better-supabase 0.11.0 → 0.13.0

package/dist/workflow-sdk-world-BOEsvWmx.js

@@ -0,0 +1,2123 @@
+import { a as sqlString, i as sqlIdent } from "./template-DXsGm_R0.js";
+import "./batch-limit-DKVQDz4o.js";
+//#region src/sql/shared.ts
+/**
+* What `record` and the other statement helpers return when there is nothing to
+* do.
+*/
+const NOTHING = "null;";
+/**
+* `alter table ... add column if not exists` for each extra column of a managed
+* table.
+*/
+const addExtraColumns = (table, columns) => columns.map((column) => `\nalter table ${table} add column if not exists ${column.ident} ${column.type};`).join("");
+/**
+* A `jsonb` object of `columns` of row `alias`, keyed by column name, so reads
+* return extra columns without exposing the rest of the row.
+*/
+const columnsObject = (alias, columns) => `jsonb_build_object(${columns.map((name) => `${sqlString(name)}, ${alias}.${sqlIdent(name)}`).join(", ")})`;
+/**
+* `, 'fields', jsonb_build_object(...)` of the extra columns of row `alias`,
+* for a read built with `jsonb_build_object`; empty without any.
+*/
+const extraFieldsJson = (alias, extras) => extras.length === 0 ? "" : `, 'fields', ${columnsObject(alias, extras.map((extra) => extra.name))}`;
+/**
+* PL/pgSQL that copies the extra columns from `source`, a `jsonb` object keyed
+* by column name, onto the rows of `table` (alias `x`) that `where` matches. A
+* key `source` leaves out keeps the column's value, so it runs after an insert
+* (the defaults stay) and on a partial update. Empty without extra columns.
+*/
+const writeExtraColumns = (table, extras, source, where, into) => extras.length === 0 ? "" : `
+  update ${table} x set ${extras.map((extra) => `${extra.ident} = case when ${source} ? ${sqlString(extra.name)} then r.${extra.ident} else x.${extra.ident} end`).join(", ")}
+  from jsonb_populate_record(null::${table}, (select coalesce(jsonb_object_agg(e.key, e.value), '{}') from jsonb_each(${source}) e where e.key in (${extras.map((extra) => sqlString(extra.name)).join(", ")}))) r
+  where ${where}${into === void 0 ? "" : `\n  returning x.* into ${into}`};`;
+/**
+* `json` (a `jsonb` expression of row `alias`) with the extra columns under
+* `fields`, or `json` itself without any.
+*/
+const withExtraFields = (json, alias, extras) => extras.length === 0 ? json : `(${json} || jsonb_build_object('fields', ${columnsObject(alias, extras.map((extra) => extra.name))}))`;
+/** The `fields jsonb` parameter for `columns`; see `ExtraFieldsArg`. */
+function extraFieldsArg(columns) {
+	const on = columns.length > 0;
+	return {
+		param: on ? ", fields jsonb default null" : "",
+		type: on ? ", jsonb" : "",
+		contract: on ? ["jsonb"] : [],
+		drop: (fn, types) => `drop function if exists ${fn}(${on ? types : [types, "jsonb"].filter((type) => type !== "").join(", ")});`
+	};
+}
+const SCHEMA = `create schema if not exists better_supabase;
+grant usage on schema better_supabase to anon, authenticated, service_role;`;
+/**
+* A SQL condition true for the service role and for a direct admin connection
+* (no JWT, a privileged session user), which may act for others.
+*/
+const SERVICE_CALLER = "coalesce(nullif((select auth.jwt()) ->> 'role', ''), session_user::text) in ('service_role', 'postgres', 'supabase_admin')";
+/**
+* The `organization.member_added` record for a module that adds a member, so
+* every module writes the same payload. Each value is a SQL expression.
+*/
+function memberAddedRecord(ctx, member) {
+	return ctx.record({
+		type: "organization.member_added",
+		payload: `jsonb_build_object('organizationId', ${member.tenant}::text, 'userId', ${member.user}, 'role', ${member.role})`,
+		subject: `'organizations/' || ${member.tenant}::text`,
+		tenant: member.tenant,
+		audit: {
+			category: "membership",
+			targetType: "user",
+			recordId: `${member.user}::text`
+		}
+	});
+}
+/**
+* Creates the module's schema when it isn't `better_supabase`, then the module
+* schema.
+*/
+function schemaPreamble(ctx) {
+	if (ctx.schemaName === "better_supabase") return SCHEMA;
+	return `${SCHEMA}
+create schema if not exists ${ctx.schema};
+grant usage on schema ${ctx.schema} to anon, authenticated, service_role;`;
+}
+/** A claim from the top level of the token, then `app_metadata`. */
+function jwtClaim(name) {
+	return `coalesce(auth.jwt() ->> ${sqlString(name)}, auth.jwt() -> 'app_metadata' ->> ${sqlString(name)})`;
+}
+/** `table` or `schema.table` as `[schema, table]`, in `public` without a schema. */
+function splitTable(name) {
+	const parts = name.split(".");
+	if (parts.length > 2 || parts.some((part) => part.length === 0)) throw new TypeError(`"${name}" must be "table" or "schema.table"`);
+	return parts.length === 2 ? [parts[0], parts[1]] : ["public", parts[0]];
+}
+/** `table` or `schema.table`, quoted. */
+function quotedTable(name) {
+	const [schema, table] = splitTable(name);
+	return `${sqlIdent(schema)}.${sqlIdent(table)}`;
+}
+/** `schema.table.column` split into its quoted table and column. */
+function columnRef(where, value) {
+	const parts = value.split(".");
+	if (parts.length !== 3 || parts.some((part) => part.length === 0)) throw new TypeError(`${where} must be "schema.table.column", got "${value}"`);
+	const [schema, table, column] = parts;
+	return {
+		table: `${sqlIdent(schema)}.${sqlIdent(table)}`,
+		column: sqlIdent(column)
+	};
+}
+const QUOTED_IDENT = /^"(.*)"$/s;
+/**
+* Replaces the check constraints on one column of a table a module created
+* earlier: `create table if not exists` never changes an inline check, and its
+* generated name follows the table's configured name. For upgrade steps.
+* `column` is a quoted identifier; the catalog stores the bare name.
+*/
+function replaceColumnCheck(check) {
+	const column = QUOTED_IDENT.exec(check.column)?.[1]?.replaceAll("\"\"", "\"") ?? check.column;
+	return `do $$
+declare
+  v_name name;
+begin
+  for v_name in
+    select c.conname from pg_catalog.pg_constraint c
+    join pg_catalog.pg_attribute a on a.attrelid = c.conrelid and a.attnum = c.conkey[1]
+    where c.conrelid = ${sqlString(check.table)}::regclass and c.contype = 'c'
+      and cardinality(c.conkey) = 1 and a.attname = ${sqlString(column)}
+  loop
+    execute format('alter table %s drop constraint %I', ${sqlString(check.table)}, v_name);
+  end loop;
+end;
+$$;
+alter table ${check.table} add constraint ${sqlIdent(check.name)} check (${check.expression});`;
+}
+/**
+* Adds a foreign key to a table a module created earlier, once: `create table
+* if not exists` can't add it to a table that already exists, and the
+* referenced table can come from a module that renders later. Existing rows
+* without a match leave the key unvalidated, with a warning.
+*/
+function addForeignKey(fk) {
+	return `do $$
+begin
+  if not exists (
+    select 1 from pg_constraint
+    where conrelid = ${sqlString(fk.table)}::regclass and conname = ${sqlString(fk.name)}
+  ) then
+    alter table ${fk.table} add constraint ${sqlIdent(fk.name)}
+      foreign key (${fk.column}) references ${fk.references} on delete ${fk.onDelete} not valid;
+    begin
+      alter table ${fk.table} validate constraint ${sqlIdent(fk.name)};
+    exception when foreign_key_violation then
+      raise warning '% has rows without a match, so only new rows are checked. Delete them, then run: alter table % validate constraint %',
+        ${sqlString(fk.table)}, ${sqlString(fk.table)}, ${sqlString(fk.name)};
+    end;
+  end if;
+end;
+$$;`;
+}
+/**
+* Adds a check constraint to a table a module created earlier, once, for the
+* same reason as `addForeignKey`. Existing rows that fail it leave the check
+* unvalidated, with a warning, so an upgrade never stops on old data.
+*/
+function addCheck(check) {
+	return `do $$
+begin
+  if not exists (
+    select 1 from pg_constraint
+    where conrelid = ${sqlString(check.table)}::regclass and conname = ${sqlString(check.name)}
+  ) then
+    alter table ${check.table} add constraint ${sqlIdent(check.name)}
+      check (${check.expression}) not valid;
+    begin
+      alter table ${check.table} validate constraint ${sqlIdent(check.name)};
+    exception when check_violation then
+      raise warning '% has rows that fail %, so only new rows are checked. Fix them, then run: alter table % validate constraint %',
+        ${sqlString(check.table)}, ${sqlString(check.name)}, ${sqlString(check.table)}, ${sqlString(check.name)};
+    end;
+  end if;
+end;
+$$;`;
+}
+/**
+* An `updated_at` column on a managed table, kept current by the `updated-at`
+* module's `set_updated_at()` (the module must require it).
+*/
+function updatedAt(table, column) {
+	return `alter table ${table} add column if not exists ${column} timestamptz not null default now();
+drop trigger if exists bs_updated_at on ${table};
+create trigger bs_updated_at before update on ${table}
+  for each row execute function better_supabase.set_updated_at(${sqlString(column.replaceAll("\"", ""))});`;
+}
+function renameSql(renames) {
+	const schema = sqlString(renames.schema);
+	const q = (name) => `${sqlIdent(renames.schema)}.${sqlIdent(name)}`;
+	const lines = [];
+	let table = renames.table;
+	for (const [from, to] of renames.tables ?? []) {
+		lines.push(`  if to_regclass(${sqlString(`${renames.schema}.${from}`)}) is not null
+    and (select c.relkind from pg_class c where c.oid = to_regclass(${sqlString(`${renames.schema}.${from}`)})) in ('r', 'p')
+    and to_regclass(${sqlString(`${renames.schema}.${to}`)}) is null then
+    alter table ${q(from)} rename to ${sqlIdent(to)};
+  end if;`);
+		if (from === table) table = to;
+	}
+	for (const [from, to] of renames.columns ?? []) lines.push(`  if exists (select 1 from information_schema.columns c
+      where c.table_schema = ${schema} and c.table_name = ${sqlString(table)} and c.column_name = ${sqlString(from)})
+    and not exists (select 1 from information_schema.columns c
+      where c.table_schema = ${schema} and c.table_name = ${sqlString(table)} and c.column_name = ${sqlString(to)}) then
+    alter table ${q(table)} rename column ${sqlIdent(from)} to ${sqlIdent(to)};
+  end if;`);
+	for (const [from, to] of renames.indexes ?? []) lines.push(`  if to_regclass(${sqlString(`${renames.schema}.${from}`)}) is not null
+    and to_regclass(${sqlString(`${renames.schema}.${to}`)}) is null then
+    alter index ${q(from)} rename to ${sqlIdent(to)};
+  end if;`);
+	for (const [from, to, args] of renames.functions ?? []) lines.push(`  if to_regprocedure(${sqlString(`${renames.schema}.${from}(${args})`)}) is not null
+    and to_regprocedure(${sqlString(`${renames.schema}.${to}(${args})`)}) is null then
+    alter function ${q(from)}(${args}) rename to ${sqlIdent(to)};
+  end if;`);
+	if (lines.length === 0) return "";
+	return `do $$
+begin
+${lines.join("\n")}
+end;
+$$;`;
+}
+/**
+* A SQL condition true when `organization` names no row of the installed
+* organizations table. False without the organizations module.
