better-supabase 0.12.0 → 0.13.0

package/dist/index-DdZcWH6q.d.ts

@@ -0,0 +1,820 @@
+import { n as AccessPolicySql, u as ClaimsMeta } from "./types-DmshMaXz.js";
+import { g as BlockScope, h as BlockMode, n as AuthorizationMembership, p as AnyBlocksConfig, r as AuthorizationOperation, s as AuthorizationRoleSource, t as AuthorizationFunctions, x as SqlNaming, y as DisabledRow } from "./authorization-CB69cvnA.js";
+import { I as ReadSet } from "./define-D0LSXmUP.js";
+import { n as SubjectsConfig, t as SubjectConfig } from "./subjects-DQ2SU4cA.js";
+import { l as ModuleIdType, o as ModuleContext, s as ModuleContractFunction, u as ModuleNames } from "./context-DvBEhsXX.js";
+import { In as AppTablesConfig, S as EntitlementPlansSource, x as ResolvedConfig } from "./codegen-DGtOsqz9.js";
+//#region src/sql/shared.d.ts
+/**
+ * A `pg_jsonschema` check on a jsonb column, for the `jsonb-schemas` module and
+ * key-value tables.
+ */
+interface JsonSchemaCheck {
+  /** `table` or `schema.table`. */
+  readonly table: string;
+  readonly column: string;
+  readonly schema: Readonly<Record<string, unknown>>;
+  /**
+   * Checks only rows whose `where.column` equals `where.value` (a settings
+   * key).
+   */
+  readonly where?: {
+    readonly column: string;
+    readonly value: string;
+  };
+}
+//#endregion
+//#region src/sql/audit-registrations.d.ts
+/** A table registered with `better_supabase.audit(...)` in a SQL file. */
+interface AuditedTable {
+  /** `schema.table`, unquoted; an unqualified name is in `public`. */
+  readonly target: string;
+  readonly ignore: readonly string[];
+  readonly redact: readonly string[];
+}
+/**
+ * The tables `files` register with `better_supabase.audit(...)` or a static
+ * `create trigger bs_audit ... execute function
+ * better_supabase.audit_row_change('{...}')`, in file order: a later
+ * registration for the same table replaces the earlier one, and `unaudit(...)`
+ * or a `drop table` removes it. Calls with non-literal arguments are skipped.
+ */
+declare function auditRegistrations(files: readonly {
+  readonly text: string;
+}[]): AuditedTable[];
+//#endregion
+//#region src/sql/foreign-keys.d.ts
+/** A foreign key the schema files declare. */
+interface DeclaredForeignKey {
+  /** `schema.table`, unquoted. */
+  readonly table: string;
+  readonly columns: readonly string[];
+  /** The referenced `schema.table`, unquoted. */
+  readonly references: string;
+  /**
+   * The referenced columns. Without a column list, the referenced table's
+   * declared primary key, or `id` when the files don't declare one.
+   */
+  readonly referencedColumns: readonly string[];
+}
+/**
+ * The layout fields `blocks.tenant.options.sameTenant.auto` derives its entries
+ * from.
+ */
+declare function sameTenantLayout(files: readonly {
+  readonly text: string;
+}[], schemas: readonly string[]): Required<Pick<ModuleLayout, "foreignKeys" | "declaredColumns">>;
+//#endregion
+//#region src/sql/modules/entitlements-checks.d.ts
+/** `entitlements.claim`: what `feature_claims` puts in the token. */
+type FeatureClaimOption = false | {
+  /** At most this many tenants, the lowest ids first. */
+  readonly maxTenants?: number;
+  /** Short codes written instead of the feature keys: `{ exports: "x" }`. */
+  readonly keys?: Readonly<Record<string, string>>;
+};
+//#endregion
+//#region src/sql/modules/entitlements-source.d.ts
+/** The table holding each tenant's Stripe customer id. */
+interface EntitlementsSource {
+  /** `table` or `schema.table`; unset uses the `organizations` module's. */
+  readonly table?: string;
+  /** Column with the Stripe customer id (`cus_...`). */
+  readonly column?: string;
+  /** Column with the tenant id. */
+  readonly key: string;
+  /**
+   * Where entitlements come from; the customer lookups are for `stripe-sync`
+   * only.
