;
+  readonly textSearch?: unknown;
+  readonly maxContent?: number;
+};
+//#endregion
+//#region src/blocks/metrics/options.d.ts
+/** `blocks.metrics.options`. */
+type MetricsSqlOptions = {
+  readonly metrics?: unknown;
+  readonly window?: string;
+};
+//#endregion
+//#region src/blocks/notifications/options.d.ts
+/** `blocks.notifications.options`. */
+type NotificationsSqlOptions = {
+  readonly subjects?: unknown;
+  readonly channelDefaults?: unknown;
+  readonly channels?: readonly string[];
+  readonly createdEvent?: string;
+  readonly maxRecipients?: number;
+  readonly partitioned?: boolean;
+  readonly priorities?: readonly string[];
+  readonly realtime?: string;
+  readonly topic?: string;
+  readonly updatedEvent?: string;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/number-sequences/options.d.ts
+/** One numbered entity of `blocks.number-sequences.options.entities`. */
+type NumberSequenceEntityOptions = {
+  readonly period: "none" | "year" | "month" | "format" | {
+    readonly fiscalYearStartMonth: number;
+  };
+  readonly format: string;
+  /**
+   * A tenant's own format: `column` is `schema.table.column`, `key` holds the
+   * tenant id (default `id`).
+   */
+  readonly formatFrom?: {
+    readonly column: string;
+    readonly key?: string;
+  };
+  readonly periodFrom?: {
+    readonly column: string;
+    readonly key?: string;
+  };
+  readonly table?: string;
+  readonly column?: string;
+  readonly sequenceColumn?: string;
+  readonly tenantColumn?: string;
+  readonly periodColumn?: string;
+  readonly assignOn?: string;
+  readonly permission?: string;
+};
+/** `blocks.number-sequences.options`. */
+type NumberSequencesSqlOptions = {
+  readonly entities?: Readonly<Record<string, NumberSequenceEntityOptions>>;
+};
+//#endregion
+//#region src/blocks/oauth-server/options.d.ts
+/** `blocks.oauth-server.options`. */
+type OAuthServerSqlOptions = {
+  /**
+   * The pattern a client id must match: a regular expression, or `"slug"` for
+   * lower-case slugs such as `acme-cli`. The default accepts the 22-character
+   * ids `registerClient` generates and any `[A-Za-z0-9._~-]{8,128}` id.
+   */
+  readonly clientIdPattern?: string;
+};
+//#endregion
+//#region src/blocks/onboarding/options.d.ts
+/** `blocks.onboarding.options`. */
+type OnboardingSqlOptions = {
+  readonly checklists?: unknown;
+};
+//#endregion
+//#region src/blocks/orders/options.d.ts
+/** `blocks.orders.options`. */
+type OrdersSqlOptions = {
+  readonly paymentWindowMinutes?: number;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/organizations/options.d.ts
+/** `blocks.organizations.options`. */
+type OrganizationsSqlOptions = {
+  readonly assignmentGuard?: string;
+  readonly attributes?: readonly string[];
+  readonly auditCategory?: unknown;
+  readonly deleteMode?: string;
+  readonly extraColumns?: unknown;
+  readonly formerOwnerRole?: string;
+  readonly ownerInvariant?: boolean;
+  readonly ownerRole?: string;
+  readonly reservedSlugs?: readonly string[];
+  readonly slugCitext?: boolean;
+  readonly slugMaxLength?: number;
+  readonly slugMinLength?: number;
+  readonly slugPattern?: string;
+};
+/** `blocks.invitations.options`. */
+type InvitationsSqlOptions = {
+  readonly maxValidFor?: string;
+  readonly platformRoles?: unknown;
+  readonly prefill?: boolean;
+  readonly previewColumns?: readonly string[];
+  readonly requireConfirmedEmail?: boolean;
+  readonly tokenBytes?: number;
+  readonly tokenStorage?: string;
+  readonly validFor?: string;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/outbox/options.d.ts
+/** `blocks.outbox.options`. */
+type OutboxSqlOptions = {
+  readonly defaultSource?: string;
+  readonly emitRoles?: readonly string[];
+  readonly blockSource?: unknown;
+  readonly partitioned?: boolean;
+  readonly retention?: string;
+  readonly settle?: string;
+};
+//#endregion
+//#region src/blocks/parties/options.d.ts
+/** `blocks.parties.options`. */
+type PartiesSqlOptions = {
+  readonly companyLifecycles?: unknown;
+  readonly personLifecycles?: unknown;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/pipelines/options.d.ts
+/** `blocks.pipelines.options`. */
+type PipelinesSqlOptions = {
+  readonly subjects?: unknown;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/profiles/options.d.ts
+/** `blocks.profiles.options`. */
+type ProfilesSqlOptions = {
+  readonly columnGrants?: boolean;
+  readonly extraColumns?: unknown;
+  readonly metadata?: unknown;
+  readonly mirrorEmail?: boolean;
+  readonly readPolicy?: unknown;
+  readonly reservedUsernames?: readonly string[];
+  readonly serviceColumns?: readonly string[];
+  readonly splitName?: boolean;
+  readonly syncTrigger?: boolean;
+  readonly updatable?: readonly string[];
+  readonly username?: boolean;
+  readonly usernameFrom?: unknown;
+  readonly usernameMaxLength?: number;
+  readonly usernameMinLength?: number;
+};
+//#endregion
+//#region src/blocks/promotions/options.d.ts
+/** `blocks.promotions.options`. */
+type PromotionsSqlOptions = {
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/push/options.d.ts
+/** `blocks.push.options`. */
+type PushSqlOptions = {
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/quotes/options.d.ts
+/** `blocks.quotes.options`. */
+type QuotesSqlOptions = {
+  readonly company?: string;
+  readonly contact?: string;
+  readonly prefix?: string;
+  readonly validDays?: number;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/reactions/options.d.ts
+/** `blocks.reactions.options`. */
+type ReactionsSqlOptions = {
+  readonly subjects?: unknown;
+  readonly topic?: string;
+};
+//#endregion
+//#region src/blocks/relations/options.d.ts
+/** `blocks.relations.options`. */
+type RelationsSqlOptions = {