+*/
+function organizationMissing(ctx, organization) {
+	if (!ctx.installed("organizations")) return "false";
+	const organizations = ctx.of("organizations");
+	return `not exists (select 1 from ${organizations.table("organizations")} o where o.${organizations.col("organizations", "id")} = ${organization})`;
+}
+function membershipDisabledAt(ctx) {
+	if (ctx.module !== "tenant" && !ctx.installed("tenant")) return;
+	const tenant = ctx.module === "tenant" ? ctx : ctx.of("tenant");
+	if (!tenant.has("memberships", "disabledAt")) return;
+	if (!tenant.manages && typeof tenant.config.columns["memberships"]?.["disabledAt"] !== "string") return;
+	return tenant.col("memberships", "disabledAt");
+}
+function activeMembership(ctx, alias) {
+	const column = membershipDisabledAt(ctx);
+	return column === void 0 ? "" : ` and ${alias}.${column} is null`;
+}
+function membershipSuspended(ctx, tenant, user) {
+	const column = membershipDisabledAt(ctx);
+	if (column === void 0) return;
+	const t = ctx.module === "tenant" ? ctx : ctx.of("tenant");
+	return `exists (select 1 from ${t.table("memberships")} sm where sm.${t.col("memberships", "tenant")} = ${tenant} and sm.${t.col("memberships", "user")} = ${user} and sm.${column} is not null)`;
+}
+/**
+* `tenant_disabled(id)` and `user_disabled(uuid)` from
+* `blocks.access.disabled`. Without a column they return false, so callers
+* don't need to know whether it is configured.
+*/
+function disabledHelpers(ctx) {
+	const disabled = ctx.modules.access?.disabled ?? {};
+	const id = ctx.idType;
+	const organizations = managedOrganizations(ctx);
+	let tenantCheck = "false";
+	if (disabled.tenant !== void 0) tenantCheck = disabledCheck("blocks.access.disabled.tenant", disabled.tenant, {
+		key: "\"id\"",
+		alias: "t",
+		value: "tenant_disabled.tenant"
+	});
+	else if (organizations) tenantCheck = `exists (select 1 from ${organizations.table} t where t.${organizations.id} = tenant_disabled.tenant and (${organizations.flags.map((column) => `t.${column} is not null`).join(" or ")}))`;
+	const userCheck = disabled.user === void 0 ? "false" : disabledCheck("blocks.access.disabled.user", disabled.user, {
+		key: sqlIdent(disabled.userKey ?? "id"),
+		alias: "u",
+		value: "user_disabled.user_id"
+	});
+	return `
+-- Disabled tenants and users get no permissions and no membership claims
+-- (blocks.access.disabled; with the managed organizations module, its
+-- disabled_at and deleted_at columns).
+create or replace function better_supabase.tenant_disabled(tenant ${id})
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select ${tenantCheck}
+$$;
+
+create or replace function better_supabase.user_disabled(user_id uuid)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select ${userCheck}
+$$;
+
+revoke execute on function better_supabase.tenant_disabled(${id}) from public, anon, authenticated;
+revoke execute on function better_supabase.user_disabled(uuid) from public, anon, authenticated;
+grant execute on function better_supabase.tenant_disabled(${id}) to service_role, supabase_auth_admin;
+grant execute on function better_supabase.user_disabled(uuid) to service_role, supabase_auth_admin;`;
+}
+/**
+* Whether `disabledHelpers` reads the managed organizations table, which a
+* later file creates: the caller turns `check_function_bodies` off around it.
+*/
+/**
+* The condition that `value` is disabled: a set column (`schema.table.column`,
+* matched on `key`), or no active row (an authorization provider's suspension
+* row, where a missing row counts as disabled).
+*/
+function disabledCheck(where, config, match) {
+	const { alias: d, value } = match;
+	if (typeof config === "string") {
+		const ref = columnRef(where, config);
+		return `exists (select 1 from ${ref.table} ${d} where ${d}.${match.key} = ${value} and ${d}.${ref.column} is not null)`;
+	}
+	const parts = config.table.split(".");
+	if (parts.length !== 2 || parts.some((part) => part.length === 0)) throw new TypeError(`${where}.table must be "schema.table", got "${config.table}"`);
+	const active = [`${d}.${sqlIdent(config.id)} = ${value}`];
+	if (config.disabledAt !== void 0) active.push(`${d}.${sqlIdent(config.disabledAt)} is null`);
+	if (config.status !== void 0) {
+		if (!config.active || config.active.length === 0) throw new TypeError(`${where}.status needs the active values in active`);
+		active.push(`${d}.${sqlIdent(config.status)}::text in (${config.active.map(sqlString).join(", ")})`);
+	}
+	if (config.disabledAt === void 0 && config.status === void 0) throw new TypeError(`${where} needs disabledAt, status or both`);
+	return `not exists (select 1 from ${parts.map((part) => sqlIdent(part)).join(".")} ${d} where ${active.join(" and ")})`;
+}
+/**
+* Whether the `access` module's file defines `tenant_disabled` and
+* `user_disabled`: it does whenever it is installed (or configured) outside
+* custom mode, and the `tenant` module's file then leaves them out, so each
+* function is defined in one file.
+*/
+function accessDefinesDisabledHelpers(ctx) {
+	const access = ctx.modules.access;
+	if (!ctx.installed("access") && access === void 0) return false;
+	return (access?.mode ?? "managed") !== "custom";
+}
+function disabledHelpersNeedLaterTables(ctx) {
+	return !ctx.modules.access?.disabled?.tenant && managedOrganizations(ctx) !== void 0;
+}
+/**
+* The managed organizations table and its disabling columns, when installed and
+* managed.
+*/
+function managedOrganizations(ctx) {
+	if (!ctx.installed("organizations")) return;
+	const organizations = ctx.of("organizations");
+	if (!organizations.manages) return;
+	const flags = ["disabledAt", "deletedAt"].filter((logical) => organizations.has("organizations", logical)).map((logical) => organizations.col("organizations", logical));
+	if (flags.length === 0) return;
+	return {
+		table: organizations.table("organizations"),
+		id: organizations.col("organizations", "id"),
+		flags
+	};
+}
+/**
+* Another row trigger on `target` whose function name matches `pattern` does
+* the module trigger's job twice. `track_*` warns about it, or drops it with
+* `replace_trigger => true`.
+*/
+const EQUIVALENT_TRIGGERS = `
+create or replace function better_supabase.replace_equivalent_triggers(
+  target regclass,
+  module_trigger text,
+  pattern text,
+  replace_trigger boolean
+)
+returns void
+language plpgsql
+set search_path = ''
+as $$
+declare
+  found record;
+begin
+  for found in
+    select t.tgname as name, p.proname as fn
+    from pg_catalog.pg_trigger t
+    join pg_catalog.pg_proc p on p.oid = t.tgfoid
+    where t.tgrelid = replace_equivalent_triggers.target
+      and not t.tgisinternal
+      and t.tgname <> replace_equivalent_triggers.module_trigger
+      and p.proname ~* replace_equivalent_triggers.pattern
+  loop
+    if replace_trigger then
+      execute format('drop trigger %I on %s', found.name, target);
+    else
+      raise warning '% already has trigger % (%), which does what % does. Pass replace_trigger => true to drop it.',
+        target, found.name, found.fn, module_trigger;
+    end if;
+  end loop;
+end;
+$$;
+revoke execute on function better_supabase.replace_equivalent_triggers(regclass, text, text, boolean) from public, anon, authenticated;`;
+/** FNV-1a, as 8 hex digits: a stable suffix that keeps two names apart. */
+function shortHash(text) {
+	let hash = 2166136261;
+	for (let index = 0; index < text.length; index += 1) {
+		hash ^= text.codePointAt(index) ?? 0;
+		hash = Math.imul(hash, 16777619) >>> 0;
+	}
+	return hash.toString(16).padStart(8, "0");
+}
+/**
+* Adds CHECK `name` on `table` (quoted) unless a re-run finds it already
+* checking `expression`: the constraint comment records a hash of the
+* expression, so an unchanged check skips the table scan under ACCESS
+* EXCLUSIVE. `notValid` leaves existing rows unchecked.
+*/
+function ensureCheck(table, name, expression, options = {}) {
+	const marker = sqlString(`better-supabase check ${shortHash(`${expression}|${options.notValid === true}`)}`);
+	const constraint = sqlIdent(name);
+	return `do $$
+begin
+  if coalesce(obj_description((
+    select c.oid from pg_catalog.pg_constraint c
+    where c.conrelid = ${sqlString(table)}::regclass and c.conname = ${sqlString(name)}
+  ), 'pg_constraint'), '') <> ${marker} then
+    alter table ${table} drop constraint if exists ${constraint};
+    alter table ${table} add constraint ${constraint} check (${expression})${options.notValid === true ? " not valid" : ""};
+    comment on constraint ${constraint} on ${table} is ${marker};
+  end if;
+end;
+$$;`;
+}
+/**
+* The constraint and trigger name of a check. A key that sanitizing or the
+* 63-byte limit would change (`notify.email`, `notify-email`, a long key) gets
+* a hash of the key, so two keys never share a name and drop each other's
+* check.
+*/
+function jsonCheckName(check) {
+	const base = `bs_json_${check.column}`;
+	if (!check.where) return base.slice(0, 63);
+	const key = check.where.value;
+	const clean = key.replaceAll(/[^a-z0-9_]/gi, "_");
+	const plain = `${base}_${clean}`;
+	if (clean === key && plain.length <= 63) return plain;
+	return `${plain.slice(0, 54)}_${shortHash(key)}`;
+}
+function jsonSchemaChecks(checks) {
+	if (checks.length === 0) return "";
+	return `\n-- config.json schemas
+-- Each check is added not valid and validated separately. On a large table,
+-- move the validate statements to a later migration: adding a not valid check
+-- blocks writes only briefly, and validating takes a lock that lets writes
+-- continue. The trigger of the same name reports which part of the schema failed.