+   */
+  readonly source?: "stripe-sync" | "custom" | EntitlementPlansSource;
+  readonly claim?: FeatureClaimOption;
+}
+//#endregion
+//#region src/sql/modules/grants.d.ts
+/** Privileges one role gets on a table or view. */
+interface TableGrant {
+  /** `table` or `schema.table`. */
+  readonly table: string;
+  readonly role: "anon" | "authenticated" | "service_role";
+  readonly privileges: readonly string[];
+}
+/** The roles that may execute a function. */
+interface FunctionGrant {
+  /** `name(argument types)` or `schema.name(argument types)`. */
+  readonly function: string;
+  readonly roles: readonly ("anon" | "authenticated" | "service_role")[];
+}
+//#endregion
+//#region src/sql/modules/vector-search.d.ts
+/** An embedding column `db.$search` can query. */
+interface VectorSearchTable {
+  /** `table` or `schema.table`. */
+  readonly table: string;
+  readonly column: string;
+  readonly distance: "cosine" | "l2" | "inner_product";
+  /** The column's type: pgvector's `vector` (default) or `halfvec`. */
+  readonly type?: "vector" | "halfvec";
+  /** The primary key column the scores function returns. Defaults to `id`. */
+  readonly key?: string;
+  /** Full-text ranking fused with the vector ranking (reciprocal rank fusion). */
+  readonly hybrid?: {
+    readonly tsvector: string;
+    /** The text search configuration of the query. Defaults to `simple`. */
+    readonly config?: string;
+    /** The RRF constant. Defaults to 60. */
+    readonly k?: number;
+  };
+  /**
+   * A SQL expression over the row `t` the score is multiplied by, such as
+   * `t.priority`.
+   */
+  readonly boost?: string;
+  /** Columns `filter` narrows before ranking, such as `organization_id`. */
+  readonly prefilter?: readonly string[];
+  /** A SQL condition over the row `t` every candidate must meet. */
+  readonly predicate?: string;
+  /** How `boost` combines with the score. Defaults to `multiply`. */
+  readonly boostMode?: "multiply" | "add";
+  /** A SQL `order by` list over the row `t` that breaks score ties. */
+  readonly order?: string;
+}
+//#endregion
+//#region src/sql/module-types.d.ts
+/** The step from one module version to the next, for `sql upgrade`. */
+interface ModuleUpgrade {
+  /** The installed version this step upgrades from. */
+  readonly from: number;
+  readonly description: string;
+  /** SQL run before the module's current file, e.g. renames and backfills. */
+  readonly sql: (ctx: ModuleContext) => string;
+}
+/**
+ * A renamed module symbol. It keeps a compatibility wrapper for at least one
+ * minor release, then is removed; doctor reports uses of both (BS309), and the
+ * name stays reserved.
+ */
+interface ModuleDeprecation {
+  readonly kind: "function" | "claim" | "table" | "column";
+  /**
+   * The old name: `schema.function`, a claim name, `schema.table` or
+   * `table.column`.
+   */
+  readonly symbol: string;
+  /** What to use instead. */
+  readonly use: string;
+  /** The package version that deprecated it. */
+  readonly since: string;
+  /** The package version that removed it; until then `wrapper` is written. */
+  readonly removed?: string;
+  /**
+   * The compatibility wrapper the module file keeps, e.g. a function with the
+   * old name that calls the new one and a `comment on function ... is
+   * 'deprecated: use X'`.
+   */
+  readonly wrapper?: (ctx: ModuleContext) => string;
+}
+/**
+ * SQL modules for `better-supabase add`. Every module is idempotent (`create or
+ * replace`, `if not exists`), so re-running it upgrades in place.
+ */
+interface SqlModule {
+  readonly name: string;
+  readonly title: string;
+  readonly description: string;
+  /** Modules this one needs, added along with it. */
+  readonly requires: readonly string[];
+  /**
+   * The scopes the module runs in. A module that needs tenants declares
+   * `["tenant"]`; unset, it runs in every scope. Outside `tenant` scope a
+   * module needs neither `tenant` nor `access`, so they drop from `requires`.
+   */
+  readonly scopes?: readonly BlockScope[];
+  /**
+   * A module this one renders and is numbered ahead of, for a module that owns
+   * a subject table the `case` checks of `comments` or `attachments` name, or
+   * that `search` puts its index trigger on. The file takes the number before
+   * it, so later files keep theirs.
+   */
+  readonly before?: string;
+  /** What it needs instead when an authorization provider supplies memberships. */
+  readonly providerRequires?: readonly string[];
+  /**
+   * The optional `authorization.functions` templates it calls under the
+   * `provider` access model, such as `idsWithFor` to check another user. Doctor
+   * warns (BS411) when the provider doesn't set one.
+   */
+  readonly providerFunctions?: readonly (keyof AuthorizationFunctions)[];
+  /**
+   * Modules it works with when they are installed, without needing them.
+   * `ctx.installed` and `ctx.of` accept only these and what it requires;
+   * `record` reaches the outbox and the audit log without listing them. `*`
+   * stands for every module, for one that reads them all (`data-lifecycle`).
+   */
+  readonly integrates?: readonly string[];
+  /**
+   * What it needs for this layout, e.g. per `blocks.access.model`; overrides
+   * both.
