better-supabase 0.14.0 → 0.15.0

package/dist/context-CEuTKrkz.d.ts

@@ -0,0 +1,4129 @@
+/// <reference lib="esnext.temporal" />
+import { M as Casing, P as ClaimsMeta, T as AccessBucketPolicy, _t as BucketLifecycle, j as BucketPolicyName, ot as SchemaMeta } from "./types-DFdg_4yN.js";
+import { D as ResolvedBlock, E as NamedInstance, F as BlockNameRegistry, P as TablesOf, T as InstanceOn, _ as BlockName, a as AuthorizationProvider, d as AccessBlockConfig, g as BlockMode, h as BlockConfigOf, m as BlockConfig, n as AuthorizationMembership, p as AnyBlocksConfig, r as AuthorizationOperation, s as AuthorizationRoleSource, t as AuthorizationFunctions, v as BlockScope, w as InstanceKeys, x as DisabledRow, y as BlocksConfig } from "./authorization-HZdJCaVm.js";
+import { Mn as EntityNames, Nn as EntityNoun, Pn as EntityRename, R as PortName, Ut as ActionDescriptor, Xt as BlockSchedule, Zt as DefaultAutomation, _ as BlockProvider, g as BlockEnvKey, i as BlockCategory, y as BlockWorker } from "./define-block-BVcLQ3DF.js";
+import { a as ScalarKind, i as FieldSpec } from "./table-schema-BlF6k62Q.js";
+import { n as SubjectsConfig } from "./subjects-DvmQeF_F.js";
+import { i as FIELD_FORMAT_NAMES, s as FieldFormatName } from "./field-formats-CAFNkKSN.js";
+import { t as GuestAction } from "./guest-actions-1T1DeS5Y.js";
+//#region src/config/names.d.ts
+/** The steps `better-supabase gen` runs, in the order it runs them. */
+declare const GEN_TASKS: readonly ["types", "sql", "spec", "seed", "env"];
+/** Glue `better-supabase init` and `add` write for a framework or runtime. */
+declare const INTEGRATION_NAMES: readonly ["next", "hono", "orpc", "edge", "expo", "mcp", "client", "react"];
+/**
+ * An integration as `init`, `add` and `/create` show it, and the integrations
+ * it needs.
+ */
+interface IntegrationInfo {
+  readonly title: string;
+  /** What `init` or `add` writes, one sentence. */
+  readonly description: string;
+  readonly requires: readonly (typeof INTEGRATION_NAMES)[number][];
+}
+declare const INTEGRATION_INFO: Readonly<Record<(typeof INTEGRATION_NAMES)[number], IntegrationInfo>>;
+/** The agent folders `better-supabase skills install` writes to. */
+declare const SKILLS_AGENTS: readonly ["cursor", "claude", "agents"];
+//#endregion
+//#region src/config/types/tooling.d.ts
+interface OpenApiConfig {
+  /**
+   * Module exporting the document (or a function returning it) as `openapi` or
+   * default.
+   */
+  readonly entry?: string;
+  /** JSON file `better-supabase spec emit openapi` writes. */
+  readonly output?: string;
+}
+/** A docs UI `spec emit --ui` writes next to an OpenAPI document. */
+type SpecUiName = "scalar" | "swagger" | "redoc" | "elements" | "rapidoc";
+/** One document `better-supabase spec emit` writes. */
+interface SpecOutputConfig {
+  /** A format id: `openapi`, `asyncapi` or `arazzo`. */
+  readonly format: string;
+  /** Defaults to the format's default version, e.g. `3.1` for OpenAPI. */
+  readonly version?: string;
+  /** File to write, relative to the root. Defaults to the format's file name. */
+  readonly output?: string;
+  /** Overlay files (JSON or YAML), applied in order. */
+  readonly overlays?: readonly string[];
+  /**
+   * Defaults to `yaml` when `output` ends in `.yaml` or `.yml`, otherwise
+   * `json`.
+   */
+  readonly serialize?: "json" | "yaml";
+  /**
+   * Also writes a reference page (`openapi.html` for `openapi.json`) next to
+   * OpenAPI outputs.
+   */
+  readonly ui?: SpecUiName;
+}
+interface SpecsConfig {
+  /**
+   * Module exporting a `defineApi()` result (or a function returning one) as
+   * `api` or default.
+   */
+  readonly entry?: string;
+  /** The documents to write. Defaults to one OpenAPI document. */
+  readonly outputs?: readonly SpecOutputConfig[];
+  /**
+   * The lowest severity that fails `spec emit`, `check` and `validate`.
+   * Defaults to `error`.
+   */
+  readonly failOn?: "error" | "warning" | "never";
+  /**
+   * Also write the diagnostics manifest (JSON) to this file, like `spec
+   * --manifest`.
+   */
+  readonly manifest?: string;
+}
+/** A step `better-supabase gen` runs. */
+type GenTask = (typeof GEN_TASKS)[number];
+interface GenConfig {
+  /**
+   * The steps `better-supabase gen` runs, in this order: `types` (the generated
+   * modules and `generators`), `sql` (`upgrade`), `spec` (`spec emit`), `seed`
+   * and `env`. Without a list, `types` runs, plus `sql` when `blocks` or
+   * `realtime.policies` is set, and `spec` and `seed` when their entry file
+   * exists. `env` runs only when listed, because it needs the local stack. A
+   * listed step always runs.
+   */
+  readonly tasks?: readonly GenTask[];
+  /** Milliseconds between checks in `gen --watch` and `spec emit --watch`. */
+  readonly watchInterval?: number;
+  /**
+   * Serves the schema types through the TypeScript 7.1 content mapper instead
+   * of writing them. `gen` then writes a slim `generated.ts` with the runtime
+   * values and a `schema.bsb` next to it, and no `database.types.ts`. The app
+   * still imports from `./generated`. Needs a `contentMappers` entry in
+   * `tsconfig.json` and `tsc --runExternalCode`. Defaults to `false`.
+   */
+  readonly contentMapper?: boolean;
+}
+/** Glue `better-supabase init` and `add` write for a framework or runtime. */
+type IntegrationName = (typeof INTEGRATION_NAMES)[number];
+interface EnvFileConfig {
+  /** Env file `better-supabase dev env` writes. Defaults to `.env.local`. */
+  readonly output?: string;
+  /**
+   * Prefix for the browser variables, such as `NEXT_PUBLIC_`; `'none'` for no
+   * prefix. Detected from the framework by default.
+   */
+  readonly prefix?: string;
+}
+/** An agent folder `better-supabase skills install` writes to. */
+type SkillsAgent = (typeof SKILLS_AGENTS)[number];
+interface SkillsConfig {
+  /** Defaults to the agent folders the project has, else `agents`. */
+  readonly agents?: readonly SkillsAgent[];
+}
+interface KeysConfig {
+  /**
+   * Signing key file `better-supabase dev keys` writes. Defaults to
+   * `supabase/signing_keys.json`.
+   */
+  readonly output?: string;
+}
+interface DoctorConfig {
+  /** Finding codes to skip, e.g. `['BS204']`. */
+  readonly ignore?: readonly string[];
+  /** Run only these checks, e.g. `['BS100', 'BS304']`. */
+  readonly only?: readonly string[];
+  /** Treat warnings as errors. */
+  readonly strict?: boolean;
+  /**
+   * Report format: `text` (default), `sarif` (code scanning) or `github`
+   * (workflow annotations). `--json` still wins.
+   */
+  readonly format?: "text" | "sarif" | "github";
+  /** Write the report to this file. */
+  readonly output?: string;
+  /**
+   * App source files doctor scans for API use (BS210). Globs relative to the
+   * root. Defaults to `['src/**\/*.{ts,tsx}']`.
+   */
+  readonly sources?: readonly string[];
+  /**
+   * How many policies a security definer helper may appear in before BS206 asks
+   * for an inlinable `language sql stable` function. Defaults to 5.
+   */
+  readonly policyHelperLimit?: number;
+  /**
+   * The BS405 limit in bytes. When the authorization provider's token hook has
+   * a budget, it replaces that budget and the whole token keeps 2048. Otherwise
+   * it limits the whole token's claims (default 2048).
+   */
+  readonly claimsLimit?: number;
+  /** Which migrations the lock checks (BS229 to BS235) read. */
+  readonly migrationSafety?: MigrationSafetyConfig;
+}
+interface MigrationSafetyConfig {
+  /**
+   * The newest migration that is already applied everywhere, by file name
+   * (`20260101000000_init.sql`) or version (`20260101000000`). Offline, doctor
+   * checks only the migrations after it; with `--db-url` it checks the ones the
+   * database hasn't applied. `init` and `add --adopt` set it to the latest
+   * migration.
+   */
+  readonly since?: string;
+}
+//#endregion
+//#region src/preset/fields.d.ts
+/**
+ * How `/create` and `init` show one value: its label and, where the label is
+ * not enough, a hint.
+ */
+interface PresetValueInfo {
+  readonly label: string;
+  readonly hint?: string;
+}
+/** One convention a preset sets, with the names `/create` and `init` show. */
+interface PresetField<K extends string = string, V extends string = string> {
+  readonly key: K;
+  readonly values: readonly V[];
+  readonly default: V | readonly V[];
+  /** The field takes several values (`integrations`). */
+  readonly multi?: true;
+  readonly label: string;
+  readonly labels: { readonly [P in V]: PresetValueInfo; };
+}
+/** The value each convention field takes. */
+interface PresetConventions {
+  readonly framework: PresetFramework;
+  readonly platforms: "web" | "native" | "both";
+  readonly casing: "snake" | "camel";
+  readonly idType: "uuid" | "text" | "bigint" | "integer";
+  readonly scope: "tenant" | "user" | "none";
+  readonly tenantName: PresetTenantName;
+  readonly access: "roles" | "catalog" | "provider" | "custom";
+  readonly api: "none" | "api";
+  readonly integrations: readonly IntegrationName[];
+}
+/** A convention field's key. */
+type PresetFieldKey = keyof PresetConventions;
+/** The values a convention field takes. */
+type PresetFieldValue<K extends PresetFieldKey> = ValueOf<K>;
+type ValueOf<K extends PresetFieldKey> = PresetConventions[K] extends readonly (infer V extends string)[] ? V : Extract<PresetConventions[K], string>;
+/** The tenant names a preset can set (`blocks.memberships.names.organization`). */
+declare const PRESET_TENANT_NAMES: readonly ["organization", "workspace", "team"];
+type PresetTenantName = (typeof PRESET_TENANT_NAMES)[number];
+/** The frameworks `/create` and `init --preset` set up glue for. */
+declare const PRESET_FRAMEWORKS: readonly ["next", "vite", "tanstack-start", "expo", "sveltekit", "nuxt", "hono", "astro", "react-router"];
+type PresetFramework = (typeof PRESET_FRAMEWORKS)[number];
+/** The convention fields, in the order `/create` and `init` show them. */
+declare const CONVENTION_FIELDS: readonly PresetField<PresetFieldKey>[];
+/** A convention field by key, with its values and labels typed. */
+declare function presetField<K extends PresetFieldKey>(key: K): PresetField<K, ValueOf<K>>;
+/** A field value's label, or the value itself when it has none. */
+declare function presetValueLabel(key: PresetFieldKey, value: string): PresetValueInfo;
+/**
+ * The integrations `init --preset` adds for a framework whatever the selection
+ * says: the framework's own one, when it has one, then what that one requires.
+ */
+declare function integrationsForFramework(framework: PresetFramework): readonly IntegrationName[];
+type PresetPlatforms = PresetConventions["platforms"];
+type PresetScope = PresetConventions["scope"];
+type PresetAccess = PresetConventions["access"];
+/** A block selection and its conventions. */
+interface Preset extends PresetConventions {
+  /**
+   * Block names (`blocks` keys in the config), as selected; `resolvePreset`
+   * adds what they require.
+   */
+  readonly blocks: readonly string[];
+  /**
+   * `blocks` entries the preset writes: a selected block's names and options
+   * (`tasks: { names: { work_item: "ticket" } }`), or another instance of a
+   * block (`maintenance: { block: "tasks" }`).
+   */
+  readonly instances?: Readonly<Record<string, PresetInstance>>;
+}
+/** A `blocks` entry a preset writes, with the keys a config file uses. */
+interface PresetInstance extends InstanceKeys {
+  readonly names?: Readonly<Record<string, string>>;
+  readonly options?: Readonly<Record<string, unknown>>;
+  readonly tables?: Readonly<Record<string, string | null>>;
+}
+/** Every convention at its default. */
+declare const DEFAULT_CONVENTIONS: PresetConventions;
+//#endregion
+//#region src/preset/catalog-types.d.ts
+/** One SQL module in the preset catalog: a key of `blocks` in the config. */
+interface PresetCatalogBlock {
+  readonly name: string;
+  readonly title: string;
+  readonly category: BlockCategory;
+  /** The modules it needs with the default options. */
+  readonly requires: readonly string[];
+  /** What it needs instead under an access model, where that differs. */
+  readonly requiresByAccess?: Partial<Readonly<Record<PresetAccess, readonly string[]>>>;
+  /** The scopes it runs in; unset, every scope. */
+  readonly scopes?: readonly PresetScope[];
+  /** Tenant names that would rename a table or column to a name it already uses. */
+  readonly tenantNameClashes?: readonly PresetTenantName[];
+  /**
+   * The logical table `options.extraColumns` adds columns to, when it takes
+   * them.
+   */
+  readonly extraColumns?: string;
+  /**
+   * The nouns `blocks.<name>.names` renames, with what config resolution needs
+   * to name them and register their subjects.
+   */
+  readonly entities?: PresetCatalogEntities;
+  /** Modules it works with when installed; `*` is every module. */
+  readonly integrates: readonly string[];
+  /** The manifest that installs it, a key of `manifests`. */
+  readonly manifest: string;
+}
+/** A block's entities as the catalog carries them. */
+interface PresetCatalogEntities {
+  readonly specs: Readonly<Record<string, BlockSqlEntitySpec>>;
+  /** The tables that hold them, with their default names and columns. */
+  readonly tables: Readonly<Record<string, Pick<BlockSqlTableSpec, "name" | "columns">>>;
+  /** The default permission key of each module action. */
+  readonly keys: Readonly<Record<string, string>>;
+}
+/** One block manifest (ADR 0029): what `lib/blocks.ts` wires. */
+interface PresetCatalogManifest {
+  readonly name: string;
+  /** The SQL modules it installs. */
+  readonly sql: readonly string[];
+  readonly category: BlockCategory;
+  /** Its export and subpath, when it has a TypeScript client. */
+  readonly client: {
+    readonly export: string;
+    readonly subpath: string;
+  } | null;
+  readonly consumes: Partial<Readonly<Record<PortName, "optional" | "required">>>;
+  readonly provides: readonly PortName[];
+  /** The export of its subpath that builds its repository extension. */
+  readonly extension?: string;
+  /**
+   * The types its subpath exports that carry one of its entities' names, which
+   * `gen` aliases under the renamed names.
+   */
+  readonly entityTypes?: readonly PresetCatalogEntityType[];
+  /**
+   * JSON Schemas of the inputs its client takes, by entity key, from the
+   * Standard Schemas the block exports.
+   */
+  readonly entitySchemas?: Readonly<Record<string, PresetCatalogEntitySchemas>>;
+  /**
+   * The block's events: the event map type its subpath exports and the event
+   * types, in its default names.
+   */
+  readonly events?: {
+    readonly type: string;
+    readonly types: readonly string[];
+  };
+  /**
+   * The write names of its record binding (`block.record`), present when the
+   * block binds to records; `gen` puts the block on each served record type.
+   */
+  readonly record?: readonly string[];
+  /** The env keys it reads, for `.env.example` and doctor's BS504. */
+  readonly env?: readonly BlockEnvKey[];
+  /** The interfaces the app implements for it, for `providers.ts` and BS505. */
+  readonly providers?: readonly BlockProvider[];
+  /** The registry items that hold its routes, without the framework suffix. */
+  readonly routes?: readonly string[];
+  /** The crons or processes it needs. */
+  readonly workers?: readonly BlockWorker[];
+  /** The action kinds it ships, for the action registry. */
+  readonly actions?: readonly ActionDescriptor[];
+  /** The timers it runs on the queue's `block_ticks`. */
+  readonly schedules?: readonly BlockSchedule[];
+}
+/** One entity's input schemas, in the block's default names. */
+interface PresetCatalogEntitySchemas {
+  readonly input?: PresetCatalogInputSchema;
+  readonly change?: PresetCatalogInputSchema;
+  readonly listFilter?: PresetCatalogInputSchema;
+}
+/** One input schema: its fields as `entitySchema` takes them, and JSON Schema. */
+interface PresetCatalogInputSchema {
+  readonly title: string;
+  readonly fields: Readonly<Record<string, FieldSpec>>;
+  readonly jsonSchema: Readonly<Record<string, unknown>>;
+}
+/** A block type named after one of its entities, such as `WorkItem`. */
+interface PresetCatalogEntityType {
+  readonly name: string;
+  /** Takes the extra columns as its first type parameter, `F`. */
+  readonly fields?: true;
+}
+/**
+ * One item of the `@better-supabase` shadcn registry: glue the app copies (`npx
+ * shadcn add @better-supabase/<name>`), for some blocks, frameworks and
+ * platforms.
+ */
+interface PresetGlueItem {
+  readonly name: string;
+  readonly title: string;
+  /** The SQL modules the item needs. */
+  readonly blocks: readonly string[];
+  readonly frameworks: readonly string[];
+  readonly platforms: readonly ("web" | "native")[];
+  /** Where its files go, as shadcn targets (`@lib/blocks.ts`, `~/app/...`). */
+  readonly targets: readonly string[];
+  /** The env keys its files read. */
+  readonly envVars?: readonly string[];
+  /** The named preset a bundle item (`registry:item`) installs the glue of. */
+  readonly preset?: string;
+}
+/** What `scripts/build-catalog.ts` writes to `catalog.generated.ts`. */
+interface PresetCatalog {
+  readonly blocks: readonly PresetCatalogBlock[];
+  readonly manifests: readonly PresetCatalogManifest[];
+  readonly glue: readonly PresetGlueItem[];
+}
+//#endregion
+//#region src/config/instances.d.ts
+/** One named install of a block. */
+interface ResolvedInstance {
+  /** The key in `blocks`. */
+  readonly name: string;
+  /** The block it installs. */
+  readonly block: string;
+  /** The record types it attaches to; unset, every record type. */
+  readonly on?: InstanceOn;
+  /**
+   * Each dependency block to the instance it resolves to, when that is not the
+   * instance named after the block: what `uses` sets, and a dependency's only
+   * instance when it has another name.
+   */
+  readonly uses: Readonly<Record<string, string>>;
+  /** Its config, without `block`. */
+  readonly config: BlockConfig;
+}
+//#endregion
+//#region src/sql/contributions.d.ts
+/**
+ * What a block adds to a generic block's SQL through `contributes`, keyed by
+ * the generic block. The generic block reads the contributions of every
+ * installed instance whose `uses` names it, so it never names its consumers.
+ */
+interface BlockContributions {
+  readonly approvals: ApprovalContribution;
+  readonly bulk: BulkActionContribution;
+  readonly numbering: NumberingContribution;
+  readonly pipelines: PipelineContribution;
+  readonly "share-links": ShareLinkContribution;
+  readonly subjects: SubjectContribution;
+}
+/** `BlockSql.contributes`: one function per generic block it adds to. */
+type BlockContributes = { readonly [K in keyof BlockContributions]?: (own: BlockSqlContext, target: BlockSqlContext) => readonly BlockContributions[K][]; };
+/** SQL expressions for the approval request being decided. */
+interface ApprovalRequestSql {
+  /** The request's subject id, as text. */
+  readonly subjectId: string;
+  /** The decision's comment. */
+  readonly comment: string;
+}
+/** Requests of one subject type the contributing block files with approvals. */
+interface ApprovalContribution {
+  readonly subject: string;
+  /**
+   * `declared`: whoever reads the organization's requests reads these.
+   * `linked`: the contributing block decides them, so only the requester and
+   * eligible approvers read them, they can't be delegated, and
+   * `approval_settle` closes them.
+   */
+  readonly access: "declared" | "linked";
+  /** Statements `approval_finalize` runs once a request is approved. */
+  readonly approve: (request: ApprovalRequestSql) => string;
+  /** Statements `decide_approval` runs when a request is rejected. */
+  readonly reject?: (request: ApprovalRequestSql) => string;
+  /** A boolean expression: whether the request can still be decided. */
+  readonly approvable?: (request: ApprovalRequestSql) => string;
+}
+/** A bulk action the contributing block runs on one row. */
+interface BulkActionContribution {
+  /** The action name callers pass, such as `tags.set`. */
+  readonly name: string;
+  /**
+   * PL/pgSQL statements for one row, reading `bulk_row.tenant`,
+   * `bulk_row.subject_type`, `bulk_row.subject_id` and `bulk_row.args`.
+   */
+  readonly run: string;
+  /** Variables the statements declare, such as `v_tag uuid;`. */
+  readonly declare?: string;
+}
+/**
+ * A number sequence the contributing block draws from, for when the app doesn't
+ * configure `blocks.numbering.options.entities.<entity>` itself.
+ */
+interface NumberingContribution {
+  /** The entity name, after the instance's entity names. */
+  readonly entity: string;
+  /** The default entry: `{ period, format }` and the other entity keys. */
+  readonly entry: Readonly<Record<string, unknown>>;
+}
+/** A record table of the contributing block that runs on pipelines. */
+interface PipelineContribution {
+  /** The subject type, after the instance's entity names. */
+  readonly type: string;
+  /** The qualified table its records live in. */
+  readonly table: string;
+  /** Its tenant column, unquoted; `tenant_id` when left out. */
+  readonly tenant?: string;
+  /** The binding; an app's own `on` entry is merged over it. */
+  readonly entry: Readonly<Record<string, unknown>>;
+}
+/** SQL expressions for the subject a new share link names. */
+interface ShareLinkSubjectSql {
+  readonly id: string;
+  readonly tenant: string;
+}
+/** A subject type the contributing block owns and share links can name. */
+interface ShareLinkContribution {
+  readonly subject: string;
+  /**
+   * A boolean expression: the subject exists in the tenant, and the caller may
+   * share it.