+  readonly kinds?: unknown;
+  readonly subjects?: unknown;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/reminders/options.d.ts
+/** `blocks.reminders.options`. */
+type RemindersSqlOptions = {
+  readonly ruleFormat?: string;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/reserved-slugs/options.d.ts
+/** `blocks.reserved-slugs.options`. */
+type ReservedSlugsSqlOptions = {
+  readonly maxLength?: number;
+  readonly minLength?: number;
+  readonly slugs?: readonly string[];
+};
+//#endregion
+//#region src/blocks/reviews/options.d.ts
+/** `blocks.reviews.options`. */
+type ReviewsSqlOptions = {
+  readonly subjects?: unknown;
+  readonly scale?: number;
+  readonly maxBodyLength?: number;
+  readonly moderation?: string;
+  readonly requirePurchase?: boolean;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/rules/options.d.ts
+/** `blocks.rules.options`. */
+type RulesSqlOptions = {
+  /** The most conditions one rule may hold. */
+  readonly maxConditions?: number;
+  /** How deep groups may nest, the root group counting as 1. */
+  readonly maxDepth?: number;
+  /** The most actions one rule may run. */
+  readonly maxActions?: number;
+};
+//#endregion
+//#region src/blocks/saved-views/options.d.ts
+/** `blocks.saved-views.options`. */
+type SavedViewsSqlOptions = {
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/search/options.d.ts
+/** `blocks.search.options`. */
+type SearchSqlOptions = {
+  readonly config?: string;
+  readonly dimensions?: number;
+};
+//#endregion
+//#region src/blocks/service-principals/options.d.ts
+/** `blocks.service-principals.options`. */
+type ServicePrincipalsSqlOptions = {
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/sessions/options.d.ts
+/** `blocks.sessions.options`. */
+type SessionsSqlOptions = {
+  readonly exclude?: readonly string[];
+  readonly policies?: boolean;
+};
+//#endregion
+//#region src/blocks/settings/options.d.ts
+/** `blocks.settings.options`. */
+type SettingsSqlOptions = {
+  readonly schemas?: unknown;
+  readonly platform?: unknown;
+};
+//#endregion
+//#region src/blocks/share-links/options.d.ts
+/** `blocks.share-links.options`. */
+type ShareLinksSqlOptions = {
+  readonly subjects?: unknown;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/shared-signals/options.d.ts
+/** `blocks.shared-signals.options`. */
+type SharedSignalsSqlOptions = {
+  readonly retention?: string;
+};
+//#endregion
+//#region src/blocks/signing-keys/options.d.ts
+/** `blocks.signing-keys.options`. */
+type SigningKeysSqlOptions = {
+  readonly jwksGrace?: string;
+};
+//#endregion
+//#region src/blocks/sla/options.d.ts
+/** `blocks.sla.options`. */
+type SlaSqlOptions = {
+  readonly businessHours?: unknown;
+  readonly subjects?: unknown;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/sso/options.d.ts
+/** `blocks.sso.options`. */
+type SsoSqlOptions = {
+  readonly txtPrefix?: string;
+  readonly defaultRole?: string;
+  readonly roleOrder?: readonly string[];
+  readonly groupRoles?: unknown;
+  /** Adds `scim_sync_log` and its functions, for `sqlScimSyncLog`. */
+  readonly syncLog?: boolean;
+};
+//#endregion
+//#region src/blocks/state-machine/options.d.ts
+/** `blocks.state-machine.options`. */
+type StateMachineSqlOptions = {
+  readonly machines?: unknown;
+};
+//#endregion
+//#region src/blocks/streams/options.d.ts
+/** `blocks.streams.options`. */
+type StreamsSqlOptions = {
+  readonly topic?: string;
+};
+//#endregion
+//#region src/blocks/support-sessions/options.d.ts
+/** `blocks.support-sessions.options`. */
+type SupportSessionsSqlOptions = {
+  readonly allowPlatformTargets?: unknown;
+  readonly allowWrites?: unknown;
+  readonly approval?: unknown;
+  readonly approvalTtl?: unknown;
+  readonly auditCategory?: unknown;
+  readonly claimsHook?: unknown;
+  readonly maxTtl?: unknown;
+  readonly requireReason?: unknown;
+};
+//#endregion
+//#region src/blocks/tags/options.d.ts
+/** `blocks.tags.options`. */
+type TagsSqlOptions = {
+  readonly subjects?: unknown;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/targets/options.d.ts
+/** `blocks.targets.options`. */
+type TargetsSqlOptions = {
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/teams/options.d.ts
+/** `blocks.teams.options`. */
+type TeamsSqlOptions = {
+  readonly teamIdType?: unknown;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/templates/options.d.ts
+/** `blocks.templates.options`. */
+type TemplatesSqlOptions = {
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/tenant/options.d.ts
+/** `blocks.tenant.options`. */
+type TenantSqlOptions = {
+  readonly claimFormat?: string;
+  readonly roleThrough?: unknown;
+  readonly sameTenant?: unknown;
+};
+//#endregion
+//#region src/blocks/time-tracking/options.d.ts
+/** `blocks.time-tracking.options`. */
+type TimeTrackingSqlOptions = {
+  readonly subjects?: unknown;
+  readonly policy?: unknown;
+  readonly timeZone?: string;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/trash/options.d.ts
+/** `blocks.trash.options`. */
+type TrashSqlOptions = {
+  readonly subjects?: unknown;
+  readonly retentionDays?: number;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/usage/options.d.ts
+/** `blocks.usage.options`. */
+type UsageSqlOptions = {
+  readonly meters?: unknown;
+  readonly history?: boolean;
+  readonly partitioned?: boolean;
+};
+//#endregion
+//#region src/blocks/vector-search/options.d.ts
+/** `blocks.vector-search.options`. */
+type VectorSearchSqlOptions = {
+  readonly schema?: unknown;
+};
+//#endregion
+//#region src/blocks/vercel-marketplace/options.d.ts
+/** `blocks.vercel-marketplace.options`. */
+type VercelMarketplaceSqlOptions = {
+  /**
+   * The currency an invoice takes when the webhook names none (ISO 4217,
+   * lowercase).