+   */
+  readonly dependencies?: (layout: ModuleLayout) => readonly string[];
+  /** `schema` files go with your schemas; `test` files go to `supabase/tests`. */
+  readonly target: "schema" | "test";
+  /** The module built for the default layout. */
+  readonly sql: string;
+  /** Bumped when installed databases need an upgrade step. Defaults to 1. */
+  readonly version?: number;
+  /** The modes `blocks.<name>.mode` accepts. Defaults to `managed` only. */
+  readonly modes?: readonly BlockMode[];
+  /** The logical tables and columns `blocks.<name>.tables` and `columns` map. */
+  readonly names?: ModuleNames;
+  /** The functions other modules and the TypeScript side call. */
+  readonly contract?: (ctx: ModuleContext) => readonly ModuleContractFunction[];
+  /** Renders the module for a layout. */
+  readonly build: (ctx: ModuleContext, layout: ModuleLayout) => string;
+  /**
+   * SQL appended after the module's body that depends on the whole layout, for
+   * example the grants for the tables in `expose`. Unlike `build`, it stays out
+   * of what `api` wrappers and extension scans read.
+   */
+  readonly extras?: (ctx: ModuleContext, layout: ModuleLayout) => string;
+  readonly upgrades?: readonly ModuleUpgrade[];
+  readonly deprecated?: readonly ModuleDeprecation[];
+  /**
+   * Rows, role settings and calls that a schema diff doesn't capture. They go
+   * to `better-supabase-data/` next to the schema folder and a migration (`sql
+   * data`) instead of the schema file.
+   */
+  readonly data?: (ctx: ModuleContext, layout: ModuleLayout) => string;
+  /**
+   * PgTAP files for this layout, written to the tests folder next to the
+   * `pgtap` module's.
+   */
+  readonly tests?: (ctx: ModuleContext, layout: ModuleLayout) => readonly ModuleTestFile[];
+  readonly topics?: (ctx: ModuleContext) => readonly string[];
+  readonly permissionKeys?: (ctx: ModuleContext) => readonly {
+    readonly action: string;
+    readonly key: string;
+    readonly scope: "tenant" | "platform";
+    readonly setting: string;
+  }[];
+  /**
+   * Functions granted to `anon` or `authenticated` only so the module's
+   * policies and triggers can call them as the client. `api` writes no entry
+   * point for them.
+   */
+  readonly internal?: readonly string[];
+  /**
+   * Soft-delete columns, as logical `table.column`: a write can set them to
+   * hide a row but never clear them again, so doctor BS213 doesn't count them
+   * as columns that grant access.
+   */
+  readonly hidingColumns?: readonly string[];
+  readonly adoptOptional?: (ctx: ModuleContext) => Readonly<Record<string, readonly string[]>>;
+  /**
+   * Adopted tables a subject carries (`options.subjects.<type>.<key>`), checked
+   * by `adoptedColumnProblems`. A null column is mapped away.
+   */
+  readonly adoptSubjectTables?: (ctx: ModuleContext) => readonly {
+    readonly logical: string;
+    readonly schema: string;
+    readonly table: string;
+    readonly columns: Readonly<Record<string, string | null>>;
+  }[];
+}
+/** A pgTAP file a module writes for the layout, e.g. one per audited table. */
+interface ModuleTestFile {
+  /** The file name's suffix, after the module's slug. */
+  readonly name: string;
+  readonly sql: string;
+}
+declare const moduleVersion: (module: SqlModule) => number;
+interface ModuleFile {
+  readonly module: string;
+  /** `schema` and `test` files are diffed; `data` files go in a migration too. */
+  readonly kind: "schema" | "data" | "test";
+  readonly path: string;
+  readonly contents: string;
+}
+interface ModuleLayout {
+  /** Directory for schema modules. Defaults to `supabase/schemas`. */
+  readonly dir?: string;
+  /**
+   * The declarative schema folder the diff engine loads. Defaults to
+   * `supabase/schemas`.
+   */
+  readonly schemasDir?: string;
+  /** File prefix. Defaults to `900_better_supabase`. */
+  readonly prefix?: string;
+  /** Directory for pgTAP files. Defaults to `supabase/tests`. */
+  readonly testsDir?: string;
+  /**
+   * The `better_supabase.audit(...)` calls in the SQL files: the `audit` module
+   * writes a pgTAP file per table.
+   */
+  readonly auditedTables?: readonly AuditedTable[];
+  /**
+   * Ignored: the header names only the module, so a release doesn't rewrite
+   * every file. The `@bs-module name@N` marker carries the module version.
+   *
+   * @deprecated Remove it; it has no effect.