+   */
+  readonly exists: (subject: ShareLinkSubjectSql) => string;
+  /** Statements share-links adds for this subject type, such as wrappers. */
+  readonly sql?: string;
+}
+/** One section `record_summary` counts. */
+interface SummarySection {
+  readonly name: string;
+  /** The `from` clause; rows are aliased `x`. */
+  readonly from: string;
+  readonly subjectType: string;
+  readonly subjectId: string;
+  /** The row's time, for the unread check. */
+  readonly latest: string;
+  /** Extra conditions a counted row meets, such as not being deleted. */
+  readonly live?: string;
+  /**
+   * When the caller last read the section, as a SQL expression; the `seen_at`
+   * argument is the fallback.
+   */
+  readonly readAt?: string;
+}
+/** What the contributing block adds to the subject functions. */
+interface SubjectContribution {
+  /** A section `record_summary` counts. */
+  readonly summary?: SummarySection;
+  /**
+   * A `my_work` branch selecting `kind, subject_type, subject_id, ref, title,
+   * at`; `my_work.tenant` filters by organization and `v_me` is the caller.
+   */
+  readonly work?: string;
+  /** Statements the subjects block adds ahead of `my_work`. */
+  readonly sql?: string;
+}
+//#endregion
+//#region src/config/generator-metadata.d.ts
+/**
+ * A copy of `@supabase/postgrest-typegen`'s `GeneratorMetadata` contract
+ * (version 1), so the published types don't reference the package: it is an
+ * optional peer that only the CLI loads.
+ * `tests/config/generator-metadata.test-d.ts` checks the copy against the
+ * pinned version.
+ */
+interface PostgresColumn {
+  table_id: number;
+  schema: string;
+  table: string;
+  id: string;
+  ordinal_position: number;
+  name: string;
+  default_value: unknown;
+  data_type: string;
+  format: string;
+  type_schema: string;
+  is_identity: boolean;
+  identity_generation: "ALWAYS" | "BY DEFAULT" | null;
+  is_generated: boolean;
+  is_nullable: boolean;
+  is_updatable: boolean;
+  is_unique: boolean;
+  enums: string[];
+  check: string | null;
+  comment: string | null;
+}
+interface PostgresFunctionArg {
+  mode: "in" | "inout" | "out" | "table" | "variadic";
+  name: string;
+  type_id: number;
+  has_default: boolean | null;
+}
+interface PostgresFunction {
+  id: number;
+  schema: string;
+  name: string;
+  language: string;
+  definition: string;
+  complete_statement: string;
+  args: PostgresFunctionArg[];
+  argument_types: string;
+  identity_argument_types: string;
+  return_type_id: number;
+  return_type: string;
+  return_type_relation_id: number | null;
+  is_set_returning_function: boolean;
+  prorows: number | null;
+  behavior: "IMMUTABLE" | "STABLE" | "VOLATILE";
+  security_definer: boolean;
+  config_params: {
+    [x: string]: string;
+  } | null;
+}
+/**
+ * A reference to a `types` entry by oid; `null` names when it is not in
+ * `types`.
+ */
+interface RpcTypeReference {
+  type_id: number;
+  format: string | null;
+  type_schema: string | null;
+}
+interface RpcFunctionArg extends RpcTypeReference {
+  name: string;
+  mode: "in" | "inout" | "variadic";
+  has_default: boolean;
+  relation_id: number | null;
+}
+interface RpcReturnColumn extends RpcTypeReference {
+  name: string;
+}
+interface RpcFunctionReturns extends RpcTypeReference {
+  relation_id: number | null;
+  columns: RpcReturnColumn[] | null;
+}
+interface RpcFunctionOverload {
+  function_id: number;
+  args: RpcFunctionArg[];
+  returns: RpcFunctionReturns;
+  is_set_returning: boolean;
+  rows_estimate: number | null;
+  setof_options: {
+    from: string;
+    to: string;
+    is_one_to_one: boolean;
+    is_setof_return: boolean;
+  } | null;
+  computed_field_of: number | null;
+  error: string | null;
+}
+/** A function PostgREST exposes under `/rpc`, with its overloads resolved. */
+interface RpcFunction {
+  schema: string;
+  name: string;
+  overloads: RpcFunctionOverload[];
+}
+interface GeneratorMetadata {
+  version: 1;
+  schemas: {
+    id: number;
+    name: string;
+    owner: string;
+  }[];
+  tables: {
+    bytes: number;
+    comment: string | null;
+    dead_rows_estimate: number;
+    id: number;
+    live_rows_estimate: number;
+    name: string;
+    replica_identity: "DEFAULT" | "FULL" | "INDEX" | "NOTHING";
+    rls_enabled: boolean;
+    rls_forced: boolean;
+    schema: string;
+    size: string;
+  }[];
+  foreignTables: {
+    comment: string | null;
+    id: number;
+    name: string;
+    schema: string;
+  }[];
+  views: {
+    comment: string | null;
+    id: number;
+    is_insert_enabled?: boolean | undefined;
+    is_updatable: boolean;
+    is_update_enabled?: boolean | undefined;
+    name: string;
+    schema: string;
+  }[];
+  materializedViews: {
+    comment: string | null;
+    id: number;
+    is_populated: boolean;
+    name: string;
+    schema: string;
+  }[];
+  columns: PostgresColumn[];
+  primaryKeys: {
+    schema: string;
+    table_name: string;
+    name: string;
+    table_id: number;
+  }[];
+  relationships: {
+    foreign_key_name: string;
+    schema: string;
+    relation: string;
+    columns: string[];
+    is_one_to_one: boolean;
+    referenced_schema: string;
+    referenced_relation: string;
+    referenced_columns: string[];
+  }[];
+  functions: PostgresFunction[];
+  types: {
+    id: number;
+    name: string;
+    schema: string;
+    format: string;
+    enums: string[];
+    attributes: {
+      name: string;
+      type_id: number;
+    }[];
+    comment: string | null;
+    type_relation_id: number | null;
+  }[];
+  /**
+   * Derived from `functions`; generators resolve it themselves when it is
+   * absent, which is how better-supabase stores metadata.
+   */
+  rpcFunctions?: RpcFunction[] | undefined;
+}
+//#endregion
+//#region src/config/snapshot.d.ts
+/**
+ * What `better-supabase gen --save-snapshot` reads from Postgres. `generator`
+ * is the `@supabase/postgrest-typegen` contract (the same metadata behind
+ * `supabase gen types`); `extras` holds what that contract leaves out. Codegen
+ * and doctor both work from this snapshot, so either can run offline from a
+ * saved file.
+ */
+interface Snapshot {
+  readonly $schema?: string;
+  readonly version: 2;
+  /** Every schema that was read, including helper schemas for doctor. */
+  readonly schemas: readonly string[];
+  readonly generator: GeneratorMetadata;
+  readonly extras: SnapshotExtras;
+}
+/** Catalog details `GeneratorMetadata` does not carry. */
+interface SnapshotExtras {
+  readonly tables: readonly ExtrasTable[];
+  readonly buckets: readonly SnapshotBucket[];
+  /** Tables in the `supabase_realtime` publication, as `schema.table`. */
+  readonly realtime: readonly string[];
+  /**
+   * `alter role ... set` values for the Data API roles (`authenticator`), such
+   * as `pgrst.db_aggregates_enabled`. Absent in older snapshots.
+   */
+  readonly roleSettings?: Readonly<Record<string, Readonly<Record<string, string>>>>;
+  /**
+   * Functions that policies in the read schemas call, plus functions in those
+   * schemas with `set` options. Absent in older snapshots.
+   */
+  readonly functions?: readonly ExtrasFunction[];
+  /**
+   * The Postgres functions `supabase/config.toml` configures as Auth hooks, in
+   * any schema. Absent in older snapshots and without a `config.toml`.
+   */
+  readonly hooks?: readonly ExtrasHook[];
+  /**
+   * Comments of the functions in the read schemas that carry a gen tag
+   * (`@notNull`), keyed by `schema.name(signature)`. Absent when none do.
+   */
+  readonly functionComments?: Readonly<Record<string, string>>;
+  /**
+   * Domains that the read schemas' functions take or return, with their base
+   * type. Typegen leaves them `unknown`; `gen` types them by the base type, and
+   * a `returns table` column of a NOT NULL domain is never null. Absent when no
+   * function uses a domain.
+   */
+  readonly domains?: readonly ExtrasDomain[];
+  /**
+   * Set when the snapshot comes from a `GeneratorMetadata` document alone (`gen
+   * --metadata`): unique keys, checks and foreign keys are inferred from the
+   * columns and relationships, and the rest is empty, so doctor skips the rules
+   * that read it.
+   */
+  readonly fromMetadata?: true;
+}
+interface ExtrasDomain {
+  readonly schema: string;
+  readonly name: string;
+  /** The base type's name (`uuid`, `_text`). */
+  readonly baseType: string;
+  readonly baseSchema: string;
+  /** Declared `not null`. */
+  readonly notNull: boolean;
+}
+/** An `[auth.hook.<name>]` with a `pg-functions://` URI. */
+interface ExtrasHook {
+  /** `custom_access_token`, `send_email`, ... */
+  readonly hook: string;
+  readonly schema: string;
+  readonly name: string;
+  /** Every overload with that name; empty when the function does not exist. */
+  readonly functions: readonly ExtrasHookFunction[];
+}
+interface ExtrasHookFunction extends ExtrasFunction {
+  /**
+   * Of `supabase_auth_admin`, `authenticated` and `anon`, the roles that may
+   * execute it (directly or through `public`).
+   */
+  readonly execute: readonly string[];
+  /** Whether `public` may execute it (the default until revoked). */
+  readonly publicExecute: boolean;
+  /** Of the same roles, those with `usage` on its schema. */
+  readonly schemaUsage: readonly string[];
+  /** The function body (`pg_proc.prosrc`). Absent in snapshots that predate it. */
+  readonly source?: string;
+}
+/** A function as doctor needs it for RLS checks, in any schema. */
+interface ExtrasFunction {
+  readonly schema: string;
+  readonly name: string;
+  /** Identity arguments, e.g. `organization uuid`. */
+  readonly signature: string;
+  /** `sql`, `plpgsql`, `c`, ... */
+  readonly language: string;
+  readonly volatility: "immutable" | "stable" | "volatile";
+  readonly securityDefiner: boolean;
+  /** `set` options, e.g. `{ statement_timeout: '5s' }`. */
+  readonly settings: Readonly<Record<string, string>>;
+  /**
+   * Which of `anon` and `authenticated` may execute it. Absent in older
+   * snapshots.
+   */
+  readonly execute?: readonly string[];
+}
+interface ExtrasTable {
+  /** Table oid, matching `GeneratorMetadata.tables[].id`. */
+  readonly id: number;
+  readonly schema: string;
+  readonly name: string;
+  /** Primary key columns in key order. */
+  readonly primaryKey: readonly string[];
+  readonly uniques: readonly CatalogUnique[];
+  readonly foreignKeys: readonly {
+    readonly name: string;
+    readonly onDelete: ForeignKeyAction;
+    readonly onUpdate: ForeignKeyAction;
+  }[];
+  readonly checks: readonly CatalogCheck[];
+  readonly indexes: readonly CatalogIndex[];
+  readonly policies: readonly CatalogPolicy[];
+  readonly triggers: readonly CatalogTrigger[];
+  readonly grants: readonly CatalogGrant[];
+  /** Absent in snapshots taken before column grants were introspected. */
+  readonly columnGrants?: readonly CatalogColumnGrant[];
+  /**
+   * Postgres estimates at least `LARGE_TABLE_ROWS` rows; the `unbounded-read`
+   * lint reads it.
+   */
+  readonly large?: true;
+  /** The partitioned parent as `schema.name`, when the table is a partition. */
+  readonly partitionOf?: string;
+}
+type ForeignKeyAction = "no action" | "restrict" | "cascade" | "set null" | "set default";
+interface CatalogUnique {
+  readonly name: string;
+  readonly columns: readonly string[];
+}
+interface CatalogCheck {
+  readonly name: string;
+  readonly definition: string;
+}
+interface CatalogIndex {
+  readonly name: string;
+  readonly columns: readonly string[];
+  readonly unique: boolean;
+  readonly primary: boolean;
+  readonly partial: boolean;
+  /** Access method (`btree`, `gin`, `gist`, ...). Absent in older snapshots. */
+  readonly method?: string;
+  /**
+   * The `where` of a partial index, as Postgres prints it. Absent in older
+   * snapshots.
+   */
+  readonly predicate?: string | null;
+}
+interface CatalogPolicy {
+  readonly name: string;
+  readonly command: "all" | "select" | "insert" | "update" | "delete";
+  readonly roles: readonly string[];
+  readonly permissive: boolean;
+  readonly using: string | null;
+  readonly check: string | null;
+  /**
+   * Functions the policy expressions call, as `schema.name`, from `pg_depend`.
+   * Absent in older snapshots.
+   */
+  readonly functions?: readonly string[];
+}
+interface CatalogTrigger {
+  readonly name: string;
+  readonly timing: "before" | "after" | "instead of";
+  readonly events: readonly ("insert" | "update" | "delete" | "truncate")[];
+  readonly level: "row" | "statement";
+  readonly function: string;
+  /** The `create trigger` arguments, when there are any. */
+  readonly args?: readonly string[];
+  /**
+   * The function's body, only for functions that call `realtime.send()` or
+   * `realtime.broadcast_changes()`, other than `broadcast_topic()`.
+   */
+  readonly source?: string;
+  /** The function's comment, for the same functions as `source`. */
+  readonly comment?: string;
+}
+interface CatalogGrant {
+  readonly role: string;
+  readonly privileges: readonly string[];
+}
+/**
+ * A column-level `select`, `insert` or `update` grant to `anon` or
+ * `authenticated`.
+ */
+interface CatalogColumnGrant {
+  readonly column: string;
+  readonly role: string;
+  readonly privileges: readonly string[];
+}
+interface SnapshotBucket {
+  readonly id: string;
+  readonly public: boolean;
+  readonly fileSizeLimit: number | null;
+  readonly allowedMimeTypes: readonly string[] | null;
+  /** `versioning_status`; absent when Storage has no versioning. */
+  readonly versioning?: "DISABLED" | "ENABLED" | "SUSPENDED" | null;
+  /** `lifecycle_configuration`; absent when Storage has no lifecycles. */
+  readonly lifecycle?: unknown;
+}
+/**
+ * The snapshot joined into one record per table, function and enum. Codegen and
+ * doctor read this view rather than the raw snapshot.
+ */
+interface Catalog {
+  readonly schemas: readonly string[];
+  readonly tables: readonly CatalogTable[];
+  readonly enums: readonly CatalogEnum[];
+  readonly functions: readonly CatalogFunction[];
+  readonly buckets: readonly SnapshotBucket[];
+  readonly realtime: readonly string[];
+}
+interface CatalogTable {
+  readonly id: number;
+  readonly schema: string;
+  readonly name: string;
+  /** Materialized views count as views; foreign tables as tables. */
+  readonly kind: "table" | "view";
+  readonly rls: boolean;
+  readonly forceRls: boolean;
+  readonly replicaIdentity: "DEFAULT" | "INDEX" | "FULL" | "NOTHING" | null;
+  /** Inserts work (always true for tables). */
+  readonly insertable: boolean;
+  /** Updates work (always true for tables). */
+  readonly updatable: boolean;
+  readonly comment: string | null;
+  readonly columns: readonly CatalogColumn[];
+  readonly primaryKey: readonly string[];
+  readonly uniques: readonly CatalogUnique[];
+  readonly foreignKeys: readonly CatalogForeignKey[];
+  readonly checks: readonly CatalogCheck[];
+  readonly indexes: readonly CatalogIndex[];
+  readonly policies: readonly CatalogPolicy[];
+  readonly triggers: readonly CatalogTrigger[];
+  readonly grants: readonly CatalogGrant[];
+  /** Absent in snapshots taken before column grants were introspected. */
+  readonly columnGrants?: readonly CatalogColumnGrant[];
+  /** The partitioned parent as `schema.name`, when the table is a partition. */
+  readonly partitionOf?: string;
+}
+interface CatalogColumn {
+  readonly name: string;
+  /** Type name; the element type for arrays (`uuid`, `int8`, `note_kind`). */
+  readonly udt: string;
+  /** Raw type name as Postgres reports it (`_text` for `text[]`). */
+  readonly format: string;
+  readonly typeSchema: string;
+  readonly isArray: boolean;
+  readonly isEnum: boolean;
+  readonly nullable: boolean;
+  readonly hasDefault: boolean;
+  readonly default: string | null;
+  readonly identity: "always" | "by default" | null;
+  readonly generated: boolean;
+  readonly updatable: boolean;
+  readonly comment: string | null;
+}
+interface CatalogForeignKey {
+  readonly name: string;
+  readonly columns: readonly string[];
+  readonly refSchema: string;
+  readonly refTable: string;
+  readonly refColumns: readonly string[];
+  readonly oneToOne: boolean;
+  readonly onDelete: ForeignKeyAction;
+  readonly onUpdate: ForeignKeyAction;
+}
+interface CatalogEnum {
+  readonly schema: string;
+  readonly name: string;
+  readonly values: readonly string[];
+}
+interface CatalogFunction {
+  readonly schema: string;
+  readonly name: string;
+  /** Signature that tells overloads apart, e.g. `a integer, b text`. */
+  readonly signature: string;
+  readonly args: readonly CatalogFunctionArg[];
+  /** Columns for `returns table (...)` functions. */
+  readonly returnsTable: readonly {
+    readonly name: string;
+    readonly udt: string;
+    /** Schema of the column's type, when typegen knows it. */
+    readonly typeSchema?: string;
+    /** The column's type is a NOT NULL domain. */
+    readonly notNull?: true;
+  }[] | null;
+  /** Return type name (`int4`, `_text`, a table's row type). */
+  readonly returns: string;
+  /** Schema of the return type, when typegen knows it. */
+  readonly returnsSchema?: string;
+  /** `schema.table` when the function returns rows of a table or view. */
+  readonly returnsRelation: string | null;
+  readonly returnsSet: boolean;
+  readonly volatility: "immutable" | "stable" | "volatile";
+  readonly securityDefiner: boolean;
+  readonly language: string;
+  /** `search_path` from `SET search_path`, or `null` when unset. */
+  readonly searchPath: string | null;
+  /** The function's comment, when it carries a gen tag such as `@notNull`. */
+  readonly comment?: string;
+}
+interface CatalogFunctionArg {
+  readonly name: string;
+  readonly udt: string;
+  /** Schema of the argument's type, when typegen knows it. */
+  readonly typeSchema?: string;
+  readonly isArray: boolean;
+  readonly hasDefault: boolean;
+}
+//#endregion
+//#region src/config/types/app-tables.d.ts
+/**
+ * The column types an app table may use. Money is a `bigint` of minor units
+ * next to a `text` currency column (ADR 0024 and 0037), never `numeric`.
+ */
+declare const APP_COLUMN_TYPES: readonly ["text", "uuid", "integer", "bigint", "numeric", "boolean", "timestamptz", "date", "jsonb", "text[]"];
+type AppColumnType = (typeof APP_COLUMN_TYPES)[number];
+/**
+ * What a reference does when the row it points at is deleted
+ * (`references.onDelete`).
+ */
+declare const APP_ON_DELETE_ACTIONS: readonly ["cascade", "restrict", "set null", "no action"];
+type AppOnDeleteAction = (typeof APP_ON_DELETE_ACTIONS)[number];
+/**
+ * What a column references: another app table, `auth.users` (`{ table:
+ * "auth.users" }`), or a logical table of an installed block (`{ block: "crm",
+ * table: "contacts" }`), which follows the block's renames.
+ */
+type AppReferenceTarget = {
+  readonly table: string;
+} | {
+  readonly block: string;
+  readonly table: string;
+};
+type AppReference = AppReferenceTarget & {
+  /** Defaults to `no action`. */
+  readonly onDelete?: AppOnDeleteAction;
+};
+/**
+ * What a column holds, beyond its Postgres type. `email`, `url`, `rating` and
+ * `percent` add a check; the others tell the UI and `gen` how to show the
+ * value. `FIELD_FORMATS` lists the types each fits and its input.
+ */
+declare const APP_COLUMN_FORMATS: typeof FIELD_FORMAT_NAMES;
+type AppColumnFormat = FieldFormatName;
+interface AppColumnConfig {
+  readonly type: AppColumnType;
+  /** Defaults to true. */
+  readonly nullable?: boolean;
+  /**
+   * The column default, from an allowlist: `now()`, `gen_random_uuid()`,
+   * `auth.uid()`, `true`, `false`, a number, a `'quoted'` text literal, and
+   * `'{}'` or `'[]'` for `jsonb` and `text[]`.
+   */
+  readonly default?: string;
+  readonly unique?: boolean;
+  readonly references?: AppReference;
+  /** What the column holds; see `APP_COLUMN_FORMATS`. */
+  readonly format?: AppColumnFormat;
+  /**
+   * The values a `text` column (single select) or each element of a `text[]`
+   * column (multi-select) may take, checked by the database.
+   */
+  readonly options?: readonly string[];
+  /** The smallest value of a number column, or the shortest `text`. */
+  readonly min?: number;
+  /** The largest value of a number column, or the longest `text`. */
+  readonly max?: number;
+  /** Rendered as `comment on column`. */
+  readonly comment?: string;
+  /**
+   * An `integer` or `bigint` the database numbers (`generated by default as
+   * identity`).
+   */
+  readonly identity?: boolean;
+  /**
+   * Who reaches the column, through column grants (ADR 0051). By default
+   * signed-in users read and write it, within the row's policies. `read` lets
+   * them read it while only the service role, triggers and defaults write it;
+   * `server` hides it from them, so only the service role reads and writes it.