+   */
+  readonly currency?: string;
+};
+//#endregion
+//#region src/blocks/versions/options.d.ts
+/** `blocks.versions.options`. */
+type VersionsSqlOptions = {
+  readonly subjects?: unknown;
+  readonly keep?: number;
+  readonly debounce?: number;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/waitlist/options.d.ts
+/** `blocks.waitlist.options`. */
+type WaitlistSqlOptions = {
+  readonly defaultRole?: string;
+  readonly codeField?: string;
+  readonly roles?: readonly string[];
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/webhooks/options.d.ts
+/** `blocks.webhooks-out.options`. */
+type WebhooksOutSqlOptions = {
+  readonly allowHttp?: boolean;
+  readonly defaultFormat?: string;
+  readonly disableAfter?: string;
+  readonly eventIdType?: unknown;
+  readonly partitioned?: boolean;
+  readonly runIdType?: unknown;
+  readonly secretStorage?: string;
+  readonly statuses?: unknown;
+};
+/** `blocks.webhooks-in.options`. */
+type WebhooksInSqlOptions = {
+  readonly maxBodyBytes?: number;
+  readonly secretStorage?: string;
+  readonly subjects?: unknown;
+};
+//#endregion
+//#region src/blocks/work-items/options.d.ts
+/** `blocks.work-items.options`. */
+type WorkItemsSqlOptions = {
+  readonly prefix?: string;
+  readonly maxAssignees?: number;
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/workflow-builder/options.d.ts
+/** `blocks.workflow-builder.options`. */
+type WorkflowBuilderSqlOptions = {
+  readonly extraColumns?: unknown;
+};
+//#endregion
+//#region src/blocks/workflow-sdk-world/options.d.ts
+/** `blocks.workflow-sdk-world.options`. */
+type WorkflowSdkWorldSqlOptions = {
+  readonly delivery?: string;
+  readonly queue?: string;
+  readonly batch?: number;
+  readonly timeout?: number;
+  readonly schedule?: string;
+};
+//#endregion
+//#region src/blocks/options-registry.d.ts
+type None = Record<never, never>;
+/**
+ * The options of every SQL module, keyed by module name. `BlocksConfig` types
+ * `blocks.<module>.options` from it, and `schemas/config-v1.json` is generated
+ * from `BLOCK_OPTION_SCHEMAS`.