+   */
+  readonly version?: string;
+  /**
+   * `config.realtime.tables`: registered at the end of the `realtime-tables`
+   * module.
+   */
+  readonly realtimeTables?: readonly string[];
+  /** `config.realtime.global`: tables registered with `tenant_column => null`. */
+  readonly realtimeGlobal?: readonly string[];
+  /** `config.realtime.users`: tables registered with `user_column`. */
+  readonly realtimeUsers?: Readonly<Record<string, string>>;
+  /** Tenant column passed to `track_realtime` for the other tables. */
+  readonly tenantColumn?: string;
+  /** Check constraints for the `jsonb-schemas` module. */
+  readonly jsonSchemas?: readonly JsonSchemaCheck[];
+  /** `config.expose`: the grants the `grants` module writes. */
+  readonly grants?: readonly TableGrant[];
+  /** `config.expose` functions: the roles that may execute each one. */
+  readonly functionGrants?: readonly FunctionGrant[];
+  /**
+   * Grants the permissive policies in the schema files imply, for
+   * `blocks.grants.options.fromPolicies`. Tables in `grants` keep their listed
+   * privileges.
+   */
+  readonly policyGrants?: readonly TableGrant[];
+  /** The tables the schema files create, for `blocks.sessions.options.policies`. */
+  readonly declaredTables?: readonly string[];
+  /**
+   * The declared tables with row level security on, for tables `fromPolicies`
+   * makes service-only.
+   */
+  readonly rlsTables?: readonly string[];
+  /**
+   * The foreign keys the schema files declare, for
+   * `blocks.tenant.options.sameTenant.auto`.
+   */
+  readonly foreignKeys?: readonly DeclaredForeignKey[];
+  /**
+   * Each declared table's columns, `schema.table` to names, for
+   * `sameTenant.auto`.
+   */
+  readonly declaredColumns?: Readonly<Record<string, readonly string[]>>;
+  /** `config.readSets`, compiled: the functions the `read-sets` module writes. */
+  readonly readSets?: readonly {
+    readonly name: string;
+    readonly sql: string;
+  }[];
+  /**
+   * `config.entitlements`: where the `entitlements` module finds each tenant's
+   * Stripe customer.
+   */
+  readonly entitlements?: EntitlementsSource;
+  /**
+   * `config.vectorSearch`: the tables the `vector-search` module writes a
+   * search function for.
+   */
+  readonly vectorSearch?: readonly VectorSearchTable[];
+  readonly vectorSchema?: string;
+  /** `config.claims`: claim names the modules read and write. */
+  readonly claims?: ClaimsMeta;
+  /**
+   * The authorization provider's memberships: `entitlements` reads them instead
+   * of `tenant`'s.
+   */
+  readonly entitlementsProvider?: ModuleEntitlementsProvider;
+  /** The authorization provider the `access` module's `provider` model calls. */
+  readonly accessProvider?: ModuleAccessProvider;
+  /** `config.blocks`: modes, names and permission keys per module. */
+  readonly modules?: AnyBlocksConfig;
+  /** `sql.scope`: the scope of every block that sets none. Defaults to `tenant`. */
+  readonly scope?: BlockScope;
+  /** `sql.naming`: the tenant concept's name in tables, functions and columns. */
+  readonly naming?: SqlNaming;
+  /** `config.subjects`: the app-wide subject registry (ADR 0020). */
+  readonly subjects?: SubjectsConfig;
+  /**
+   * `config.appTables`: the tables the app owns, rendered after the blocks (ADR
+   * 0040).
+   */
+  readonly appTables?: AppTablesConfig;
+  /** The authorization provider's permission keys, for `api-keys` scopes. */
+  readonly permissionCatalog?: readonly string[];
+  /**
+   * `authorization.delegation.scopes`: the access module's `scope_permissions`
+   * (with `blocks.access.scopes` merged over it).
+   */
+  readonly delegationScopes?: Readonly<Record<string, readonly string[]>>;
+}
+/**
+ * Where the `entitlements` module reads the provider's memberships, and the
+ * tables behind them.
+ */
+interface ModuleEntitlementsProvider {
+  /** The provider's name, for comments. */
+  readonly name: string;
+  /** The provider scope tenants are, e.g. `organization`. */
+  readonly scope: string;
+  readonly idType: ModuleIdType;
+  /** `authorization.functions.memberIds`. */
+  readonly memberIds: string;
+  /** `authorization.functions.memberIdsFor`. */
+  readonly memberIdsFor: string;
+  readonly memberships: readonly AuthorizationMembership[];
+}
+/** What the `access` module's `provider` model calls. */
+interface ModuleAccessProvider {
+  /** The provider's name, for comments and errors. */
+  readonly name: string;
+  /** The provider scope tenants are. */
+  readonly scope: string;
+  /** Every scope it declares, for `options.subjects.<type>.scope`. */
+  readonly scopes?: readonly string[];
+  readonly idType: ModuleIdType;
+  readonly functions: AuthorizationFunctions;
+  /** The access module's `disabled` setting defaults to these. */
+  readonly suspension?: {
+    readonly user?: DisabledRow;
+    readonly tenant?: DisabledRow;
+  };
+  /**
+   * An adopted `tenant` module on one of these tables reads role names the same
+   * way.