+   */
+  readonly access?: AppColumnAccess;
+  /**
+   * Stores the column encrypted with the row's tenant (or user) data key from
+   * Supabase Vault, through the `field-encryption` block. Signed-in users write
+   * plaintext and never select the column; they read it through
+   * `public.<table>_reveal(ids)`, which checks the row's policy and decrypts.
+   * It can't be unique, a reference, an identity, indexed or searched.
+   */
+  readonly encrypted?: boolean;
+}
+declare const APP_COLUMN_ACCESS: readonly ["read", "server"];
+type AppColumnAccess = (typeof APP_COLUMN_ACCESS)[number];
+/**
+ * A table the app owns, created in `public` by `better-supabase upgrade` next
+ * to the block files. Every table gets `id`, the scope column and (unless
+ * `timestamps: false`) `created_at` and `updated_at`.
+ */
+interface AppTableConfig {
+  /** The table's own columns, keyed by lower snake name. */
+  readonly columns?: Readonly<Record<string, AppColumnConfig>>;
+  /**
+   * Who reaches a row. `inherit` (the default) follows `sql.scope`: per tenant,
+   * members of the row's tenant; per user, the row's user. `user` keeps rows
+   * per user in any scope, and `none` lets signed-in users read every row while
+   * only the service role writes.
+   */
+  readonly scope?: "inherit" | "user" | "none";
+  /** `created_at` and `updated_at`. Defaults to true. */
+  readonly timestamps?: boolean;
+  /**
+   * The id's type: `uuid` (the default, `gen_random_uuid()`) or `bigint` (an
+   * identity). A reference to the table needs a column of the same type.
+   */
+  readonly id?: "uuid" | "bigint";
+  /** Sets of columns that are unique together, each a unique constraint. */
+  readonly unique?: readonly (readonly string[])[];
+  /**
+   * Sets of columns to index, in order. Reference and scope columns already
+   * have one.
+   */
+  readonly indexes?: readonly (readonly string[])[];
+  /** Rendered as `comment on table`. */
+  readonly comment?: string;
+  /**
+   * Registers the table as a subject (ADR 0043), so blocks that attach rows to
+   * subjects (comments, attachments, tags, versions, search and others) reach
+   * its rows without a `subjects` entry.
+   */
+  readonly subject?: AppTableSubject;
+  /**
+   * Values computed from the rows of another app table that references this
+   * one, keyed by the column name they get in `public.<table>_view` (ADR
+   * 0044).
+   */
+  readonly rollups?: Readonly<Record<string, AppRollupConfig>>;
+  /**
+   * Columns of the row a reference points at, keyed by the column name they get
+   * in `public.<table>_view` (ADR 0044).
+   */
+  readonly lookups?: Readonly<Record<string, AppLookupConfig>>;
+  /**
+   * Emits an outbox event for each insert, update and delete (ADR 0048):
+   * `<subject type or table>.created`, `.updated` and `.deleted`. Needs the
+   * `outbox` block.
+   */
+  readonly events?: true | AppTableEvents;
+  /**
+   * Writes an audit log entry in the `read` category for each call of
+   * `public.<table>_reveal`: who read which rows and when, one entry per tenant
+   * per call. Needs an `encrypted` column and the `audit` block.
+   */
+  readonly auditReads?: boolean;
+}
+declare const APP_TABLE_EVENT_KINDS: readonly ["created", "updated", "deleted"];
+type AppTableEventKind = (typeof APP_TABLE_EVENT_KINDS)[number];
+/** Which writes emit an event and which column values its payload carries. */
+interface AppTableEvents {
+  /** Defaults to all three. */
+  readonly on?: readonly AppTableEventKind[];
+  /**
+   * Columns whose values go in the payload. By default it holds the row id and,
+   * for updates, the names of the changed columns.
+   */
+  readonly include?: readonly string[];
+}
+declare const APP_ROLLUP_AGGREGATES: readonly ["count", "sum", "min", "max", "avg"];
+type AppRollupAggregate = (typeof APP_ROLLUP_AGGREGATES)[number];
+/**
+ * An aggregate over the rows of `table` whose `via` column references this
+ * table: `{ table: "tasks", via: "project_id", aggregate: "count" }`.
+ */
+interface AppRollupConfig {
+  /** The app table whose rows are aggregated. */
+  readonly table: string;
+  /** The column of `table` that references this table. */
+  readonly via: string;
+  /** `sum` of no rows is 0; `min`, `max` and `avg` of no rows are null. */
+  readonly aggregate: AppRollupAggregate;
+  /**
+   * The column of `table` the aggregate reads: a number for `sum` and `avg`, a
+   * number, date, time or text for `min` and `max`. `count` takes none and
+   * counts rows.
+   */
+  readonly column?: string;
+  /**
+   * Only the rows whose select column (a `text` column with `options`) holds
+   * `equals`.
+   */
+  readonly where?: {
+    readonly column: string;
+    readonly equals: string;
+  };
+}
+/** The `column` of the app table row that this table's `via` column references. */
+interface AppLookupConfig {
+  /** A column of this table that references another app table. */
+  readonly via: string;
+  /** A column of the referenced table. */
+  readonly column: string;
+}
+/**
+ * The subject an app table registers. The table, id type and tenant column come
+ * from the table itself.
+ */
+interface AppTableSubject {
+  /** The subject type, lowercase letters, digits and underscores. */
+  readonly type: string;
+  /** The column `subject_title` returns. */
+  readonly title?: string;
+  /**
+   * The path `subject_url` returns, with `{column}` placeholders:
+   * `/projects/{id}`.
+   */
+  readonly url?: string;
+  /** The columns a search index reads. */
+  readonly search?: {
+    readonly title?: string;
+    readonly body?: readonly string[];
+  };
+  /**
+   * A permission key per action that `can_subject` checks; see
+   * `SubjectConfig.permissions`.
+   */
+  readonly permissions?: Readonly<Record<string, string>>;
+  /**
+   * Adds a `rank text collate "C"` column for `move()` (ADR 0021), ordered
+   * within `group` when set.
+   */
+  readonly rank?: true | {
+    readonly group?: string;
+  };
+  /**
+   * Adds a `deleted_at timestamptz` column that blocks treat as the soft-delete
+   * time.
+   */
+  readonly softDelete?: boolean;
+  /**
+   * Registers the table with the versions block: `true` snapshots every column
+   * of the table on each change; `columns` and `auto` narrow it.
+   */
+  readonly versions?: true | AppTableVersions;
+}
+/** What the versions block keeps of an app table's rows. */
+interface AppTableVersions {
+  /**
+   * The columns a snapshot copies and a restore writes back; every column of
+   * the table by default.
+   */
+  readonly columns?: readonly string[];
+  /** Snapshot on each change to `columns`, debounced; `true` by default. */
+  readonly auto?: boolean;
+}
+type AppTablesConfig = Readonly<Record<string, AppTableConfig>>;
+//#endregion
+//#region src/sql/audit-registrations.d.ts
+/** A table registered with `better_supabase.audit(...)` in a SQL file. */
+interface AuditedTable {
+  /** `schema.table`, unquoted; an unqualified name is in `public`. */
+  readonly target: string;
+  readonly ignore: readonly string[];
+  readonly redact: readonly string[];
+}
+/**
+ * The tables `files` register with `better_supabase.audit(...)` or a static
+ * `create trigger bsb_audit ... execute function
+ * better_supabase.audit_row_change('{...}')`, in file order: a later
+ * registration for the same table replaces the earlier one, and `unaudit(...)`
+ * or a `drop table` removes it. Calls with non-literal arguments are skipped.
+ */
+declare function auditRegistrations(files: readonly {
+  readonly text: string;
+}[]): AuditedTable[];
+//#endregion
+//#region src/sql/foreign-keys.d.ts
+/** A foreign key the schema files declare. */
+interface DeclaredForeignKey {
+  /** `schema.table`, unquoted. */
+  readonly table: string;
+  readonly columns: readonly string[];
+  /** The referenced `schema.table`, unquoted. */
+  readonly references: string;
+  /**
+   * The referenced columns. Without a column list, the referenced table's
+   * declared primary key, or `id` when the files don't declare one.
+   */
+  readonly referencedColumns: readonly string[];
+}
+/**
+ * The layout fields `blocks.memberships.options.sameTenant.auto` derives its
+ * entries from.
+ */
+declare function sameTenantLayout(files: readonly {
+  readonly text: string;
+}[], schemas: readonly string[]): Required<Pick<BlockSqlLayout, "foreignKeys" | "declaredColumns">>;
+//#endregion
+//#region src/config/defaults.d.ts
+/**
+ * Every default `resolveConfig` fills in. Other modules (the SQL module
+ * registry, the CLI) read their fallbacks from here instead of repeating the
+ * literals.
+ */
+declare const CONFIG_DEFAULTS: {
+  readonly output: string;
+  readonly schemas: readonly string[];
+  readonly casing: "snake";
+  readonly postgrestVersion: string;
+  readonly codecs: {
+    readonly timestamptz: "string";
+    readonly int8: "number";
+    readonly numeric: "number";
+  };
+  readonly sql: {
+    readonly dir: string;
+    readonly prefix: string;
+    readonly testsDir: string;
+  };
+  readonly seed: {
+    readonly entry: string;
+    readonly output: string;
+    readonly perTenant: string;
+  };
+  readonly openapi: {
+    readonly entry: string;
+    readonly output: string;
+  };
+  readonly specs: {
+    readonly failOn: "error";
+  };
+  readonly doctor: {
+    readonly format: "text";
+    readonly sources: readonly string[];
+    readonly policyHelperLimit: number;
+  };
+  readonly gen: {
+    readonly watchInterval: number;
+  };
+  readonly env: {
+    readonly output: string;
+  };
+};
+//#endregion
+//#region src/preset/presets.d.ts
+/** Where a named preset sits in the `/create` and `init` pickers. */
+type PresetGroup = "starters" | "products" | "verticals" | "ai" | "platforms" | "everything";
+/** The preset groups in display order, with their headings. */
+declare const PRESET_GROUPS: Readonly<Record<PresetGroup, string>>;
+/** A named starting point: a block selection with the default conventions. */
+interface NamedPreset {
+  readonly name: string;
+  readonly title: string;
+  readonly description: string;
+  readonly group: PresetGroup;
+  /** The blocks it selects; `resolvePreset` adds what they require. */
+  readonly blocks: readonly string[];
+  /** The conventions it sets over the defaults, such as a user scope. */
+  readonly conventions?: Partial<PresetConventions>;
+  /** The `blocks` entries it writes: its nouns and extra instances. */
+  readonly instances?: Preset["instances"];
+}
+/** A named preset's name. */
+type PresetName = "minimal" | "saas" | "consumer" | "crm" | "projects" | "helpdesk" | "chat" | "commerce" | "cms" | "erp" | "pim" | "marketplace" | "scheduling" | "people" | "drive" | "docs" | "invoicing" | "forms" | "property" | "field-service" | "clinic" | "lms" | "events" | "legal" | "spend" | "contracts" | "customer-success" | "logistics" | "pos" | "fitness" | "nonprofit" | "itsm" | "compliance" | "construction" | "claims" | "community" | "feedback" | "ai" | "ai-chat" | "ai-agents" | "developer-api" | "automation" | "enterprise" | "admin" | "everything";
+/** The named presets, for `defineConfig({ preset })` and `/create`. */
+declare const PRESETS: Readonly<Record<PresetName, NamedPreset>>;
+/** The named presets in display order, grouped by `group`. */
+declare const PRESET_NAMES: readonly PresetName[];
+declare function isPresetName(value: unknown): value is PresetName;
+/** The named preset as a `Preset`: the default conventions, then its own. */
+declare function namedPreset(name: PresetName): Preset;
+/** The preset `/create` and `init` start from. */
+declare const DEFAULT_PRESET_NAME: "saas";
+/** The default preset as a `Preset`, so a new design can start from it. */
+declare function defaultPreset(): Preset;
+//#endregion
+//#region src/preset/spec.d.ts
+/**
+ * A preset written out: the conventions that differ from the defaults and the
+ * selected blocks. It is what the config's `preset` key and a design's `preset`
+ * key hold when the selection isn't a named preset.
+ */
+type PresetSpec = Partial<PresetConventions> & {
+  readonly blocks?: readonly string[];
+  readonly instances?: Readonly<Record<string, PresetInstance>>;
+};
+/**
+ * The preset as the config or a design writes it: its name when it is a named
+ * preset as it ships, otherwise the conventions that differ from the defaults
+ * and the selected blocks.
+ */
+declare function presetSpec(preset: Preset): PresetName | PresetSpec;
+/**
+ * Reads a preset object (`PresetSpec`) into a `Preset`, with the conventions it
+ * leaves out at their defaults. Throws a TypeError naming the first key or
+ * value that isn't one.
+ */
+declare function presetFromSpec(value: unknown): Preset;
+/** A preset name or object as a `Preset`. */
+declare function presetOfSpec(value: unknown): Preset;
+//#endregion
+//#region src/config/expose.d.ts
+/** A privilege the Data API roles can be granted on a table or view. */
+type Privilege = "select" | "insert" | "update" | "delete";
+type ColumnPrivilege = `${"select" | "insert" | "update"}(${string})`;
+type ExposePrivilege = Privilege | ColumnPrivilege;
+/** A role the `grants` module writes privileges for. */
+type ExposeRole = "anon" | "authenticated" | "service_role";
+/**
+ * Data API grants for one table: privileges for `authenticated`, or per role.
+ * `serviceRole` defaults to every privilege. For a function, keyed by its
+ * signature (`search_notes(text, integer)`), `execute` lists the roles that may
+ * call it; `service_role` is added unless `serviceRole` is false.
+ */
+type ExposeConfig = readonly ExposePrivilege[] | {
+  readonly anon?: readonly ExposePrivilege[];
+  readonly authenticated?: readonly ExposePrivilege[];
+  readonly serviceRole?: readonly ExposePrivilege[];
+} | {
+  readonly execute: readonly ("anon" | "authenticated")[];
+  readonly serviceRole?: boolean;
+};
+/** Resolved grants for one table. */
+interface ResolvedExpose {
+  readonly anon: readonly ExposePrivilege[];
+  readonly authenticated: readonly ExposePrivilege[];
+  readonly serviceRole: readonly ExposePrivilege[];
+}
+//#endregion
+//#region src/config/types/database.d.ts
+interface BucketConfig {
+  readonly id?: string;
+  readonly public?: boolean;
+  /**
+   * Path template with `{placeholders}`, e.g.
+   * `{organizationId}/{customerId}/logo.webp`, or several when the bucket
+   * stores objects in more than one layout. A last segment `{...rest}` matches
+   * one or more segments.
+   */
+  readonly path: string | readonly [string, ...string[]];
+  /** Generated storage policy, or an access contract policy (`{ access }`). */
+  readonly policy?: BucketPolicyName | AccessBucketPolicy;
+  readonly fileSizeLimit?: string;
+  readonly allowedMimeTypes?: readonly string[];
+  /**
+   * Keep earlier object versions. `bucket.apply()` sets it; doctor (BS302)
+   * compares it.
+   */
+  readonly versioning?: boolean;
+  /** When noncurrent versions expire. Needs `versioning: true`. */
+  readonly lifecycle?: BucketLifecycle;
+}
+/**
+ * How the SQL modules reach the database: `pg-delta` (Supabase Declarative
+ * Schemas 2.0, `supabase db schema declarative sync`), `migra` (declarative
+ * schemas 1.0, `supabase db diff`) or `migrations` (no declarative schemas: the
+ * `sql` commands write the modules into a migration).
+ */
+type SqlWorkflow = "pg-delta" | "migra" | "migrations";
+interface SqlConfig {
+  /**
+   * The workflow. Unset, better-supabase reads `supabase/config.toml`: pg-delta
+   * when it enables it or nothing says otherwise, migra when it turns pg-delta
+   * off or the project keeps migra's declarative schemas.
+   */
+  readonly workflow?: SqlWorkflow;
+  /** Directory declarative schema files are written to. */
+  readonly dir?: string;
+  /** File name prefix, so generated files sort after yours. */
+  readonly prefix?: string;
+  /** Directory pgTAP files (the `pgtap` module) are written to. */
+  readonly testsDir?: string;
+  /**
+   * The schema every module writes its functions and managed tables to, unless
+   * `blocks.<name>.schema` sets its own. Defaults to `better_supabase`.
+   */
+  readonly schema?: string;
+  /**
+   * The Data API schema, such as `api`, every module writes its `security
+   * invoker` wrappers to, unless `blocks.<name>.api` sets its own or `false`.
+   */
+  readonly api?: string;
+  /**
+   * Who a block's rows belong to, unless `blocks.<name>.owner` sets its own:
+   * `tenant` (a tenant, checked through the access contract; the default),
+   * `user` (the signed-in user, with no tenants) or `none` (one shared space
+   * every signed-in user reads and writes).
+   */
+  readonly scope?: BlockScope;
+}
+/** `sql` with defaults applied. */
+interface ResolvedSqlConfig {
+  /** Unset when the config leaves it to `supabase/config.toml`. */
+  readonly workflow?: SqlWorkflow;
+  readonly dir: string;
+  readonly prefix: string;
+  readonly testsDir: string;
+  /** Unset means `tenant`. */
+  readonly scope?: BlockScope;
+}
+interface SeedConfig {
+  /** Module exporting `defineSeed(...)` as `seed` or default. */
+  readonly entry?: string;
+  /** SQL file `better-supabase db seed` writes. Add it to `[db.seed] sql_paths`. */
+  readonly output?: string;
+  /**
+   * Module exporting `defineTenantSeed(...)` as `seed` or default.
+   * `better-supabase db seed --tenant <slug>` applies it to one tenant.
+   */
+  readonly perTenant?: string;
+}
+interface RealtimeConfig {
+  /**
+   * Tables that broadcast a change signal for live queries (`table` or
+   * `schema.table`). Tenant tables broadcast per tenant. Install the triggers
+   * with `better-supabase add realtime-tables`.
+   */
+  readonly tables?: readonly string[];
+  /**
+   * Tables in `tables` without a tenant column. They broadcast on one topic
+   * every signed-in user receives. With the `tenant` plugin, a table that lacks
+   * the tenant column and is not listed here fails to install.
+   */
+  readonly global?: readonly string[];
+  /**
+   * Tables in `tables` whose rows belong to one user: table to its user column
+   * (`{ notifications: "user_id" }`). They broadcast on a topic per user,
+   * `bsb:t:<schema>.<table>:u:<user id>`, which only that user receives,
+   * instead of the tenant's topic.
+   */
+  readonly users?: Readonly<Record<string, string>>;
+  /**
+   * Writes the `realtime.messages` policies of the topics that `from` exports
+   * (`defineTopic`) to `output`, a file in `supabase/schemas`, on
+   * `better-supabase upgrade`; `upgrade --check` fails when it is stale.
+   */
+  readonly policies?: TopicPoliciesConfig;
+  /**
+   * Broadcast triggers that `upgrade` writes to `policies.output` next to the
+   * policies, through the topic's `trigger()`, for topics that `policies.from`
+   * exports. A trigger with column values, one topic, a `keys` or `row` payload
+   * and one event name calls `better_supabase.broadcast_topic()` (the
+   * `realtime-tables` module); any other gets a generated function.
+   */
+  readonly triggers?: readonly TopicTriggerConfig[];
+}
+interface TopicTriggerLookupConfig {
+  readonly from: string;
+  readonly via: TopicTriggerValueConfig;
+  readonly select: string;
+  readonly key?: string;
+}
+type TopicTriggerValueConfig = string | TopicTriggerLookupConfig;
+type TopicTriggerPayloadValueConfig = TopicTriggerValueConfig | {
+  readonly sql: string;
+};
+interface TopicTriggerTopicConfig {
+  readonly topic: string;
+  readonly values?: Readonly<Record<string, TopicTriggerValueConfig>>;
+}
+/** One `realtime.triggers` entry: a table whose row changes go to a topic. */
+interface TopicTriggerConfig {
+  /** The template of a topic that `realtime.policies.from` exports. */
+  readonly topic: string;
+  /** `table` or `schema.table`. */
+  readonly table: string;
+  /**
+   * The column or lookup per placeholder. Defaults to the placeholder in
+   * snake_case. A row whose topic comes out null is not sent to it.
+   */
+  readonly values?: Readonly<Record<string, TopicTriggerValueConfig>>;
+  /** Defaults to all three. */
+  readonly events?: readonly ("insert" | "update" | "delete")[];
+  /**
+   * The broadcast event name, or one per operation (`{ insert: "created",
+   * delete: "deleted" }`). Defaults to the operation.
+   */
+  readonly event?: string | {
+    readonly insert?: string;
+    readonly update?: string;
+    readonly delete?: string;
+  };
+  /**
+   * `"keys"` (default) sends the primary key and the placeholder values.
+   * `"row"` sends the whole row, which bypasses column grants. An object is the
+   * payload itself: each key is a column, a lookup, or `{ sql }`, an expression
+   * on the row `{row}` (`tg_op` is the operation).
+   */
+  readonly payload?: "keys" | "row" | Readonly<Record<string, TopicTriggerPayloadValueConfig>>;
+  readonly topics?: readonly TopicTriggerTopicConfig[];
+  readonly functionSchema?: string;
+  /**
+   * `{ changed: ["status"] }` sends an UPDATE only when one of these columns
+   * changed. Inserts and deletes always send.
+   */
+  readonly when?: {
+    readonly changed: readonly string[];
+  };
+}
+/** `realtime.policies`: where topic policies come from and go. */
+interface TopicPoliciesConfig {
+  /** Modules that export `defineTopic` results. Node imports them. */
+  readonly from: readonly string[];
+  /** The SQL file to write, such as `supabase/schemas/905_topics.sql`. */
+  readonly output: string;
+}
+/**
+ * Pgvector distance: `<=>` (cosine), `<->` (l2) or `<#>` (negative inner
+ * product).
+ */
+type VectorDistance = "cosine" | "l2" | "inner_product";
+/** The embedding column, or the column and its distance (default `cosine`). */
+type VectorSearchConfig = string | {
+  readonly column: string;
+  readonly distance?: VectorDistance;
+  /** The column's pgvector type. Defaults to `vector`. */
+  readonly type?: "vector" | "halfvec";
+  /**
+   * The primary key column `db.$search({ score: true })` merges by.
