better-supabase 0.12.0 → 0.13.0

package/dist/connectors-CgWuPQks.d.ts

@@ -0,0 +1,147 @@
+/// <reference lib="esnext.temporal" />
+import { T as ErrorMapper, t as AsyncResult } from "./result-mijqfoJN.js";
+import { t as StandardSchemaV1 } from "./standard-16AIDny5.js";
+import { n as ExtraFields, r as FieldsOf } from "./block-fields-DnXkMney.js";
+import { n as Logger } from "./logger-DWVYUmwi.js";
+import { i as CredentialRef, r as CredentialProvider } from "./provider-Dmsbl8ug.js";
+import { t as BlockTransport } from "./block-transport-DBPhgF3W.js";
+import { r as BlockTemporalOptions } from "./block-helpers-DyA5BAW4.js";
+import { n as BlockHooks } from "./block-hooks-BadAniNI.js";
+//#region src/blocks/connectors/connectors.d.ts
+type ConnectorTransport = "http" | "sse";
+/**
+ * `none`, OAuth per user (a grant each), or a header from the server's
+ * credential_ref.
+ */
+type ConnectorAuth = "none" | "oauth" | "header";
+type FingerprintStatus = "approved" | "pending" | "rejected";
+interface ConnectorGrant {
+  readonly id: string;
+  readonly userId: string;
+  readonly serverId: string;
+  readonly organizationId: string;
+  readonly credentialRef: CredentialRef;
+  readonly scopes: readonly string[];
+  readonly expiresAt: Temporal.Instant | undefined;
+  readonly grantedAt: Temporal.Instant;
+  readonly revokedAt: Temporal.Instant | undefined;
+}
+/** An MCP server. `F` types the extra columns the `fields` schema describes. */
+interface ConnectorServer<F extends object = Record<never, never>> {
+  readonly id: string;
+  readonly organizationId: string;
+  readonly name: string;
+  readonly url: string;
+  readonly transport: ConnectorTransport;
+  readonly authType: ConnectorAuth;
+  /** For `header` auth: the app credential sent with every request. */
+  readonly credentialRef: CredentialRef | undefined;
+  /** The OAuth scopes to ask for. */
+  readonly scopes: readonly string[];
+  /** OAuth client metadata for dynamic client registration. */
+  readonly clientMetadata: Readonly<Record<string, unknown>>;
+  readonly enabled: boolean;
+  /** The caller's (or `ownerId`'s) active grant, from `list` and `get`. */
+  readonly grant: ConnectorGrant | undefined;
+  readonly createdAt: Temporal.Instant;
+  readonly updatedAt: Temporal.Instant;
+  /** The extra columns, keyed by database name. */
+  readonly fields: ExtraFields<F>;
+}
+interface ConnectorServerFields<F extends object = Record<never, never>> {
+  readonly name?: string;
+  readonly url?: string;
+  readonly transport?: ConnectorTransport;
+  readonly authType?: ConnectorAuth;
+  readonly credentialRef?: CredentialRef | null;
+  readonly scopes?: readonly string[];
+  readonly clientMetadata?: Readonly<Record<string, unknown>>;
+  readonly enabled?: boolean;
+  /** The extra columns to set, keyed by database name; others keep their value. */
+  readonly fields?: Partial<F>;
+}
+interface ConnectorSession {
+  readonly sessionId: string | undefined;
+  readonly initializeResult: Readonly<Record<string, unknown>> | undefined;
+  readonly expiresAt: Temporal.Instant;
+}
+interface ConnectorsOptions<S extends StandardSchemaV1 | undefined = undefined> extends BlockTemporalOptions {
+  /**
+   * A Standard Schema for the server's extra columns
+   * (`blocks.connectors.options.extraColumns`), keyed by database name. It
+   * types and parses them on reads, and validates them on `create` and
+   * `update`.