+   */
+  readonly roleSources?: readonly AuthorizationRoleSource[];
+  /** How `ai-chat` applies `functions.canApprove`. */
+  readonly approvals?: {
+    readonly distinctApprover?: boolean;
+  };
+  /** The provider's operations table; `operationPermission` reads it. */
+  readonly operations?: Readonly<Record<string, AuthorizationOperation>>;
+}
+//#endregion
+//#region src/sql/render.d.ts
+/** A module's SQL for `layout`, without header; `undefined` in custom mode. */
+declare function moduleBody(name: string, layout?: ModuleLayout): string | undefined;
+/**
+ * The files `sql add` writes for these modules. Modules in `custom` mode write
+ * nothing: the app implements their contract. A schema module's rows, role
+ * settings and other statements a schema diff can't capture go to a second file
+ * in `better-supabase-data/` (`kind: 'data'`), which `sql data` writes into a
+ * migration.
+ */
+declare function renderModules(names: readonly string[], layout?: ModuleLayout): ModuleFile[];
+interface ModuleTopic {
+  readonly module: string;
+  readonly topic: string;
+}
+declare function moduleTopics(names: readonly string[], layout?: ModuleLayout): ModuleTopic[];
+/** The contract functions of the modules in `custom` mode, for doctor. */
+declare function customContracts(names: readonly string[], layout?: ModuleLayout): {
+  readonly module: string;
+  readonly schema: string;
+  readonly idType: ModuleIdType;
+  readonly functions: readonly ModuleContractFunction[];
+}[];
+//#endregion
+//#region src/sql/upgrade.d.ts
+/** An installed module, from its file's `@bs-module` line or `modules`. */
+interface InstalledModule {
+  readonly module: string;
+  readonly version: number;
+}
+/** What `sql upgrade` runs for one module behind the current version. */
+interface ModuleUpgradePlan {
+  readonly module: string;
+  readonly from: number;
+  readonly to: number;
+  readonly steps: readonly {
+    readonly from: number;
+    readonly description: string;
+    readonly sql: string;
+  }[];
+}
+/**
+ * The upgrade steps for modules installed at an older version. A version
+ * without a step needs none: the module file upgrades in place. Modules in
+ * custom mode belong to the app and are skipped.
+ */
+declare function upgradePlan(installed: readonly InstalledModule[], layout?: ModuleLayout, modules?: Readonly<Record<string, SqlModule>>): ModuleUpgradePlan[];
+/** Every deprecated or removed module symbol, with its module. */
+declare function moduleDeprecations(modules?: Readonly<Record<string, SqlModule>>): readonly (ModuleDeprecation & {
+  readonly module: string;
+})[];
+//#endregion
+//#region src/sql/paths.d.ts
+/**
+ * The schema or test file `renderModules` writes for each of `names` and the
+ * modules they pull in, without rendering: modules in custom mode have none.
+ */
+declare function moduleFilePaths(names: readonly string[], layout?: ModuleLayout): ReadonlyMap<string, string>;
+//#endregion
+//#region src/sql/markers.d.ts
+/** The installed version of a module file, from its `@bs-module` line. */
+declare function moduleFileVersion(contents: string): {
+  readonly module: string;
+  readonly version: number;
+} | undefined;
+/**
+ * Whether an installed file matches, ignoring line endings and the version
+ * releases before 0.13 stamped in its header.
+ */
+declare function sameModuleFile(current: string | undefined, expected: string): boolean;
+//#endregion
+//#region src/sql/introspect.d.ts
+/** A permission key a SQL module checks, from `modulePermissionKeys`. */
+interface ModulePermissionKey {
+  readonly module: string;
+  /** The action in `blocks.<module>.permissions` that overrides the key. */
+  readonly action: string;
+  readonly key: string;
+  /**
+   * `tenant` for keys checked in a tenant (`member_can`, `can`,
+   * `tenant_ids_with`), `platform` for `is_platform` and `platform_can`.
+   */
+  readonly scope: "tenant" | "platform";
+  readonly setting?: string;
+}
+/**
+ * Every permission key the modules `names` install (with what they pull in)
+ * check, after `blocks.<module>.permissions` overrides. Modules in custom mode
+ * are skipped, and so is `invitations.invitePlatform` without platform roles.