+   * Defaults to `id`.
+   */
+  readonly key?: string;
+  /**
+   * Fuses a full-text ranking over a `tsvector` column with the vector
+   * ranking (reciprocal rank fusion), for `db.$search({ text })`.
+   */
+  readonly hybrid?: {
+    readonly tsvector: string;
+    /** The query's text search configuration. Defaults to `simple`. */
+    readonly config?: string;
+    /** The RRF constant. Defaults to 60. */
+    readonly k?: number;
+  };
+  /**
+   * A SQL expression over the row `t` the score is multiplied by, such as
+   * `t.priority`.
+   */
+  readonly boost?: string;
+  /** Columns `db.$search({ filter })` narrows before ranking. */
+  readonly prefilter?: readonly string[];
+  /**
+   * A SQL condition over the row `t` every candidate must meet, applied
+   * before ranking: ranges, a parent row, such as `t.expires_at > now() and
+   * exists (select 1 from public.folders f where f.id = t.folder_id and not
+   * f.disabled)`.
+   */
+  readonly predicate?: string;
+  /** How `boost` combines with the score: `multiply` (default) or `add`. */
+  readonly boostMode?: "multiply" | "add";
+  /**
+   * A SQL `order by` list over the row `t` that breaks score ties, such as
+   * `t.created_at desc`.
+   */
+  readonly order?: string;
+};
+//#endregion
+//#region src/config/types/entitlements.d.ts
+interface EntitlementsConfig {
+  /**
+   * `table.column` (or `schema.table.column`) holding each tenant's Stripe
+   * customer id, read by the `entitlements` SQL module. Required without the
+   * `organizations` module; with it, defaults to the `stripe_customer_id`
+   * column that module adds.
+   */
+  readonly customer?: string;
+  /** The tenant id column of that table. Defaults to `id`. */
+  readonly key?: string;
+  /**
+   * Where `has_entitlement` and `feature_claims` read memberships from.
+   * `"provider"` calls the authorization provider's `memberIds` and
+   * `memberIdsFor` functions; `"tenant"` reads `better_supabase.memberships`.
+   * Defaults to `"provider"` when `authorization` is set, else `"tenant"`.
+   */
+  readonly memberships?: "tenant" | "provider";
+  /**
+   * Where each tenant's entitlements come from. `"stripe-sync"` (the default)
+   * reads the Stripe Sync Engine's `stripe.active_entitlements` through
+   * `customer`. `{ plans }` reads a plan catalog: the tenant's active
+   * subscription and the features its plan includes. `"custom"` leaves
+   * `better_supabase.tenant_entitlements(tenant)` to you; the module writes the
+   * checks and the claim over it.
+   */
+  readonly source?: "stripe-sync" | "custom" | EntitlementPlansSource;
+  /**
+   * The shape of the features claim `feature_claims` writes, which every token
+   * carries. `false` writes `{}` (check entitlements in SQL with
+   * `has_entitlement` only); `maxTenants` keeps at most that many tenants;
+   * `keys` writes short codes instead of the feature keys. Pass the same `keys`
+   * to `hasEntitlement`.
+   */
+  readonly claim?: false | {
+    readonly maxTenants?: number;
+    readonly keys?: Readonly<Record<string, string>>;
+  };
+}
+/** `entitlements.source.plans`: a plan catalog in your own tables. */
+interface EntitlementPlansSource {
+  readonly plans: {
+    readonly subscriptions: {
+      /** `table` or `schema.table`. */
+      readonly table: string;
+      /** The tenant id column. */
+      readonly tenant: string;
+      /** The plan key column. */
+      readonly plan: string;
+      /** A status column; with it, only rows in `activeStatuses` count. */
+      readonly status?: string;
+      /** Defaults to `["active", "trialing"]`. */
+      readonly activeStatuses?: readonly string[];
+    };
+    readonly features: {
+      /** `table` or `schema.table`. */
+      readonly table: string;
+      /** The plan key column. */
+      readonly plan: string;
+      /** The feature key column: what `has_entitlement` and the claim name. */
+      readonly feature: string;
+      /** A boolean column; with it, only included features count. */
+      readonly included?: string;
+      /**
+       * A column with the feature's value (a number, text or jsonb), such as a
+       * limit, that `tenant_entitlement_value` returns.
+       */
+      readonly value?: string;
+    };
+  };
+}
+//#endregion
+//#region src/config/types/groups.d.ts
+interface LegacyBlockKeys {
+  readonly mode?: unknown;
+  readonly scope?: unknown;
+  readonly entities?: unknown;
+  readonly hooks?: unknown;
+}
+/**
+ * One `blocks.<name>` entry as the config writes it: the block settings with
+ * `ownership`, `owner`, `names` and `callbacks`.
+ */
+type BlockInput<T extends LegacyBlockKeys> = Omit<T, keyof LegacyBlockKeys> & {
+  /**
+   * Who owns the block's tables: `managed` (better-supabase writes them, the
+   * default), `adopt` (your tables, mapped through `tables` and `columns`) or
+   * `custom` (your functions behind the block's contract).
+   */
+  readonly ownership?: T["mode"];
+  /**
+   * Who the block's rows belong to. Defaults to `database.sql.owner`, then
+   * `tenant`.
+   */
+  readonly owner?: T["scope"];
+  /** New names for the block's entities. */
+  readonly names?: T["entities"];
+  /**
+   * The app's optional `before_*` and `after_*` functions the block calls when
+   * they exist, e.g. `after_organization_create(organization, user)`.
+   */
+  readonly callbacks?: T["hooks"];
+};
+/**
+ * `blocks` keyed by instance, as the config writes it: a block name installs
+ * that block, and any other key names an instance with `block`.
+ */
+type BlocksInput = { readonly [M in BlockName]?: BlockInput<BlockConfigOf<M>>; } & {
+  readonly [instance: string]: NamedInstance | undefined;
+};
+/** One `tables.<name>` entry: an app table with `owner`. */
+type AppTableInput = Omit<AppTableConfig, "scope"> & {
+  /**
+   * Who reaches a row. `inherit` (the default) follows `database.sql.owner`;
+   * `user` keeps rows per user, and `none` lets signed-in users read every row
+   * while only the service role writes.
+   */
+  readonly owner?: AppTableConfig["scope"];
+};
+type AppTablesInput = Readonly<Record<string, AppTableInput>>;
+/** `database.sql`: SQL-wide settings with `owner`. */
+type SqlInput = Omit<SqlConfig, "scope"> & {
+  /**
+   * Who a block's rows belong to, unless `blocks.<name>.owner` sets its own:
+   * `tenant` (the default), `user` or `none`.
+   */
+  readonly owner?: SqlConfig["scope"];
+};
+/** Where the active organization of a request comes from. */
+interface OrganizationConfig {
+  /**
+   * Top-level claim holding the active organization id. Defaults to
+   * `tenant_id`.
+   */
+  readonly claim?: string;
+  /**
+   * The column holding the organization id on organization tables, which the
+   * `memberships` extension scopes and fills. Defaults to `organization_id`, or
+   * `<name>_id` when `blocks.memberships.names.organization` renames it.
+   * Setting it without the `memberships` block turns the extension on for an
+   * app's own tenancy.
+   */
+  readonly column?: string;
+  /**
+   * A request without an organization on an organization table: `skip`
+   * (default) leaves it to RLS, `error` fails it with `forbidden`.
+   */
+  readonly onMissing?: "error" | "skip";
+  /**
+   * The request header an app's resolver reads the organization from; the API
+   * spec documents it on organization tables.
+   */
+  readonly header?: string;
+}
+/** The database: where it is read from, its SQL and what it exposes. */
+interface DatabaseConfig {
+  readonly source?: SourceConfig;
+  /** Postgres schemas to generate. Defaults to `['public']`. */
+  readonly schemas?: readonly string[];
+  /**
+   * SQL-wide settings: the workflow, paths, and the `schema`, `api` and `owner`
+   * every block inherits.
+   */
+  readonly sql?: SqlInput;
+  readonly seed?: SeedConfig;
+  /**
+   * Data API grants, keyed by `table` or `schema.table`, and function `execute`
+   * grants, keyed by `name(argument types)` or `schema.name(argument types)`.
+   */
+  readonly expose?: Readonly<Record<string, ExposeConfig>>;
+  readonly buckets?: Readonly<Record<string, BucketConfig>>;
+  readonly realtime?: RealtimeConfig;
+  /**
+   * Realtime topic templates: `{ notifications:
+   * 'organization:{organizationId}:notifications' }`.
+   */
+  readonly topics?: Readonly<Record<string, string>>;
+  /**
+   * Embedding columns, keyed by `table` or `schema.table`. The `vector-search`
+   * block writes `search_<table>(query, k)` for each.
+   */
+  readonly vectorSearch?: Readonly<Record<string, VectorSearchConfig>>;
+}
+/** Who the caller is: the organization, claims and authorization. */
+interface AuthConfig {
+  readonly organization?: OrganizationConfig;
+  /** Claim names shared by the SQL, codegen and the runtime. */
+  readonly claims?: Omit<ClaimsConfig, "tenant">;
+  /**
+   * An authorization system the blocks, policies and doctor delegate to: the
+   * `provider` access model, `entitlements.memberships` and the hook and policy
+   * checks.
+   */
+  readonly authorization?: AuthorizationProvider;
+  readonly entitlements?: EntitlementsConfig;
+}
+/** What `better-supabase gen` writes and how. */
+interface GenGroupConfig extends GenConfig {
+  /**
+   * Main generated module. Defaults to `src/lib/supabase/generated.ts`;
+   * `database.types.ts` is written next to it.
+   */
+  readonly output?: string;
+  /** Casing of generated models and returned rows. Defaults to `'snake'`. */
+  readonly casing?: Casing;
+  /**
+   * PostgREST major version, written to `__InternalSupabase` in
+   * `database.types.ts`. Defaults to `'13'`.
+   */
+  readonly postgrestVersion?: string;
+  /**
+   * Write one `records/<type>.ts` next to `output` per record type that an
+   * installed block binds to (`defineRecordType`). Defaults to `true`.
+   */
+  readonly recordTypes?: boolean;
+  /**
+   * Write `hooks.ts` next to `output`: `defineDataHooks` from this framework's
+   * entry, once per block instance and table (`useTickets`, `useTicket`).
+   * Defaults to `react` when the adapters include `next`, `react` or `expo`,
+   * and to `false` otherwise.
+   */
+  readonly hooks?: DataHooksFramework | false;
+  /** Overrides per generated table, keyed by `table` or `schema.table`. */
+  readonly tables?: Readonly<Record<string, TableConfig>>;
+  /** Types for jsonb columns, keyed by `table.column`. */
+  readonly json?: Readonly<Record<string, JsonTypeConfig>>;
+  readonly codecs?: CodecsConfig;
+  readonly relations?: RelationsConfig;
+  /**
+   * Columns that must not be read by accident (`table.column` or
+   * `schema.table.column`, database names), for the `noSensitiveSelect` rule.
+   */
+  readonly sensitive?: readonly string[];
+  /**
+   * Text columns that hold an object path, keyed by `table.column` or
+   * `schema.table.column`, with the bucket as the value (a `database.buckets`
+   * key or a bucket id).
+   */
+  readonly storagePaths?: Readonly<Record<string, string>>;
+  /** Function results `gen` may type as not null, keyed by function name. */
+  readonly functions?: Readonly<Record<string, FunctionConfig>>;
+  readonly generators?: readonly Generator[];
+  /**
+   * Modules that export `defineReadSet` results, compiled to functions in the
+   * `read-sets` block.
+   */
+  readonly readSets?: readonly string[];
+}
+/** The API documents `better-supabase spec emit` writes. */
+interface ApiConfig {
+  /** @deprecated Use `specs`; `openapi.entry` and `openapi.output` map onto it. */
+  readonly openapi?: OpenApiConfig;
+  /** The documents `spec emit` writes (OpenAPI, AsyncAPI, Arazzo). */
+  readonly specs?: SpecsConfig;
+}
+/** Project tooling: doctor, env files, keys and skills. */
+interface ToolingConfig {
+  readonly doctor?: DoctorConfig;
+  readonly env?: EnvFileConfig;
+  readonly keys?: KeysConfig;
+  readonly skills?: SkillsConfig;
+}
+/** `better-supabase.config.ts`, grouped by what each key configures. */
+interface BetterSupabaseConfig {
+  readonly $schema?: string;
+  /**
+   * A named preset (`saas`, `crm`, ...), or a preset object: the conventions
+   * that differ from the defaults and the blocks. It expands into `blocks`,
+   * with the blocks they require, and the conventions it sets; the keys you set
+   * win.
+   */
+  readonly preset?: PresetName | (string & {}) | PresetSpec;
+  readonly database?: DatabaseConfig;
+  readonly auth?: AuthConfig;
+  /**
+   * The app's record types: the entities blocks attach tags, comments, fields
+   * and ranks to, keyed by type name.
+   */
+  readonly records?: SubjectsConfig;
+  /**
+   * Tables the app owns, keyed by name, created in `public` by `better-supabase
+   * upgrade`. ADR 0040.
+   */
+  readonly tables?: AppTablesInput;
+  /**
+   * The blocks to install and keep in sync: a list of names, or an object keyed
+   * by block name whose values set each block's ownership, names and options.
+   */
+  readonly blocks?: readonly string[] | BlocksInput;
+  /** The framework and runtime adapters `init` and `add` wrote. */
+  readonly adapters?: readonly IntegrationName[];
+  readonly gen?: GenGroupConfig;
+  readonly api?: ApiConfig;
+  readonly tooling?: ToolingConfig;
+  /**
+   * Overrides per environment, keyed by name. The CLI applies the block for
+   * `--env <name>`, else `$BETTER_SUPABASE_ENV`, else `ci` when `$CI` is set.
+   * Objects merge into the config; arrays and other values replace.
+   */
+  readonly $env?: Readonly<Record<string, EnvironmentConfig>>;
+  /** Shorthand for `$env.development`. */
+  readonly $development?: EnvironmentConfig;
+  /** Shorthand for `$env.production`. */
+  readonly $production?: EnvironmentConfig;
+  /** Shorthand for `$env.test`. */
+  readonly $test?: EnvironmentConfig;
+  /** Shorthand for `$env.ci`, which the CLI picks when `$CI` is set. */
+  readonly $ci?: EnvironmentConfig;
+}
+/** The keys an environment block may override. */
+type EnvironmentConfig = Omit<BetterSupabaseConfig, "$schema" | "$env" | "$development" | "$production" | "$test" | "$ci" | "preset">;
+//#endregion
+//#region src/config/types/config.d.ts
+/** The frameworks `gen.hooks` writes data hooks for. */
+type DataHooksFramework = "react" | "vue" | "svelte" | "solid";
+/**
+ * The config with every key at the top level, as `flattenConfig` returns it and
+ * `resolveConfig` reads it. Apps write the grouped `BetterSupabaseConfig`.
+ */
+interface FlatConfig {
+  readonly $schema?: string;
+  readonly source?: SourceConfig;
+  /** Postgres schemas to generate. Defaults to `['public']`. */
+  readonly schemas?: readonly string[];
+  /** Casing of generated models and returned rows. Defaults to `'snake'`. */
+  readonly casing?: Casing;
+  readonly tables?: Readonly<Record<string, TableConfig>>;
+  /**
+   * Main generated module. Defaults to `src/lib/supabase/generated.ts`;
+   * `database.types.ts` is written next to it.
+   */
+  readonly output?: string;
+  /**
+   * PostgREST major version, written to `__InternalSupabase` in
+   * `database.types.ts` so `createClient` picks matching behavior. Defaults to
+   * `'13'`.
+   */
+  readonly postgrestVersion?: string;
+  /**
+   * Write one `records/<type>.ts` next to `output` per record type that an
+   * installed block binds to (`defineRecordType`). Defaults to `true`.
+   */
+  readonly recordTypes?: boolean;
+  /**
+   * Write `hooks.ts` next to `output`: `defineDataHooks` from this framework's
+   * entry, once per block instance and table (`useTickets`, `useTicket`).
+   * Defaults to `react` when the adapters include `next`, `react` or `expo`,
+   * and to `false` otherwise.
+   */
+  readonly hooks?: DataHooksFramework | false;
+  /** Types for jsonb columns, keyed by `table.column`. */
+  readonly json?: Readonly<Record<string, JsonTypeConfig>>;
+  readonly codecs?: CodecsConfig;
+  readonly relations?: RelationsConfig;
+  /**
+   * Columns that must not be read by accident (`table.column` or
+   * `schema.table.column`, database names), for the `noSensitiveSelect` rule.
+   */
+  readonly sensitive?: readonly string[];
+  /**
+   * Text columns that hold an object path, keyed by `table.column` or
+   * `schema.table.column` (database names), with the bucket as the value (a
+   * `buckets` key or a bucket id). Generated rows type them as
+   * `StoragePath<'bucket-id'>`.
+   */
+  readonly storagePaths?: Readonly<Record<string, string>>;
+  /**
+   * Function results `gen` may type as not null, keyed by function name.
+   * Results are `| null` by default, since Postgres can't promise a function
+   * returns a value. `notNull: true` covers the whole result (each element of a
+   * set, each column of `returns table`); a list names the `returns table`
+   * columns that are never null.
+   */
+  readonly functions?: Readonly<Record<string, FunctionConfig>>;
+  /**
+   * Data API grants, keyed by `table` or `schema.table`, and function `execute`
+   * grants, keyed by `name(argument types)` or `schema.name(argument types)`. A
+   * project with default privileges turned off grants new tables to no Data API
+   * role; the `grants` SQL module writes these as the complete privilege set
+   * (it revokes what is not listed), and doctor (BS106) checks them. Tables not
+   * listed need `select, insert, update, delete` for `authenticated` (`select`
+   * for views).
+   */
+  readonly expose?: Readonly<Record<string, ExposeConfig>>;
+  /**
+   * Modules that export `defineReadSet` results. `gen` compiles each set to a
+   * function in the `read-sets` SQL module. Node imports them, so relative
+   * imports need their `.ts` extension.
+   */
+  readonly readSets?: readonly string[];
+  readonly generators?: readonly Generator[];
+  /**
+   * `auth.organization` without its claim (that is `claims.tenant`): the
+   * organization column and how the `memberships` extension resolves it.
+   */
+  readonly organization?: Omit<OrganizationConfig, "claim">;
+  readonly claims?: ClaimsConfig;
+  readonly buckets?: Readonly<Record<string, BucketConfig>>;
+  /**
+   * Realtime topic templates: `{ notifications:
+   * 'organization:{organizationId}:notifications' }`.
+   */
+  readonly topics?: Readonly<Record<string, string>>;
+  readonly realtime?: RealtimeConfig;
+  readonly entitlements?: EntitlementsConfig;
+  /**
+   * An authorization system the SQL modules, policies and doctor delegate to:
+   * the `provider` access model, `entitlements.memberships` and the hook and
+   * policy checks.
+   */
+  readonly authorization?: AuthorizationProvider;
+  /**
+   * Embedding columns, keyed by `table` or `schema.table`. The `vector-search`
+   * SQL module writes `search_<table>(query, k)` for each, which
+   * `db.$search(table, { vector, k })` calls.
+   */
+  readonly vectorSearch?: Readonly<Record<string, VectorSearchConfig>>;
+  /**
+   * The app's subject types: the entities blocks attach tags, comments, fields
+   * and ranks to. Subject-bound SQL modules read this registry, the `subjects`
+   * module writes `subject_title`, `subject_url` and `can_subject` from it, and
+   * `gen` types `SubjectType` from its keys.
+   */
+  readonly subjects?: SubjectsConfig;
+  /**
+   * A named preset (`saas`, `crm`, ...), or a preset object: the conventions
+   * that differ from the defaults and the blocks. It expands into `blocks`,
+   * with the blocks they require, and the conventions it sets; the keys you set
+   * win.
+   */
+  readonly preset?: PresetName | (string & {}) | PresetSpec;
+  /**
+   * The blocks to install and keep in sync (`better-supabase add`): a list of
+   * names, or an object keyed by block name whose values set each block's mode,
+   * schema, table and column names, permission keys and options. The foundation
+   * blocks (`tenant`, `access`, `updated-at`, `rls-guard`, ...) are configured
+   * here too.
+   */
+  readonly blocks?: readonly string[] | BlocksConfig;
+  /**
+   * Tables the app owns, keyed by name, created in `public` by `better-supabase
+   * upgrade` with an `id`, the scope column, timestamps, row level security and
+   * policies for the scope. Columns reference each other, `auth.users` or a
+   * block's logical table. ADR 0040.
+   */
+  readonly appTables?: AppTablesConfig;
+  /**
+   * SQL-wide settings: the workflow, paths, and the `schema` and `api` every
+   * block inherits.
+   */
+  readonly sql?: SqlConfig;
+  readonly seed?: SeedConfig;
+  /** @deprecated Use `specs`; `openapi.entry` and `openapi.output` map onto it. */
+  readonly openapi?: OpenApiConfig;
+  /**
+   * The documents `better-supabase spec emit` writes (OpenAPI, AsyncAPI,
+   * Arazzo).
+   */
+  readonly specs?: SpecsConfig;
+  readonly doctor?: DoctorConfig;
+  /** What `better-supabase gen` runs. */
+  readonly gen?: GenConfig;
+  readonly env?: EnvFileConfig;
+  /**
+   * The integrations `init` and `add` wrote; `add` without a name sets up the
+   * ones that have no files yet.