+   */
+  readonly fields?: S;
+  /** `withBlockHooks` hooks around the client's methods. */
+  readonly hooks?: NoInfer<BlockHooks<Connectors<FieldsOf<S>>>>;
+  /** Receives the errors `after` hooks throw. Default: `console`. */
+  readonly logger?: Logger;
+  /** Calls as the user: `rpcTransport(supabase)`. */
+  readonly transport: BlockTransport;
+  /** Calls as the service role, for grants and renewals. */
+  readonly service?: BlockTransport;
+  /**
+   * The module schema, or its API schema: `defineBlocks` passes it from
+   * `blocks.generated.ts`. Default `better_supabase`.
+   */
+  readonly schema?: string;
+  readonly mappers?: readonly ErrorMapper[];
+  /** Revokes a grant's credential when the grant or its server goes away. */
+  readonly credentials?: CredentialProvider;
+}
+/** `F` is the extra fields `options.fields` describes. */
+interface Connectors<F extends object = Record<never, never>> {
+  readonly servers: {
+    list(organizationId: string): AsyncResult<readonly ConnectorServer<F>[]>;
+    /** With `ownerId` (service role), the grant is that user's. */
+    get(serverId: string, options?: {
+      readonly ownerId?: string;
+    }): AsyncResult<ConnectorServer<F>>;
+    create(organizationId: string, server: ConnectorServerFields<F> & {
+      readonly name: string;
+      readonly url: string;
+    }): AsyncResult<ConnectorServer<F>>;
+    update(organizationId: string, serverId: string, fields: ConnectorServerFields<F>): AsyncResult<ConnectorServer<F>>;
+    /** Deletes a server and revokes its grants' credentials. Returns how many. */
+    remove(serverId: string): AsyncResult<number>;
+  };
+  readonly grants: {
+    /**
+     * Records a user's grant after the provider stored the credential (service
+     * role), revoking the grant it replaces.
+     */
+    record(serverId: string, userId: string, credentialRef: CredentialRef, options?: {
+      readonly scopes?: readonly string[];
+      readonly expiresAt?: Temporal.Instant;
+    }): AsyncResult<ConnectorGrant>;
+    /** Revokes a grant (its owner or the service role) and its credential. */
+    revoke(grantId: string): AsyncResult<boolean>;
+    /** Active grants expiring before `before` (service role). */
+    expiring(before: Temporal.Instant, options?: {
+      readonly limit?: number;
+    }): AsyncResult<readonly ConnectorGrant[]>;
+    renew(grantId: string, expiresAt: Temporal.Instant): AsyncResult<boolean>;
+  };
+  readonly sessions: {
+    get(serverId: string, chatKey?: string): AsyncResult<ConnectorSession | undefined>;
+    save(serverId: string, session: {
+      readonly chatKey?: string;
+      readonly sessionId?: string;
+      readonly initializeResult?: Readonly<Record<string, unknown>>;
+    }): AsyncResult<boolean>;
+    forget(serverId: string, chatKey?: string): AsyncResult<boolean>;
+    /** Deletes expired sessions (service role). */
+    purge(): AsyncResult<number>;
+  };
+  readonly fingerprints: {
+    /** Records a tool list's fingerprint and returns whether it may be called. */
+    check(serverId: string, fingerprint: string, tools?: Readonly<Record<string, unknown>>): AsyncResult<FingerprintStatus>;
+    approve(serverId: string, fingerprint: string): AsyncResult<boolean>;
+    reject(serverId: string, fingerprint: string): AsyncResult<boolean>;
+  };
+}
+/** MCP servers, per-user grants, sessions and tool list fingerprints. */
+declare function createConnectors<S extends StandardSchemaV1 | undefined = undefined>(options: ConnectorsOptions<S>): Connectors<FieldsOf<S>>;
+//#endregion
+export { ConnectorSession as a, ConnectorsOptions as c, ConnectorServerFields as i, FingerprintStatus as l, ConnectorGrant as n, ConnectorTransport as o, ConnectorServer as r, Connectors as s, ConnectorAuth as t, createConnectors as u };

package/dist/context-CCz6ZgyI.js

@@ -0,0 +1,19 @@
+import { getCurrentInstance, inject, onMounted } from "vue";
+//#region src/vue/context.ts
+const CLIENT = Symbol("better-supabase");
+/** What `app.use(betterSupabase(bs))` provides. */
+function useContext() {
+	const context = inject(CLIENT, null);
+	if (!context) throw new Error("better-supabase: install the plugin with app.use(betterSupabase(bs))");
+	return context;
+}
+/**
+* Runs `start` on mount in a component, at once elsewhere (an effect scope),
+* and never during server rendering.
