better-supabase 0.17.0 → 0.18.0

package/dist/{authorization-CNsvnwle.d.ts → authorization-IiE__z2m.d.ts}

@@ -1,21 +1,21 @@
-import { t as BlockOptionsSchema } from "./options-CsGl5BLH.js";
+import { n as ExtraColumns, t as BlockOptionsSchema } from "./options-BTmaRzx2.js";
 import { t as AssetsSqlOptions } from "./options-D1hSuf50.js";
-import { t as ContentSqlOptions } from "./options-_F-enoBs.js";
-import { t as CoursesSqlOptions } from "./options-Li1Dyu88.js";
+import { t as ContentSqlOptions } from "./options-5WvWOkAm.js";
+import { t as CoursesSqlOptions } from "./options-BUCQYAeJ.js";
 import { t as CreatedBySqlOptions } from "./options-CDSCkYxu.js";
-import { t as DispatchSqlOptions } from "./options-CyAhRKKm.js";
+import { t as DispatchSqlOptions } from "./options-o5wCw8H7.js";
 import { t as EnrollmentsSqlOptions } from "./options-CSCXNYJO.js";
-import { t as LeadScoringSqlOptions } from "./options-DWVYM8P0.js";
-import { t as MailSyncSqlOptions } from "./options-DplE18Ko.js";
-import { t as MembershipsSqlOptions } from "./options-DINdgVih.js";
+import { t as LeadScoringSqlOptions } from "./options-DsVuVRH3.js";
+import { t as MailSyncSqlOptions } from "./options-C_7g9TTq.js";
+import { t as MembershipsSqlOptions } from "./options-_1gAIMq7.js";
 import { t as ModerationSqlOptions } from "./options-DlohRAYd.js";
-import { t as PassesSqlOptions } from "./options-DcOx8_3X.js";
-import { t as PostsSqlOptions } from "./options-D6as77gU.js";
+import { t as PassesSqlOptions } from "./options-HnfETSHr.js";
+import { t as PostsSqlOptions } from "./options-DRIgHh4O.js";
 import { t as ScoresSqlOptions } from "./options-D0bzZx9a.js";
-import { t as SegmentsSqlOptions } from "./options-pOVWwbAK.js";
-import { t as SequencesSqlOptions } from "./options-y_-AkVCs.js";
-import { t as ShipmentsSqlOptions } from "./options-BlzSfWxC.js";
-import { t as SignaturesSqlOptions } from "./options-CE93HOYi.js";
+import { t as SegmentsSqlOptions } from "./options-D-OOO9V2.js";
+import { t as SequencesSqlOptions } from "./options-B0YZtAkb.js";
+import { t as ShipmentsSqlOptions } from "./options-BbLDAp7G.js";
+import { t as SignaturesSqlOptions } from "./options-C7C5OhmL.js";
 import { t as UpdatedAtSqlOptions } from "./options-B_NrjVDt.js";
 //#region src/blocks/name-registry.generated.d.ts
 /** The names each module's `blocks.<name>` config keys accept. */
@@ -213,6 +213,7 @@ interface BlockNameRegistry {
       readonly "attachments": "id" | "tenant" | "subjectType" | "subjectId" | "bucket" | "path" | "name" | "mimeType" | "size" | "status" | "detail" | "uploadedBy" | "createdAt" | "uploadedAt" | "scannedAt" | "metadata" | "version" | "width" | "height" | "pages";
       readonly "versions": "id" | "tenant" | "attachment" | "version" | "bucket" | "path" | "name" | "mimeType" | "size" | "width" | "height" | "pages" | "status" | "detail" | "uploadedBy" | "uploadedAt" | "scannedAt" | "archivedAt";
       readonly "scans": "bucket" | "path" | "status" | "detail" | "createdAt" | "scannedAt";
+      readonly "cleanup": "bucket" | "path" | "queuedBy" | "queuedAt" | "attempts";
     };
     readonly functions: "attachment_object_allowed" | "attachment_object_visible" | "attachment_subject_readable" | "confirm_attachment" | "create_attachment" | "delete_attachment" | "get_attachment" | "list_attachment_versions" | "list_attachments" | "object_clean" | "object_scan" | "replace_attachment" | "restore_attachment_version" | "set_attachment_status" | "set_object_scan";
     readonly actions: "read" | "upload" | "manage";
@@ -1037,7 +1038,7 @@ interface BlockNameRegistry {
     readonly tables: {
       readonly "memberships": "tenant" | "user" | "role" | "createdAt" | "updatedAt" | "lastUsedAt" | "disabledAt";
     };
-    readonly functions: "current_tenant_id" | "has_organization_role" | "member_organization_ids" | "membership_claims" | "organization_member_role";
+    readonly functions: "current_tenant_id" | "has_organization_role" | "member_organization_ids" | "membership_claims" | "membership_role_from_roles" | "membership_roles_from_role" | "organization_member_role" | "organization_member_roles";
     readonly actions: never;
     readonly hooks: never;
     readonly entities: {
@@ -1113,8 +1114,8 @@ interface BlockNameRegistry {
   };
   readonly "notifications": {
     readonly tables: {
-      readonly "events": "id" | "tenant" | "type" | "actor" | "subjectType" | "subjectId" | "subjectLabel" | "summary" | "actionPath" | "priority" | "data" | "key" | "createdBy" | "createdAt";