+   */
+  readonly integrations?: readonly IntegrationName[];
+  readonly skills?: SkillsConfig;
+  readonly keys?: KeysConfig;
+}
+/** The config with defaults applied. */
+interface ResolvedConfig {
+  readonly root: string;
+  readonly source: SourceConfig;
+  readonly schemas: readonly string[];
+  readonly casing: Casing;
+  readonly tables: Readonly<Record<string, TableConfig>>;
+  readonly output: string;
+  /** `database.types.ts` next to `output`. */
+  readonly databaseTypesOutput: string;
+  readonly postgrestVersion: string;
+  readonly recordTypes: boolean;
+  readonly hooks: DataHooksFramework | false;
+  readonly json: Readonly<Record<string, JsonTypeConfig>>;
+  readonly codecs: Required<CodecsConfig>;
+  readonly relations: Required<RelationsConfig>;
+  readonly sensitive: readonly string[];
+  readonly storagePaths: Readonly<Record<string, string>>;
+  readonly functions: Readonly<Record<string, FunctionConfig>>;
+  /** The table entries of `expose`. */
+  readonly expose: Readonly<Record<string, ResolvedExpose>>;
+  /** The function entries of `expose`: the roles that may execute each one. */
+  readonly exposeFunctions: Readonly<Record<string, readonly ExposeRole[]>>;
+  readonly readSets: readonly string[];
+  readonly generators: readonly Generator[];
+  /**
+   * The repository extensions of the installed blocks and the columns they
+   * manage; `gen` writes them as table flags.
+   */
+  readonly extensions: ResolvedExtensions;
+  readonly claims: Required<ClaimsConfig>;
+  readonly buckets: Readonly<Record<string, BucketConfig>>;
+  readonly entitlements: {
+    /** Unset without `entitlements.customer`. */
+    readonly table?: string;
+    readonly column?: string;
+    readonly key: string;
+    readonly memberships: "tenant" | "provider";
+    readonly source: NonNullable<EntitlementsConfig["source"]>;
+    readonly claim?: NonNullable<EntitlementsConfig["claim"]>;
+  };
+  readonly authorization?: AuthorizationProvider;
+  readonly vectorSearch: readonly ({
+    readonly table: string;
+    readonly column: string;
+    readonly distance: VectorDistance;
+  } & Omit<Exclude<VectorSearchConfig, string>, "column" | "distance">)[];
+  readonly subjects: SubjectsConfig;
+  readonly topics: Readonly<Record<string, string>>;
+  readonly realtime: Required<Omit<RealtimeConfig, "policies">> & {
+    readonly policies?: TopicPoliciesConfig;
+  };
+  /**
+   * The `preset` the config started from, as written; `blocks` already holds it
+   * expanded.
+   */
+  readonly preset?: string | PresetSpec;
+  /** `blocks` with `sql.schema` and `sql.api` applied, keyed by block name. */
+  readonly blocks: AnyBlocksConfig;
+  /** The installed blocks, in config order, each once. */
+  readonly blockNames: readonly string[];
+  /** Every install of a block, keyed by its key in `blocks`. */
+  readonly instances: Readonly<Record<string, ResolvedInstance>>;
+  /** `appTables`, checked; empty without any. */
+  readonly appTables: AppTablesConfig;
+  readonly sql: ResolvedSqlConfig;
+  readonly seed: Required<SeedConfig>;
+  readonly openapi: Required<OpenApiConfig>;
+  readonly specs: {
+    readonly entry: string;
+    readonly outputs: readonly SpecOutputConfig[];
+    readonly failOn: NonNullable<SpecsConfig["failOn"]>;
+    readonly manifest?: string;
+  };
+  readonly doctor: Required<Omit<DoctorConfig, "claimsLimit" | "output" | "migrationSafety">> & Pick<DoctorConfig, "claimsLimit" | "output" | "migrationSafety">;
+  /**
+   * `tasks` stays unset without a list, so `gen` picks the steps the project
+   * uses.
+   */
+  readonly gen: GenConfig;
+  readonly env: {
+    readonly output: string;
+    readonly prefix?: string;
+  };
+  readonly integrations: readonly IntegrationName[];
+  readonly skills: SkillsConfig;
+  readonly keys: KeysConfig;
+  /** The environment block the CLI applied, when one was active. */
+  readonly environment?: string;
+}
+/**
+ * The columns the repository extensions of the installed blocks manage, by
+ * extension; an extension whose block is not installed is `undefined`.
+ */
+interface ResolvedExtensions {
+  /** `updated-at`: `blocks["updated-at"].options`. */
+  readonly timestamps: {
+    readonly createdAt: string;
+    readonly updatedAt: string;
+  } | undefined;
+  /** `trash`: `blocks.trash.options.deletedAt`. */
+  readonly softDelete: {
+    readonly column: string;
+  } | undefined;
+  /**
+   * `memberships`, or `auth.organization.column` without it: the organization
+   * column and how a request's organization is resolved.
+   */
+  readonly tenant: {
+    readonly column: string;
+    readonly onMissing?: "error" | "skip";
+    readonly header?: string;
+  } | undefined;
+  /** `created-by`: `blocks["created-by"].options`. */
+  readonly actor: {
+    readonly createdBy: string;
+    readonly updatedBy: string;
+    readonly impersonatedBy: string;
+  } | undefined;
+}
+//#endregion
+//#region src/config/types/codegen.d.ts
+/**
+ * Where codegen reads the database from. Without any of these, `$DATABASE_URL`,
+ * `$SUPABASE_DB_URL` and then the local stack (`supabase start`) are used.
+ */
+interface SourceConfig {
+  /** Postgres connection string. */
+  readonly dbUrl?: string;
+  /**
+   * Hosted project ref. Read through the Management API's read-only SQL
+   * endpoint, so no database password is needed.
+   */
+  readonly projectRef?: string;
+  /**
+   * Management API token for `projectRef`. Defaults to
+   * `$SUPABASE_ACCESS_TOKEN`; prefer the env var over committing a token.
+   */
+  readonly accessToken?: string;
+  /**
+   * Read a saved `better-supabase gen --save-snapshot` snapshot instead of
+   * connecting.
+   */
+  readonly snapshot?: string;
+  /**
+   * Read a Supabase Lite project's schema the way Lite runs it, from `[db]
+   * driver` in `supabase/config.toml`. On by default when that key is present;
+   * `false` reads the database like any other project.
+   */
+  readonly lite?: boolean;
+}
+/**
+ * A JSON Schema object, or a Standard JSON Schema value (zod 4, valibot,
+ * arktype, ...) that can produce one.
+ */
+type JsonSchemaSource = Readonly<Record<string, unknown>> | {
+  readonly "~standard": {
+    readonly jsonSchema: {
+      readonly input: (options: {
+        readonly target: string;
+      }) => Record<string, unknown>;
+    };
+  };
+};
+type JsonTypeConfig = ({
+  readonly import: string;
+} | {
+  readonly type: string;
+}) & {
+  /**
+   * Enforced in the database by `better-supabase add jsonb-schemas`
+   * (pg_jsonschema).
+   */
+  readonly schema?: JsonSchemaSource;
+};
+interface TableConfig {
+  readonly casing?: Casing;
+  /** Leave the table out of the generated models. */
+  readonly exclude?: boolean;
+  /**
+   * Keep the table off the Data API on purpose: only `service_role` reaches it.
+   * The models are still generated for admin clients, and doctor (BS106) checks
+   * that `anon` and `authenticated` have no grants instead of requiring them.
+   */
+  readonly serviceRole?: boolean;
+  /** Rename generated relations: `{ primaryContact: 'contact' }`. */
+  readonly relations?: Readonly<Record<string, string>>;
+  /**
+   * Database names of not-null columns an insert may leave out because the
+   * database fills them, for example from a `before insert` trigger. `gen`
+   * makes them optional in `InsertOf` and the insert validators.
+   */
+  readonly insertOptional?: readonly string[];
+}
+interface FunctionConfig {
+  /**
+   * `true`, or the `returns table` columns (database names) that are never
+   * null.
+   */
+  readonly notNull?: true | readonly string[];
+}
+/** Claim names shared by the SQL modules, codegen and the runtime defaults. */
+interface ClaimsConfig {
+  /** Top-level claim holding the active tenant id. Defaults to `tenant_id`. */
+  readonly tenant?: string;
+  /**
+   * `scope` of the tenant entries `membership_claims()` writes. Defaults to
+   * `tenant`.
+   */
+  readonly scope?: string;
+  /**
+   * Claim holding plan features per tenant (`{ [tenantId]: string[] }`).
+   * Defaults to `features`.
+   */
+  readonly features?: string;
+  /**
+   * Claim the memberships hook (`membership_claims()` or the provider's)
+   * writes. Defaults to `memberships`.
+   */
+  readonly memberships?: string;
+}
+/**
+ * Runtime types for columns whose JSON form loses information. Defaults match
+ * `supabase gen types`: timestamps as ISO strings, `int8` and `numeric` as
+ * numbers.
+ */
+interface CodecsConfig {
+  /**
+   * `'instant'` decodes `timestamptz` columns to `Temporal.Instant` and
+   * `timestamp` columns to `Temporal.PlainDateTime`. `'utc'` keeps
+   * `timestamptz` columns as strings, always in UTC as ISO 8601 with a `Z` and
+   * every fraction digit (`2026-10-21T05:10:00.123456Z`).
+   */
+  readonly timestamptz?: "string" | "instant" | "utc";
+  /** `'bigint'` or `'string'` read `int8` exactly (above 2^53). */
+  readonly int8?: "number" | "string" | "bigint";
+  /** `'string'` reads `numeric` exactly. */
+  readonly numeric?: "number" | "string";
+}
+interface GeneratedFile {
+  /** Path relative to the project root. */
+  readonly path: string;
+  readonly contents: string;
+  /**
+   * The file exports `validators` (`TableValidators`): `gen` imports them into
+   * the generated schema and installs `validation`, so writes are checked.
+   */
+  readonly validators?: boolean;
+}
+interface GeneratorInput {
+  readonly meta: SchemaMeta;
+  /**
+   * The `@supabase/postgrest-typegen` metadata for the configured schemas, the
+   * same contract `supabase gen types` is built on.
+   */
+  readonly introspection: GeneratorMetadata;
+  /** Constraints, indexes, policies, triggers and grants typegen leaves out. */
+  readonly extras: SnapshotExtras;
+  readonly config: ResolvedConfig;
+  /** Absolute path of the main generated module. */
+  readonly output: string;
+  /** Import path from `from` (a generated file) to `to`, with extension. */
+  readonly importPath: (from: string, to: string) => string;
+  /**
+   * Where generated files import `better-supabase` runtime helpers from.
+   * Defaults to `better-supabase`.
+   */
+  readonly runtimeImport?: string;
+  /**
+   * The tables and enums `gen` emits, with the TypeScript type it wrote for
+   * each column (after `json` overrides, codecs and enum unions). Frozen.
+   */
+  readonly model: GeneratorModel;
+}
+interface GeneratorColumn {
+  /** Name in rows, after casing. */
+  readonly app: string;
+  /** Database name. */
+  readonly db: string;
+  /** TypeScript type without `| null`. */
+  readonly tsType: string;
+  readonly nullable: boolean;
+  /** Optional on insert. */
+  readonly optional: boolean;
+  /** Generated or identity always: never written. */
+  readonly readonly: boolean;
+  /** Enum or check-constraint values, when the column has a closed set. */
+  readonly values: readonly string[] | undefined;
+  readonly json: boolean;
+}
+interface GeneratorTable {
+  /** Key in `schema.tables` and on the client. */
+  readonly key: string;
+  readonly schema: string;
+  readonly name: string;
+  readonly casing: Casing;
+  readonly columns: readonly GeneratorColumn[];
+}
+interface GeneratorFunctionArg {
+  readonly name: string;
+  /** TypeScript type, as `$rpc` takes it. */
+  readonly tsType: string;
+  /** Has a default, so callers may leave it out. */
+  readonly optional: boolean;
+  /** Enum values, when the argument is an enum (or an array of one). */
+  readonly values: readonly string[] | undefined;
+}
+/** A function `$rpc` calls, with the types `gen` wrote for it. */
+interface GeneratorFunction {
+  /** Name on `$rpc`. */
+  readonly key: string;
+  readonly schema: string;
+  readonly args: readonly GeneratorFunctionArg[];
+  /** TypeScript type of the result, as `$rpc` returns it. */
+  readonly returns: string;
+  readonly returnsSet: boolean;
+  readonly volatility: "immutable" | "stable" | "volatile";
+}
+/** JSON Schema (draft 2020-12) for one value. */
+type GeneratorJsonSchema = Readonly<Record<string, unknown>>;
+/**
+ * One field of a block input schema: its scalar kind with the flags and bounds
+ * `entitySchema` takes. It never carries a nested `schema`.
+ */
+type GeneratorField = FieldSpec;
+/** One of a block's input schemas, in the block's default names. */
+interface GeneratorInputSchema {
+  /** The type it validates (`WorkItemInput`). */
+  readonly title: string;
+  readonly fields: Readonly<Record<string, GeneratorField>>;
+  /** The same schema as JSON Schema (draft 2020-12), in its wire form. */
+  readonly jsonSchema: GeneratorJsonSchema;
+}
+/**
+ * The inputs a block's client takes for one entity. Each is absent when the
+ * block declares none.
+ */
+interface GeneratorEntitySchemas {
+  /** What creating one takes (`WorkItemInput`). */
+  readonly input?: GeneratorInputSchema;
+  /** What updating one takes (`WorkItemChange`). */
+  readonly change?: GeneratorInputSchema;
+  /** What listing them takes (`WorkItemListOptions`). */
+  readonly listFilter?: GeneratorInputSchema;
+}
+interface GeneratorNoun {
+  readonly singular: string;
+  readonly plural: string;
+}
+/** One of an installed block's entities, under the name the config gives it. */
+interface GeneratorBlockEntity {
+  /** The entity's key in the block's manifest: its default singular noun. */
+  readonly key: string;
+  /** The block's own noun (`work_item`). */
+  readonly from: GeneratorNoun;
+  /** The noun `blocks.<name>.names` gives it (`task`). */
+  readonly to: GeneratorNoun;
+  readonly primary: boolean;
+  /** The table that holds it, as the SQL names it; undefined when none. */
+  readonly table: string | undefined;
+  /** `blocks.<name>.names.<entity>.url`, with column placeholders. */
+  readonly url: string | undefined;
+  readonly schemas: GeneratorEntitySchemas;
+}
+/** An installed block, with its final names. */
+interface GeneratorBlock {
+  readonly name: string;
+  /** The schema its tables and functions live in. */
+  readonly schema: string;
+  /**
+   * The block's client in `blocks.generated.ts` (`tasksBlock`) and the subpath
+   * its default export comes from, or undefined for blocks with only SQL.
+   */
+  readonly client: {
+    readonly export: string;
+    readonly subpath: string;
+  } | undefined;
+  readonly entities: readonly GeneratorBlockEntity[];
+}
+interface GeneratorModel {
+  readonly tables: readonly GeneratorTable[];
+  readonly enums: readonly {
+    readonly schema: string;
+    readonly name: string;
+    readonly values: readonly string[];
+  }[];
+  /** The functions `$rpc` calls, one entry per overload. */
+  readonly functions: readonly GeneratorFunction[];
+  /** The installed blocks, in config order. */
+  readonly blocks: readonly GeneratorBlock[];
+}
+/**
+ * Codegen extension point. First-party generators: `zod()`, `valibot()`,
+ * `jsonSchema()`, `standardSchema()`. Prove custom ones with `testGenerator`.
+ */
+interface Generator {
+  /** The generator contract it targets. `gen` refuses versions it doesn't know. */
+  readonly apiVersion?: 1;
+  readonly name: string;
+  generate(input: GeneratorInput): readonly GeneratedFile[] | Promise<readonly GeneratedFile[]>;
+}
+interface RelationsConfig {
+  /**
+   * Type a to-one include as `| null` when the related table has row level
+   * security, even over a `not null` foreign key, since a policy can hide the
+   * related row. `required: true` on the include keeps it non-null. Defaults to
+   * `false`.
+   */
+  readonly nullableUnderRls?: boolean;
+}
+//#endregion
+//#region src/config/json.d.ts
+/**
+ * The JSON Schema document for a `json[...].schema` entry. A Standard Schema
+ * converts for `target` (2020-12 by default); a JSON Schema object is returned
+ * as it is.
+ */
+declare function resolveJsonSchema(source: JsonSchemaSource, target?: "draft-2020-12" | "draft-07" | "openapi-3.0"): Readonly<Record<string, unknown>>;
+//#endregion
+//#region src/preset/resolve.d.ts
+/** One block in a resolved preset, with why it is there. */
+interface ResolvedPresetBlock {
+  readonly name: string;
+  readonly title: string;
+  readonly category: BlockCategory;
+  /** Whether the preset names it, rather than another block requiring it. */
+  readonly selected: boolean;
+  /** The blocks in the set that require it. */
+  readonly requiredBy: readonly string[];
+  /** "selected", or "required by comments and tags". */
+  readonly reason: string;
+}
+/** A soft integration between two blocks that are both in the set. */
+interface PresetIntegration {
+  /** The block that works with `to`. */
+  readonly from: string;
+  readonly to: string;
+}
+/** Something in the preset that can't install, and why. */
+interface PresetConflict {
+  readonly block?: string;
+  readonly field?: PresetFieldKey;
+  readonly reason: string;
+}
+/** What `resolvePreset` returns. */
+interface ResolvedPreset {
+  readonly preset: Preset;
+  /** Every block to install, in install order; conflicting blocks are left out. */
+  readonly blocks: readonly ResolvedPresetBlock[];
+  /** The soft integrations active between blocks in the set. */
+  readonly integrations: readonly PresetIntegration[];
+  readonly conflicts: readonly PresetConflict[];
+  /** The manifests that cover `blocks`, for `lib/blocks.ts`. */
+  readonly manifests: readonly PresetCatalogManifest[];
+}
+/** "a", "a and b", "a, b and c". */
+declare function listNames(names: readonly string[]): string;
+/**
+ * Why `name` can't install with the preset's conventions, or undefined.
+ * `/create` disables a block with this reason before it is selected.
+ */
+declare function presetBlockConflict(preset: Pick<Preset, "access" | "scope">, name: string, catalog?: PresetCatalog): string | undefined;
+/**
+ * The full block set for a preset: the selected blocks and what they require, a
+ * reason per block, the soft integrations active between them, and what can't
+ * install. It reads the generated catalog, never the SQL renderers, so it runs
+ * in the browser.
+ */
+declare function resolvePreset(preset: Preset, catalog?: PresetCatalog): ResolvedPreset;
+//#endregion
+//#region src/preset/config.d.ts
+/** A named preset, a `/create?preset=` URL, or a preset object. */
+type PresetInput = string | (Partial<Preset> & {
+  readonly blocks?: readonly string[];
+});
+/**
+ * Reads a named preset, a `/create?preset=<name>` URL or a preset object
+ * (`PresetSpec`) into a `Preset`. A preset code from 0.14 throws, naming the
+ * codemod that converts it.
+ */
+declare function presetOf(input: PresetInput): Preset;
+/**
+ * The conventions that map onto config keys; `tenantName` takes any name
+ * `blocks.memberships.names.organization` allows.
+ */
+type ConfigConventions = Pick<Preset, "casing" | "idType" | "scope" | "access" | "api"> & {
+  readonly tenantName: string;
+};
+/**
+ * The config keys conventions set without a preset: `casing`, `sql`,
+ * `blocks.permissions` when the access model or id type differ from the
+ * defaults, and `blocks.memberships` when the tenant has another name.
+ */
+declare function conventionConfig(conventions: ConfigConventions): Pick<FlatConfig, "casing" | "sql"> & {
+  readonly blocks?: {
+    readonly permissions?: AccessBlockConfig;
+    readonly memberships?: BlockConfig;
+  };
+};
+/**
+ * The config keys a resolved preset sets: its blocks and the conventions that
+ * differ from the defaults.
+ */
+declare function presetConfig(resolved: ResolvedPreset): Pick<FlatConfig, "casing" | "sql" | "integrations"> & {
+  readonly blocks: BlocksConfig;
+};
+/**
+ * A literal config after `defineConfig`: the same type without a preset, and
+ * with one, every key but `blocks`, `database`, `gen` and `adapters` as
+ * written, those merged with the preset's.
+ */
+type ExpandedConfig<C extends BetterSupabaseConfig> = C extends {
+  readonly preset: NonNullable<BetterSupabaseConfig["preset"]>;
+} ? Omit<C, "blocks" | "database" | "gen" | "adapters"> & Pick<BetterSupabaseConfig, "blocks" | "database" | "gen" | "adapters"> : C;
+/**
+ * `config` with its `preset` expanded: the preset's blocks (and what they
+ * require) and conventions first, then the config's own keys over them, so
+ * explicit config wins. A block in both keeps the preset's settings that the
+ * config's entry leaves unset. Expanding twice gives the same config.
+ */
+declare function expandPreset<const C extends BetterSupabaseConfig>(config: C): ExpandedConfig<C>;
+//#endregion
+//#region src/config/references.d.ts
+/**
+ * A logical table of a block the registry knows, as `tables` columns reference
+ * it: `{ block: "tasks", table: "items" }`.
+ */
+type BlockTableReference = { readonly [M in keyof BlockNameRegistry]: {
+  readonly block: M;
+  readonly table: TablesOf<M>;
+}; }[keyof BlockNameRegistry];
+type AppTablesOf<C> = C extends {
+  readonly tables: infer T extends object;
+} ? T : Record<never, never>;
+/** The app tables a literal config declares, or `string` without any. */
+type AppTableNames<C> = [keyof AppTablesOf<C>] extends [never] ? string : (keyof AppTablesOf<C> & string) | "auth.users";
+/** What a column of `C`'s app tables may reference. */
+type TypedReference<C> = ({
+  readonly table: AppTableNames<C>;
+} | BlockTableReference) & {
+  readonly onDelete?: AppOnDeleteAction;
+};
+type ColumnsOfTable<T> = T extends {
+  readonly columns: infer K extends object;
+} ? K : Record<never, never>;
+type AppTableReferences<C> = { readonly [T in keyof AppTablesOf<C>]?: {
+  readonly columns?: { readonly [K in keyof ColumnsOfTable<AppTablesOf<C>[T]>]?: ColumnsOfTable<AppTablesOf<C>[T]>[K] extends {
+    readonly references: unknown;
+  } ? {
+    readonly references?: TypedReference<C>;
+  } : unknown; };
+}; };
+type RolesOf<C> = C extends {
+  readonly blocks: {
+    readonly permissions: {
+      readonly roles: infer R extends object;
+    };
+  };
+} ? keyof R & string : never;
+/**
+ * The roles `blocks.permissions.roles` declares, or `string` when the config
+ * leaves them to the default list or another access model.