+${checks.map((check) => {
+		const target = quotedTable(check.table);
+		const name = sqlIdent(jsonCheckName(check));
+		const schemaText = sqlString(JSON.stringify(check.schema));
+		const matches = `extensions.jsonb_matches_schema(${schemaText}::json, ${sqlIdent(check.column)})`;
+		const columns = check.where ? `${sqlIdent(check.column)}, ${sqlIdent(check.where.column)}` : sqlIdent(check.column);
+		const args = [
+			sqlString(check.column),
+			schemaText,
+			...check.where ? [sqlString(check.where.column), sqlString(check.where.value)] : []
+		].join(", ");
+		return [
+			`alter table ${target} drop constraint if exists ${name};`,
+			`alter table ${target} add constraint ${name}`,
+			`  check (${check.where ? `${sqlIdent(check.where.column)} <> ${sqlString(check.where.value)} or ` : ""}${matches}) not valid;`,
+			`alter table ${target} validate constraint ${name};`,
+			`drop trigger if exists ${name} on ${target};`,
+			`create trigger ${name} before insert or update of ${columns} on ${target}`,
+			`  for each row execute function better_supabase.check_json_schema(${args});`
+		].join("\n");
+	}).join("\n\n")}\n`;
+}
+/** SQL that takes every privilege on a table from `anon` and `authenticated`. */
+const revokeTable = (table) => `revoke all on ${table} from anon, authenticated;`;
+/**
+* One policy per command for rows `authenticated` owns. A permissive `for all`
+* policy would also grant writes on its own, so the read-only actor check
+* (which wraps only insert, update and delete policies) could never refuse
+* them. `legacy` is the name of the `for all` policy this replaces.
+*/
+function ownRowPolicies(options) {
+	const { table, legacy, name, using, check } = options;
+	const create = (command, body) => `drop policy if exists ${sqlIdent(name(command))} on ${table};
+create policy ${sqlIdent(name(command))} on ${table} ${body};`;
+	return [
+		`drop policy if exists ${sqlIdent(legacy)} on ${table};`,
+		create("read", `for select to authenticated using (${using})`),
+		create("insert", `for insert to authenticated with check (${check})`),
+		create("update", `for update to authenticated using (${using}) with check (${check})`),
+		create("delete", `for delete to authenticated using (${using})`)
+	].join("\n");
+}
+/**
+* SQL that turns on RLS for a table the module manages, takes it from `anon`
+* and `authenticated` and gives it to the service role. `read` grants `select`
+* back to `authenticated`, for tables its policies expose.
+*/
+const lockTable = (table, options = {}) => `alter table ${table} enable row level security;
+${revokeTable(table)}
+${options.read ? `grant select on ${table} to authenticated;\n` : ""}grant all on ${table} to service_role;`;
+/**
+* Monthly range partitions for any table created `partition by range` on a
+* timestamptz column: a registry, `ensure_partitions(parent, months_ahead)`,
+* which creates `<parent>_pYYYYMM` for this month and the next ones (UTC
+* bounds) with RLS on and the client roles revoked, `maintain_partitions()` for
+* every registered table, and `expired_partitions(parent, cutoff)`, the
+* partitions wholly before `cutoff`. A table that isn't partitioned (one
+* created before the option) is left alone.
+*/
+const MONTHLY_PARTITIONS = `create table if not exists better_supabase.partitioned_tables (
+  parent regclass primary key,
+  months_ahead integer not null default 3 check (months_ahead between 1 and 24)
+);
+${lockTable("better_supabase.partitioned_tables")}
+
+create or replace function better_supabase.ensure_partitions(parent regclass, months_ahead integer default 3)
+returns integer
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  v_schema text;
+  v_name text;
+  v_month timestamp := date_trunc('month', now() at time zone 'UTC');
+  v_part text;
+  v_made integer := 0;
+begin
+  select n.nspname, c.relname into v_schema, v_name
+  from pg_catalog.pg_class c join pg_catalog.pg_namespace n on n.oid = c.relnamespace
+  where c.oid = parent and c.relkind = 'p';
+  if v_name is null then
+    return 0;
+  end if;
+  for i in 0..months_ahead loop
+    v_part := v_name || '_p' || to_char(v_month + make_interval(months => i), 'YYYYMM');
+    continue when pg_catalog.to_regclass(format('%I.%I', v_schema, v_part)) is not null;
+    begin
+      execute format(
+        'create table %I.%I partition of %s for values from (%L) to (%L)',
+        v_schema, v_part, parent,
+        (v_month + make_interval(months => i)) at time zone 'UTC',
+        (v_month + make_interval(months => i + 1)) at time zone 'UTC'
+      );
+    exception when check_violation then
+      -- The default partition already holds rows of that month.
+      raise notice '% not created: the default partition has rows in its range', v_part;
+      continue;
+    end;
+    execute format('alter table %I.%I enable row level security', v_schema, v_part);
+    execute format('revoke all on %I.%I from anon, authenticated', v_schema, v_part);
+    v_made := v_made + 1;
+  end loop;
+  return v_made;
+end;
+$$;
+
+create or replace function better_supabase.maintain_partitions()
+returns integer
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  v_made integer := 0;
+  v_table record;
+begin
+  for v_table in select t.parent, t.months_ahead from better_supabase.partitioned_tables t loop
+    v_made := v_made + better_supabase.ensure_partitions(v_table.parent, v_table.months_ahead);
+  end loop;
+  return v_made;
+end;
+$$;
+
+create or replace function better_supabase.expired_partitions(parent regclass, cutoff timestamptz)
+returns setof regclass
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select c.oid::regclass
+  from pg_catalog.pg_inherits i
+  join pg_catalog.pg_class c on c.oid = i.inhrelid
+  where i.inhparent = parent
+    and c.relname ~ '_p[0-9]{6}$'
+    and cutoff is not null
+    and (to_date(right(c.relname, 6), 'YYYYMM')::timestamp + interval '1 month') at time zone 'UTC' <= cutoff
+  order by c.relname
+$$;
+revoke execute on function better_supabase.ensure_partitions(regclass, integer) from public, anon, authenticated;
+revoke execute on function better_supabase.maintain_partitions() from public, anon, authenticated;
+revoke execute on function better_supabase.expired_partitions(regclass, timestamptz) from public, anon, authenticated;
+grant execute on function better_supabase.maintain_partitions() to service_role;`;
+/**
+* SQL that registers a partitioned table for `maintain_partitions()` and
+* creates its first partitions.
+*/
+const registerPartitions = (table, monthsAhead = 3) => `insert into better_supabase.partitioned_tables (parent, months_ahead)
+select ${sqlString(table)}::regclass, ${monthsAhead}
+where exists (select 1 from pg_catalog.pg_class c where c.oid = ${sqlString(table)}::regclass and c.relkind = 'p')
+on conflict (parent) do nothing;
+select better_supabase.ensure_partitions(${sqlString(table)}::regclass, ${monthsAhead});`;
+/**
+* The quoted name of a table's default partition: `<name>_default` in its
+* schema.
+*/
+const defaultPartitionName = (table) => `${sqlIdent(table.schema)}.${sqlIdent(`${table.name}_default`)}`;
+/**
+* SQL that gives a partitioned `table` its `fallback` default partition, for
+* rows outside the monthly ones. A table created unpartitioned is skipped.
+*/
+const defaultPartition = (table, fallback) => `do $$
+begin
+  if (select c.relkind from pg_catalog.pg_class c where c.oid = ${sqlString(table)}::regclass) = 'p' then
+    create table if not exists ${fallback} partition of ${table} default;
+    alter table ${fallback} enable row level security;
+    revoke all on ${fallback} from anon, authenticated;
+  end if;
+end;
+$$;`;
+/**
+* A security definer function that runs `call` once per element of a jsonb
+* array, so a sink sends a whole batch in one round trip. Every element keeps
+* the single-row function's checks and gets its own savepoint: it returns
+* `{"<result>": value}` or `{"error": {code, message, hint}}`, in order, and
+* one bad event never rolls back the others. More than `max` elements fail with
+* 22023 before any is written. The caller adds the grants.
+*/
+function batchFunction(options) {
+	const max = options.max ?? 1e3;
+	const value = ([name, type, fallback]) => {
+		const raw = type === "jsonb" ? `nullif(batch_event -> ${sqlString(name)}, 'null'::jsonb)` : type === "text" ? `batch_event ->> ${sqlString(name)}` : `(batch_event ->> ${sqlString(name)})::${type}`;
+		return fallback === void 0 ? raw : `coalesce(${raw}, ${fallback})`;
+	};
+	return `create or replace function ${options.name}(events jsonb)
+returns jsonb
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  batch_event jsonb;
+  results jsonb := '[]';
+  batch_result ${options.returns};
+  failed_state text;
+  failed_message text;
+  failed_hint text;
+begin
+  if pg_catalog.jsonb_typeof(events) is distinct from 'array' then
+    raise exception '${options.name.replace(/^.*\./, "")} takes a jsonb array of events'
+      using errcode = '22023', hint = ${sqlString(`${options.hint}_NOT_ARRAY`)};
+  end if;
+  if pg_catalog.jsonb_array_length(events) > ${max} then
+    raise exception '${options.name.replace(/^.*\./, "")} got % events, more than ${max}', pg_catalog.jsonb_array_length(events)
+      using errcode = '22023', hint = ${sqlString(`${options.hint}_TOO_LARGE`)};
+  end if;
+  for batch_event in select e from pg_catalog.jsonb_array_elements(events) e loop
+    begin
+      batch_result := ${options.call}(
+${typeof options.args === "string" ? `        ${options.args} => batch_event` : options.args.map((arg) => `        ${arg[0]} => ${value(arg)}`).join(",\n")}
+      );
+      results := results || pg_catalog.jsonb_build_array(pg_catalog.jsonb_build_object(${sqlString(options.result)}, batch_result));
+    exception when others then
+      get stacked diagnostics
+        failed_state = returned_sqlstate,
+        failed_message = message_text,
+        failed_hint = pg_exception_hint;
+      results := results || pg_catalog.jsonb_build_array(pg_catalog.jsonb_build_object(
+        'error', pg_catalog.jsonb_build_object('code', failed_state, 'message', failed_message, 'hint', nullif(failed_hint, ''))
+      ));
+    end;
+  end loop;
+  return results;
+end;
+$$;`;
+}
+/** The PL/pgSQL variables `dropExpiredPartitions` uses, for a `declare` block. */
+const PARTITION_VARIABLES = `
+  v_part regclass;
+  v_part_rows integer;
+  v_part_busy boolean;`;
+/**
+* PL/pgSQL that drops each monthly partition of `table` wholly before `cutoff`
+* (null drops none, as `ctx.cutoff` returns under a legal hold) and adds its
+* rows to `purged`. A partition with a row that matches `busy` (a condition
+* over `p`, with `$1`.. bound to `using`) stays for the row deletes, so a purge
+* never drops a row it would keep. Declare `PARTITION_VARIABLES` first.
+*/
+function dropExpiredPartitions(options) {
+	const indent = options.indent ?? "  ";
+	const literal = (sql) => sql.replaceAll("'", "''");
+	const busy = options.busy === void 0 ? "" : `
+${indent}  execute format('select exists (select 1 from %s p where ${literal(options.busy).replaceAll("%", "%%")})', v_part) into v_part_busy${options.using && options.using.length > 0 ? ` using ${options.using.join(", ")}` : ""};
+${indent}  continue when v_part_busy;`;
+	return `for v_part in
+${indent}  select p from better_supabase.expired_partitions(${sqlString(options.table)}::regclass, ${options.cutoff}) p
+${indent}loop${busy}
+${indent}  execute format('select count(*)::integer from %s', v_part) into v_part_rows;
+${indent}  execute format('drop table %s', v_part);
+${indent}  ${options.purged} := ${options.purged} + v_part_rows;
+${indent}end loop;`;
+}
+/** SQL that grants a function to signed-in users and the service role. */
+const userGrant = (signature) => `revoke execute on function ${signature} from public, anon;
+grant execute on function ${signature} to authenticated, service_role;`;
+/** SQL that grants a function to the service role only. */
+const serviceGrant = (signature) => `revoke execute on function ${signature} from public, anon, authenticated;
+grant execute on function ${signature} to service_role;`;
+/**
+* SQL that revokes a trigger function from every API role. Postgres checks
+* `execute` only when the trigger is created, never when it fires, so the
+* trigger keeps working while the function can't be called through RPC.