+*/
+function onClient(start) {
+	if (getCurrentInstance()) onMounted(start);
+	else start();
+}
+//#endregion
+export { onClient as n, useContext as r, CLIENT as t };

package/dist/context-CMxVnPMY.js

@@ -0,0 +1,9 @@
+import { createContext } from "react";
+//#region src/react/context.ts
+/**
+* The provider's client. It lives in its own module so the block hooks read it
+* without bundling the rest of the React bindings.
+*/
+const ClientContext = createContext(null);
+//#endregion
+export { ClientContext as t };

package/dist/context-CrojkPNC.js

@@ -0,0 +1,41 @@
+import { i as userContext } from "./impersonation-DFfDVJHk.js";
+//#region src/auth/context.ts
+/** The repository context (`actor`, `claims`) for an auth state. */
+function authContext(auth) {
+	switch (auth.kind) {
+		case "user": return userContext(auth.user, auth.claims);
+		case "service": return {
+			actor: {
+				id: `service:${auth.keyName}`,
+				kind: "service",
+				role: "service_role"
+			},
+			claims: { role: "service_role" }
+		};
+		case "apiKey": return {
+			actor: auth.userId ? {
+				id: auth.userId,
+				kind: "user",
+				role: "authenticated"
+			} : {
+				id: `api-key:${auth.keyId}`,
+				kind: "service",
+				role: "authenticated"
+			},
+			claims: auth.claims,
+			...auth.organizationId ? { tenant: auth.organizationId } : {}
+		};
+		case "anon":
+		case "invalid": return {
+			actor: {
+				id: "anon",
+				kind: "anon",
+				role: "anon"
+			},
+			claims: { role: "anon" }
+		};
+		default: return auth;
+	}
+}
+//#endregion
+export { authContext as t };

package/dist/context-DvBEhsXX.d.ts

@@ -0,0 +1,403 @@
+import { u as ClaimsMeta } from "./types-DmshMaXz.js";
+import { b as ResolvedModule, g as BlockScope, h as BlockMode, p as AnyBlocksConfig } from "./authorization-CB69cvnA.js";
+import { n as SubjectsConfig } from "./subjects-DQ2SU4cA.js";
+//#region src/core/tenant-naming.d.ts
+/** The tenant concept's names, and how they rename a default identifier. */
+interface TenantNames {
+  /** `organization`, or the configured name such as `workspace`. */
+  readonly singular: string;
+  /** `organizations`, `workspaces`, `companies`. */
+  readonly plural: string;
+  /** Whether the names differ from `organization`. */
+  readonly renamed: boolean;
+  /**
+   * A default identifier with the tenant concept renamed: `create_organization`
+   * becomes `create_workspace`, `organizations` becomes `workspaces` and
+   * `organization_id` becomes `workspace_id`.
+   */
+  rename(identifier: string): string;
+}
+//#endregion
+//#region src/sql/scope.d.ts
+/**
+ * How a module checks who may reach a row, for the block's scope. Modules call
+ * these instead of naming the access contract (`can`, `tenant_ids_with`,
+ * `is_platform`) or the tenant module's helpers, so the same module runs per
+ * tenant, per user or in one shared space. In `tenant` scope each one renders
+ * the access contract call it replaces.
+ */
+interface ModuleScope {
+  readonly kind: BlockScope;
+  /**
+   * The type of a scope id: the tenant id type, or `uuid` (a user id) in `user`
+   * scope.