+ */
+type RoleNames<C> = [RolesOf<C>] extends [never] ? string : RolesOf<C>;
+type BucketsOf<C> = C extends {
+  readonly database: {
+    readonly buckets: infer B extends object;
+  };
+} ? keyof B & string : never;
+/**
+ * A bucket `gen.storagePaths` names: a `database.buckets` key, suggested first,
+ * or the id of a bucket the config doesn't declare.
+ */
+type BucketName<C> = BucketsOf<C> | (string & {});
+type RoleReferences<C> = [RolesOf<C>] extends [never] ? unknown : {
+  readonly blocks?: {
+    readonly sso?: {
+      readonly options?: {
+        readonly defaultRole?: RoleNames<C>;
+        readonly roleOrder?: readonly RoleNames<C>[];
+      };
+    };
+    readonly billing?: {
+      readonly options?: {
+        readonly seatRoles?: readonly RoleNames<C>[];
+      };
+    };
+  };
+};
+type BlocksOf<C> = C extends {
+  readonly blocks: infer B extends object;
+} ? B extends readonly string[] ? Record<never, never> : B : Record<never, never>;
+/** The instance keys a literal config declares in `blocks`. */
+type InstanceNames<C> = keyof BlocksOf<C> & string;
+/**
+ * Each named instance checked against the block it names in `block`, and every
+ * `uses` value against the config's instances.
+ */
+type InstanceReferences<C> = {
+  readonly blocks?: { readonly [K in keyof BlocksOf<C>]?: (BlocksOf<C>[K] extends {
+    readonly block: infer B extends BlockName;
+  } ? BlockInput<BlockConfigOf<B>> : unknown) & {
+    readonly on?: InstanceOn;
+    readonly uses?: Readonly<Record<string, InstanceNames<C>>>;
+  }; };
+};
+/**
+ * What `defineConfig` checks a literal config against: block tables in `tables`
+ * references, app table names, bucket names in `gen.storagePaths`, the role
+ * names other blocks take from `blocks.permissions.roles`, and each named
+ * instance's options and `uses`.
+ */
+type ConfigReferences<C> = {
+  readonly tables?: AppTableReferences<C>;
+  readonly gen?: {
+    readonly storagePaths?: Readonly<Record<string, BucketName<C>>>;
+  };
+} & RoleReferences<C> & InstanceReferences<C>;
+//#endregion
+//#region src/config/resolve.d.ts
+declare const CONFIG_SCHEMA_URL = "https://unpkg.com/better-supabase/schemas/config-v1.json";
+/**
+ * Types `better-supabase.config.ts` and returns it with its literal types. With
+ * `preset`, it expands the preset into `blocks` and its conventions first, and
+ * the keys you set win. It checks the references between keys against the
+ * config itself: block tables and app tables in `tables` references, the
+ * `database.buckets` in `gen.storagePaths`, and the `blocks.permissions.roles`
+ * other blocks name.
+ */
+declare function defineConfig<const C extends BetterSupabaseConfig>(config: C & NoInfer<ConfigReferences<C>>): ExpandedConfig<C>;
+/** Applies defaults. Paths stay relative to `root`. */
+declare function resolveConfig(input: BetterSupabaseConfig, root: string): ResolvedConfig;
+//#endregion
+//#region src/config/groups.d.ts
+type Entries = Record<string, unknown>;
+type Pairs = readonly (readonly [grouped: string, flat: string])[];
+/** The flat keys each group holds. `gen` and `auth` also keep their own keys. */
+declare const CONFIG_GROUPS: Readonly<Record<string, readonly string[]>>;
+/** Top-level keys renamed by the regrouping: the grouped name, then the flat. */
+declare const RENAMED_CONFIG_KEYS: Pairs;
+/** Keys renamed inside `blocks.<name>`: the grouped name, then the flat. */
+declare const RENAMED_BLOCK_KEYS: Pairs;
+/** A resolved block entry with the key names a config file writes. */
+declare function blockEntrySource(entry: object): Entries;
+/**
+ * The grouped config in the flat shape `resolveConfig` reads: every group's
+ * keys at the top level, `records`, `tables` and `adapters` under their flat
+ * names, `auth.organization` as `claims.tenant` and `organization`, and the
+ * renamed block and app table keys under their flat names.
+ */
+declare function flattenConfig(config: BetterSupabaseConfig): FlatConfig;
+/**
+ * Whether a top-level `tables` is the generator overrides of a config written
+ * before 0.15 rather than the app tables of a grouped one.
+ */
+declare function hasFlatTables(keys: readonly string[]): boolean;
+/** A flat config in the grouped shape: the inverse of `flattenConfig`. */
+declare function groupConfig(config: FlatConfig): BetterSupabaseConfig;
+/**
+ * Any object with the keys of a config written before 0.15, grouped: the keys
+ * it doesn't know stay where they are. `$env` blocks are grouped the same way.
+ * The 0.15 codemod uses it for JSON configs.
+ */
+declare function groupEntries(config: object): Entries;
+//#endregion
+//#region src/config/block-subjects.d.ts
+/**
+ * The entities `blocks.<module>.names` gives a new name, such as `work_item` to
+ * `task`, for the block's TypeScript client (`blocks.generated.ts`). Empty when
+ * the module renames none.
+ */
+declare function blockEntityRenames(module: string, blocks: AnyBlocksConfig): readonly EntityRename[];
+/** One installed block's entity under the name the config gives it. */
+interface BlockEntity {
+  /** The entity's key in the block's manifest: its default singular noun. */
+  readonly key: string;
+  readonly from: EntityNoun;
+  readonly to: EntityNoun;
+  readonly primary: boolean;
+  /**
+   * The table that holds it as the SQL writes it (`tasks`, or the
+   * `blocks.<name>.tables` mapping), or undefined when it has none.
+   */
+  readonly table: string | undefined;
+  /** `blocks.<name>.names.<entity>.url`, with column placeholders. */
+  readonly url: string | undefined;
+}
+/** The entities one installed block declares, with their final names. */
+declare function blockEntities(module: string, blocks: AnyBlocksConfig): readonly BlockEntity[];
+/**
+ * The entities of every installed block that registers one (work items, deals,
+ * companies and people, products, employees), under their renamed type, then
+ * `subjects`. Throws when `subjects` already has a block's type.
+ */
+/** The subject types one installed block registers, by renamed entity. */
+declare function blockSubjectTypes(module: string, blocks: AnyBlocksConfig): readonly string[];
+//#endregion
+//#region src/core/claims.d.ts
+declare const DEFAULT_CLAIMS: ClaimsMeta;
+/**
+ * Where an adapter reads each claim the SQL modules and the provider's hook
+ * write.
+ */
+interface ClaimPaths {
+  /**
+   * The active tenant: the top-level claim, then the same key in
+   * `app_metadata`.
+   */
+  readonly tenant: readonly [string, string];
+  /** `{ [tenantId]: string[] }` of plan features. */
+  readonly features: string;
+  /**
+   * The caller's memberships, a list of `{ scope, id, roles }` or a map of
+   * tenant id to role.
+   */
+  readonly memberships: string;
+  /** The `scope` of tenant entries in the memberships list. */
+  readonly scope: string;
+}
+/**
+ * The claim paths for `config.claims`, with defaults. For a generated schema,
+ * pass `claimsOf(meta)`.
+ */
+declare function claimPaths(claims?: Partial<ClaimsMeta>): ClaimPaths;
+/**
+ * Where the active tenant is read from: the top-level claim, then
+ * `app_metadata`.
+ */
+declare function tenantClaimPaths(tenant?: string): readonly [string, string];
+//#endregion
+//#region src/generators/extras.d.ts
+/** A schema for a function's arguments or one of a block's inputs. */
+interface ExtraSchema {
+  /** Export name: `listTasksArgs`, `taskInput`. */
+  readonly name: string;
+  readonly title: string;
+  readonly description?: string;
+  readonly fields: Readonly<Record<string, FieldSpec>>;
+}
+/** What a function returns, when it is a table row or a scalar. */
+interface ResultSchema {
+  /** Export name: `listTasksResult`. */
+  readonly name: string;
+  readonly title: string;
+  /** The function returns a set: the schema is an array. */
+  readonly set: boolean;
+  /** A single result may be `null`; for sets, each scalar item may be. */
+  readonly nullable: boolean;
+  readonly of: {
+    readonly kind: "row";
+    readonly table: string;
+  } | {
+    readonly kind: "scalar";
+    readonly scalar: ScalarKind;
+  };
+}
+interface ExtraSchemas {
+  readonly inputs: readonly ExtraSchema[];
+  readonly results: readonly ResultSchema[];
+}
+//#endregion
+//#region src/generators/json-schema-target.d.ts
+/** The JSON Schema dialects the generators and MCP emit. */
+type JsonSchemaTarget = "draft-2020-12" | "draft-07" | "openapi-3.0";
+//#endregion
+//#region src/generators/shared.d.ts
+/** What field planning reads: the metadata and the typed-jsonb config. */
+interface SchemaSource {
+  readonly meta: SchemaMeta;
+  readonly config: {
+    readonly json: Readonly<Record<string, unknown>>;
+  };
+  readonly runtimeImport?: string;
+}
+interface CommentEntry {
+  readonly id: number;
+  readonly schema: string;
+  readonly name: string;
+  readonly comment: string | null;
+}
+/**
+ * The catalog parts docs read: `GeneratorInput` satisfies it. Runtime callers
+ * that only have `meta` (OpenAPI, MCP) pass none and get no docs.
+ */
+interface DocsSource extends SchemaSource {
+  readonly introspection?: {
+    readonly tables: readonly CommentEntry[];
+    readonly views: readonly CommentEntry[];
+    readonly materializedViews?: readonly CommentEntry[];
+    readonly columns: readonly {
+      readonly table_id: number;
+      readonly name: string;
+      readonly comment: string | null;
+      readonly check: string | null;
+    }[];
+  };
+  readonly extras?: {
+    readonly tables: readonly {
+      readonly schema: string;
+      readonly name: string;
+      readonly checks: readonly {
+        readonly definition: string;
+      }[];
+    }[];
+  };
+}
+//#endregion
+//#region src/generators/json-schema.d.ts
+interface JsonSchemaGeneratorOptions {
+  /**
+   * Output path relative to the project root. Defaults to
+   * `<output>.schema.json`.
+   */
+  readonly output?: string;
+  /** `$id` of the document. */
+  readonly id?: string;
+  /**
+   * The dialect. `draft-2020-12` (the default) writes `$defs`; `draft-07` and
+   * `openapi-3.0` (`nullable`, `example`) write `definitions`.
+   */
+  readonly target?: JsonSchemaTarget;
+  /**
+   * Give each writable field a `title` label (from a short column comment or
+   * its name), for form builders that read JSON Schema.
+   */
+  readonly fieldMeta?: boolean;
+}
+type JsonSchema = Record<string, unknown>;
+/**
+ * JSON Schema `$defs` for every table: `customersRow`, `customersInsert`, ...
+ * `target` lowers the document to draft-07 or the OpenAPI 3.0 dialect, which
+ * keep the schemas under `definitions`.
+ */
+declare function buildJsonSchema(input: DocsSource, id?: string, target?: JsonSchemaTarget, extras?: ExtraSchemas): JsonSchema;
+/** Writes the JSON Schema document; `createOpenApi` reuses the same `$defs`. */
+declare function jsonSchema(options?: JsonSchemaGeneratorOptions): Generator;
+//#endregion
+//#region src/generators/factories.d.ts
+interface FactoriesGeneratorOptions {
+  /**
+   * Output path relative to the project root. Defaults to
+   * `<output>.factories.ts`.
+   */
+  readonly output?: string;
+  /**
+   * The table keys to write factories for. Defaults to every table, block
+   * tables included under their final names.
+   */
+  readonly tables?: readonly string[];
+  /**
+   * Where the file imports the factory runtime from. Defaults to
+   * `better-supabase/testing` (under `runtimeImport`).
+   */
+  readonly testingImport?: string;
+}
+/**
+ * Test factories, one per table: `factories.customers({ name })` returns an
+ * insert row with valid defaults for the required columns. Defaults respect
+ * enums, check-constraint bounds and `StoragePath` buckets. A foreign key takes
+ * the parent row or its id, and a column without a safe default is a required
+ * input. Block entities also get a factory under their singular noun
+ * (`factories.task`). The file imports `better-supabase/testing`.
+ */
+declare function factories(options?: FactoriesGeneratorOptions): Generator;
+//#endregion
+//#region src/generators/nuqs.d.ts
+interface NuqsGeneratorOptions {
+  /** Output path relative to the project root. Defaults to `<output>.nuqs.ts`. */
+  readonly output?: string;
+  /**
+   * The table keys to write search params for (`tasks`, `customerTags`).
+   * Defaults to every table, block tables included under their final names.
+   */
+  readonly tables?: readonly string[];
+  /** The page size `limit` defaults to. Defaults to 25. */
+  readonly limit?: number;
+}
+/**
+ * Search-param parsers for nuqs, one set per table list: a filter for every
+ * column with a closed set of values, `orderBy` over the sortable columns,
+ * `direction`, `cursor` and `limit`, with a cache, a loader and a serializer.
+ * The file imports `nuqs/server`, which the app installs.
+ */
+declare function nuqs(options?: NuqsGeneratorOptions): Generator;
+//#endregion
+//#region src/generators/standard-schema.d.ts
+interface StandardSchemaGeneratorOptions {
+  /**
+   * Output path relative to the project root. Defaults to
+   * `<output>.standard.ts`.
+   */
+  readonly output?: string;
+  /**
+   * Standard Schemas for typed jsonb columns: `{ 'customers.metadata':
+   * './schemas.ts#metadata' }`.
+   */
+  readonly json?: Readonly<Record<string, string>>;
+  /**
+   * Also export `fieldMeta`: a label, a required flag, enum options and bounds
+   * for each writable field, for building forms.
+   */
+  readonly fieldMeta?: boolean;
+}
+/**
+ * Standard Schemas for every table's Row, Insert and Update shape, with no
+ * validation library. Each one also converts to JSON Schema (Standard JSON
+ * Schema), and `validators` is what the generated schema checks writes with.
+ */
+declare function standardSchema(options?: StandardSchemaGeneratorOptions): Generator;
+//#endregion
+//#region src/generators/valibot.d.ts
+interface ValibotGeneratorOptions {
+  /**
+   * Output path relative to the project root. Defaults to
+   * `<output>.valibot.ts`.
+   */
+  readonly output?: string;
+  /**
+   * Schemas for typed jsonb columns: `{ 'customers.metadata':
+   * './schemas.ts#metadata' }`.
+   */
+  readonly json?: Readonly<Record<string, string>>;
+  /**
+   * Also export `fieldMeta`: a label, a required flag, enum options and bounds
+   * for each writable field, for building forms.
+   */
+  readonly fieldMeta?: boolean;
+}
+/** Valibot schemas for every table's Row, Insert and Update shape. */
+declare function valibot(options?: ValibotGeneratorOptions): Generator;
+//#endregion
+//#region src/generators/zod.d.ts
+interface ZodGeneratorOptions {
+  /** Output path relative to the project root. Defaults to `<output>.zod.ts`. */
+  readonly output?: string;
+  /**
+   * Schemas for typed jsonb columns: `{ 'customers.metadata':
+   * './schemas.ts#metadata' }`.
+   */
+  readonly json?: Readonly<Record<string, string>>;
+  /**
+   * `classic` (the default) imports `zod` and chains methods; `mini` imports
+   * `zod/mini` and uses its functional API (`z.nullable(...)`, `.check(...)`),
+   * which tree-shakes to a smaller bundle. Both need zod 4.
+   */
+  readonly flavor?: ZodFlavor;
+  /**
+   * Also export `fieldMeta`: a label, a required flag, enum options and bounds
+   * for each writable field, for building forms.
+   */
+  readonly fieldMeta?: boolean;
+}
+type ZodFlavor = "classic" | "mini";
+/**
+ * Zod 4 schemas for every table's Row, Insert and Update shape, for `zod` or,
+ * with `flavor: 'mini'`, `zod/mini`.
+ */
+declare function zod(options?: ZodGeneratorOptions): Generator;
+//#endregion
+//#region src/sql/modules/entitlements-checks.d.ts
+/** `entitlements.claim`: what `feature_claims` puts in the token. */
+type FeatureClaimOption = false | {
+  /** At most this many tenants, the lowest ids first. */
+  readonly maxTenants?: number;
+  /** Short codes written instead of the feature keys: `{ exports: "x" }`. */
+  readonly keys?: Readonly<Record<string, string>>;
+};
+//#endregion
+//#region src/sql/modules/entitlements-source.d.ts
+/** The table holding each tenant's Stripe customer id. */
+interface EntitlementsSource {
+  /** `table` or `schema.table`; unset uses the `organizations` module's. */
+  readonly table?: string;
+  /** Column with the Stripe customer id (`cus_...`). */
+  readonly column?: string;
+  /** Column with the tenant id. */
+  readonly key: string;
+  /**
+   * Where entitlements come from; the customer lookups are for `stripe-sync`
+   * only.
+   */
+  readonly source?: "stripe-sync" | "custom" | EntitlementPlansSource;
+  readonly claim?: FeatureClaimOption;
+}
+//#endregion
+//#region src/sql/modules/grants.d.ts
+/** Privileges one role gets on a table or view. */
+interface TableGrant {
+  /** `table` or `schema.table`. */
+  readonly table: string;
+  readonly role: "anon" | "authenticated" | "service_role";
+  readonly privileges: readonly string[];
+}
+/** The roles that may execute a function. */
+interface FunctionGrant {
+  /** `name(argument types)` or `schema.name(argument types)`. */
+  readonly function: string;
+  readonly roles: readonly ("anon" | "authenticated" | "service_role")[];
+}
+//#endregion
+//#region src/sql/modules/vector-search.d.ts
+/** An embedding column `db.$search` can query. */
+interface VectorSearchTable {
+  /** `table` or `schema.table`. */
+  readonly table: string;
+  readonly column: string;
+  readonly distance: "cosine" | "l2" | "inner_product";
+  /** The column's type: pgvector's `vector` (default) or `halfvec`. */
+  readonly type?: "vector" | "halfvec";
+  /** The primary key column the scores function returns. Defaults to `id`. */
+  readonly key?: string;
+  /** Full-text ranking fused with the vector ranking (reciprocal rank fusion). */
+  readonly hybrid?: {
+    readonly tsvector: string;
+    /** The text search configuration of the query. Defaults to `simple`. */
+    readonly config?: string;
+    /** The RRF constant. Defaults to 60. */
+    readonly k?: number;
+  };
+  /**
+   * A SQL expression over the row `t` the score is multiplied by, such as
+   * `t.priority`.
+   */
+  readonly boost?: string;
+  /** Columns `filter` narrows before ranking, such as `organization_id`. */
+  readonly prefilter?: readonly string[];
+  /** A SQL condition over the row `t` every candidate must meet. */
+  readonly predicate?: string;
+  /** How `boost` combines with the score. Defaults to `multiply`. */
+  readonly boostMode?: "multiply" | "add";
+  /** A SQL `order by` list over the row `t` that breaks score ties. */
+  readonly order?: string;
+}
+//#endregion
+//#region src/sql/shared.d.ts
+/**
+ * The name `addNotNullCheck` gives the check on `column` of `table`, both
+ * quoted or bare, the table with or without its schema:
+ * `<table>_<column>_not_null`, shortened with a hash past 63 bytes.
+ */
+declare function notNullCheckName(table: string, column: string): string;
+/**
+ * A `pg_jsonschema` check on a jsonb column, for the `jsonb-schemas` module and
+ * key-value tables.
+ */
+interface JsonSchemaCheck {
+  /** `table` or `schema.table`. */
+  readonly table: string;
+  readonly column: string;
+  readonly schema: Readonly<Record<string, unknown>>;
+  /**
+   * Checks only rows whose `where.column` equals `where.value` (a settings
+   * key).
+   */
+  readonly where?: {
+    readonly column: string;
+    readonly value: string;
+  };
+}
+//#endregion
+//#region src/sql/module-types.d.ts
+/** The step from one module version to the next, for `upgrade`. */
+interface BlockSqlUpgrade {
+  /** The installed version this step upgrades from. */
+  readonly from: number;
+  readonly description: string;
+  /** SQL run before the module's current file, e.g. renames and backfills. */
+  readonly sql: (ctx: BlockSqlContext) => string;
+}
+/**
+ * A renamed module symbol. It keeps a compatibility wrapper for at least one
+ * minor release, then is removed; doctor reports uses of both (BS309), and the
+ * name stays reserved.
+ */
+interface BlockSqlDeprecation {
+  readonly kind: "function" | "claim" | "table" | "column";
+  /**
+   * The old name: `schema.function`, a claim name, `schema.table` or
+   * `table.column`.
+   */
+  readonly symbol: string;
+  /** What to use instead. */
+  readonly use: string;
+  /** The package version that deprecated it. */
+  readonly since: string;
+  /** The package version that removed it; until then `wrapper` is written. */
+  readonly removed?: string;
+  /**
+   * The compatibility wrapper the module file keeps, e.g. a function with the
+   * old name that calls the new one and a `comment on function ... is
+   * 'deprecated: use X'`.
+   */
+  readonly wrapper?: (ctx: BlockSqlContext) => string;
+}
+/**
+ * SQL modules for `better-supabase add`. Every module is idempotent (`create or
+ * replace`, `if not exists`), so re-running it upgrades in place.
+ */
+interface BlockSql {
+  readonly name: string;
+  readonly title: string;
+  readonly description: string;
+  /** Modules this one needs, added along with it. */
+  readonly requires: readonly string[];
+  /**
+   * The scopes the module runs in. A module that needs tenants declares
+   * `["tenant"]`; unset, it runs in every scope. Outside `tenant` scope a
+   * module needs neither `tenant` nor `access`, so they drop from `requires`.