+ */
+declare function modulePermissionKeys(config: AnyBlocksConfig, names: readonly string[]): ModulePermissionKey[];
+interface ModuleExtension {
+  readonly name: string;
+  readonly statement: string;
+}
+declare const moduleSchemaExtensions: (files: readonly ModuleFile[]) => ModuleExtension[];
+/**
+ * The installed modules' soft-delete columns (`SqlModule.hidingColumns`), as
+ * `schema.table.column` after the layout's renames, for doctor BS213.
+ */
+declare function moduleHidingColumns(installed: readonly string[], layout: ModuleLayout): string[];
+/**
+ * The event triggers each of these modules creates, as its default file renders
+ * them, for doctor's check of a database.
+ */
+declare function moduleEventTriggers(names: readonly string[], modules?: Readonly<Record<string, SqlModule>>): {
+  readonly module: string;
+  readonly name: string;
+}[];
+//#endregion
+//#region src/sql/registry.d.ts
+/** New modules go at the end: the position is part of the file name. */
+declare const SQL_MODULES: Readonly<Record<string, SqlModule>>;
+/**
+ * The modules to install for `names`, dependencies first. Throws on an unknown
+ * name.
+ */
+declare function resolveModules(names: readonly string[], layout?: ModuleLayout): SqlModule[];
+//#endregion
+//#region src/sql/modules/app-tables.d.ts
+/**
+ * The `module` of the files `renderModules` writes for `appTables`. App tables
+ * aren't a block: no `SQL_MODULES` entry, no preset, no row in
+ * `better_supabase.modules` (ADR 0040).
+ */
+declare const APP_TABLES_MODULE = "app-tables";
+/** The first line after the title of the app tables schema file. */
+declare const APP_TABLES_MARKER = "-- @bs-app-tables";
+/**
+ * The files for `layout.appTables`: one schema file that creates every app
+ * table in `public` (implicit columns first, then each column with `add column
+ * if not exists`, so a later column reaches an existing table), with row level
+ * security, the grants and policies of its scope, indexes on the scope and
+ * reference columns, and the `updated_at` trigger when the `updated-at` block
+ * is installed; and one pgTAP file that checks the policies and grants. Empty
+ * without app tables. `installed` is every block module `renderModules`
+ * resolved.
+ */
+declare function appTablesFiles(layout: ModuleLayout, installed: readonly string[]): ModuleFile[];
+//#endregion
+//#region src/sql/adopted-columns.d.ts
+/** A table an adopt-mode module reads and writes, with the columns it uses. */
+interface AdoptedTable {
+  readonly module: string;
+  readonly logical: string;
+  readonly schema: string;
+  readonly table: string;
+  /** Logical column to the physical column the module's SQL names. */
+  readonly columns: Readonly<Record<string, string>>;
+  /**
+   * Logical text columns a module writes a computed value into without
+   * `ctx.cast`, so the adopted column must take a text value: an enum there
+   * fails. Columns written only with string literals are left out.
+   */
+  readonly textColumns: readonly string[];
+}
+/**
+ * Every table the adopt-mode modules in `modules` use, with the columns their
+ * SQL names: mapped to `null` and unused optional columns are left out.
+ */
+declare function adoptedTables(modules: AnyBlocksConfig): readonly AdoptedTable[];
+/**
+ * Adopt-mode modules that default an optional column to its physical name while
+ * the adopted `create table` has no such column. `sql sync` refuses those
+ * configs so `has()` does not treat a missing column as present.
+ */
+declare function adoptedColumnProblems(modules: AnyBlocksConfig, files: readonly {
+  readonly text: string;
+}[], schemas: readonly string[]): readonly string[];
+//#endregion
+//#region src/sql/expose-columns.d.ts
+/**
+ * The columns `privilege(*, -a, -b)` leaves out, unquoted. Empty for any other
+ * privilege.
+ */
+declare function excludedColumns(privilege: string): readonly string[];
+/**
+ * `grants` with every `privilege(*, -col)` turned into the explicit column list
+ * the `create table` in `files` declares, in declaration order. Throws for a
+ * table no file declares, or when the exclusions leave no column.
+ */
+declare function resolveExposeColumns(grants: readonly TableGrant[], files: readonly {
+  readonly text: string;
+}[], schemas: readonly string[]): readonly TableGrant[];
+//#endregion
+//#region src/sql/modules/data-lifecycle-secrets.d.ts
+/** Column names that usually hold a credential, matched case-insensitively. */
+declare const SECRET_COLUMNS = "token|secret|_hash|password|api_key|license_key";
+/** What doctor needs to tell which columns a data export reads. */
+interface DataExportPlan {
+  /**
+   * The listed and module tables an export reads, `schema.table`, with the
+   * columns it leaves out.