+ */
+interface BlockOptionsRegistry {
+  readonly access: AccessSqlOptions;
+  readonly "access-requests": AccessRequestsSqlOptions;
+  readonly actor: None;
+  readonly agents: AgentsSqlOptions;
+  readonly "ai-cache": AiCacheSqlOptions;
+  readonly "ai-chat": AiChatSqlOptions;
+  readonly "ai-files": AiFilesSqlOptions;
+  readonly "ai-providers": AiProvidersSqlOptions;
+  readonly "ai-tasks": AiTasksSqlOptions;
+  readonly announcements: AnnouncementsSqlOptions;
+  readonly "api-keys": ApiKeysSqlOptions;
+  readonly approvals: ApprovalsSqlOptions;
+  readonly attachments: AttachmentsSqlOptions;
+  readonly audit: AuditSqlOptions;
+  readonly billing: BillingSqlOptions;
+  readonly bookings: BookingsSqlOptions;
+  readonly bulk: BulkSqlOptions;
+  readonly calendar: CalendarSqlOptions;
+  readonly catalog: CatalogSqlOptions;
+  readonly "chat-sdk-state": None;
+  readonly collections: CollectionsSqlOptions;
+  readonly comments: CommentsSqlOptions;
+  readonly connectors: ConnectorsSqlOptions;
+  readonly credentials: CredentialsSqlOptions;
+  readonly "custom-fields": CustomFieldsSqlOptions;
+  readonly "data-lifecycle": DataLifecycleSqlOptions;
+  readonly deals: DealsSqlOptions;
+  readonly documents: DocumentsSqlOptions;
+  readonly domains: DomainsSqlOptions;
+  readonly drive: DriveSqlOptions;
+  readonly "drive-files": None;
+  readonly employees: EmployeesSqlOptions;
+  readonly engagements: EngagementsSqlOptions;
+  readonly "ensure-rls": None;
+  readonly entitlements: None;
+  readonly flags: FlagsSqlOptions;
+  readonly forms: FormsSqlOptions;
+  readonly grants: GrantsSqlOptions;
+  readonly hiring: HiringSqlOptions;
+  readonly idempotency: None;
+  readonly identities: IdentitiesSqlOptions;
+  readonly imports: None;
+  readonly "oauth-server": OAuthServerSqlOptions;
+  readonly inbox: InboxSqlOptions;
+  readonly inventory: InventorySqlOptions;
+  readonly invitations: InvitationsSqlOptions;
+  readonly invoices: InvoicesSqlOptions;
+  readonly jobs: JobsSqlOptions;
+  readonly "jsonb-schemas": None;
+  readonly knowledge: KnowledgeSqlOptions;
+  readonly leave: LeaveSqlOptions;
+  readonly memory: MemorySqlOptions;
+  readonly metrics: MetricsSqlOptions;
+  readonly mfa: None;
+  readonly notifications: NotificationsSqlOptions;
+  readonly "number-sequences": NumberSequencesSqlOptions;
+  readonly onboarding: OnboardingSqlOptions;
+  readonly orders: OrdersSqlOptions;
+  readonly organizations: OrganizationsSqlOptions;
+  readonly outbox: OutboxSqlOptions;
+  readonly parties: PartiesSqlOptions;
+  readonly pgtap: None;
+  readonly pipelines: PipelinesSqlOptions;
+  readonly profiles: ProfilesSqlOptions;
+  readonly promotions: PromotionsSqlOptions;
+  readonly push: PushSqlOptions;
+  readonly quotes: QuotesSqlOptions;
+  readonly rank: None;
+  readonly "rate-limit": RateLimitSqlOptions;
+  readonly reactions: ReactionsSqlOptions;
+  readonly "read-sets": None;
+  readonly "realtime-tables": None;
+  readonly relations: RelationsSqlOptions;
+  readonly reminders: RemindersSqlOptions;
+  readonly "reserved-slugs": ReservedSlugsSqlOptions;
+  readonly reviews: ReviewsSqlOptions;
+  readonly rules: RulesSqlOptions;
+  readonly "vercel-marketplace": VercelMarketplaceSqlOptions;
+  readonly "saved-views": SavedViewsSqlOptions;
+  readonly search: SearchSqlOptions;
+  readonly "service-principals": ServicePrincipalsSqlOptions;
+  readonly sessions: SessionsSqlOptions;
+  readonly settings: SettingsSqlOptions;
+  readonly "share-links": ShareLinksSqlOptions;
+  readonly "shared-signals": SharedSignalsSqlOptions;
+  readonly signatures: SignaturesSqlOptions;
+  readonly "signing-keys": SigningKeysSqlOptions;
+  readonly sla: SlaSqlOptions;
+  readonly sso: SsoSqlOptions;
+  readonly "state-machine": StateMachineSqlOptions;
+  readonly streams: StreamsSqlOptions;
+  readonly subjects: None;
+  readonly "support-sessions": SupportSessionsSqlOptions;
+  readonly tags: TagsSqlOptions;
+  readonly targets: TargetsSqlOptions;
+  readonly teams: TeamsSqlOptions;
+  readonly templates: TemplatesSqlOptions;
+  readonly tenant: TenantSqlOptions;
+  readonly "time-tracking": TimeTrackingSqlOptions;
+  readonly trash: TrashSqlOptions;
+  readonly "updated-at": None;
+  readonly usage: UsageSqlOptions;
+  readonly "vector-search": VectorSearchSqlOptions;
+  readonly versions: VersionsSqlOptions;
+  readonly waitlist: WaitlistSqlOptions;
+  readonly "webhook-inbox": WebhookInboxSqlOptions;
+  readonly "webhooks-in": WebhooksInSqlOptions;
+  readonly "webhooks-out": WebhooksOutSqlOptions;
+  readonly "work-items": WorkItemsSqlOptions;
+  readonly "workflow-builder": WorkflowBuilderSqlOptions;
+  readonly "workflow-sdk-world": WorkflowSdkWorldSqlOptions;
+  readonly workflows: None;
+}
+/** The options schema of every SQL module, keyed by module name. */
+declare const BLOCK_OPTION_SCHEMAS: { readonly [M in keyof BlockOptionsRegistry]: BlockOptionsSchema<BlockOptionsRegistry[M]>; };
+//#endregion
+//#region src/config/blocks.d.ts
+/**
+ * `blocks` in `better-supabase.config.ts`: how each SQL module maps onto the
+ * app's database. A module's contract (the functions other modules and the
+ * TypeScript side call) stays the same in every mode; only the tables behind it
+ * change.
+ */
+/**
+ * `managed`: the module owns its tables. `adopt`: the module writes its
+ * functions and views over tables the app already has (`tables` and `columns`),
+ * never `create table`. `custom`: the app implements the contract functions
+ * itself; the module writes nothing and doctor checks the signatures (BS307).