+   */
+  readonly scopes?: readonly BlockScope[];
+  /**
+   * A module this one renders and is numbered ahead of, for a module that owns
+   * a subject table the `case` checks of `comments` or `attachments` name, or
+   * that `search` puts its index trigger on. The file takes the number before
+   * it, so later files keep theirs.
+   */
+  readonly before?: string;
+  /** What it needs instead when an authorization provider supplies memberships. */
+  readonly providerRequires?: readonly string[];
+  /**
+   * The optional `authorization.functions` templates it calls under the
+   * `provider` access model, such as `idsWithFor` to check another user. Doctor
+   * warns (BS411) when the provider doesn't set one.
+   */
+  readonly providerFunctions?: readonly (keyof AuthorizationFunctions)[];
+  /**
+   * Modules it works with when they are installed, without needing them.
+   * `ctx.installed` and `ctx.of` accept only these and what it requires;
+   * `record` reaches the outbox and the audit log without listing them. `*`
+   * stands for every module, for one that reads them all (`data-lifecycle`).
+   */
+  readonly integrates?: readonly string[];
+  /**
+   * What it adds to generic blocks (approvals, bulk actions, share links and
+   * the subject functions) that read it without naming it. Each function gets
+   * this block's context and the generic block's.
+   */
+  readonly contributes?: BlockContributes;
+  /**
+   * What it needs for this layout, e.g. per `blocks.permissions.model`;
+   * overrides both.
+   */
+  readonly dependencies?: (layout: BlockSqlLayout) => readonly string[];
+  /** `schema` files go with your schemas; `test` files go to `supabase/tests`. */
+  readonly target: "schema" | "test";
+  /** The module built for the default layout. */
+  readonly sql: string;
+  /** Bumped when installed databases need an upgrade step. Defaults to 1. */
+  readonly version?: number;
+  /** The modes `blocks.<name>.ownership` accepts. Defaults to `managed` only. */
+  readonly modes?: readonly BlockMode[];
+  /**
+   * The logical tables and columns `blocks.<name>.tables` and `columns` map. A
+   * table's entry is its spec; its `app` says whether it can be a table the app
+   * already has (`BlockSqlAppTable`).
+   */
+  readonly names?: BlockSqlNames;
+  /** The functions other modules and the TypeScript side call. */
+  readonly contract?: (ctx: BlockSqlContext) => readonly BlockSqlContractFunction[];
+  /** Renders the module for a layout. */
+  readonly build: (ctx: BlockSqlContext, layout: BlockSqlLayout) => string;
+  /**
+   * SQL appended after the module's body that depends on the whole layout, for
+   * example the grants for the tables in `expose`. Unlike `build`, it stays out
+   * of what `api` wrappers and extension scans read.
+   */
+  readonly extras?: (ctx: BlockSqlContext, layout: BlockSqlLayout) => string;
+  readonly upgrades?: readonly BlockSqlUpgrade[];
+  readonly deprecated?: readonly BlockSqlDeprecation[];
+  /**
+   * Rows, role settings and calls that a schema diff doesn't capture. They go
+   * to `better-supabase-data/` next to the schema folder and a migration (`sql
+   * data`) instead of the schema file.
+   */
+  readonly data?: (ctx: BlockSqlContext, layout: BlockSqlLayout) => string;
+  /**
+   * PgTAP files for this layout, written to the tests folder next to the
+   * `pgtap` module's.
+   */
+  readonly tests?: (ctx: BlockSqlContext, layout: BlockSqlLayout) => readonly BlockSqlTestFile[];
+  readonly topics?: (ctx: BlockSqlContext) => readonly string[];
+  readonly permissionKeys?: (ctx: BlockSqlContext) => readonly {
+    readonly action: string;
+    readonly key: string;
+    readonly scope: "tenant" | "platform";
+    readonly setting: string;
+  }[];
+  /**
+   * Functions granted to `anon` or `authenticated` only so the module's
+   * policies and triggers can call them as the client. `api` writes no entry
+   * point for them.
+   */
+  readonly internal?: readonly string[];
+  /**
+   * Soft-delete columns, as logical `table.column`: a write can set them to
+   * hide a row but never clear them again, so doctor BS213 doesn't count them
+   * as columns that grant access.
+   */
+  readonly hidingColumns?: readonly string[];
+  /** The app's tables outside `names.tables` that the module writes columns of. */
+  readonly appSubjectTables?: (ctx: BlockSqlContext) => readonly BlockSqlAppSubjectTable[];
+}
+/**
+ * How one of a module's tables can be a table the app already has (ADR 0098).
+ * It sits on the table's entry in `names.tables` (`app`), next to `columns`,
+ * `optional` and `typed`, which together make the table's spec:
+ *
+ * - The required columns are those in `columns` that aren't `optional` or
+ *   `unused`. The module adds each one the app's table lacks with `add column
+ *   if not exists`, nullable unless it has a default, and doctor (BS330) and
+ *   `add --adopt` check and propose them.
+ * - The optional columns may be mapped to `null` in `blocks.<name>.columns`; the
+ *   module then leaves out the feature that needs them.
+ * - The `typed` columns may be an enum or a domain on the app's table; the module
+ *   writes them through `ctx.cast`.
+ *
+ * When `layout.ownTables` has the table, `ctx.owns(table)` is false: the module
+ * skips its `create table` and lays its functions, policies, triggers and
+ * indexes over the app's table. A table whose entry has no `app` is always the
+ * module's: it creates it, and a table of that name in the app's schema is an
+ * error.
+ */
+interface BlockSqlAppTable {
+  /**
+   * The app's table only when `blocks.<name>.tables` maps it. Unmapped, the
+   * module creates its own, so an app table with the default name is an error.
+   */
+  readonly onlyWhenMapped?: boolean;
+  /**
+   * Logical columns this configuration doesn't use, such as the secret column
+   * when secrets live in Vault. They are neither required nor checked.
+   */
+  readonly unused?: (ctx: BlockSqlContext) => readonly string[];
+}
+/**
+ * A table of the app's outside `names.tables` that a module writes columns of,
+ * such as a subject table that `blocks.<name>.on.<type>` names. A null column
+ * is mapped away; doctor and `upgrade` check the others exist.
+ */
+interface BlockSqlAppSubjectTable {
+  readonly logical: string;
+  readonly schema: string;
+  readonly table: string;
+  readonly columns: Readonly<Record<string, string | null>>;
+}
+/** A pgTAP file a module writes for the layout, e.g. one per audited table. */
+interface BlockSqlTestFile {
+  /** The file name's suffix, after the module's slug. */
+  readonly name: string;
+  readonly sql: string;
+}
+declare const blockSqlVersion: (module: BlockSql) => number;
+interface BlockSqlFile {
+  readonly module: string;
+  /** The instance, when it installs `module` under another name. */
+  readonly instance?: string;
+  /** `schema` and `test` files are diffed; `data` files go in a migration too. */
+  readonly kind: "schema" | "data" | "test";
+  readonly path: string;
+  readonly contents: string;
+}
+interface BlockSqlLayout {
+  /**
+   * `config.instances`. An instance that installs a block under another name
+   * renders its own files; `modules` holds the instances named after their
+   * block.
+   */
+  readonly instances?: Readonly<Record<string, ResolvedInstance>>;
+  /** Directory for schema modules. Defaults to `supabase/schemas`. */
+  readonly dir?: string;
+  /**
+   * The declarative schema folder the diff engine loads. Defaults to
+   * `supabase/schemas`.
+   */
+  readonly schemasDir?: string;
+  /** File prefix. Defaults to `900_better_supabase`. */
+  readonly prefix?: string;
+  /** Directory for pgTAP files. Defaults to `supabase/tests`. */
+  readonly testsDir?: string;
+  /**
+   * The `better_supabase.audit(...)` calls in the SQL files: the `audit` module
+   * writes a pgTAP file per table.
+   */
+  readonly auditedTables?: readonly AuditedTable[];
+  /**
+   * Ignored: the header names only the module, so a release doesn't rewrite
+   * every file. The `@bsb-block name@N` marker carries the module version.
+   *
+   * @deprecated Remove it; it has no effect.
+   */
+  readonly version?: string;
+  /**
+   * `config.realtime.tables`: registered at the end of the `realtime-tables`
+   * module.
+   */
+  readonly realtimeTables?: readonly string[];
+  /** `config.realtime.global`: tables registered with `tenant_column => null`. */
+  readonly realtimeGlobal?: readonly string[];
+  /** `config.realtime.users`: tables registered with `user_column`. */
+  readonly realtimeUsers?: Readonly<Record<string, string>>;
+  /** Tenant column passed to `track_realtime` for the other tables. */
+  readonly tenantColumn?: string;
+  /** Check constraints for the `jsonb-schemas` module. */
+  readonly jsonSchemas?: readonly JsonSchemaCheck[];
+  /** `config.expose`: the grants the `grants` module writes. */
+  readonly grants?: readonly TableGrant[];
+  /** `config.expose` functions: the roles that may execute each one. */
+  readonly functionGrants?: readonly FunctionGrant[];
+  /**
+   * Grants the permissive policies in the schema files imply, for
+   * `blocks['grants'].options.fromPolicies`. Tables in `grants` keep their
+   * listed privileges.
+   */
+  readonly policyGrants?: readonly TableGrant[];
+  /**
+   * The tables the schema files create, for
+   * `blocks['sessions'].options.policies`.
+   */
+  readonly declaredTables?: readonly string[];
+  /**
+   * `schema.table` of each table the app already has, to the schema file that
+   * creates it or `database`. A block leaves these tables alone and adds only
+   * the columns it needs, and an app table refuses their names.
+   */
+  readonly ownTables?: Readonly<Record<string, string>>;
+  /** The columns of the tables in `ownTables`, where they are known. */
+  readonly ownColumns?: Readonly<Record<string, readonly string[]>>;
+  /**
+   * The trigger that already keeps `updated_at` current on a table in
+   * `ownTables`, by `schema.table`. A block adds no `updated_at` trigger
+   * there.
+   */
+  readonly ownUpdatedAtTriggers?: Readonly<Record<string, string>>;
+  /**
+   * The app's own policies on a table in `ownTables`, by `schema.table`. A
+   * block adds no permissive policy that one of them already covers.
+   */
+  readonly ownPolicies?: Readonly<Record<string, readonly CatalogPolicy[]>>;
+  /**
+   * The declared tables with row level security on, for tables `fromPolicies`
+   * makes service-only.
+   */
+  readonly rlsTables?: readonly string[];
+  /**
+   * The foreign keys the schema files declare, for
+   * `blocks.memberships.options.sameTenant.auto`.
+   */
+  readonly foreignKeys?: readonly DeclaredForeignKey[];
+  /**
+   * Each declared table's columns, `schema.table` to names, for
+   * `sameTenant.auto`.
+   */
+  readonly declaredColumns?: Readonly<Record<string, readonly string[]>>;
+  /** `config.readSets`, compiled: the functions the `read-sets` module writes. */
+  readonly readSets?: readonly {
+    readonly name: string;
+    readonly sql: string;
+  }[];
+  /**
+   * `config.entitlements`: where the `entitlements` module finds each tenant's
+   * Stripe customer.
+   */
+  readonly entitlements?: EntitlementsSource;
+  /**
+   * `config.vectorSearch`: the tables the `vector-search` module writes a
+   * search function for.
+   */
+  readonly vectorSearch?: readonly VectorSearchTable[];
+  readonly vectorSchema?: string;
+  /** `config.claims`: claim names the modules read and write. */
+  readonly claims?: ClaimsMeta;
+  /**
+   * The authorization provider's memberships: `entitlements` reads them instead
+   * of `tenant`'s.
+   */
+  readonly entitlementsProvider?: BlockSqlEntitlementsProvider;
+  /** The authorization provider the `access` module's `provider` model calls. */
+  readonly accessProvider?: BlockSqlAccessProvider;
+  /** `config.blocks`: modes, names and permission keys per module. */
+  readonly modules?: AnyBlocksConfig;
+  /** `sql.scope`: the scope of every block that sets none. Defaults to `tenant`. */
+  readonly scope?: BlockScope;
+  /** `config.records`: the app-wide subject registry (ADR 0020). */
+  readonly subjects?: SubjectsConfig;
+  /**
+   * `config.appTables`: the tables the app owns, rendered after the blocks (ADR
+   * 0040).
+   */
+  readonly appTables?: AppTablesConfig;
+  /** The authorization provider's permission keys, for `api-keys` scopes. */
+  readonly permissionCatalog?: readonly string[];
+  /**
+   * `authorization.delegation.scopes`: the access module's `scope_permissions`
+   * (with `blocks.permissions.scopes` merged over it).
+   */
+  readonly delegationScopes?: Readonly<Record<string, readonly string[]>>;
+}
+/**
+ * Where the `entitlements` module reads the provider's memberships, and the
+ * tables behind them.
+ */
+interface BlockSqlEntitlementsProvider {
+  /** The provider's name, for comments. */
+  readonly name: string;
+  /** The provider scope tenants are, e.g. `organization`. */
+  readonly scope: string;
+  readonly idType: BlockSqlIdType;
+  /** `authorization.functions.memberIds`. */
+  readonly memberIds: string;
+  /** `authorization.functions.memberIdsFor`. */
+  readonly memberIdsFor: string;
+  readonly memberships: readonly AuthorizationMembership[];
+}
+/** What the `access` module's `provider` model calls. */
+interface BlockSqlAccessProvider {
+  /** The provider's name, for comments and errors. */
+  readonly name: string;
+  /** The provider scope tenants are. */
+  readonly scope: string;
+  /** Every scope it declares, for `on.<type>.scope`. */
+  readonly scopes?: readonly string[];
+  readonly idType: BlockSqlIdType;
+  readonly functions: AuthorizationFunctions;
+  /** The access module's `disabled` setting defaults to these. */
+  readonly suspension?: {
+    readonly user?: DisabledRow;
+    readonly tenant?: DisabledRow;
+  };
+  /**
+   * An adopted `tenant` module on one of these tables reads role names the same
+   * way.
+   */
+  readonly roleSources?: readonly AuthorizationRoleSource[];
+  /** How `ai-chat` applies `functions.canApprove`. */
+  readonly approvals?: {
+    readonly distinctApprover?: boolean;
+  };
+  /** The provider's operations table; `operationPermission` reads it. */
+  readonly operations?: Readonly<Record<string, AuthorizationOperation>>;
+}
+//#endregion
+//#region src/sql/resolved-names.d.ts
+/** One of a module's entities with the name the config gives it. */
+interface ResolvedEntity {
+  readonly key: string;
+  /** The logical table that holds it; global entities may have none. */
+  readonly table?: string;
+  readonly from: EntityNoun;
+  readonly to: EntityNoun;
+  readonly primary: boolean;
+  /** Renamed in every module (the tenant). */
+  readonly global: boolean;
+  /** `blocks.<name>.entities.<entity>.url`, with logical column placeholders. */
+  readonly url?: string;
+  /**
+   * What makes the entity a subject, or undefined when it isn't one or the
+   * config sets `subject: false`.
+   */
+  readonly subject?: BlockSqlEntitySubject;
+}
+/**
+ * A module's final names for one config: its entities as renamed and the
+ * renamer every name goes through (the tenant rename, then the module's own).
+ */
+interface ResolvedNames {
+  readonly module: string;
+  readonly entities: Readonly<Record<string, ResolvedEntity>>;
+  /** The tenant's noun, `organization` unless the tenant block renames it. */
+  readonly tenant: EntityNoun;
+  /** Tables, columns, functions, hooks and triggers: tenant and own entities. */
+  readonly naming: EntityNames;
+  /**
+   * Event types, payload keys, subjects, permission keys and TypeScript names:
+   * the module's own entities. The tenant rename leaves them alone, as it
+   * always has.
+   */
+  readonly entityNaming: EntityNames;
+}
+//#endregion
+//#region src/sql/scope.d.ts
+/**
+ * How a module checks who may reach a row, for the block's scope. Modules call
+ * these instead of naming the access contract (`can`, `tenant_ids_with`,
+ * `is_platform`) or the tenant module's helpers, so the same module runs per
+ * tenant, per user or in one shared space. In `tenant` scope each one renders
+ * the access contract call it replaces.
+ */
+interface BlockSqlScope {
+  readonly kind: BlockScope;
+  /**
+   * The type of a scope id: the tenant id type, or `uuid` (a user id) in `user`
+   * scope.
+   */
+  readonly idType: BlockSqlIdType;
+  /**
+   * The type of a managed table's scope column: `<idType> not null` per tenant,
+   * nullable outside it (`uuid default auth.uid()` per user).
+   */
+  column(): string;
+  /** True when the caller holds `permission` (a SQL expression) in scope `id`. */
+  can(id: string, permission: string): string;
+  /** True when `user` (a uuid expression) holds `permission` in scope `id`. */
+  canUser(user: string, id: string, permission: string): string;
+  /**
+   * PL/pgSQL that sets the scope id parameter `param` for the scope: the
+   * caller's id per user (the service role keeps what it passes), null in the
+   * shared space. Empty per tenant.
+   */
+  bind(param: string): string;
+  /**
+   * A scope id argument as an expression: as passed per tenant, the caller's id
+   * when it is null per user, null in the shared space.
+   */
+  value(param: string): string;
+  /**
+   * A set-returning call of the scope ids the caller holds `permission` in,
+   * usable as `select ...`, `x in (select ...)` and `from ... x`.
+   */
+  ids(permission: string): string;
+  /** A row policy check: `column` is a scope the caller holds `permission` in. */
+  check(column: string, permission: string): string;
+  /** `a = b` for scope ids, null-safe in `none` scope where they are null. */
+  eq(a: string, b: string): string;
+  /**
+   * `is_platform(permission)`: whether the caller is platform staff holding
+   * `permission`. `false` outside `tenant` scope without the access module.
+   */
+  platform(permission: string): string;
+  /** A set-returning call of the tenants the caller is a member of. */
+  members(): string;
+  /**
+   * True when the caller holds a guest grant for `action` on record `type`/`id`
+   * in tenant `tenant` (ADR 0070). A guest is not a member, so `can` stays
+   * false for them. `false` without the `guests` module and without a provider
+   * that answers for guests, and outside `tenant` scope.
+   */
+  guest(tenant: string, type: string, id: string, action: GuestAction): string;
+  /**
+   * True when the caller is a guest of tenant `tenant` who represents the party
+   * `type`/`id`, such as the customer an invoice is addressed to. `false` where
+   * `guest` is.
+   */
+  guestParty(tenant: string, type: string, id: string): string;
+}
+//#endregion
+//#region src/sql/context.d.ts
+/** The scope id types SQL modules render. */
+declare const MODULE_ID_TYPES: readonly ["uuid", "text", "bigint", "integer"];
+type BlockSqlIdType = (typeof MODULE_ID_TYPES)[number];
+declare const isBlockSqlIdType: (value: string) => value is BlockSqlIdType;
+/**
+ * A Postgres type name as one of `MODULE_ID_TYPES`: case and spacing are
+ * normalised and aliases such as `int8` resolved. `undefined` for any other
+ * type, so callers refuse it instead of guessing.
+ */
+declare function moduleIdType(value: string): BlockSqlIdType | undefined;
+/** One logical table of a module: its default name and logical columns. */
+interface BlockSqlTableSpec {
+  /** Default name, in the module's schema. */
+  readonly name: string;
+  /** Logical column to default column name. */
+  readonly columns: Readonly<Record<string, string>>;
+  /**
+   * Logical columns an adopted table may lack (mapped to `null`): the module
+   * leaves out the feature that needs them.
+   */
+  readonly optional?: readonly string[];
+  /** The app may lack the whole table (`blocks.<name>.tables.<table>: null`). */
+  readonly optionalTable?: boolean;
+  /**
+   * How the table can be a table the app already has (ADR 0098). Without it the
+   * module always creates the table.
+   */
+  readonly app?: BlockSqlAppTable;
+  readonly lifecycle?: BlockSqlTableLifecycle;
+  /**
+   * Text columns an adopted table may declare with another type, such as an
+   * enum: the module writes and compares them through `ctx.cast`.
+   */
+  readonly typed?: readonly string[];
+}
+interface BlockSqlTableLifecycle {
+  readonly user?: string;
+  readonly tenant?: string;
+  readonly purge?: boolean;
+  readonly omit?: readonly string[];
+  readonly export?: boolean;
+  /**
+   * Columns that hold a `credential_ref`. Exports leave them out, and the
+   * organization purger revokes each ref that carries the row's tenant through
+   * the `CredentialProvider` before the purge deletes the row.
+   */
+  readonly credentials?: readonly string[];
+  /** Revoke for the row's `user` instead of the app. Default `app`. */
+  readonly credentialSubject?: "app" | "user";
+}
+/**
+ * What makes an entity a `config.records` entry when the block is installed.
+ * Columns are the table's logical columns; permissions are module actions.
+ */
+interface BlockSqlEntitySubject {
+  readonly title: string;
+  readonly deletedAt?: string;
+  readonly permissions: {
+    readonly read: string;
+    readonly write: string;
+    /**
+     * The action whose key `attachments` checks for files on the entity, in
+     * place of `attachments.upload`. Set it when the table's own write policies
+     * check more than tenant membership (doctor BS345).
+     */
+    readonly upload?: string;
+  };
+  readonly rank?: {
+    readonly column: string;
+    readonly group: string;
+  };
+  readonly search?: {
+    readonly title: string;
+    readonly body: readonly string[];
+  };
+  readonly url?: string;
+  readonly cascade?: boolean;
+}
+/**
+ * A noun the module names its tables, functions, events, permissions and hooks
+ * after (`work_item`), renamed through `blocks.<name>.entities`.