+   */
+  readonly idType: ModuleIdType;
+  /**
+   * The type of a managed table's scope column: `<idType> not null` per tenant,
+   * nullable outside it (`uuid default auth.uid()` per user).
+   */
+  column(): string;
+  /** True when the caller holds `permission` (a SQL expression) in scope `id`. */
+  can(id: string, permission: string): string;
+  /** True when `user` (a uuid expression) holds `permission` in scope `id`. */
+  canUser(user: string, id: string, permission: string): string;
+  /**
+   * PL/pgSQL that sets the scope id parameter `param` for the scope: the
+   * caller's id per user (the service role keeps what it passes), null in the
+   * shared space. Empty per tenant.
+   */
+  bind(param: string): string;
+  /**
+   * A scope id argument as an expression: as passed per tenant, the caller's id
+   * when it is null per user, null in the shared space.
+   */
+  value(param: string): string;
+  /**
+   * A set-returning call of the scope ids the caller holds `permission` in,
+   * usable as `select ...`, `x in (select ...)` and `from ... x`.
+   */
+  ids(permission: string): string;
+  /** A row policy check: `column` is a scope the caller holds `permission` in. */
+  check(column: string, permission: string): string;
+  /** `a = b` for scope ids, null-safe in `none` scope where they are null. */
+  eq(a: string, b: string): string;
+  /**
+   * `is_platform(permission)`: whether the caller is platform staff holding
+   * `permission`. `false` outside `tenant` scope without the access module.
+   */
+  platform(permission: string): string;
+  /** A set-returning call of the tenants the caller is a member of. */
+  members(): string;
+}
+//#endregion
+//#region src/sql/context.d.ts
+/** The scope id types SQL modules render. */
+declare const MODULE_ID_TYPES: readonly ["uuid", "text", "bigint", "integer"];
+type ModuleIdType = (typeof MODULE_ID_TYPES)[number];
+declare const isModuleIdType: (value: string) => value is ModuleIdType;
+/**
+ * A Postgres type name as one of `MODULE_ID_TYPES`: case and spacing are
+ * normalised and aliases such as `int8` resolved. `undefined` for any other
+ * type, so callers refuse it instead of guessing.
+ */
+declare function moduleIdType(value: string): ModuleIdType | undefined;
+/** One logical table of a module: its default name and logical columns. */
+interface ModuleTableSpec {
+  /** Default name, in the module's schema. */
+  readonly name: string;
+  /** Logical column to default column name. */
+  readonly columns: Readonly<Record<string, string>>;
+  /**
+   * Logical columns an adopted table may lack (mapped to `null`): the module
+   * leaves out the feature that needs them.
+   */
+  readonly optional?: readonly string[];
+  /** The app may lack the whole table (`blocks.<name>.tables.<table>: null`). */
+  readonly optionalTable?: boolean;
+  readonly adoptOnlyWhenMapped?: boolean;
+  readonly lifecycle?: ModuleTableLifecycle;
+  /**
+   * Text columns an adopted table may declare with another type, such as an
+   * enum: the module writes and compares them through `ctx.cast`.
+   */
+  readonly typed?: readonly string[];
+}
+interface ModuleTableLifecycle {
+  readonly user?: string;
+  readonly tenant?: string;
+  readonly purge?: boolean;
+  readonly omit?: readonly string[];
+  readonly export?: boolean;
+  /**
+   * Columns that hold a `credential_ref`. Exports leave them out, and the
+   * organization purger revokes each ref that carries the row's tenant through
+   * the `CredentialProvider` before the purge deletes the row.
+   */
+  readonly credentials?: readonly string[];
+  /** Revoke for the row's `user` instead of the app. Default `app`. */
+  readonly credentialSubject?: "app" | "user";
+}
+interface ModuleNames {
+  readonly tables: Readonly<Record<string, ModuleTableSpec>>;
+  /**
+   * The `before_*` and `after_*` hooks the module calls, so
+   * `blocks.<name>.hooks.functions` is checked.