+ */
+type BlockMode = "managed" | "adopt" | "custom";
+/**
+ * Who a block's rows belong to. `tenant`: a tenant, checked through the access
+ * contract (`can`, `tenant_ids_with`). `user`: the signed-in user, whose id the
+ * scope column holds. `none`: one shared space every signed-in user reads and
+ * writes. Blocks that need tenants run only in `tenant`.
+ */
+type BlockScope = "tenant" | "user" | "none";
+/** `sql.naming`: how the tenant concept is named in SQL. */
+interface SqlNaming {
+  /**
+   * The tenant concept's singular name in table, function and column names:
+   * `workspace` turns `organizations` into `workspaces`, `create_organization`
+   * into `create_workspace` and `organization_id` into `workspace_id`.
+   * Lowercase letters, digits and underscores. Defaults to `organization`.
+   */
+  readonly tenant?: "organization" | "workspace" | "team" | (string & {});
+}
+/**
+ * Options every module takes; `Options` types `options`
+ * (`blocks.<module>.options`).
+ */
+interface BlockConfig<Options extends object = Readonly<Record<string, unknown>>> {
+  readonly mode?: BlockMode;
+  /**
+   * Schema of the module's functions and managed tables. Defaults to
+   * `sql.schema`, then `better_supabase`.
+   */
+  readonly schema?: string;
+  /**
+   * Logical table to `table` or `schema.table`, e.g. `{ memberships:
+   * 'public.organization_users' }`. An unqualified name is in `schema`. `null`
+   * marks an optional table the app doesn't have.
+   */
+  readonly tables?: Readonly<Record<string, string | null>>;
+  /**
+   * Logical table to logical column to column name, e.g. `{ memberships: {
+   * tenant: 'organization_id', role: 'role_id' } }`. `null` marks an optional
+   * column the adopted table doesn't have.
+   */
+  readonly columns?: Readonly<Record<string, Readonly<Record<string, string | null>>>>;
+  /** Type of tenant ids: `uuid` (default), `text`, `bigint` or `integer`. */
+  readonly idType?: string;
+  /** Who the block's rows belong to. Defaults to `sql.scope`, then `tenant`. */
+  readonly scope?: BlockScope;
+  /**
+   * Function name to the name the module writes it under, e.g. `{
+   * create_organization: 'start_company' }`. Keys are the default names or the
+   * names after `sql.naming`; an unknown function is an error.
+   * `blocks.access.functions` is the custom model's templates instead.
+   */
+  readonly functions?: Readonly<Record<string, string>>;
+  /**
+   * Module action to permission key, checked through the access contract, e.g.
+   * `{ invite: 'organization.members.invite' }`.
+   */
+  readonly permissions?: Readonly<Record<string, string>>;
+  /**
+   * Module-specific options, typed from the block manifest's options schema;
+   * each module's docs page lists them.
+   */
+  readonly options?: Options;
+  /**
+   * The app's optional `before_*` and `after_*` functions the module calls when
+   * they exist, e.g. `after_organization_create(organization, user)`. They are
+   * looked up in `schema` (default `public`); `functions` maps a hook name to
+   * another function, e.g. `{ after_organization_create:
+   * 'app.seed_organization' }`.
+   */
+  readonly hooks?: {
+    readonly schema?: string;
+    readonly functions?: Readonly<Record<string, string>>;
+  };
+  /**
+   * Whether the module writes its events to the outbox (`emit_event`) when the
+   * `outbox` module is installed. Defaults to true.
+   */
+  readonly events?: boolean;
+  /**
+   * Whether the module writes its actions to the audit log (`audit_event`) when
+   * the `audit` module is installed. Defaults to true.
+   */
+  readonly audit?: boolean;
+  /**
+   * A schema for the Data API, such as `api`: the module writes a `security
+   * invoker` wrapper there for each of its functions that `anon` or
+   * `authenticated` may execute (or only those in `functions`), so
+   * `rpcTransport(supabase, { schema: "api" })` reaches them without exposing
+   * the module schema (doctor BS312). Defaults to `sql.api`; `false` writes no
+   * wrappers even when `sql.api` is set.
+   */
+  readonly api?: string | false | {
+    readonly schema: string;
+    readonly functions?: readonly string[];
+  };
+}
+/**
+ * Where the active tenant of a request comes from. Every source counts only
+ * while the caller is a member, so a stale claim or setting grants nothing.
+ */
+type ActiveTenantSource = "claim" | "resolver" | {
+  readonly profileColumn: string;
+  readonly key?: string;
+};
+/**
+ * URL tenancy: the tenant comes from the request (a slug), not a stored
+ * setting.
+ */
+declare const DEFAULT_ACTIVE_TENANT: ActiveTenantSource;
+/**
+ * The access contract every module checks permissions through: `can(scope, id,
+ * permission)`, `tenant_ids_with(permission)`, `is_platform(permission)` and
+ * `can_user(user, scope, id, permission)`.
+ */
+/**
+ * A table whose row says whether a tenant or a user is active. Needs
+ * `disabledAt`, `status` with `active`, or both.