-      readonly "recipients": "id" | "event" | "tenant" | "user" | "readAt" | "dismissedAt" | "resolvedAt" | "deliveredAt" | "createdAt";
+      readonly "events": "id" | "tenant" | "type" | "actor" | "subjectType" | "subjectId" | "subjectLabel" | "summary" | "actionPath" | "actions" | "priority" | "data" | "key" | "createdBy" | "createdAt";
+      readonly "recipients": "id" | "event" | "tenant" | "user" | "readAt" | "dismissedAt" | "resolvedAt" | "resolution" | "deliveredAt" | "createdAt";
       readonly "deliveries": "id" | "recipient" | "tenant" | "channel" | "status" | "provider" | "providerMessageId" | "error" | "attempts" | "attemptedAt" | "nextAttemptAt" | "deliveredAt" | "providerStatus" | "providerStatusAt" | "templateKey" | "createdAt";
       readonly "deliveryEvents": "id" | "delivery" | "tenant" | "kind" | "provider" | "providerEventId" | "occurredAt" | "detail" | "createdAt";
       readonly "subscriptions": "id" | "tenant" | "user" | "subjectType" | "subjectId" | "level" | "createdAt" | "updatedAt";
@@ -1189,8 +1190,8 @@ interface BlockNameRegistry {
     readonly tables: {
       readonly "organizations": "id" | "name" | "slug" | "createdBy" | "createdAt" | "updatedAt" | "disabledAt" | "deletedAt";
     };
-    readonly functions: "create_organization" | "delete_organization" | "ensure_organization_owner" | "guard_membership" | "guard_membership_role" | "leave_organization" | "list_members" | "list_my_organizations" | "mark_used" | "organization_slug_problem" | "remove_member" | "resume_member" | "suspend_member" | "switch_organization" | "transfer_ownership" | "update_member_role" | "update_organization";
-    readonly actions: "update" | "delete" | "removeMember" | "suspendMember" | "updateRole" | "transferOwnership";
+    readonly functions: "add_member_role" | "create_organization" | "delete_organization" | "ensure_organization_owner" | "guard_membership" | "guard_membership_role" | "leave_organization" | "list_members" | "list_my_organizations" | "mark_used" | "organization_slug_problem" | "remove_member" | "remove_member_role" | "resume_member" | "suspend_member" | "switch_organization" | "transfer_ownership" | "update_member_role" | "update_organization";
+    readonly actions: "update" | "delete" | "listMembers" | "removeMember" | "suspendMember" | "updateRole" | "transferOwnership";
     readonly hooks: "before_organization_create" | "after_organization_create" | "before_organization_update" | "after_organization_update" | "after_member_change";
     readonly entities: {};
     readonly primary: never;
@@ -1274,7 +1275,7 @@ interface BlockNameRegistry {
   };
   readonly "profiles": {
     readonly tables: {
-      readonly "profiles": "key" | "email" | "username" | "fullName" | "firstName" | "lastName" | "avatar" | "avatarPath" | "activeTenant" | "activeTeam" | "onboarding" | "disabledAt" | "createdAt" | "updatedAt";
+      readonly "profiles": "key" | "email" | "username" | "fullName" | "firstName" | "lastName" | "avatar" | "avatarPath" | "locale" | "activeTenant" | "activeTeam" | "onboarding" | "disabledAt" | "createdAt" | "updatedAt";
     };
     readonly functions: "allocate_username" | "backfill_profiles" | "guard_profile" | "mirror_profile_email" | "my_profile" | "on_auth_user_created" | "sync_profile" | "update_my_profile";
     readonly actions: never;
@@ -1300,6 +1301,7 @@ interface BlockNameRegistry {
   readonly "push": {
     readonly tables: {
       readonly "devices": "id" | "user" | "token" | "platform" | "provider" | "deviceName" | "appVersion" | "createdAt" | "lastSeenAt";
+      readonly "tickets": "id" | "delivery" | "token" | "ticket" | "status" | "error" | "createdAt" | "checkedAt";
     };
     readonly functions: "prune_push_tokens" | "push_tokens_for" | "register_push_device" | "unregister_push_device";
     readonly actions: never;
@@ -1919,14 +1921,14 @@ type AccessRequestsSqlOptions = {
   readonly policy?: unknown;
   readonly maxDuration?: unknown;
   readonly join?: boolean;
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/activities/options.d.ts
 /** `blocks.activities.options`. */
 type ActivitiesSqlOptions = {
   readonly types?: readonly string[];
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
   /**
    * Recordings of calls and meetings as ai-files files, their transcripts and
    * notes on each engagement. Needs the ai-files block. Default `false`.