+   */
+  readonly hooks?: readonly string[];
+  /**
+   * The `blocks.<name>.options` keys the module reads; any other key is
+   * rejected.
+   */
+  readonly options?: readonly string[];
+  /**
+   * The events the module records, typed against its block's event map
+   * (`ModuleEvents<CommentsEvents>`); `record` rejects any other type.
+   */
+  readonly events?: Readonly<Record<string, CheckedEventSpec | undefined>>;
+}
+interface CheckedEventSpec {
+  readonly subject: string;
+  readonly payload: readonly string[];
+  readonly retries?: boolean;
+}
+/** An event a module writes to the outbox, as SQL expressions. */
+interface ModuleEmit {
+  /** The event type, e.g. `organization.created`. */
+  readonly type: string;
+  /** A `jsonb` expression. */
+  readonly payload: string;
+  /** A `text` expression, e.g. `'organizations/' || new_organization`. */
+  readonly subject?: string;
+  /** The tenant id expression; it is cast to text. */
+  readonly tenant?: string;
+  /** A `text` idempotency key expression. */
+  readonly key?: string;
+}
+/**
+ * The categories module actions are audited under. An adopted log with its own
+ * names maps them through `blocks.audit.options.values.category`.
+ */
+declare const AUDIT_CATEGORIES: readonly ["membership", "access", "security", "configuration", "billing", "data", "ai", "integration"];
+type AuditCategory = (typeof AUDIT_CATEGORIES)[number];
+/** How `record` writes an action to the audit log, as SQL expressions. */
+interface ModuleAudit {
+  /** The audit category, mapped through `blocks.audit.options.values`. */
+  readonly category: AuditCategory;
+  /** What the action changed, e.g. `user` or `api_key`. */
+  readonly targetType?: string;
+  /** A `text` expression for the changed record's id. */
+  readonly recordId?: string;
+  /** A `text` expression people recognize the target by. */
+  readonly targetLabel?: string;
+  /** A `text` expression that says what happened. */
+  readonly summary?: string;
+  /** A `jsonb` expression; defaults to the event payload. */
+  readonly metadata?: string;
+  /** A `uuid` expression for the actor; defaults to the caller. */
+  readonly actor?: string;
+  /**
+   * A `uuid` expression for the support session the action belongs to. Defaults
+   * to the session in the caller's `act` claim, which wins when set.
+   */
+  readonly supportSession?: string;
+  /**
+   * A `uuid` expression for the admin acting as the user; defaults to
+   * `act.sub`.
+   */
+  readonly impersonatedBy?: string;
+  /**
+   * A `text` expression for why the admin acts as the user; defaults to
+   * `act.reason`.
+   */
+  readonly impersonationReason?: string;
+}
+/**
+ * An action a module records once: the outbox gets it as an event and the audit
+ * log as an entry, each when its module is installed.
+ */
+interface ModuleAction extends ModuleEmit {
+  /**
+   * How the action is audited, or `false` for an event that is not an audited
+   * action, such as a chat message or a run status.
+   */
+  readonly audit: ModuleAudit | false;
+}
+/**
+ * A function of a module's contract: what other modules and the TypeScript side
+ * call.
+ */
+interface ModuleContractFunction {
+  readonly name: string;
+  /** Argument types; `{id}` stands for the module's id type. */
+  readonly args: readonly string[];
+  readonly returns: string;
+}
+/** What a module's `build` reads: resolved names for one layout. */
+interface ModuleContext {
+  readonly module: string;
+  readonly mode: BlockMode;
+  readonly config: ResolvedModule;
+  /** The quoted schema of the module's functions and managed tables. */
+  readonly schema: string;
+  readonly schemaName: string;
+  readonly idType: ModuleIdType;
+  readonly claims: ClaimsMeta;
+  readonly modules: AnyBlocksConfig;
+  /** The app-wide subject registry (`config.subjects`). */
+  readonly subjects: SubjectsConfig;
+  /**
+   * The names of `config.appTables`, created in `public` after every block
+   * file, so a block can't put a trigger on one (ADR 0043).