+*/
+const triggerGrant = (signature) => `revoke execute on function ${signature} from public, anon, authenticated;`;
+/**
+* `serviceGrant` for each function in `schema` (as SQL, e.g. `ctx.schema`), one
+* statement per function, so `blocks.<module>.api` sees the grants and writes
+* an entry point for each.
+*/
+function serviceOnly(signatures, schema = "better_supabase") {
+	return signatures.map((signature) => serviceGrant(`${schema}.${signature}`)).join("\n");
+}
+/**
+* `raise exception` with an errcode and, when given, a hint the TypeScript side
+* maps. Sites that put `using` on its own line, raise without an errcode or
+* compute the hint stay inline: this one-line form would change SQL apps have
+* generated.
+*/
+const raise = (message, errcode, hint, ...args) => `raise exception ${sqlString(message)}${args.map((arg) => `, ${arg}`).join("")} using errcode = '${errcode}'${hint === void 0 ? "" : `, hint = '${hint}'`};`;
+/**
+* `raise` for a module function: the hint first, the errcode defaulting to
+* insufficient privilege.
+*/
+const fail = (code, message, errcode = "42501") => raise(message, errcode, code);
+/** The hex SHA-256 of a `text` expression, as tokens and codes are stored. */
+const sha256Hex = (value) => `encode(extensions.digest(${value}, 'sha256'), 'hex')`;
+/** A page size: `value`, or `fallback` when null, clamped to `min`..`max`. */
+const pageSize = (value, fallback, max, min = 1) => `least(greatest(coalesce(${value}, ${String(fallback)}), ${String(min)}), ${String(max)})`;
+/**
+* A row trigger that records writes to a table that callers change through
+* `security invoker` functions or policies, which can't call `emit_event` or
+* `audit_event` themselves. `written` and `removed` are `ctx.record` statements
+* over `v_row`, the new row (or the old one on delete). When both are `null;`
+* the trigger and its function are dropped.
+*/
+function recordTrigger(ctx, options) {
+	const fn = ctx.fn(options.name);
+	const trigger = ctx.trigger(options.name);
+	if (options.written === "null;" && options.removed === "null;") return `drop trigger if exists ${trigger} on ${options.table};
+drop function if exists ${fn}();`;
+	return `create or replace function ${fn}()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  v_row ${options.table};
+begin
+  if tg_op = 'DELETE' then
+    v_row := old;
+    ${options.removed}
+  else
+    v_row := new;
+    ${options.written}
+  end if;
+  return null;
+end;
+$$;
+revoke execute on function ${fn}() from public, anon, authenticated;
+drop trigger if exists ${trigger} on ${options.table};
+create trigger ${trigger} after insert or update or delete on ${options.table}
+  for each row execute function ${fn}();`;
+}
+//#endregion
+//#region src/sql/modules/access-model.ts
+/**
+* The `roles` model's defaults. Module actions name these keys (see
+* `OPERATIONS`); `*` grants everything and `prefix.*` a prefix.
+*/
+const DEFAULT_ROLES = {
+	owner: ["*"],
+	admin: [
+		"organization.read",
+		"organization.update",
+		"members.*",
+		"audit.read",
+		"audit.revert",
+		"webhooks.*",
+		"notifications.*",
+		"billing.*",
+		"api_keys.*",
+		"settings.*",
+		"usage.*",
+		"comments.*",
+		"activity.read",
+		"attachments.*",
+		"organization.export",
+		"onboarding.*",
+		"inbox.*",
+		"ai_chat.*",
+		"ai.*",
+		"tags.*",
+		"teams.*",
+		"custom_fields.*",
+		"share_links.*",
+		"reminders.*",
+		"imports.*",
+		"views.*",
+		"relations.*",
+		"bulk.*",
+		"search.*",
+		"metrics.*",
+		"calendar.*",
+		"bookings.*",
+		"versions.*",
+		"trash.*",
+		"reactions.*",
+		"approvals.*",
+		"access_requests.*",
+		"documents.*",
+		"drive.*",
+		"forms.*",
+		"signatures.*",
+		"templates.*",
+		"time_tracking.*",
+		"service_principals.*",
+		"pipelines.*",
+		"parties.*",
+		"engagements.*",
+		"deals.*",
+		"work_items.*",
+		"quotes.*",
+		"invoices.*",
+		"sla.*",
+		"targets.*",
+		"hiring.*",
+		"employees.*",
+		"collections.*",
+		"domains.*",
+		"rules.*",
+		"reviews.*",
+		"leave.*"
+	],
+	member: [
+		"organization.read",
+		"members.read",
+		"notifications.read",
+		"api_keys.own",
+		"settings.read",
+		"comments.read",
+		"comments.create",
+		"activity.read",
+		"attachments.read",
+		"attachments.upload",
+		"onboarding.read",
+		"inbox.read",
+		"inbox.reply",
+		"ai_chat.read",
+		"ai_chat.create",
+		"ai_chat.share",
+		"ai.read",
+		"ai.create",
+		"ai.share",
+		"custom_fields.read",
+		"teams.read",
+		"tags.read",
+		"tags.apply",
+		"share_links.read",
+		"reminders.read",
+		"views.read",
+		"relations.read",
+		"bulk.run",
+		"search.read",
+		"metrics.read",
+		"calendar.read",
+		"calendar.write",
+		"bookings.read",
+		"bookings.create",
+		"versions.read",
+		"versions.create",
+		"versions.restore",
+		"trash.read",
+		"trash.create",
+		"trash.restore",
+		"reactions.read",
+		"reactions.create",
+		"approvals.read",
+		"approvals.request",
+		"access_requests.create",
+		"documents.read",
+		"documents.write",
+		"drive.read",
+		"drive.create",
+		"forms.read",
+		"forms.submit",
+		"signatures.read",
+		"signatures.request",
+		"templates.read",
+		"templates.apply",
+		"time_tracking.track",
+		"leave.request",
+		"pipelines.read",
+		"parties.read",
+		"parties.write",
+		"engagements.read",
+		"engagements.write",
+		"deals.read",
+		"deals.write",
+		"work_items.read",
+		"work_items.write",
+		"quotes.read",
+		"quotes.write",
+		"invoices.read",
+		"sla.read",
+		"targets.read",
+		"employees.read",
+		"collections.read",
+		"collections.write",
+		"domains.read",
+		"rules.read"
+	],
+	viewer: ["organization.read"]
+};
+/**
+* The permission key each operation checks by default, keyed
+* `<module>.<action>`. `blocks.<name>.permissions` renames a key per module,
+* `authorization.operations` overrides it for a provider, and the access
+* module's `operation_permission(op)` answers the result in SQL. Keys are
+* `<area>.<verb>`, with `read` for viewing; platform-wide actions use the
+* `platform` area or a key that `is_platform()` checks. The AI blocks other
+* than ai-chat check `ai.*` keys.
+*/
+const OPERATIONS = {
+	"organizations.update": "organization.update",
+	"organizations.delete": "organization.delete",
+	"organizations.removeMember": "members.remove",
+	"organizations.suspendMember": "members.remove",
+	"organizations.updateRole": "members.update_role",
+	"organizations.transferOwnership": "organization.transfer_ownership",
+	"invitations.invite": "members.invite",
+	"invitations.revoke": "members.invite",
+	"invitations.view": "members.invite",
+	"invitations.invitePlatform": "platform.invite",
+	"audit.view": "audit.read",
+	"audit.viewAll": "audit.read",
+	"audit.revert": "audit.revert",
+	"support-sessions.start": "support.start",
+	"support-sessions.view": "support.read",
+	"support-sessions.revoke": "support.revoke",
+	"notifications.send": "notifications.send",
+	"notifications.read": "notifications.read",
+	"webhooks-out.manage": "webhooks.manage",
+	"webhooks-out.view": "webhooks.read",
+	"webhooks-in.create": "webhooks.manage",
+	"webhooks-in.update": "webhooks.manage",
+	"webhooks-in.delete": "webhooks.manage",
+	"webhooks-in.view": "webhooks.read",
+	"api-keys.manage": "api_keys.manage",
+	"api-keys.own": "api_keys.own",
+	"settings.read": "settings.read",
+	"settings.update": "settings.update",
+	"settings.platform": "settings.manage",
+	"usage.read": "usage.read",
+	"usage.record": "usage.record",
+	"billing.read": "billing.read",
+	"billing.manage": "billing.manage",
+	"billing.viewAll": "billing.read",
+	"comments.read": "comments.read",
+	"comments.create": "comments.create",
+	"comments.moderate": "comments.moderate",
+	"comments.activity": "activity.read",
+	"data-lifecycle.export": "organization.export",
+	"data-lifecycle.delete": "organization.delete",
+	"data-lifecycle.cancelDelete": "organization.delete",
+	"attachments.read": "attachments.read",
+	"attachments.upload": "attachments.upload",
+	"attachments.manage": "attachments.manage",
+	"sso.manage": "sso.manage",
+	"onboarding.read": "onboarding.read",
+	"onboarding.complete": "onboarding.complete",
+	"announcements.manage": "announcements.manage",
+	"waitlist.manage": "waitlist.manage",
+	"waitlist.invite": "members.invite",
+	"flags.manage": "flags.manage",
+	"workflows.read": "workflow.read",
+	"workflows.run": "workflow.run",
+	"workflows.admin": "workflow.admin",
+	"workflow-builder.read": "workflow.read",
+	"workflow-builder.run": "workflow.run",
+	"workflow-builder.edit": "workflow.edit",
+	"workflow-builder.publish": "workflow.publish",
+	"workflow-builder.admin": "workflow.admin",
+	"inbox.read": "inbox.read",
+	"inbox.reply": "inbox.reply",
+	"inbox.assign": "inbox.assign",
+	"inbox.manage": "inbox.manage",
+	"ai-chat.read": "ai_chat.read",
+	"ai-chat.create": "ai_chat.create",
+	"ai-chat.share": "ai_chat.share",
+	"ai-chat.moderate": "ai_chat.moderate",
+	"ai-chat.admin": "ai_chat.admin",
+	"ai-files.upload": "ai.create",
+	"ai-files.manage": "ai.admin",
+	"knowledge.read": "ai.read",
+	"knowledge.write": "ai.create",
+	"knowledge.manage": "ai.admin",
+	"memory.read": "ai.read",
+	"memory.manage": "ai.admin",
+	"agents.read": "ai.read",
+	"agents.create": "ai.create",
+	"agents.publish": "ai.share",
+	"agents.moderate": "ai.moderate",
+	"connectors.read": "ai.read",
+	"connectors.use": "ai.create",
+	"connectors.manage": "ai.admin",
+	"ai-tasks.create": "ai.create",
+	"ai-tasks.manage": "ai.admin",
+	"ai-providers.use": "ai.create",
+	"ai-providers.manage": "ai.admin",
+	"number-sequences.assign": "number_sequences.assign",
+	"teams.manage": "teams.manage",
+	"teams.read": "teams.read",
+	"tags.manage": "tags.manage",
+	"tags.read": "tags.read",
+	"tags.apply": "tags.apply",
+	"catalog.manage": "catalog.manage",
+	"catalog.read": "catalog.read",
+	"inventory.manage": "inventory.manage",
+	"inventory.read": "inventory.read",
+	"inventory.reserve": "inventory.reserve",
+	"inventory.purchase": "inventory.purchase",
+	"orders.manage": "orders.manage",
+	"orders.read": "orders.read",
+	"promotions.manage": "promotions.manage",
+	"promotions.read": "promotions.read",
+	"custom-fields.manage": "custom_fields.manage",
+	"custom-fields.read": "custom_fields.read",
+	"custom-fields.sensitive": "custom_fields.sensitive.read",
+	"share-links.create": "share_links.create",
+	"share-links.read": "share_links.read",
+	"reminders.manage": "reminders.manage",
+	"reminders.read": "reminders.read",
+	"imports.manage": "imports.manage",
+	"saved-views.read": "views.read",