@@ -1944,7 +1946,7 @@ type ActivitiesSqlOptions = {
 /** `blocks.agents.options`. */
 type AgentsSqlOptions = {
   readonly maxInstructions?: number;
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/ai-cache/options.d.ts
@@ -1965,7 +1967,7 @@ type AiChatSqlOptions = {
   readonly meterUsage?: boolean;
   readonly inputMeter?: string;
   readonly outputMeter?: string;
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/ai-files/options.d.ts
@@ -1975,7 +1977,7 @@ type AiFilesSqlOptions = {
   readonly maxSize?: number;
   readonly allowedMimeTypes?: readonly string[];
   readonly pendingTtl?: string;
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/ai-keys/options.d.ts
@@ -1990,7 +1992,7 @@ type AiSchedulesSqlOptions = {
   readonly queue?: string;
   readonly staleAfter?: string;
   readonly maxPrompt?: number;
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/announcements/options.d.ts
@@ -1998,7 +2000,7 @@ type AiSchedulesSqlOptions = {
 type AnnouncementsSqlOptions = {
   readonly topic?: string;
   readonly event?: string;
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/api-keys/options.d.ts
@@ -2008,14 +2010,14 @@ type ApiKeysSqlOptions = {
   readonly kinds?: readonly string[];
   readonly touchInterval?: number;
   readonly prefix?: string;
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/approvals/options.d.ts
 /** `blocks.approvals.options`. */
 type ApprovalsSqlOptions = {
   readonly policies?: unknown;
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/attachments/options.d.ts
@@ -2028,10 +2030,27 @@ type AttachmentsSqlOptions = {
   readonly path?: string;
   readonly scanBuckets?: readonly string[];
   readonly publicBuckets?: readonly string[];
-  readonly extraColumns?: unknown;
+  readonly offline?: boolean;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/audit/options.d.ts
+/** `blocks.audit.options.ipHeader`. */
+interface AuditIpHeader {
+  /** The request header that carries the client address. */
+  readonly name: string;
+  /** Which hop of a comma-separated list to take. Defaults to `"last"`. */
+  readonly hop?: "first" | "last";
+}
+/** One entry of `blocks.audit.options.subjectColumns`. */
+interface AuditSubjectColumn {
+  readonly type: "text" | "uuid" | "bigint";
+  /**
+   * The key in the row (or the event metadata) to read. Defaults to the column
+   * name.
+   */
+  readonly from?: string;
+}
 /** `blocks.audit.options`. */
 type AuditSqlOptions = {
   readonly appendOnly?: boolean;
@@ -2043,12 +2062,21 @@ type AuditSqlOptions = {
   readonly eventSource?: string;
   readonly exempt?: unknown;
   readonly impersonators?: string;
+  /**
+   * The header `request_ip()` reads; defaults to the last `x-forwarded-for`
+   * hop.