+ */
+interface DisabledRow {
+  /** `schema.table`. */
+  readonly table: string;
+  /** The column holding the tenant id or the user id. */
+  readonly id: string;
+  /** A nullable timestamp column; a row with a value is disabled. */
+  readonly disabledAt?: string;
+  /** A status column; only a row whose value is in `active` is active. */
+  readonly status?: string;
+  readonly active?: readonly string[];
+}
+interface AccessBlockConfig<Options extends object = Readonly<Record<string, unknown>>> extends BlockConfig<Options> {
+  /**
+   * `roles`: a fixed role list from `roles` (the default without
+   * `authorization`; with it, `provider` is the default). `catalog`: role,
+   * permission and override tables (`tables.roles`, `permissions`,
+   * `rolePermissions`, `overrides`, `platformAssignments`). `provider`: the
+   * functions of the config's `authorization` provider. `custom`: expression
+   * templates in `functions`.
+   */
+  readonly model?: "roles" | "catalog" | "provider" | "custom";
+  /**
+   * `roles` model: role name to permission keys. `*` grants everything and
+   * `prefix.*` a prefix. Defaults to owner, admin, member and viewer.
+   */
+  readonly roles?: Readonly<Record<string, readonly string[]>>;
+  /**
+   * `custom` model: SQL expressions with `{scope}`, `{id}`, `{permission}` and
+   * `{user}` placeholders, e.g. `{ can:
+   * 'public.authorize_scope({scope}::public.scope_type, {id}, {permission})'
+   * }`.
+   */
+  readonly functions?: {
+    readonly can?: string;
+    readonly tenantIdsWith?: string;
+    readonly isPlatform?: string;
+    readonly canUser?: string;
+    /**
+     * `{tenant}` and `{role}`: whether the caller may assign the role. Required
+     * by the `custom` model. The `provider` model defaults to the provider's
+     * `canAssign`; without either, only the service role assigns roles unless
+     * the `tenant` module is installed, and doctor BS411 warns.
+     */
+    readonly canAssign?: string;
+    /**
+     * `{user}`, `{tenant}` and `{role}`: whether that user may assign the role,
+     * for SQL that acts later for a stored user (an invitation accept checking
+     * the inviter again), as `can_assign_as`. The `provider` model defaults to
+     * the provider's `canAssignFor`.
+     */
+    readonly canAssignFor?: string;
+    /**
+     * `{permission}` and `{tenant}`: the user ids that hold the permission in
+     * the tenant, for the `custom` model's notification audiences.
+     */
+    readonly holdersOf?: string;
+    /** `{user}`: the permission claim for the access token hook. */
+    readonly permissionClaims?: string;
+  };
+  /**
+   * `roles` model: the JWT claim holding the caller's platform permission keys
+   * (an array). Defaults to `platform_permissions`.
+   */
+  readonly platformClaim?: string;
+  /**
+   * OAuth scope to the permission keys it grants a delegated token (a
+   * `client_id`, or an `act` chain that is not a support or impersonation
+   * level). The access functions refuse every key the token's scopes don't map
+   * to, whatever the user holds. A scope without an entry grants the key with
+   * its own name; map a scope to `["*"]` to grant everything. Merged over
+   * `authorization.delegation.scopes`.
+   */
+  readonly scopes?: Readonly<Record<string, readonly string[]>>;
+  /**
+   * What disables a tenant or a user. A string is a column that disables when
+   * set, as `schema.table.column`, keyed by the table's `id` (tenant) or the
+   * column named in `userKey` (user). An object is an active row: only a row
+   * whose `disabledAt` is null and whose `status` is in `active` is active, and
+   * a missing row counts as disabled. Disabled tenants and users get no
+   * permissions. Under the `provider` model both default to the provider's
+   * `suspension`.
+   */
+  readonly disabled?: {
+    readonly tenant?: string | DisabledRow;
+    readonly user?: string | DisabledRow;
+    readonly userKey?: string;
+  };
+  readonly activeTenant?: ActiveTenantSource;
+}
+/**
+ * `blocks` in the config, keyed by module name. Each block's `options` is typed
+ * from its manifest's options schema, and a name that is no SQL module is a
+ * type error.
+ */
+type BlocksConfig = { readonly [M in keyof BlockOptionsRegistry]?: M extends "access" ? AccessBlockConfig<BlockOptionsRegistry[M]> : BlockConfig<BlockOptionsRegistry[M]>; };
+/**
+ * `blocks` keyed by any module name, as the resolved config and the SQL
+ * renderer read it.
+ */
+interface AnyBlocksConfig {
+  readonly access?: AccessBlockConfig;
+  /**
+   * `AccessBlockConfig` is listed so an `access` entry fits the index
+   * signature.
+   */
+  readonly [module: string]: BlockConfig | AccessBlockConfig | undefined;
+}
+/** A module's config with defaults applied. */
+interface ResolvedModule {
+  readonly mode: BlockMode;
+  readonly schema: string;
+  readonly tables: Readonly<Record<string, string | null>>;
+  readonly columns: Readonly<Record<string, Readonly<Record<string, string | null>>>>;
+  readonly idType?: string;
+  readonly scope?: BlockScope;
+  readonly functions: Readonly<Record<string, string>>;
+  readonly permissions: Readonly<Record<string, string>>;
+  readonly options: Readonly<Record<string, unknown>>;
+  readonly hooks: {
+    readonly schema: string;
+    readonly functions: Readonly<Record<string, string>>;
+  };
+  readonly events: boolean;
+  readonly audit: boolean;
+  readonly api?: {
+    readonly schema: string;
+    readonly functions?: readonly string[];
+  };
+}
+declare function resolveModule(config?: BlockConfig): ResolvedModule;
+//#endregion
+//#region src/config/authorization.d.ts
+/**
+ * SQL expression templates the SQL modules and the access policies call.