+	"saved-views.share": "views.share",
+	"relations.read": "relations.read",
+	"relations.manage": "relations.manage",
+	"bulk.run": "bulk.run",
+	"search.read": "search.read",
+	"metrics.read": "metrics.read",
+	"metrics.manage": "metrics.manage",
+	"calendar.manage": "calendar.manage",
+	"calendar.write": "calendar.write",
+	"calendar.read": "calendar.read",
+	"bookings.manage": "bookings.manage",
+	"bookings.create": "bookings.create",
+	"bookings.read": "bookings.read",
+	"versions.read": "versions.read",
+	"versions.create": "versions.create",
+	"versions.restore": "versions.restore",
+	"versions.manage": "versions.manage",
+	"trash.read": "trash.read",
+	"trash.create": "trash.create",
+	"trash.restore": "trash.restore",
+	"trash.manage": "trash.manage",
+	"reactions.read": "reactions.read",
+	"reactions.create": "reactions.create",
+	"reactions.manage": "reactions.manage",
+	"approvals.read": "approvals.read",
+	"approvals.request": "approvals.request",
+	"approvals.manage": "approvals.manage",
+	"access-requests.read": "access_requests.read",
+	"access-requests.create": "access_requests.create",
+	"access-requests.manage": "access_requests.manage",
+	"documents.read": "documents.read",
+	"documents.write": "documents.write",
+	"documents.manage": "documents.manage",
+	"drive.read": "drive.read",
+	"drive.create": "drive.create",
+	"drive.manage": "drive.manage",
+	"forms.read": "forms.read",
+	"forms.manage": "forms.manage",
+	"forms.submit": "forms.submit",
+	"forms.review": "forms.review",
+	"signatures.read": "signatures.read",
+	"signatures.request": "signatures.request",
+	"signatures.manage": "signatures.manage",
+	"templates.read": "templates.read",
+	"templates.apply": "templates.apply",
+	"templates.manage": "templates.manage",
+	"time-tracking.read": "time_tracking.read",
+	"time-tracking.track": "time_tracking.track",
+	"time-tracking.approve": "time_tracking.approve",
+	"time-tracking.manage": "time_tracking.manage",
+	"service-principals.read": "service_principals.read",
+	"service-principals.manage": "service_principals.manage",
+	"pipelines.read": "pipelines.read",
+	"pipelines.manage": "pipelines.manage",
+	"parties.read": "parties.read",
+	"parties.write": "parties.write",
+	"parties.manage": "parties.manage",
+	"engagements.read": "engagements.read",
+	"engagements.write": "engagements.write",
+	"engagements.manage": "engagements.manage",
+	"deals.read": "deals.read",
+	"deals.write": "deals.write",
+	"deals.manage": "deals.manage",
+	"work-items.read": "work_items.read",
+	"work-items.write": "work_items.write",
+	"work-items.manage": "work_items.manage",
+	"quotes.read": "quotes.read",
+	"quotes.write": "quotes.write",
+	"quotes.manage": "quotes.manage",
+	"invoices.read": "invoices.read",
+	"invoices.write": "invoices.write",
+	"invoices.manage": "invoices.manage",
+	"sla.read": "sla.read",
+	"sla.manage": "sla.manage",
+	"targets.read": "targets.read",
+	"targets.manage": "targets.manage",
+	"hiring.read": "hiring.read",
+	"hiring.write": "hiring.write",
+	"hiring.manage": "hiring.manage",
+	"employees.read": "employees.read",
+	"employees.write": "employees.write",
+	"employees.viewSensitive": "employees.view_sensitive",
+	"collections.read": "collections.read",
+	"collections.write": "collections.write",
+	"collections.share": "collections.share",
+	"domains.read": "domains.read",
+	"domains.manage": "domains.manage",
+	"rules.read": "rules.read",
+	"rules.edit": "rules.edit",
+	"rules.publish": "rules.publish",
+	"rules.admin": "rules.admin",
+	"reviews.manage": "reviews.manage",
+	"leave.request": "leave.request",
+	"leave.read": "leave.read",
+	"leave.approve": "leave.approve",
+	"leave.manage": "leave.manage"
+};
+const operationsByModule = /* @__PURE__ */ new Map();
+for (const [name, key] of Object.entries(OPERATIONS)) {
+	const dot = name.indexOf(".");
+	const module = name.slice(0, dot);
+	const actions = operationsByModule.get(module) ?? {};
+	actions[name.slice(dot + 1)] = key;
+	operationsByModule.set(module, actions);
+}
+/** `module`'s default keys by action, from `OPERATIONS`. */
+function moduleOperations(module) {
+	return operationsByModule.get(module) ?? {};
+}
+/**
+* Where each module action checks its key: `tenant` through `member_can`, `can`
+* or `tenant_ids_with` (a provider's `idsWith`), and `platform` through
+* `is_platform` or `platform_can` (a provider's `isPlatform`).
+*/
+const MODULE_PERMISSION_SCOPES = {
+	organizations: {
+		update: "tenant",
+		delete: "tenant",
+		removeMember: "tenant",
+		suspendMember: "tenant",
+		updateRole: "tenant",
+		transferOwnership: "tenant"
+	},
+	invitations: {
+		invite: "tenant",
+		revoke: "tenant",
+		view: "tenant",
+		invitePlatform: "platform"
+	},
+	audit: {
+		view: "tenant",
+		viewAll: "platform",
+		revert: "tenant"
+	},
+	"support-sessions": {
+		start: "platform",
+		view: "platform",
+		revoke: "platform"
+	},
+	notifications: {
+		send: "tenant",
+		read: "tenant"
+	},
+	"webhooks-out": {
+		manage: "tenant",
+		view: "tenant"
+	},
+	"webhooks-in": {
+		create: "tenant",
+		update: "tenant",
+		delete: "tenant",
+		view: "tenant"
+	},
+	"api-keys": {
+		manage: "tenant",
+		own: "tenant"
+	},
+	settings: {
+		read: "tenant",
+		update: "tenant",
+		platform: "platform"
+	},
+	usage: {
+		read: "tenant",
+		record: "tenant"
+	},
+	billing: {
+		read: "tenant",
+		manage: "tenant",
+		viewAll: "platform"
+	},
+	comments: {
+		read: "tenant",
+		create: "tenant",
+		moderate: "tenant",
+		activity: "tenant"
+	},
+	attachments: {
+		read: "tenant",
+		upload: "tenant",
+		manage: "tenant"
+	},
+	"data-lifecycle": {
+		export: "tenant",
+		delete: "tenant",
+		cancelDelete: "tenant"
+	},
+	sso: { manage: "tenant" },
+	onboarding: {
+		read: "tenant",
+		complete: "tenant"
+	},
+	announcements: { manage: "platform" },
+	waitlist: {
+		manage: "platform",
+		invite: "tenant"
+	},
+	flags: { manage: "platform" },
+	workflows: {
+		read: "tenant",
+		run: "tenant",
+		admin: "tenant"
+	},
+	"workflow-builder": {
+		read: "tenant",
+		run: "tenant",
+		edit: "tenant",
+		publish: "tenant",
+		admin: "tenant"
+	},
+	inbox: {
+		read: "tenant",
+		reply: "tenant",
+		assign: "tenant",
+		manage: "tenant"
+	},
+	"ai-chat": {
+		read: "tenant",
+		create: "tenant",
+		share: "tenant",
+		moderate: "tenant",
+		admin: "tenant"
+	},
+	"ai-files": {
+		upload: "tenant",
+		manage: "tenant"
+	},
+	knowledge: {
+		read: "tenant",
+		write: "tenant",
+		manage: "tenant"
+	},
+	memory: {
+		read: "tenant",
+		manage: "tenant"
+	},
+	agents: {
+		read: "tenant",
+		create: "tenant",
+		publish: "tenant",
+		moderate: "tenant"
+	},
+	connectors: {
+		read: "tenant",
+		use: "tenant",
+		manage: "tenant"
+	},
+	"ai-tasks": {
+		create: "tenant",
+		manage: "tenant"
+	},
+	"ai-providers": {
+		use: "tenant",
+		manage: "tenant"
+	},
+	"number-sequences": { assign: "tenant" },
+	teams: {
+		manage: "tenant",
+		read: "tenant"
+	},
+	tags: {
+		manage: "tenant",
+		read: "tenant",
+		apply: "tenant"
+	},
+	catalog: {
+		manage: "tenant",
+		read: "tenant"
+	},
+	inventory: {
+		manage: "tenant",
+		read: "tenant",
+		reserve: "tenant",
+		purchase: "tenant"
+	},
+	orders: {
+		manage: "tenant",
+		read: "tenant"
+	},
+	promotions: {
+		manage: "tenant",
+		read: "tenant"
+	},
+	"custom-fields": {
+		manage: "tenant",
+		read: "tenant",
+		sensitive: "tenant"
+	},
+	"share-links": {
+		create: "tenant",
+		read: "tenant"
+	},
+	reminders: {
+		manage: "tenant",
+		read: "tenant"
+	},
+	imports: { manage: "tenant" },
+	"saved-views": {
+		read: "tenant",
+		share: "tenant"
+	},
+	relations: {
+		read: "tenant",
+		manage: "tenant"
+	},
+	bulk: { run: "tenant" },
+	search: { read: "tenant" },
+	metrics: {
+		read: "tenant",
+		manage: "tenant"
+	},
+	calendar: {
+		manage: "tenant",
+		write: "tenant",
+		read: "tenant"
+	},
+	bookings: {
+		manage: "tenant",
+		create: "tenant",
+		read: "tenant"
+	},
+	versions: {
+		read: "tenant",
+		create: "tenant",
+		restore: "tenant",
+		manage: "tenant"
+	},
+	trash: {
+		read: "tenant",
+		create: "tenant",
+		restore: "tenant",
+		manage: "tenant"
+	},
+	reactions: {
+		read: "tenant",
+		create: "tenant",
+		manage: "tenant"
+	},
+	approvals: {
+		read: "tenant",
+		request: "tenant",
+		manage: "tenant"
+	},
+	"access-requests": {
+		read: "tenant",
+		create: "tenant",
+		manage: "tenant"
+	},
+	documents: {
+		read: "tenant",
+		write: "tenant",
+		manage: "tenant"
+	},
+	drive: {
+		read: "tenant",
+		create: "tenant",
+		manage: "tenant"
+	},
+	forms: {
+		read: "tenant",
+		manage: "tenant",
+		submit: "tenant",
+		review: "tenant"
+	},
+	signatures: {
+		read: "tenant",
+		request: "tenant",
+		manage: "tenant"
+	},
+	templates: {
+		read: "tenant",
+		apply: "tenant",
+		manage: "tenant"
+	},
+	"time-tracking": {
+		read: "tenant",
+		track: "tenant",
+		approve: "tenant",
+		manage: "tenant"
+	},
+	"service-principals": {
+		read: "tenant",
+		manage: "tenant"
+	},
+	pipelines: {
+		read: "tenant",
+		manage: "tenant"
+	},
+	parties: {
+		read: "tenant",
+		write: "tenant",
+		manage: "tenant"
+	},
+	engagements: {
+		read: "tenant",
+		write: "tenant",
+		manage: "tenant"
+	},
+	deals: {
+		read: "tenant",
+		write: "tenant",
+		manage: "tenant"
+	},
+	"work-items": {
+		read: "tenant",
+		write: "tenant",
+		manage: "tenant"
+	},
+	quotes: {
+		read: "tenant",
+		write: "tenant",
+		manage: "tenant"
+	},
+	invoices: {
+		read: "tenant",
+		write: "tenant",
+		manage: "tenant"
+	},
+	sla: {
+		read: "tenant",
+		manage: "tenant"
+	},
+	targets: {
+		read: "tenant",
+		manage: "tenant"
+	},
+	hiring: {
+		read: "tenant",
+		write: "tenant",
+		manage: "tenant"
+	},
+	employees: {
+		read: "tenant",
+		write: "tenant",
+		viewSensitive: "tenant"
+	},
+	collections: {
+		read: "tenant",
+		write: "tenant",
+		share: "tenant"
+	},
+	domains: {
+		read: "tenant",
+		manage: "tenant"
+	},
+	rules: {
+		read: "tenant",
+		edit: "tenant",
+		publish: "tenant",
+		admin: "tenant"
+	},
+	reviews: { manage: "tenant" },
+	leave: {
+		request: "tenant",
+		read: "tenant",
+		approve: "tenant",
+		manage: "tenant"
+	}
+};
+function accessModel(ctx) {
+	return ctx.modules.access?.model ?? "roles";
+}
+function rolesOf(ctx) {
+	return ctx.modules.access?.roles ?? DEFAULT_ROLES;
+}
+const roleNames = (ctx) => Object.keys(rolesOf(ctx));
+/**
+* The scope name tenants use in `can(scope, id, permission)`
+* (`blocks.access.options.scope`, default `organization`). `tenant` is accepted
+* too.