+   */
+  readonly ipHeader?: string | AuditIpHeader;
   readonly keepMappedMetadata?: boolean;
   readonly metadataColumns?: unknown;
   readonly partitioned?: boolean;
   readonly readPolicy?: boolean;
   readonly requestIdHeader?: string;
   readonly restricted?: boolean;
+  /** A dotted JWT claim path; a caller that carries it is recorded as `staff`. */
+  readonly staffClaim?: string;
+  /** Indexed columns generated from a key of the row or event metadata. */
+  readonly subjectColumns?: Readonly<Record<string, AuditSubjectColumn>>;
   readonly tenantColumn?: string;
   readonly tenantLabel?: unknown;
   readonly tenantLabelKey?: string;
@@ -2086,7 +2114,7 @@ type BillingSqlOptions = {
 //#region src/blocks/bookings/options.d.ts
 /** `blocks.bookings.options`. */
 type BookingsSqlOptions = {
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
   /** Adds booking series: a recurrence rule that books every occurrence. */
   readonly recurring?: boolean;
 };
@@ -2101,14 +2129,14 @@ type BulkSqlOptions = {
 //#region src/blocks/calendar/options.d.ts
 /** `blocks.calendar.options`. */
 type CalendarSqlOptions = {
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/catalog/options.d.ts
 /** `blocks.catalog.options`. */
 type CatalogSqlOptions = {
   readonly storefront?: string;
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
   /** Language tags the catalog translates into; the first is the default. */
   readonly locales?: readonly string[];
 };
@@ -2116,7 +2144,7 @@ type CatalogSqlOptions = {
 //#region src/blocks/collections/options.d.ts
 /** `blocks.collections.options`. */
 type CollectionsSqlOptions = {
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/comments/options.d.ts
@@ -2134,7 +2162,7 @@ type CommentsSqlOptions = {
 //#region src/blocks/compliance/options.d.ts
 /** `blocks.compliance.options`. */
 type ComplianceSqlOptions = {
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/connectors/options.d.ts
@@ -2143,7 +2171,7 @@ type ConnectorsSqlOptions = {
   readonly allowHttp?: boolean;
   readonly trustFirstUse?: boolean;
   readonly sessionTtl?: string;
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/contacts/options.d.ts
@@ -2151,7 +2179,7 @@ type ConnectorsSqlOptions = {
 type ContactsSqlOptions = {
   readonly companyLifecycles?: unknown;
   readonly personLifecycles?: unknown;
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/contracts/options.d.ts
@@ -2159,7 +2187,7 @@ type ContactsSqlOptions = {
 type ContractsSqlOptions = {
   /** Days before the notice deadline the owner's renewal reminder fires. */
   readonly reminderDays?: number;
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/credentials/options.d.ts
@@ -2201,7 +2229,7 @@ type DealsSqlOptions = {
   readonly priorities?: unknown;
   readonly prefix?: string;
   readonly readAll?: boolean;
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/documents/options.d.ts
@@ -2227,7 +2255,7 @@ type DomainsSqlOptions = {
 //#region src/blocks/donations/options.d.ts
 /** `blocks.donations.options`. */
 type DonationsSqlOptions = {
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/drive/options.d.ts
@@ -2239,20 +2267,20 @@ type DriveSqlOptions = {
   readonly memberRole?: unknown;
   readonly subjectType?: string;
   readonly conflict?: string;
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/employees/options.d.ts
 /** `blocks.employees.options`. */
 type EmployeesSqlOptions = {
   readonly employmentTypes?: readonly string[];
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/expenses/options.d.ts
 /** `blocks.expenses.options`. */
 type ExpensesSqlOptions = {
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/flags/options.d.ts
@@ -2272,7 +2300,7 @@ type FlagsSqlOptions = {
    * column: "brand_id" } }`.