+   */
+  readonly tables: readonly {
+    readonly name: string;
+    readonly omit: readonly string[];
+  }[];
+  /**
+   * `options.autoTables`: the tables in `schemas` with one of `columns`, minus
+   * `excluded` and the listed ones.
+   */
+  readonly auto: {
+    readonly schemas: readonly string[];
+    readonly columns: readonly string[];
+    readonly excluded: (name: string) => boolean;
+  } | undefined;
+  /** `options.omitPattern`, resolved. */
+  readonly omitPattern: string | undefined;
+}
+/** The export tables for doctor. Undefined without the `data-lifecycle` module. */
+declare function dataExportPlan(layout: ModuleLayout, installed: readonly string[]): DataExportPlan | undefined;
+//#endregion
+//#region src/sql/modules/tenant-same.d.ts
+/**
+ * The unquoted trigger name `sameTenant` gives `column`, within Postgres' 63
+ * bytes.
+ */
+declare function sameTenantTrigger(column: string): string;
+/**
+ * The tenant column `sameTenant` entries default to: the memberships tenant
+ * column.
+ */
+declare function sameTenantColumn(layout: ModuleLayout): string;
+//#endregion
+//#region src/sql/flag-lifecycle.d.ts
+/**
+ * The flags past their `expires_at`, as doctor reads them: `expires_at` and
+ * `owner` are optional `extraColumns` of the flags table, and an archived flag
+ * is left out. Undefined when the flags module isn't installed or has no
+ * `expires_at` column.
+ */
+declare function expiredFlagsQuery(layout: ModuleLayout, installed: readonly string[]): string | undefined;
+//#endregion
+//#region src/sql/tenant-query.d.ts
+interface TenantQuery {
+  readonly text: string;
+  readonly values: readonly string[];
+}
+/**
+ * The organizations `seed --tenant` fills: the one whose slug or id is
+ * `tenant`, or every live one for `*`. Each row has `id`, `slug` and `name` as
+ * text. Undefined when the organizations module isn't installed.
+ */
+declare function tenantsQuery(layout: ModuleLayout, installed: readonly string[], tenant: string): TenantQuery | undefined;
+//#endregion
+//#region src/sql/subject-registry.d.ts
+/** Every column a registry entry names, keyed by the config path that names it. */
+declare function subjectColumns(entry: SubjectConfig): readonly (readonly [path: string, column: string])[];
+//#endregion
+//#region src/sql/schema-scan.d.ts
+/** Privileges one role gets on a table, from the policies that name it. */
+interface PolicyGrant {
+  /** `schema.table`, unquoted; an unqualified name is in `public`. */
+  readonly table: string;
+  readonly role: "anon" | "authenticated";
+  readonly privileges: readonly ("select" | "insert" | "update" | "delete")[];
+}
+/**
+ * The tables `files` create (`create table`), as `schema.table`, in the order
+ * they first appear. Only tables in `schemas` are kept.
+ */
+declare function declaredTables(files: readonly {
+  readonly text: string;
+}[], schemas: readonly string[]): string[];
+/**
+ * The tables in `schemas` that `files` leave with row level security on: `alter
+ * table ... enable row level security`, until a later `disable` or `drop
+ * table`.
+ */
+declare function rlsTables(files: readonly {
+  readonly text: string;
+}[], schemas: readonly string[]): string[];
+/**
+ * The privileges the permissive policies in `files` imply, per table and role:
+ * `for all` gives the four commands, `to public` (or no `to`) counts for
+ * `authenticated` only, so `anon` needs a policy that names it. Restrictive
+ * policies grant nothing. Only tables in `schemas` are kept.
+ */
+declare function policyGrants(files: readonly {
+  readonly text: string;
+}[], schemas: readonly string[]): PolicyGrant[];
+declare function extensionSchema(sources: readonly {
+  readonly text: string;
+}[], extension: string): string | undefined;
+//#endregion
+//#region src/core/access-sql.d.ts
+/** The Postgres types a scope's ids can have. */
+declare const SCOPE_ID_TYPES: readonly string[];
+/**
+ * What is wrong with a provider's scopes: an unknown tenant scope or parent, a
+ * parent cycle, an id type outside `SCOPE_ID_TYPES`, or a tenant scope without
+ * one.
+ */
+declare function scopeProblems(provider: {
+  readonly scopes: readonly {
+    readonly name: string;
+    readonly idType?: string | undefined;
+    readonly parent?: string | undefined;
+  }[];
+  readonly tenantScope: string;
+}): string[];
+/**
+ * The `schema.name` of every schema-qualified function a template calls, with
+ * `{scope}` filled.