+*/
+const tenantScope = (ctx) => ctx.of("access").text("scope", "organization");
+const isPlain = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const quotedRef = (where, table, column) => {
+	const parts = `${table}.${column}`.split(".");
+	if (parts.length !== 3 || parts.some((part) => !/^[A-Za-z_][A-Za-z0-9_$]*$/.test(part))) throw new TypeError(`${where}: "${table}" must be "schema.table" and "${column}" a column`);
+	return {
+		table: `${sqlIdent(parts[0])}.${sqlIdent(parts[1])}`,
+		column: sqlIdent(parts[2])
+	};
+};
+/** The `provider` model's platform role table, or `undefined` without one. */
+function providerPlatformRoles(ctx) {
+	if (accessModel(ctx) !== "provider" || !ctx.installed("invitations")) return;
+	const value = ctx.of("invitations").option("platformRoles");
+	if (value === void 0) return;
+	const where = "blocks.invitations.options.platformRoles";
+	if (!isPlain(value) || typeof value["table"] !== "string" || typeof value["user"] !== "string" || typeof value["role"] !== "string" || value["canAssign"] !== void 0 && typeof value["canAssign"] !== "string" || value["canAssignFor"] !== void 0 && (typeof value["canAssignFor"] !== "string" || !value["canAssignFor"].includes("{user}"))) throw new TypeError(`${where} must be { table: "schema.table", user: "<user column>", role: "<role column>", through?: { table, id, column }, canAssign?: "<SQL template>", canAssignFor?: "<SQL template with {user}>" }`);
+	const user = quotedRef(where, value["table"], value["user"]);
+	const role = quotedRef(where, value["table"], value["role"]);
+	const through = value["through"];
+	let lookup;
+	if (through !== void 0) {
+		if (!isPlain(through) || typeof through["table"] !== "string" || typeof through["id"] !== "string" || typeof through["column"] !== "string" || through["where"] !== void 0 && (typeof through["where"] !== "string" || !through["where"].includes("{row}"))) throw new TypeError(`${where}.through must be { table: "schema.table", id: "<key column>", column: "<role name column>", where?: "<condition on {row}>" }`);
+		const id = quotedRef(`${where}.through`, through["table"], through["id"]);
+		lookup = {
+			table: id.table,
+			id: id.column,
+			column: quotedRef(`${where}.through`, through["table"], through["column"]).column,
+			...typeof through["where"] === "string" ? { where: through["where"] } : {}
+		};
+	}
+	return {
+		table: user.table,
+		user: user.column,
+		role: role.column,
+		...lookup ? { through: lookup } : {},
+		...typeof value["canAssign"] === "string" ? { canAssign: value["canAssign"] } : {},
+		...typeof value["canAssignFor"] === "string" ? { canAssignFor: value["canAssignFor"] } : {}
+	};
+}
+/** Whether the catalog has platform roles, and so platform invitations. */
+function hasPlatformRoles(ctx) {
+	if (providerPlatformRoles(ctx)) return true;
+	return accessModel(ctx) === "catalog" && ctx.of("access").hasTable("platformAssignments");
+}
+/**
+* Whether catalog role row `alias` is a tenant or a platform role, or
+* `undefined` when roles carry no scope. Managed catalogs have a `scope`
+* column; an adopted one maps `roles.scope` and names its values in
+* `blocks.access.options.tenantRoleScope` and `platformRoleScope`.
+*/
+function roleScopeIs(ctx, alias, scope) {
+	if (accessModel(ctx) !== "catalog") return;
+	const access = ctx.of("access");
+	if (!access.manages && typeof access.config.columns["roles"]?.["scope"] !== "string") return;
+	const value = scope === "tenant" ? access.text("tenantRoleScope", "tenant") : access.text("platformRoleScope", "platform");
+	return `${alias}.${access.col("roles", "scope")}::text = ${sqlString(value)}`;
+}
+const MODULE_PERMISSION_SHORTHANDS = {
+	organizations: { suspendMember: "removeMember" },
+	invitations: {
+		revoke: "invite",
+		view: "invite"
+	},
+	audit: { viewAll: "view" },
+	billing: { viewAll: "read" },
+	waitlist: { invite: {
+		module: "invitations",
+		action: "invite"
+	} },
+	"webhooks-in": {
+		create: "manage",
+		update: "manage",
+		delete: "manage"
+	}
+};
+function modulePermissionKey(ctx, action, fallback) {
+	const shorthand = MODULE_PERMISSION_SHORTHANDS[ctx.module]?.[action];
+	if (shorthand === void 0) return ctx.permissionKey(action, fallback);
+	const target = typeof shorthand === "string" ? modulePermissionKey(ctx, shorthand, fallback) : modulePermissionKey(ctx.of(shorthand.module), shorthand.action, fallback);
+	return ctx.permissionKey(action, target);
+}
+const modulePermission = (ctx, action, fallback) => sqlString(modulePermissionKey(ctx, action, fallback));
+//#endregion
+//#region src/sql/modules/workflow-sdk-world-ddl.generated.ts
+/** The `@workflow/world-postgres` version the DDL below was generated from. */
+const WORLD_POSTGRES_VERSION = "5.0.4";
+/** The `workflow` schema after every migration above, as idempotent DDL. */
+const WORLD_POSTGRES_DDL = `create schema if not exists workflow;
+
+do $$ begin
+  create type workflow.status as enum ('pending', 'running', 'completed', 'failed', 'cancelled');
+exception when duplicate_object then null;
+end $$;
+
+do $$ begin
+  create type workflow.step_status as enum ('pending', 'running', 'completed', 'failed', 'cancelled');
+exception when duplicate_object then null;
+end $$;
+
+do $$ begin
+  create type workflow.wait_status as enum ('waiting', 'completed');
+exception when duplicate_object then null;
+end $$;
+
+create table if not exists workflow.workflow_event_slots (
+  "run_id" character varying not null,
+  "seq_in_band" integer not null default 1,
+  constraint "workflow_event_slots_pkey" PRIMARY KEY (run_id)
+);
+
+alter table workflow.workflow_event_slots
+  add column if not exists "run_id" character varying not null,
+  add column if not exists "seq_in_band" integer not null default 1;
+
+create table if not exists workflow.workflow_events (
+  "id" character varying not null,
+  "type" character varying not null,
+  "correlation_id" character varying,
+  "created_at" timestamp without time zone not null default now(),
+  "run_id" character varying not null,
+  "payload" jsonb,
+  "payload_cbor" bytea,
+  "spec_version" integer,
+  "resume_id" character varying,
+  "resume_payload_digest" character varying,
+  constraint "workflow_events_run_id_id_pk" PRIMARY KEY (run_id, id)
+);
+
+alter table workflow.workflow_events
+  add column if not exists "id" character varying not null,
+  add column if not exists "type" character varying not null,
+  add column if not exists "correlation_id" character varying,
+  add column if not exists "created_at" timestamp without time zone not null default now(),
+  add column if not exists "run_id" character varying not null,
+  add column if not exists "payload" jsonb,
+  add column if not exists "payload_cbor" bytea,
+  add column if not exists "spec_version" integer,
+  add column if not exists "resume_id" character varying,
+  add column if not exists "resume_payload_digest" character varying;
+
+create index if not exists workflow_events_correlation_id_index ON workflow.workflow_events USING btree (correlation_id);
+
+create unique index if not exists workflow_events_entity_creation_unique ON workflow.workflow_events USING btree (run_id, correlation_id, type) WHERE ((type)::text = ANY ((ARRAY['step_created'::character varying, 'hook_created'::character varying, 'wait_created'::character varying, 'attr_set'::character varying])::text[]));
+
+create unique index if not exists workflow_events_hook_resume_unique ON workflow.workflow_events USING btree (run_id, resume_id) WHERE (((type)::text = 'hook_received'::text) AND (resume_id IS NOT NULL));
+
+create table if not exists workflow.workflow_hooks (
+  "run_id" character varying not null,
+  "hook_id" character varying not null,
+  "token" character varying not null,
+  "owner_id" character varying not null,
+  "project_id" character varying not null,
+  "environment" character varying not null,
+  "created_at" timestamp without time zone not null default now(),
+  "metadata" jsonb,
+  "metadata_cbor" bytea,
+  "spec_version" integer,
+  "is_webhook" boolean default true,
+  "is_system" boolean default false,
+  "resume_context" bytea,
+  "token_retention_until" timestamp with time zone,
+  "claimed_from" bytea,
+  constraint "workflow_hooks_pkey" PRIMARY KEY (hook_id)
+);
+
+alter table workflow.workflow_hooks
+  add column if not exists "run_id" character varying not null,
+  add column if not exists "hook_id" character varying not null,
+  add column if not exists "token" character varying not null,
+  add column if not exists "owner_id" character varying not null,
+  add column if not exists "project_id" character varying not null,
+  add column if not exists "environment" character varying not null,
+  add column if not exists "created_at" timestamp without time zone not null default now(),
+  add column if not exists "metadata" jsonb,
+  add column if not exists "metadata_cbor" bytea,
+  add column if not exists "spec_version" integer,
+  add column if not exists "is_webhook" boolean default true,
+  add column if not exists "is_system" boolean default false,
+  add column if not exists "resume_context" bytea,
+  add column if not exists "token_retention_until" timestamp with time zone,
+  add column if not exists "claimed_from" bytea;
+
+create index if not exists workflow_hooks_run_id_index ON workflow.workflow_hooks USING btree (run_id);
+
+create index if not exists workflow_hooks_token_index ON workflow.workflow_hooks USING btree (token);
+
+create table if not exists workflow.workflow_invocations (
+  "sequence" bigserial,
+  "run_id" character varying not null,
+  "request_id" character varying not null,
+  "payload" bytea,
+  "fingerprint" character varying,
+  "result" bytea,
+  "created_at" timestamp without time zone not null default now(),
+  "responded_at" timestamp without time zone,
+  "expired_at" timestamp without time zone,
+  "result_version" integer not null default 0,