+   */
+  readonly appTables: ReadonlySet<string>;
+  /**
+   * Who the module's rows belong to, and the checks for it: the port every
+   * tenant, user or shared-space check goes through.
+   */
+  readonly scope: ModuleScope;
+  /** The tenant concept's names (`sql.naming.tenant`). */
+  readonly naming: TenantNames;
+  /**
+   * `schema.name` of a module function, quoted. The name is the default one;
+   * `sql.naming` and `blocks.<name>.functions` rename it.
+   */
+  fn(name: string): string;
+  /** The unquoted name a module function is written under (see `fn`). */
+  fnName(name: string): string;
+  /** `blocks.<name>.functions` keys no `fn` call has asked for yet. */
+  unusedFunctions(): readonly string[];
+  /** Default name to written name, for every function `fn` renamed so far. */
+  functionRenames(): ReadonlyMap<string, string>;
+  /** `schema.table` of a logical table, quoted. */
+  table(logical: string): string;
+  /** The unquoted schema and name of a logical table. */
+  tableName(logical: string): {
+    readonly schema: string;
+    readonly name: string;
+  };
+  /** A logical column, quoted. Throws when an adopted table lacks it. */
+  col(table: string, column: string): string;
+  /** A logical column, unquoted. Throws when an adopted table lacks it. */
+  colName(table: string, column: string): string;
+  /** Whether a logical column exists (adopted tables can map it to `null`). */
+  has(table: string, column: string): boolean;
+  /**
+   * `value`, a text expression, as the type of a logical column the table spec
+   * lists in `typed`. In adopt mode the column may be an enum or another type
+   * with a text input, so the value goes through
+   * `better_supabase.as_column_type`; in managed mode it stays as it is.
+   */
+  cast(table: string, column: string, value: string): string;
+  /** Whether an optional logical table exists (it can be mapped to `null`). */
+  hasTable(table: string): boolean;
+  /** Whether the module owns `table` (managed mode). */
+  readonly manages: boolean;
+  readonly names: ModuleNames;
+  readonly installedModules: readonly string[];
+  /** The permission key for a module action, as a SQL literal. */
+  permission(action: string, fallback: string): string;
+  /** The permission key for a module action. */
+  permissionKey(action: string, fallback: string): string;
+  /** A trigger name with the module's prefix, quoted. */
+  trigger(name: string): string;
+  /** Whether `module` is installed alongside this one. */
+  installed(module: string): boolean;
+  /** The context of another module in the same layout. */
+  of(module: string): ModuleContext;
+  /** A string module option (`blocks.<name>.options`). */
+  text(name: string, fallback: string): string;
+  number(name: string, fallback: number): number;
+  flag(name: string, fallback: boolean): boolean;
+  /** A module option that is a list of strings. */
+  list(name: string, fallback: readonly string[]): readonly string[];
+  /** A declared module option as configured, for object-shaped options. */
+  option(name: string): unknown;
+  /**
+   * `options.extraColumns` (column name to SQL type), checked: names are
+   * lower-case identifiers, types are SQL types, and no name shadows one of
+   * `table`'s mapped columns or a key in `reserved`, the stable keys the
+   * module's read functions return next to them.
+   */
+  extraColumns(table: string, reserved?: readonly string[]): readonly ExtraColumn[];
+  /**
+   * PL/pgSQL that calls the app's hook function when it exists, with `[type,
+   * expression]` arguments: `if to_regprocedure(...) is not null then execute
+   * format(...) using ...; end if;`. The name comes from `to_regprocedure`
+   * rather than a literal: plpgsql_check (`supabase db lint`) checks constant
+   * dynamic SQL and fails when the hook is missing.
+   */
+  hook(name: string, args: readonly (readonly [string, string])[]): string;
+  /** The app function a hook calls, quoted, for hooks that return a value. */
+  hookTarget(name: string): string;
+  /**
+   * PL/pgSQL that writes the event to the outbox (`emit_event`) when the
+   * `outbox` module is installed and `blocks.<name>.events` isn't false;
+   * otherwise an empty string. `record` without the audit entry.