+ */
+interface BlockSqlEntitySpec {
+  /** The logical table that holds the entity; global entities may have none. */
+  readonly table?: string;
+  readonly singular: string;
+  /** Defaults to the English plural of `singular`. */
+  readonly plural?: string;
+  /** The entity `entities: "<noun>"` renames. */
+  readonly primary?: boolean;
+  /** Renamed in every module, not only this one (the tenant). */
+  readonly global?: boolean;
+  readonly subject?: BlockSqlEntitySubject;
+}
+interface BlockSqlNames {
+  readonly tables: Readonly<Record<string, BlockSqlTableSpec>>;
+  readonly entities?: Readonly<Record<string, BlockSqlEntitySpec>>;
+  /**
+   * The `before_*` and `after_*` hooks the module calls, so
+   * `blocks.<name>.hooks.functions` is checked.
+   */
+  readonly hooks?: readonly string[];
+  /**
+   * The `blocks.<name>.options` keys the module reads; any other key is
+   * rejected.
+   */
+  readonly options?: readonly string[];
+  /**
+   * The events the module records, typed against its block's event map
+   * (`BlockSqlEvents<MessagingEvents>`); `record` rejects any other type.
+   */
+  readonly events?: Readonly<Record<string, CheckedEventSpec | undefined>>;
+  /**
+   * Tables and columns the module renamed between versions. `upgrade` renames
+   * them on installs below `from + 1`, after the config's entity and table
+   * renames, so a declared move needs no hand-written upgrade step.
+   */
+  readonly migrations?: readonly BlockSqlNameMigration[];
+}
+/**
+ * One version's table and column moves. Old names are the module's default
+ * names before the move; they go through the entity renames like every other
+ * name.
+ */
+interface BlockSqlNameMigration {
+  /** The installed version this move upgrades from. */
+  readonly from: number;
+  readonly description: string;
+  /** The logical table, under its current key. */
+  readonly table: string;
+  /** The table's default name before the move, when the move renamed it. */
+  readonly was?: string;
+  /** Logical column to its default name before the move. */
+  readonly columns?: Readonly<Record<string, string>>;
+}
+interface CheckedEventSpec {
+  readonly subject: string;
+  readonly payload: readonly string[];
+  readonly retries?: boolean;
+}
+/** An event a module writes to the outbox, as SQL expressions. */
+interface BlockSqlEmit {
+  /** The event type, e.g. `organization.created`. */
+  readonly type: string;
+  /** A `jsonb` expression. */
+  readonly payload: string;
+  /** A `text` expression, e.g. `'organizations/' || new_organization`. */
+  readonly subject?: string;
+  /** The tenant id expression; it is cast to text. */
+  readonly tenant?: string;
+  /** A `text` idempotency key expression. */
+  readonly key?: string;
+}
+/**
+ * The categories module actions are audited under. An adopted log with its own
+ * names maps them through `blocks.audit.options.values.category`.
+ */
+declare const AUDIT_CATEGORIES: readonly ["membership", "access", "security", "configuration", "billing", "data", "ai", "integration", "read"];
+type AuditCategory = (typeof AUDIT_CATEGORIES)[number];
+/** How `record` writes an action to the audit log, as SQL expressions. */
+interface BlockSqlAudit {
+  /** The audit category, mapped through `blocks.audit.options.values`. */
+  readonly category: AuditCategory;
+  /** What the action changed, e.g. `user` or `api_key`. */
+  readonly targetType?: string;
+  /** A `text` expression for the changed record's id. */
+  readonly recordId?: string;
+  /** A `text` expression people recognize the target by. */
+  readonly targetLabel?: string;
+  /** A `text` expression that says what happened. */
+  readonly summary?: string;
+  /** A `jsonb` expression; defaults to the event payload. */
+  readonly metadata?: string;
+  /** A `uuid` expression for the actor; defaults to the caller. */
+  readonly actor?: string;
+  /**
+   * A `uuid` expression for the support session the action belongs to. Defaults
+   * to the session in the caller's `act` claim, which wins when set.
+   */
+  readonly supportSession?: string;
+  /**
+   * A `uuid` expression for the admin acting as the user; defaults to
+   * `act.sub`.
+   */
+  readonly impersonatedBy?: string;
+  /**
+   * A `text` expression for why the admin acts as the user; defaults to
+   * `act.reason`.
+   */
+  readonly impersonationReason?: string;
+}
+/**
+ * An action a module records once: the outbox gets it as an event and the audit
+ * log as an entry, each when its module is installed.
+ */
+interface BlockSqlAction extends BlockSqlEmit {
+  /**
+   * How the action is audited, or `false` for an event that is not an audited
+   * action, such as a chat message or a run status.
+   */
+  readonly audit: BlockSqlAudit | false;
+}
+/**
+ * A function of a module's contract: what other modules and the TypeScript side
+ * call.
+ */
+interface BlockSqlContractFunction {
+  readonly name: string;
+  /** Argument types; `{id}` stands for the module's id type. */
+  readonly args: readonly string[];
+  readonly returns: string;
+}
+/** What a module's `build` reads: resolved names for one layout. */
+interface BlockSqlContext {
+  readonly module: string;
+  /**
+   * The instance being rendered: the module's name, or the `blocks` key of an
+   * instance that installs the module under another name.
+   */
+  readonly instance: string;
+  /**
+   * `blocks.<instance>.on`: the record types the instance attaches to, as a
+   * list or keyed by type with settings. Unset, it attaches to every one.
+   */
+  readonly on: InstanceOn | undefined;
+  readonly mode: BlockMode;
+  readonly config: ResolvedBlock;
+  /** The quoted schema of the module's functions and managed tables. */
+  readonly schema: string;
+  readonly schemaName: string;
+  readonly idType: BlockSqlIdType;
+  readonly claims: ClaimsMeta;
+  readonly modules: AnyBlocksConfig;
+  /** The app-wide subject registry (`config.records`). */
+  readonly subjects: SubjectsConfig;
+  /**
+   * The names of `config.appTables`, created in `public` after every block
+   * file, so a block can't put a trigger on one (ADR 0043).
+   */
+  readonly appTables: ReadonlySet<string>;
+  /**
+   * Who the module's rows belong to, and the checks for it: the port every
+   * tenant, user or shared-space check goes through.
+   */
+  readonly scope: BlockSqlScope;
+  /**
+   * The module's final names: its entities as `blocks.<name>.entities` and
+   * `blocks.memberships.names.organization` rename them.
+   */
+  readonly resolved: ResolvedNames;
+  /** The renamer every default name goes through (`resolved.naming`). */
+  readonly naming: EntityNames;
+  /**
+   * Every configured block's entity renames as one, for names that span blocks,
+   * such as the permission keys in the default roles.
+   */
+  blockNaming(): EntityNames;
+  /**
+   * The entity renames of each block installed under another name, such as
+   * `tickets` from `tasks`, for the permission keys each instance adds.
+   */
+  instanceNamings(): readonly EntityNames[];
+  /**
+   * What the installed instances whose `uses` names this instance add to it
+   * through `contributes`, in block order. Custom-mode instances add nothing.
+   */
+  contributions<K extends keyof BlockContributions>(block: K): readonly BlockContributions[K][];
+  /**
+   * `schema.name` of a module function, quoted. The name is the default one;
+   * `blocks.<name>.entities` and `blocks.<name>.functions` rename it.
+   */
+  fn(name: string): string;
+  /** The unquoted name a module function is written under (see `fn`). */
+  fnName(name: string): string;
+  /** `blocks.<name>.functions` keys no `fn` call has asked for yet. */
+  unusedFunctions(): readonly string[];
+  /** Default name to written name, for every function `fn` renamed so far. */
+  functionRenames(): ReadonlyMap<string, string>;
+  /** `schema.table` of a logical table, quoted. */
+  table(logical: string): string;
+  /** The unquoted schema and name of a logical table. */
+  tableName(logical: string): {
+    readonly schema: string;
+    readonly name: string;
+  };
+  /** A logical column, quoted. Throws when an adopted table lacks it. */
+  col(table: string, column: string): string;
+  /** A logical column, unquoted. Throws when an adopted table lacks it. */
+  colName(table: string, column: string): string;
+  /** Whether a logical column exists (adopted tables can map it to `null`). */
+  has(table: string, column: string): boolean;
+  /**
+   * `value`, a text expression, as the type of a logical column the table spec
+   * lists in `typed`. On a table the app has, the column may be an enum or
+   * another type with a text input, so the value goes through
+   * `better_supabase.as_column_type`; on the module's own table it stays as it
+   * is.
+   */
+  cast(table: string, column: string, value: string): string;
+  /** Whether an optional logical table exists (it can be mapped to `null`). */
+  hasTable(table: string): boolean;
+  /** Whether the module renders its managed SQL (not adopt or custom mode). */
+  readonly manages: boolean;
+  /** Whether the module creates `table`, which the app doesn't have. */
+  owns(table: string): boolean;
+  /** The logical tables the app has; the module only adds their columns. */
+  readonly appOwned: readonly string[];
+  readonly names: BlockSqlNames;
+  readonly installedModules: readonly string[];
+  /** The permission key for a module action, as a SQL literal. */
+  permission(action: string, fallback: string): string;
+  /** The permission key for a module action. */
+  permissionKey(action: string, fallback: string): string;
+  /** A trigger name with the module's prefix, quoted. */
+  trigger(name: string): string;
+  /** Whether `module` is installed alongside this one. */
+  installed(module: string): boolean;
+  /** The context of another module in the same layout. */
+  of(module: string): BlockSqlContext;
+  /** A string module option (`blocks.<name>.options`). */
+  text(name: string, fallback: string): string;
+  number(name: string, fallback: number): number;
+  flag(name: string, fallback: boolean): boolean;
+  /** A module option that is a list of strings. */
+  list(name: string, fallback: readonly string[]): readonly string[];
+  /** A declared module option as configured, for object-shaped options. */
+  option(name: string): unknown;
+  /**
+   * `options.extraColumns` (column name to SQL type), checked: names are
+   * lower-case identifiers, types are SQL types, and no name shadows one of
+   * `table`'s mapped columns or a key in `reserved`, the stable keys the
+   * module's read functions return next to them.
+   */
+  extraColumns(table: string, reserved?: readonly string[]): readonly ExtraColumn[];
+  /**
+   * PL/pgSQL that calls the app's hook function when it exists, with `[type,
+   * expression]` arguments: `if to_regprocedure(...) is not null then execute
+   * format(...) using ...; end if;`. The name comes from `to_regprocedure`
+   * rather than a literal: plpgsql_check (`supabase db lint`) checks constant
+   * dynamic SQL and fails when the hook is missing.
+   */
+  hook(name: string, args: readonly (readonly [string, string])[]): string;
+  /** The app function a hook calls, quoted, for hooks that return a value. */
+  hookTarget(name: string): string;
+  /**
+   * PL/pgSQL that writes the event to the outbox (`emit_event`) when the
+   * `outbox` module is installed and `blocks.<name>.events` isn't false;
+   * otherwise an empty string. `record` without the audit entry.
+   */
+  emit(event: BlockSqlEmit): string;
+  /**
+   * PL/pgSQL that writes the action to the outbox (as `emit` does) and, when it
+   * carries `audit` and the `audit` module is installed, to the audit log
+   * (`audit_event`), with `key` as the idempotency key of both. `null;` when
+   * neither applies, so it is always a valid statement.
+   */
+  record(action: BlockSqlAction): string;
+  /**
+   * PL/pgSQL that writes the action to the audit log only, with no outbox
+   * event, for reads that leave no change behind. `null;` without the `audit`
+   * module or when `audit` is `false`.
+   */
+  audit(action: BlockSqlAction): string;
+  /**
+   * PL/pgSQL that calls `notify(fields)` as the service role, which `notify()`
+   * requires, then restores the caller's claims. The function declares
+   * `v_claims text`. `null;` without the `notifications` module.
+   */
+  notify(fields: string, options?: {
+    readonly indent?: string;
+  }): string;
+  /**
+   * PL/pgSQL that enqueues a job (`enqueue_job`); `null;` without the `jobs`
+   * module. `delay` is an integer expression of seconds before it runs.
+   */
+  enqueue(queue: string, payload: string, dedupe: string, options?: {
+    readonly delay?: string;
+  }): string;
+  /**
+   * Row SQL for `data` that ships an automation as a default rule
+   * (`rule_defaults`): every organization gets its own copy, which it may turn
+   * off or edit. The trigger and subject type follow the module's entity
+   * renames. `''` without the `automations` module or a block in `requires`.
+   */
+  automation(spec: DefaultAutomation): string;
+  /**
+   * The `text[]` of a tenant's entitlements, or `fallback` without the
+   * `entitlements` module.
+   */
+  entitlements(tenant: string): string | undefined;
+  entitlements(tenant: string, fallback: string): string;
+  /**
+   * How long rows of `kind` are kept for `tenant` (SQL expressions): the
+   * data-lifecycle policy for the tenant, its plan or every tenant, else
+   * `fallback`; just `fallback` without the `data-lifecycle` module.
+   */
+  retention(kind: string, tenant: string, fallback: string): string;
+  /**
+   * Whether a legal hold covers `kind` for `tenant`; `false` without the
+   * `data-lifecycle` module.
+   */
+  held(kind: string, tenant: string): string;
+  /**
+   * The condition a purge deletes on: the row's timestamp `at` is past
+   * `retention` and no hold covers it. With data-lifecycle it first bounds `at`
+   * by the shortest policy, so the timestamp index still serves.
+   */
+  expired(kind: string, row: {
+    readonly at: string;
+    readonly tenant: string;
+    readonly fallback: string;
+  }): string;
+  /**
+   * Before when every tenant's rows of `kind` may go (a timestamptz
+   * expression), for dropping whole partitions: null under any hold on the
+   * kind, else the longest policy or `fallback`; `now() - fallback` without the
+   * `data-lifecycle` module.
+   */
+  cutoff(kind: string, fallback: string): string;
+  /**
+   * PL/pgSQL that broadcasts on a Realtime topic when `realtime.send` exists:
+   * projects without Realtime skip it.
+   */
+  broadcast(topic: string, event: string, payload: string, options?: {
+    readonly indent?: string;
+  }): string;
+  /**
+   * `coalesce(better_supabase.can(scope, id, permission), false)`; `permission`
+   * is a SQL expression. The `tenant` scope goes through `scope.can`.
+   */
+  can(scope: string, id: string, permission: string): string;
+  /**
+   * True for the service role and platform staff holding `permission` (a SQL
+   * expression); the service role only without the `access` module.
+   */
+  staff(permission: string): string;
+}
+/** A column from `options.extraColumns`. */
+interface ExtraColumn {
+  /** The column name, as reads return it. */
+  readonly name: string;
+  /** The name, quoted. */
+  readonly ident: string;
+  /** Its SQL type, such as `text not null default 'en'`. */
+  readonly type: string;
+}
+/** The contract's argument list with `{id}` resolved, as Postgres prints it. */
+declare function contractSignature(fn: BlockSqlContractFunction, idType: string): string;
+//#endregion
+export { flattenConfig as $, APP_COLUMN_FORMATS as $n, PresetCatalog as $r, ApiConfig as $t, valibot as A, GEN_TASKS as Ai, ExposeRole as An, CatalogPolicy as Ar, Generator as At, JsonSchemaTarget as B, PRESET_GROUPS as Bn, Snapshot as Br, GeneratorJsonSchema as Bt, blockSqlVersion as C, GenTask as Ci, TopicTriggerTopicConfig as Cn, CatalogColumnGrant as Cr, listNames as Ct, ZodGeneratorOptions as D, OpenApiConfig as Di, ColumnPrivilege as Dn, CatalogFunctionArg as Dr, ClaimsConfig as Dt, ZodFlavor as E, MigrationSafetyConfig as Ei, VectorSearchConfig as En, CatalogFunction as Er, resolveJsonSchema as Et, FactoriesGeneratorOptions as F, presetOfSpec as Fn, ExtrasFunction as Fr, GeneratorField as Ft, BlockEntity as G, isPresetName as Gn, PostgresFunction as Gr, JsonTypeConfig as Gt, DEFAULT_CLAIMS as H, PresetGroup as Hn, SnapshotExtras as Hr, GeneratorNoun as Ht, factories as I, presetSpec as In, ExtrasHook as Ir, GeneratorFunction as It, blockSubjectTypes as J, DeclaredForeignKey as Jn, RpcFunctionArg as Jr, TableConfig as Jt, blockEntities as K, namedPreset as Kn, PostgresFunctionArg as Kr, RelationsConfig as Kt, JsonSchemaGeneratorOptions as L, DEFAULT_PRESET_NAME as Ln, ExtrasHookFunction as Lr, GeneratorFunctionArg as Lt, standardSchema as M, INTEGRATION_NAMES as Mi, ResolvedExpose as Mn, CatalogTrigger as Mr, GeneratorBlockEntity as Mt, NuqsGeneratorOptions as N, IntegrationInfo as Ni, PresetSpec as Nn, CatalogUnique as Nr, GeneratorColumn as Nt, zod as O, SkillsAgent as Oi, ExposeConfig as On, CatalogGrant as Or, CodecsConfig as Ot, nuqs as P, SKILLS_AGENTS as Pi, presetFromSpec as Pn, ExtrasDomain as Pr, GeneratorEntitySchemas as Pt, blockEntrySource as Q, APP_COLUMN_ACCESS as Qn, RpcTypeReference as Qr, ResolvedExtensions as Qt, buildJsonSchema as R, NamedPreset as Rn, ExtrasTable as Rr, GeneratorInput as Rt, BlockSqlUpgrade as S, GenConfig as Si, TopicTriggerPayloadValueConfig as Sn, CatalogColumn as Sr, ResolvedPresetBlock as St, TableGrant as T, KeysConfig as Ti, VectorDistance as Tn, CatalogForeignKey as Tr, resolvePreset as Tt, claimPaths as U, PresetName as Un, GeneratorMetadata as Ur, GeneratorTable as Ut, ClaimPaths as V, PRESET_NAMES as Vn, SnapshotBucket as Vr, GeneratorModel as Vt, tenantClaimPaths as W, defaultPreset as Wn, PostgresColumn as Wr, JsonSchemaSource as Wt, RENAMED_BLOCK_KEYS as X, AuditedTable as Xn, RpcFunctionReturns as Xr, FlatConfig as Xt, CONFIG_GROUPS as Y, sameTenantLayout as Yn, RpcFunctionOverload as Yr, DataHooksFramework as Yt, RENAMED_CONFIG_KEYS as Z, auditRegistrations as Zn, RpcReturnColumn as Zr, ResolvedConfig as Zt, BlockSqlDeprecation as _, integrationsForFramework as _i, SeedConfig as _n, AppTableSubject as _r, presetConfig as _t, BlockSqlContext as a, PRESET_FRAMEWORKS as ai, BlocksInput as an, AppColumnConfig as ar, resolveConfig as at, BlockSqlLayout as b, DoctorConfig as bi, TopicTriggerConfig as bn, Catalog as br, PresetIntegration as bt, BlockSqlIdType as c, PresetAccess as ci, GenGroupConfig as cn, AppLookupConfig as cr, BucketName as ct, MODULE_ID_TYPES as d, PresetFieldKey as di, ToolingConfig as dn, AppReferenceTarget as dr, TypedReference as dt, PresetCatalogBlock as ei, AppTableInput as en, APP_COLUMN_TYPES as er, groupConfig as et, contractSignature as f, PresetFieldValue as fi, EntitlementPlansSource as fn, AppRollupAggregate as fr, ConfigConventions as ft, BlockSqlAccessProvider as g, PresetValueInfo as gi, ResolvedSqlConfig as gn, AppTableEvents as gr, expandPreset as gt, BlockSql as h, PresetScope as hi, RealtimeConfig as hn, AppTableEventKind as hr, conventionConfig as ht, BlockSqlAudit as i, DEFAULT_CONVENTIONS as ii, BlockInput as in, AppColumnAccess as ir, defineConfig as it, StandardSchemaGeneratorOptions as j, INTEGRATION_INFO as ji, Privilege as jn, CatalogTable as jr, GeneratorBlock as jt, ValibotGeneratorOptions as k, SkillsConfig as ki, ExposePrivilege as kn, CatalogIndex as kr, GeneratedFile as kt, BlockSqlNames as l, PresetConventions as li, OrganizationConfig as ln, AppOnDeleteAction as lr, ConfigReferences as lt, moduleIdType as m, PresetPlatforms as mi, BucketConfig as mn, AppTableConfig as mr, PresetInput as mt, AuditCategory as n, PresetGlueItem as ni, AuthConfig as nn, APP_ROLLUP_AGGREGATES as nr, hasFlatTables as nt, BlockSqlContractFunction as o, PRESET_TENANT_NAMES as oi, DatabaseConfig as on, AppColumnFormat as or, AppTableNames as ot, isBlockSqlIdType as p, PresetFramework as pi, EntitlementsConfig as pn, AppRollupConfig as pr, ExpandedConfig as pt, blockEntityRenames as q, CONFIG_DEFAULTS as qn, RpcFunction as qr, SourceConfig as qt, BlockSqlAction as r, CONVENTION_FIELDS as ri, BetterSupabaseConfig as rn, APP_TABLE_EVENT_KINDS as rr, CONFIG_SCHEMA_URL as rt, BlockSqlEmit as s, Preset as si, EnvironmentConfig as sn, AppColumnType as sr, BlockTableReference as st, AUDIT_CATEGORIES as t, PresetCatalogManifest as ti, AppTablesInput as tn, APP_ON_DELETE_ACTIONS as tr, groupEntries as tt, BlockSqlTableSpec as u, PresetField as ui, SqlInput as un, AppReference as ur, RoleNames as ut, BlockSqlEntitlementsProvider as v, presetField as vi, SqlConfig as vn, AppTableVersions as vr, presetOf as vt, notNullCheckName as w, IntegrationName as wi, TopicTriggerValueConfig as wn, CatalogEnum as wr, presetBlockConflict as wt, BlockSqlTestFile as x, EnvFileConfig as xi, TopicTriggerLookupConfig as xn, CatalogCheck as xr, ResolvedPreset as xt, BlockSqlFile as y, presetValueLabel as yi, SqlWorkflow as yn, AppTablesConfig as yr, PresetConflict as yt, jsonSchema as z, PRESETS as zn, ForeignKeyAction as zr, GeneratorInputSchema as zt };