+  constraint "workflow_invocations_pkey" PRIMARY KEY (run_id, request_id)
+);
+
+alter table workflow.workflow_invocations
+  add column if not exists "sequence" bigserial,
+  add column if not exists "run_id" character varying not null,
+  add column if not exists "request_id" character varying not null,
+  add column if not exists "payload" bytea,
+  add column if not exists "fingerprint" character varying,
+  add column if not exists "result" bytea,
+  add column if not exists "created_at" timestamp without time zone not null default now(),
+  add column if not exists "responded_at" timestamp without time zone,
+  add column if not exists "expired_at" timestamp without time zone,
+  add column if not exists "result_version" integer not null default 0;
+
+create index if not exists workflow_invocations_pending ON workflow.workflow_invocations USING btree (run_id, sequence) WHERE (responded_at IS NULL);
+
+create table if not exists workflow.workflow_runs (
+  "id" character varying not null,
+  "output" jsonb,
+  "deployment_id" character varying not null,
+  "status" workflow.status not null,
+  "name" character varying not null,
+  "execution_context" jsonb,
+  "input" jsonb,
+  "error" text,
+  "created_at" timestamp without time zone not null default now(),
+  "updated_at" timestamp without time zone not null default now(),
+  "completed_at" timestamp without time zone,
+  "started_at" timestamp without time zone,
+  "output_cbor" bytea,
+  "execution_context_cbor" bytea,
+  "input_cbor" bytea,
+  "expired_at" timestamp without time zone,
+  "spec_version" character varying,
+  "error_cbor" bytea,
+  "error_code" character varying,
+  "attributes" jsonb not null default '{}'::jsonb,
+  "encryption_public_key" character varying,
+  "dynamic_workflow_code_cbor" bytea,
+  constraint "workflow_runs_pkey" PRIMARY KEY (id)
+);
+
+alter table workflow.workflow_runs
+  add column if not exists "id" character varying not null,
+  add column if not exists "output" jsonb,
+  add column if not exists "deployment_id" character varying not null,
+  add column if not exists "status" workflow.status not null,
+  add column if not exists "name" character varying not null,
+  add column if not exists "execution_context" jsonb,
+  add column if not exists "input" jsonb,
+  add column if not exists "error" text,
+  add column if not exists "created_at" timestamp without time zone not null default now(),
+  add column if not exists "updated_at" timestamp without time zone not null default now(),
+  add column if not exists "completed_at" timestamp without time zone,
+  add column if not exists "started_at" timestamp without time zone,
+  add column if not exists "output_cbor" bytea,
+  add column if not exists "execution_context_cbor" bytea,
+  add column if not exists "input_cbor" bytea,
+  add column if not exists "expired_at" timestamp without time zone,
+  add column if not exists "spec_version" character varying,
+  add column if not exists "error_cbor" bytea,
+  add column if not exists "error_code" character varying,
+  add column if not exists "attributes" jsonb not null default '{}'::jsonb,
+  add column if not exists "encryption_public_key" character varying,
+  add column if not exists "dynamic_workflow_code_cbor" bytea;
+
+create index if not exists workflow_runs_name_index ON workflow.workflow_runs USING btree (name);
+
+create index if not exists workflow_runs_status_index ON workflow.workflow_runs USING btree (status);
+
+create table if not exists workflow.workflow_snapshots (
+  "run_id" character varying not null,
+  "data" bytea not null,
+  "events_cursor" character varying,
+  "created_at" timestamp without time zone not null default now(),
+  constraint "workflow_snapshots_pkey" PRIMARY KEY (run_id)
+);
+
+alter table workflow.workflow_snapshots
+  add column if not exists "run_id" character varying not null,
+  add column if not exists "data" bytea not null,
+  add column if not exists "events_cursor" character varying,
+  add column if not exists "created_at" timestamp without time zone not null default now();
+
+create table if not exists workflow.workflow_steps (
+  "run_id" character varying not null,
+  "step_id" character varying not null,
+  "step_name" character varying not null,
+  "status" workflow.step_status not null,
+  "input" jsonb,
+  "output" jsonb,
+  "error" text,
+  "attempt" integer not null,
+  "started_at" timestamp without time zone,
+  "completed_at" timestamp without time zone,
+  "created_at" timestamp without time zone not null default now(),
+  "updated_at" timestamp without time zone not null default now(),
+  "retry_after" timestamp without time zone,
+  "input_cbor" bytea,
+  "output_cbor" bytea,
+  "error_cbor" bytea,
+  "spec_version" integer,
+  constraint "workflow_steps_pkey" PRIMARY KEY (step_id)
+);
+
+alter table workflow.workflow_steps
+  add column if not exists "run_id" character varying not null,
+  add column if not exists "step_id" character varying not null,
+  add column if not exists "step_name" character varying not null,
+  add column if not exists "status" workflow.step_status not null,
+  add column if not exists "input" jsonb,
+  add column if not exists "output" jsonb,
+  add column if not exists "error" text,
+  add column if not exists "attempt" integer not null,
+  add column if not exists "started_at" timestamp without time zone,
+  add column if not exists "completed_at" timestamp without time zone,
+  add column if not exists "created_at" timestamp without time zone not null default now(),
+  add column if not exists "updated_at" timestamp without time zone not null default now(),
+  add column if not exists "retry_after" timestamp without time zone,
+  add column if not exists "input_cbor" bytea,
+  add column if not exists "output_cbor" bytea,
+  add column if not exists "error_cbor" bytea,
+  add column if not exists "spec_version" integer;
+
+create index if not exists workflow_steps_run_id_index ON workflow.workflow_steps USING btree (run_id);
+
+create index if not exists workflow_steps_status_index ON workflow.workflow_steps USING btree (status);
+
+create table if not exists workflow.workflow_stream_chunks (
+  "id" character varying not null,
+  "stream_id" character varying not null,
+  "data" bytea not null,
+  "created_at" timestamp without time zone not null default now(),
+  "eof" boolean not null,
+  "run_id" character varying,
+  constraint "workflow_stream_chunks_stream_id_id_pk" PRIMARY KEY (stream_id, id)
+);
+
+alter table workflow.workflow_stream_chunks
+  add column if not exists "id" character varying not null,
+  add column if not exists "stream_id" character varying not null,
+  add column if not exists "data" bytea not null,
+  add column if not exists "created_at" timestamp without time zone not null default now(),
+  add column if not exists "eof" boolean not null,
+  add column if not exists "run_id" character varying;
+
+create index if not exists workflow_stream_chunks_run_id_index ON workflow.workflow_stream_chunks USING btree (run_id);
+
+create table if not exists workflow.workflow_waits (
+  "wait_id" character varying not null,
+  "run_id" character varying not null,
+  "status" workflow.wait_status not null,
+  "resume_at" timestamp without time zone,
+  "completed_at" timestamp without time zone,
+  "created_at" timestamp without time zone not null default now(),
+  "updated_at" timestamp without time zone not null default now(),
+  "spec_version" integer,
+  constraint "workflow_waits_pkey" PRIMARY KEY (wait_id)
+);
+
+alter table workflow.workflow_waits
+  add column if not exists "wait_id" character varying not null,
+  add column if not exists "run_id" character varying not null,
+  add column if not exists "status" workflow.wait_status not null,
+  add column if not exists "resume_at" timestamp without time zone,
+  add column if not exists "completed_at" timestamp without time zone,
+  add column if not exists "created_at" timestamp without time zone not null default now(),
+  add column if not exists "updated_at" timestamp without time zone not null default now(),
+  add column if not exists "spec_version" integer;
+
+create index if not exists workflow_waits_run_id_index ON workflow.workflow_waits USING btree (run_id);
+`;
+//#endregion
+//#region src/sql/modules/workflow-sdk-world.ts
+/** The Vault secret names the pg_net dispatcher reads. */
+const WORKFLOW_VAULT_SECRETS = {
+	flowUrl: "workflow_flow_url",
+	deliverySecret: "workflow_delivery_secret",
+	encryptionKey: "workflow_encryption_key"
+};
+const WORKFLOW_DELIVERY_QUEUE = "workflow_deliveries";
+function deliveryModeOf(ctx) {
+	const mode = ctx.text("delivery", "poll");
+	if (mode !== "poll" && mode !== "pg_net") throw new TypeError(`blocks.workflow-sdk-world.options.delivery must be "poll" or "pg_net", got "${mode}"`);
+	return mode;
+}
+const IDENT = /^[a-z_][a-z0-9_]{0,40}$/;
+function deliveryQueueOf(ctx) {
+	const queue = ctx.text("queue", WORKFLOW_DELIVERY_QUEUE);
+	if (!IDENT.test(queue)) throw new TypeError(`blocks.workflow-sdk-world.options.queue: "${queue}" is not a queue name`);
+	return queue;
+}
+const PRINCIPAL_KINDS = "'user', 'service_principal', 'system', 'external'";
+function build(ctx) {
+	if (ctx.mode === "custom") return "";
+	const fn = (name) => ctx.fn(name);
+	const workflows = ctx.of("workflows");
+	const record = workflows.fn("record_workflow_run");
+	const runKey = workflows.permission("run", OPERATIONS["workflows.run"]);
+	const claimJobs = ctx.of("jobs").fn("claim_jobs");
+	const id = ctx.idType;
+	const queue = sqlString(deliveryQueueOf(ctx));
+	const batch = Math.max(1, Math.trunc(ctx.number("batch", 20)));
+	const timeout = Math.max(1e3, Math.trunc(ctx.number("timeout", 3e4)));
+	const lease = Math.ceil(timeout / 1e3) + 30;
+	const mirror = ctx.trigger("workflow_sdk_runs_mirror");
+	return `${schemaPreamble(ctx)}
+-- The Workflow SDK World's tables (@workflow/world-postgres ${WORLD_POSTGRES_VERSION}).