+   */
+  emit(event: ModuleEmit): string;
+  /**
+   * PL/pgSQL that writes the action to the outbox (as `emit` does) and, when it
+   * carries `audit` and the `audit` module is installed, to the audit log
+   * (`audit_event`), with `key` as the idempotency key of both. `null;` when
+   * neither applies, so it is always a valid statement.
+   */
+  record(action: ModuleAction): string;
+  /**
+   * PL/pgSQL that calls `notify(fields)` as the service role, which `notify()`
+   * requires, then restores the caller's claims. The function declares
+   * `v_claims text`. `null;` without the `notifications` module.
+   */
+  notify(fields: string, options?: {
+    readonly indent?: string;
+  }): string;
+  /**
+   * PL/pgSQL that enqueues a job (`enqueue_job`); `null;` without the `jobs`
+   * module.
+   */
+  enqueue(queue: string, payload: string, dedupe: string): string;
+  /**
+   * The `text[]` of a tenant's entitlements, or `fallback` without the
+   * `entitlements` module.
+   */
+  entitlements(tenant: string): string | undefined;
+  entitlements(tenant: string, fallback: string): string;
+  /**
+   * How long rows of `kind` are kept for `tenant` (SQL expressions): the
+   * data-lifecycle policy for the tenant, its plan or every tenant, else
+   * `fallback`; just `fallback` without the `data-lifecycle` module.
+   */
+  retention(kind: string, tenant: string, fallback: string): string;
+  /**
+   * Whether a legal hold covers `kind` for `tenant`; `false` without the
+   * `data-lifecycle` module.
+   */
+  held(kind: string, tenant: string): string;
+  /**
+   * The condition a purge deletes on: the row's timestamp `at` is past
+   * `retention` and no hold covers it. With data-lifecycle it first bounds `at`
+   * by the shortest policy, so the timestamp index still serves.
+   */
+  expired(kind: string, row: {
+    readonly at: string;
+    readonly tenant: string;
+    readonly fallback: string;
+  }): string;
+  /**
+   * Before when every tenant's rows of `kind` may go (a timestamptz
+   * expression), for dropping whole partitions: null under any hold on the
+   * kind, else the longest policy or `fallback`; `now() - fallback` without the
+   * `data-lifecycle` module.
+   */
+  cutoff(kind: string, fallback: string): string;
+  /**
+   * PL/pgSQL that broadcasts on a Realtime topic when `realtime.send` exists:
+   * projects without Realtime skip it.
+   */
+  broadcast(topic: string, event: string, payload: string, options?: {
+    readonly indent?: string;
+  }): string;
+  /**
+   * `coalesce(better_supabase.can(scope, id, permission), false)`; `permission`
+   * is a SQL expression. The `tenant` scope goes through `scope.can`.
+   */
+  can(scope: string, id: string, permission: string): string;
+  /**
+   * True for the service role and platform staff holding `permission` (a SQL
+   * expression); the service role only without the `access` module.
+   */
+  staff(permission: string): string;
+}
+/** A column from `options.extraColumns`. */
+interface ExtraColumn {
+  /** The column name, as reads return it. */
+  readonly name: string;
+  /** The name, quoted. */
+  readonly ident: string;
+  /** Its SQL type, such as `text not null default 'en'`. */
+  readonly type: string;
+}
+/** The contract's argument list with `{id}` resolved, as Postgres prints it. */
+declare function contractSignature(fn: ModuleContractFunction, idType: string): string;
+//#endregion
+export { ModuleAudit as a, ModuleEmit as c, ModuleTableSpec as d, contractSignature as f, ModuleAction as i, ModuleIdType as l, moduleIdType as m, AuditCategory as n, ModuleContext as o, isModuleIdType as p, MODULE_ID_TYPES as r, ModuleContractFunction as s, AUDIT_CATEGORIES as t, ModuleNames as u };