+ * `{permission}` is a text expression (a literal or a parameter), `{user}` a
+ * uuid expression, `{tenant}` an expression of the tenant id type and `{role}`
+ * a text expression. `{scope}` is the scope's name unquoted, so it can be part
+ * of a function name (`app.ids_{scope}({permission})`); write `'{scope}'` to
+ * pass it as text.
+ */
+interface AuthorizationFunctions {
+  /**
+   * The ids of the `{scope}` instances where the caller holds `{permission}`,
+   * as a set: it is used as `select t.id::text from <template> as t(id)`.
+   */
+  readonly idsWith: string;
+  /** Whether the caller holds `{permission}` platform-wide. */
+  readonly isPlatform: string;
+  /** `idsWith` for `{user}`, so `can_user` answers for another user. */
+  readonly idsWithFor?: string;
+  /** `isPlatform` for `{user}`. */
+  readonly isPlatformFor?: string;
+  /** The ids of the `{scope}` instances the caller is a member of, as a set. */
+  readonly memberIds?: string;
+  /**
+   * `memberIds` for `{user}`, which the access token hook calls as
+   * `supabase_auth_admin`.
+   */
+  readonly memberIdsFor?: string;
+  /**
+   * The team ids `{user}` belongs to, as a set of the team id type: it is used
+   * as `select t.id from <template> as t(id)`. Under the provider model the
+   * teams module's `team_ids_of()`, and the team sharing in `saved-views` and
+   * `collections`, call it instead of reading `team_members`.
+   */
+  readonly teamIdsOf?: string;
+  /** Whether the caller may assign `{role}` in `{tenant}`. */
+  readonly canAssign?: string;
+  /** Whether `{user}` may assign `{role}` in `{tenant}`. */
+  readonly canAssignFor?: string;
+  /**
+   * The permission keys `{user}` holds in `{tenant}`, as a `text[]`. It fills
+   * `member_permissions` and the `permissions` claim; without it both are
+   * empty.
+   */
+  readonly permissionsFor?: string;
+  /**
+   * Whether the caller may decide the tool call `{tool}` (text) waits on in
+   * `{tenant}`. Without it only the chat's owner and the service role decide.
+   *
+   * @deprecated Use `isApprover`, which every module that waits for an
+   * approval reads. `canApprove` is read for tool calls only when
+   * `isApprover` is unset.
+   */
+  readonly canApprove?: string;
+  /**
+   * Whether the caller may approve the request `{subject}` (text) of kind
+   * `{kind}` (a text literal: `'ai-tool'` with the tool name as `{subject}`,
+   * `'support-session'` with the request id, or the app's own kind) in
+   * `{tenant}`. `{requester}` is the uuid of the user who asked (the approval's
+   * `requested_by`, the support admin, the chat's owner), or `null`; a provider
+   * that resolves out-of-office covers reads it to refuse a cover by the
+   * requester's own delegator. It replaces each module's own eligibility check;
+   * the requester is refused before it runs. Without it a module falls back to
+   * its default approver (the chat's owner, a platform permission).
+   */
+  readonly isApprover?: string;
+  /**
+   * The user ids that hold `{permission}` on `{tenant}`, as a set: it is used
+   * as `select u from <template> as t(u)`. A notification's `permission`
+   * audience calls it. Without it, naming `permission` is refused.
+   */
+  readonly holdersOf?: string;
+  /**
+   * Whether the caller's session may write. No placeholders. Write functions
+   * and write policies call it instead of the built-in act check.
+   */
+  readonly actorMayWrite?: string;
+  /**
+   * Whether the caller holds `{permission}` on the instance `{id}` (text) of
+   * `{resource}` in `{tenant}`, at `{scope}`. A realtime topic that declares a
+   * `permission` calls it for the instance in its topic name.
+   */
+  readonly permitted?: string;
+}
+/** One scope the provider decides permissions in, such as `organization`. */
+interface AuthorizationScope {
+  /** Lower case letters, digits and `_`, starting with a letter. */
+  readonly name: string;
+  /**
+   * The Postgres type of the scope's ids: `uuid`, `text`, `bigint` or
+   * `integer`.
+   */
+  readonly idType?: string;
+  /** The scope this one sits in; the root scope has none. */
+  readonly parent?: string;
+}
+/** A function the templates call, which must exist and be executable by `role`. */
+interface AuthorizationRequirement {
+  /** `schema.name`. */
+  readonly function: string;
+  /** The argument types, such as `text` or `uuid, text`. */
+  readonly args?: string;
+  readonly role: string;
+}
+/** A permission key the provider defines. */
+interface AuthorizationPermission {
+  readonly key: string;
+  /**
+   * `true` when the SQL functions answer for the key completely. A key with row
+   * conditions they don't check is `false`, and policies refuse it. Unset means
+   * unknown, which counts as `false`.
+   */
+  readonly sqlComplete?: boolean;
+  /** The scopes it can be granted at. */
+  readonly scopes?: readonly string[];
+}
+/**
+ * One named operation: what workflow builder nodes, MCP tools, AI tools and
+ * inbox commands with that name need. The provider supplies the table;
+ * `blocks.<module>.permissions` still renames a module's own keys.