+-- Only the service role reads them: the app reads runs from workflow_runs in
+-- the workflows module.
+${WORLD_POSTGRES_DDL}
+revoke all on schema workflow from public, anon, authenticated;
+grant usage on schema workflow to service_role;
+do $$
+declare
+  t record;
+begin
+  for t in select c.relname from pg_catalog.pg_class c
+    join pg_catalog.pg_namespace n on n.oid = c.relnamespace
+    where n.nspname = 'workflow' and c.relkind = 'r'
+  loop
+    execute format('alter table workflow.%I enable row level security', t.relname);
+    execute format('revoke all on workflow.%I from public, anon, authenticated', t.relname);
+    execute format('grant all on workflow.%I to service_role', t.relname);
+  end loop;
+end;
+$$;
+grant usage, select on all sequences in schema workflow to service_role;
+create index if not exists workflow_runs_attributes_idx on workflow.workflow_runs using gin (attributes jsonb_path_ops);
+
+-- Copies each World run into workflow_runs: its tenant and actor come from
+-- the bs.tenant and bs.actor attributes that startFor sets. A run with an
+-- actor keeps its tenant only when the actor holds workflow.run there; a
+-- run without one, or one with bs.principal_kind (a runAs start, whose
+-- actor is the user who triggered it), was started by the server, which is
+-- trusted. bs.subject
+-- (type/id), bs.principal_kind, bs.principal, bs.mode and bs.trigger_node
+-- fill the run's subject, principal, mode and trigger node.
+create or replace function ${fn("workflow_sdk_mirror_run")}()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  v_tenant ${id};
+  v_actor uuid;
+  v_subject text;
+  v_subject_type text;
+  v_subject_id text;
+  v_principal_kind text;
+  v_mode text;
+begin
+  begin
+    v_tenant := (new.attributes ->> 'bs.tenant')::${id};
+  exception when others then
+    v_tenant := null;
+  end;
+  begin
+    v_actor := (new.attributes ->> 'bs.actor')::uuid;
+  exception when others then
+    v_actor := null;
+  end;
+  v_principal_kind := new.attributes ->> 'bs.principal_kind';
+  if v_principal_kind is not null and v_principal_kind not in (${PRINCIPAL_KINDS}) then
+    v_principal_kind := null;
+  end if;
+  if v_tenant is not null and v_actor is not null and v_principal_kind is null
+    and not ${ctx.scope.canUser("v_actor", "v_tenant", runKey)} then
+    v_tenant := null;
+  end if;
+  v_subject := new.attributes ->> 'bs.subject';
+  if v_subject is not null and position('/' in v_subject) between 2 and 101
+    and length(v_subject) - position('/' in v_subject) between 1 and 200 then
+    v_subject_type := left(v_subject, position('/' in v_subject) - 1);
+    v_subject_id := substr(v_subject, position('/' in v_subject) + 1);
+  end if;
+  v_mode := case when new.attributes ->> 'bs.mode' = 'test' then 'test' else 'live' end;
+  perform ${record}(
+    'workflow-sdk',
+    new.id,
+    new.name,
+    case new.status::text when 'pending' then 'queued' else new.status::text end,
+    v_tenant,
+    v_actor,
+    coalesce(new.attributes, '{}'::jsonb) - 'bs.tenant' - 'bs.actor' - 'bs.subject' - 'bs.principal_kind' - 'bs.principal' - 'bs.mode' - 'bs.trigger_node',
+    case when new.status::text = 'failed' then coalesce(new.error_code, left(new.error, 4000)) end,
+    new.started_at at time zone 'UTC',
+    new.completed_at at time zone 'UTC',
+    v_subject_type,
+    v_subject_id,
+    v_principal_kind,
+    case when v_principal_kind is null then null else nullif(left(new.attributes ->> 'bs.principal', 200), '') end,
+    v_mode,
+    nullif(left(new.attributes ->> 'bs.trigger_node', 100), '')
+  );
+  return null;
+end;
+$$;
+revoke execute on function ${fn("workflow_sdk_mirror_run")}() from public, anon, authenticated;
+drop trigger if exists ${mirror} on workflow.workflow_runs;
+create trigger ${mirror} after insert or update of status, attributes, error on workflow.workflow_runs
+  for each row execute function ${fn("workflow_sdk_mirror_run")}();
+
+-- pg_net delivery: posts up to batch due messages to the flow route in the
+-- Vault secret ${WORKFLOW_VAULT_SECRETS.flowUrl}, signed with ${WORKFLOW_VAULT_SECRETS.deliverySecret}
+-- (x-bs-signature: t=<unix>,v1=hex(hmac_sha256(t.job.body))). The body is
+-- the stored message; the route completes or fails the job, so a delivery
+-- whose response is lost runs again after the lease.
+create or replace function ${fn("dispatch_workflow_deliveries")}(batch integer default ${String(batch)})
+returns integer
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  v_url text;
+  v_secret text;
+  v_job record;
+  v_body jsonb;
+  v_t text;
+  v_job_header text;
+  v_count integer := 0;
+  -- pg_net is optional: http_post is looked up, not named, so plpgsql_check
+  -- (supabase db lint) passes without the extension.
+  v_post regprocedure := pg_catalog.to_regprocedure('net.http_post(text, jsonb, jsonb, jsonb, integer)');
+begin
+  if v_post is null then
+    raise exception 'dispatch_workflow_deliveries needs pg_net: create extension pg_net, or deliver with the poll mode';
+  end if;
+  select ds.decrypted_secret into v_url from vault.decrypted_secrets ds where ds.name = ${sqlString(WORKFLOW_VAULT_SECRETS.flowUrl)};
+  select ds.decrypted_secret into v_secret from vault.decrypted_secrets ds where ds.name = ${sqlString(WORKFLOW_VAULT_SECRETS.deliverySecret)};
+  if v_url is null or v_secret is null then
+    raise exception 'Set the Vault secrets ${WORKFLOW_VAULT_SECRETS.flowUrl} and ${WORKFLOW_VAULT_SECRETS.deliverySecret} before dispatching' using hint = 'WORKFLOW_DELIVERY_UNCONFIGURED';
+  end if;
+  for v_job in select * from ${claimJobs}(${queue}, ${String(lease)}, greatest(coalesce(batch, ${String(batch)}), 1)) loop
+    v_body := coalesce(v_job.message -> 'payload', '{}'::jsonb);
+    v_t := floor(extract(epoch from now()))::bigint::text;
+    v_job_header := ${queue} || ':' || v_job.id::text || ':' || v_job.attempts::text;
+    execute format('select %s(url := $1, body := $2, headers := $3, timeout_milliseconds := $4)', v_post::oid::regproc)
+      using v_url, v_body, jsonb_build_object(
+        'content-type', 'application/json',
+        'x-bs-job', v_job_header,
+        'x-bs-signature', 't=' || v_t || ',v1=' || encode(extensions.hmac(v_t || '.' || v_job_header || '.' || v_body::text, v_secret, 'sha256'), 'hex')
+      ), ${String(timeout)};
+    v_count := v_count + 1;
+  end loop;
+  return v_count;
+end;
+$$;
+revoke execute on function ${fn("dispatch_workflow_deliveries")}(integer) from public, anon, authenticated;
+grant execute on function ${fn("dispatch_workflow_deliveries")}(integer) to service_role;`;
+}
+function data(ctx) {
+	if (ctx.mode === "custom" || deliveryModeOf(ctx) !== "pg_net") return "";
+	const schedule = ctx.text("schedule", "1 seconds");
+	return `-- Delivers workflow messages through pg_net every ${schedule} when pg_cron is installed.
+do $$
+begin
+  if pg_catalog.to_regnamespace('cron') is not null then
+    perform cron.schedule('better-supabase-workflow-deliveries', ${sqlString(schedule)}, ${sqlString(`select ${ctx.fn("dispatch_workflow_deliveries")}()`)});
+  else
+    raise notice 'pg_cron is not installed: call ${ctx.fn("dispatch_workflow_deliveries").replaceAll("'", "")}() on a schedule to deliver workflow messages';
+  end if;
+end;
+$$;`;
+}
+function contract() {
+	return [{
+		name: "dispatch_workflow_deliveries",
+		args: ["integer"],
+		returns: "integer"
+	}];
+}
+const WORKFLOW_SDK_WORLD = {
+	name: "workflow-sdk-world",
+	scopes: ["tenant"],
+	title: "Workflow SDK World",
+	description: `The tables of the Workflow SDK World (@workflow/world-postgres ${WORLD_POSTGRES_VERSION}) in the workflow schema, closed to the API roles; a trigger that copies each run into workflow_runs, and a pg_net dispatcher for the delivery queue on a pg_cron schedule.`,
+	requires: [
+		"workflows",
+		"jobs",
+		"access"
+	],
+	providerFunctions: ["idsWithFor"],
+	target: "schema",
+	modes: ["managed", "custom"],
+	version: 2,
+	upgrades: [{
+		from: 1,
+		description: "The run trigger fills subject, principal, mode and trigger node from the bs.subject, bs.principal_kind, bs.principal, bs.mode and bs.trigger_node attributes, and a runAs start keeps bs.actor as the user who triggered it.",
+		sql: () => ""
+	}],
+	names: {
+		tables: {},
+		options: [
+			"delivery",
+			"queue",
+			"batch",
+			"timeout",
+			"schedule"
+		]
+	},
+	contract,
+	build,
+	data
+};
+//#endregion
+export { renameSql as $, columnsObject as A, jsonSchemaChecks as B, accessDefinesDisabledHelpers as C, addForeignKey as D, addExtraColumns as E, dropExpiredPartitions as F, membershipSuspended as G, lockTable as H, ensureCheck as I, pageSize as J, organizationMissing as K, extraFieldsArg as L, defaultPartitionName as M, disabledHelpers as N, batchFunction as O, disabledHelpersNeedLaterTables as P, registerPartitions as Q, extraFieldsJson as R, SERVICE_CALLER as S, addCheck as T, memberAddedRecord as U, jwtClaim as V, membershipDisabledAt as W, raise as X, quotedTable as Y, recordTrigger as Z, EQUIVALENT_TRIGGERS as _, MODULE_PERMISSION_SCOPES as a, sha256Hex as at, PARTITION_VARIABLES as b, hasPlatformRoles as c, updatedAt as ct, modulePermissionKey as d, writeExtraColumns as dt, replaceColumnCheck as et, providerPlatformRoles as f, tenantScope as g, rolesOf as h, WORLD_POSTGRES_VERSION as i, serviceOnly as it, defaultPartition as j, columnRef as k, moduleOperations as l, userGrant as lt, roleScopeIs as m, WORKFLOW_SDK_WORLD as n, schemaPreamble as nt, OPERATIONS as o, splitTable as ot, roleNames as p, ownRowPolicies as q, WORKFLOW_VAULT_SECRETS as r, serviceGrant as rt, accessModel as s, triggerGrant as st, WORKFLOW_DELIVERY_QUEUE as t, revokeTable as tt, modulePermission as u, withExtraFields as ut, MONTHLY_PARTITIONS as v, activeMembership as w, SCHEMA as x, NOTHING as y, fail as z };