+ */
+declare function templateFunctions(template: string, scope?: string): string[];
+/** What a bucket or topic access policy decides with. */
+interface AccessTarget {
+  /** `tenant` (default), `platform`, or with `sql` any scope its templates take. */
+  readonly scope?: string;
+  /** `"provider"` is replaced with `authorization.functions` by `gen`. */
+  readonly sql?: AccessPolicySql | "provider";
+}
+/**
+ * `target` with `sql: "provider"` replaced by the provider's `idsWith` and
+ * `isPlatform`. `where` names the policy in the error when there is no
+ * provider.
+ */
+declare function resolveProviderSql<T extends AccessTarget>(where: string, target: T, functions: AuthorizationFunctions | undefined): T;
+//#endregion
+//#region src/sql/layout.d.ts
+/** Where and how `sql add` writes module files for this config. */
+declare function moduleLayout(config: ResolvedConfig, testsDir?: string, readSets?: ModuleLayout["readSets"], entitlementsProvider?: ModuleEntitlementsProvider, accessProvider?: ModuleAccessProvider, permissionCatalog?: readonly string[]): ModuleLayout;
+//#endregion
+//#region src/sql/migration-options.d.ts
+/** A migration-only option a config sets. */
+interface MigrationOptionUse {
+  readonly module: string;
+  readonly option: string;
+  readonly value: unknown;
+  readonly adopted: boolean;
+  /** `blocks.<module>.options.<option> ... It <effect>.` */
+  readonly message: string;
+}
+/**
+ * The migration-only options `blocks` sets to a value other than the managed
+ * default. They are accepted in `adopt` mode only; doctor warns about each.
+ */
+declare function migrationOptionUses(modules?: AnyBlocksConfig): MigrationOptionUse[];
+//#endregion
+//#region src/sql/shared-roles.d.ts
+/**
+ * Why a roles table that holds both tenant and platform roles (the tenant
+ * module's `roleThrough` and the invitations module's `platformRoles.through`
+ * under the `provider` model) can't tell them apart: the setting that lacks
+ * `where` and why. Empty when the modules don't share a roles table.
+ */
+declare function sharedRolesProblems(names: readonly string[], layout: ModuleLayout): {
+  readonly setting: string;
+  readonly message: string;
+}[];
+//#endregion
+//#region src/sql/read-sets.d.ts
+/** A read set compiled to the SQL of its function. */
+interface CompiledReadSet {
+  readonly name: string;
+  readonly sql: string;
+}
+/**
+ * The function for a read set: `stable`, `security invoker` (RLS applies to the
+ * caller) and with an empty `search_path`. Parameters are read from the `p
+ * jsonb` argument; nothing is built dynamically.
+ */
+declare function compileReadSet(set: ReadSet): Promise<CompiledReadSet>;
+/** Compiles every set, sorted by name. Throws on a duplicate name. */
+declare function compileReadSets(sets: readonly ReadSet[]): Promise<CompiledReadSet[]>;
+//#endregion
+export { renderModules as $, adoptedTables as A, modulePermissionKeys as B, DataExportPlan as C, resolveExposeColumns as D, excludedColumns as E, resolveModules as F, InstalledModule as G, moduleFileVersion as H, ModuleExtension as I, upgradePlan as J, ModuleUpgradePlan as K, ModulePermissionKey as L, APP_TABLES_MODULE as M, appTablesFiles as N, AdoptedTable as O, SQL_MODULES as P, moduleTopics as Q, moduleEventTriggers as R, sameTenantTrigger as S, dataExportPlan as T, sameModuleFile as U, moduleSchemaExtensions as V, moduleFilePaths as W, customContracts as X, ModuleTopic as Y, moduleBody as Z, subjectColumns as _, MigrationOptionUse as a, ModuleTestFile as at, expiredFlagsQuery as b, SCOPE_ID_TYPES as c, moduleVersion as ct, templateFunctions as d, AuditedTable as dt, ModuleAccessProvider as et, PolicyGrant as f, auditRegistrations as ft, rlsTables as g, policyGrants as h, sharedRolesProblems as i, ModuleLayout as it, APP_TABLES_MARKER as j, adoptedColumnProblems as k, resolveProviderSql as l, DeclaredForeignKey as lt, extensionSchema as m, compileReadSet as n, ModuleEntitlementsProvider as nt, migrationOptionUses as o, ModuleUpgrade as ot, declaredTables as p, moduleDeprecations as q, compileReadSets as r, ModuleFile as rt, moduleLayout as s, SqlModule as st, CompiledReadSet as t, ModuleDeprecation as tt, scopeProblems as u, sameTenantLayout as ut, TenantQuery as v, SECRET_COLUMNS as w, sameTenantColumn as x, tenantsQuery as y, moduleHidingColumns as z };