+ */
+interface AuthorizationOperation {
+  /** The permission key the operation needs. */
+  readonly permission: string;
+  readonly meta?: {
+    /** `low`, `medium` or `high`; a `high` operation can ask for approval. */
+    readonly risk?: "low" | "medium" | "high";
+    /** What it changes: `read`, `write`, `delete`, `external`. */
+    readonly effects?: readonly ("read" | "write" | "delete" | "external")[];
+    readonly title?: string;
+  };
+}
+/** A table of memberships the provider reads. */
+interface AuthorizationMembership {
+  /** `schema.table`. */
+  readonly table: string;
+  readonly userColumn: string;
+  /** The scope column, or the scope every row is in. */
+  readonly scope: {
+    readonly column: string;
+  } | {
+    readonly value: string;
+  };
+  readonly idColumn: string;
+}
+/** A membership table whose role column points into a roles table. */
+interface AuthorizationRoleSource {
+  /** `schema.table` of the memberships. */
+  readonly table: string;
+  readonly role: {
+    readonly column: string;
+    readonly through: {
+      /** `schema.table` of the roles. */
+      readonly table: string;
+      readonly id: string;
+      readonly column: string;
+    };
+  };
+}
+/** The access token hook the provider generates. */
+interface AuthorizationTokenHook {
+  /** `schema.name`. */
+  readonly function: string;
+  /** The claim it writes the active tenant id to. */
+  readonly tenantClaim?: string;
+  /** Claims it writes itself, which a second writer would contradict. */
+  readonly ownedClaims: readonly string[];
+  /**
+   * Claims it fills from other functions, such as `features` from
+   * `better_supabase.feature_claims`.
+   */
+  readonly registeredClaims?: readonly {
+    readonly name: string;
+    /** `schema.name`. */
+    readonly function: string;
+  }[];
+  /** A byte budget over some claims, which doctor `--as` measures (BS405). */
+  readonly budget?: {
+    readonly claims: readonly string[];
+    readonly bytes: number;
+    /**
+     * A claim the hook sets to `true` when it dropped entries to stay within
+     * the budget.
+     */
+    readonly truncatedClaim?: string;
+  };
+  /**
+   * Comment lines the provider's generated files contain, so doctor recognises
+   * them.
+   */
+  readonly markers?: {
+    /** In the file that defines the hook. */
+    readonly hook?: string;
+    /** In the migration that grants the hook's functions. */
+    readonly grants?: string;
+  };
+  /** The command that writes the hook's grants, for BS404. */
+  readonly grantsCommand?: string;
+}
+/**
+ * An authorization system the SQL modules, the policies and doctor delegate to.
+ * It is plain data, usually built from the provider's own output files.
+ */
+interface AuthorizationProvider {
+  readonly apiVersion: 1;
+  /** The provider's name, for messages. */
+  readonly name: string;
+  readonly scopes: readonly AuthorizationScope[];
+  /** The scope tenants are. */
+  readonly tenantScope: string;
+  readonly functions: AuthorizationFunctions;
+  readonly requires?: readonly AuthorizationRequirement[];
+  readonly permissions?: readonly AuthorizationPermission[];
+  /**
+   * Operations by name (`workflow.node.http`, `mcp.tool.search_posts`,
+   * `ai.tool.send_email`, `inbox.command.assign`). A module looks an operation
+   * up here first and uses its own default permission otherwise.
+   */
+  readonly operations?: Readonly<Record<string, AuthorizationOperation>>;
+  readonly memberships?: readonly AuthorizationMembership[];
+  /** Rows that say whether a user or a tenant is active. */
+  readonly suspension?: {
+    readonly user?: DisabledRow;
+    readonly tenant?: DisabledRow;
+  };
+  readonly roleSources?: readonly AuthorizationRoleSource[];
+  /** `schema.table.column` of every column that decides access (BS213). */
+  readonly decidingColumns?: readonly string[];
+  readonly tokenHook?: AuthorizationTokenHook;
+  /** What a delegated token (an OAuth client or agent) may use. */
+  readonly delegation?: {
+    /**
+     * OAuth scope to the permission keys it grants (RFC 9396 details stay with
+     * the app). `blocks.access.scopes` is merged over it.
+     */
+    readonly scopes?: Readonly<Record<string, readonly string[]>>;
+  };
+  /** How `canApprove` decisions are made. */
+  readonly approvals?: {
+    /** The user who asked for the tool call can't approve it. Default `false`. */
+    readonly distinctApprover?: boolean;
+  };
+  /** What the provider found wrong while building this, for doctor. */
+  readonly problems?: readonly string[];
+}
+/**
+ * The error for a provider built for another API version, or `undefined` for
+ * version 1.
+ */
+declare function providerApiProblem(provider: {
+  readonly name?: unknown;
+  readonly apiVersion?: unknown;
+}): string | undefined;
+//#endregion
+export { BLOCK_OPTION_SCHEMAS as C, resolveModule as S, BlocksConfig as _, AuthorizationProvider as a, ResolvedModule as b, AuthorizationScope as c, AccessBlockConfig as d, ActiveTenantSource as f, BlockScope as g, BlockMode as h, AuthorizationPermission as i, AuthorizationTokenHook as l, BlockConfig as m, AuthorizationMembership as n, AuthorizationRequirement as o, AnyBlocksConfig as p, AuthorizationOperation as r, AuthorizationRoleSource as s, AuthorizationFunctions as t, providerApiProblem as u, DEFAULT_ACTIVE_TENANT as v, BlockOptionsRegistry as w, SqlNaming as x, DisabledRow as y };