    */
   readonly contexts?: Readonly<Record<string, FlagContextColumn>>;
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/forms/options.d.ts
@@ -2280,13 +2308,13 @@ type FlagsSqlOptions = {
 type FormsSqlOptions = {
   readonly handlers?: unknown;
   readonly publicLimit?: unknown;
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/goals/options.d.ts
 /** `blocks.goals.options`. */
 type GoalsSqlOptions = {
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/grants/options.d.ts
@@ -2299,7 +2327,7 @@ type GrantsSqlOptions = {
 /** `blocks.hiring.options`. */
 type HiringSqlOptions = {
   readonly candidate?: string;
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/identities/options.d.ts
@@ -2337,13 +2365,13 @@ type InboxSqlOptions = {
 //#region src/blocks/incidents/options.d.ts
 /** `blocks.incidents.options`. */
 type IncidentsSqlOptions = {
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/inventory/options.d.ts
 /** `blocks.inventory.options`. */
 type InventorySqlOptions = {
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/invoices/options.d.ts
@@ -2354,7 +2382,7 @@ type InvoicesSqlOptions = {
   readonly prefix?: string;
   readonly creditPrefix?: string;
   readonly termsDays?: number;
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/knowledge/options.d.ts
@@ -2370,7 +2398,7 @@ type KnowledgeSqlOptions = {
 //#region src/blocks/leases/options.d.ts
 /** `blocks.leases.options`. */
 type LeasesSqlOptions = {
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/leave/options.d.ts
@@ -2379,7 +2407,7 @@ type LeaveSqlOptions = {
   readonly policy?: unknown;
   readonly workingDays?: readonly string[];
   readonly allowNegative?: boolean;
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/memory/options.d.ts
@@ -2403,7 +2431,7 @@ type MessagingSqlOptions = {
   readonly editWindow?: number;
   /** The jobs queue that sends scheduled messages. */
   readonly scheduleQueue?: string;
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
   /**
    * `false` sends no `message.mentioned`, `message.direct` or `message.replied`
    * notification.
@@ -2430,7 +2458,7 @@ type NotificationsSqlOptions = {
   readonly realtime?: string;
   readonly topic?: string;
   readonly updatedEvent?: string;
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/numbering/options.d.ts
@@ -2486,7 +2514,7 @@ type OnboardingSqlOptions = {
 /** `blocks.orders.options`. */
 type OrdersSqlOptions = {
   readonly paymentWindowMinutes?: number;
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
   /** Per-line preparation states and kitchen stations. Off by default. */
   readonly kitchen?: boolean;
 };
@@ -2498,7 +2526,7 @@ type OrganizationsSqlOptions = {
   readonly attributes?: readonly string[];
   readonly auditCategory?: unknown;
   readonly deleteMode?: string;
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
   readonly formerOwnerRole?: string;
   readonly ownerInvariant?: boolean;
   readonly ownerRole?: string;
@@ -2508,17 +2536,48 @@ type OrganizationsSqlOptions = {
   readonly slugMinLength?: number;
   readonly slugPattern?: string;
 };
+/**
+ * `platformRoles`: the platform roles a provider keeps outside the tenant,
+ * which an invitation can grant.
+ */
+interface PlatformRolesOption {
+  /** `schema.table` of the platform role grants. */
+  readonly table: string;
+  /** The user column. */
+  readonly user: string;
+  /** The role column. */
+  readonly role: string;
+  /** Where the role name lives when `role` holds an id. */
+  readonly through?: {
+    readonly table: string;
+    readonly id: string;
+    readonly column: string;
+    /** A condition on the roles row `{row}`. */
+    readonly where?: string;
+  };
+  /** A SQL template that holds when the caller may grant `{role}`. */
+  readonly canAssign?: string;
+  /** The same check for another user, `{user}`. */
+  readonly canAssignFor?: string;
+}
 /** `blocks.invitations.options`. */
 type InvitationsSqlOptions = {
   readonly maxValidFor?: string;
-  readonly platformRoles?: unknown;
+  readonly platformRoles?: PlatformRolesOption;
   readonly prefill?: boolean;
   readonly previewColumns?: readonly string[];
   readonly requireConfirmedEmail?: boolean;
   readonly tokenBytes?: number;
   readonly tokenStorage?: string;
   readonly validFor?: string;
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
+  /** The role `create_invitation` and `invite_member` use when none is named. */
+  readonly defaultRole?: string;
+  /** Extra roles and teams an invitation grants on accept. */
+  readonly onAccept?: {
+    readonly roles?: boolean;
+    readonly teams?: boolean;
+  };
 };
 //#endregion
 //#region src/blocks/outbox/options.d.ts
@@ -2543,14 +2602,14 @@ type PermissionsSqlOptions = {
 //#region src/blocks/pipelines/options.d.ts
 /** `blocks.pipelines.options`. */
 type PipelinesSqlOptions = {
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/profiles/options.d.ts
 /** `blocks.profiles.options`. */
 type ProfilesSqlOptions = {
   readonly columnGrants?: boolean;
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
   readonly metadata?: unknown;
   readonly mirrorEmail?: boolean;
   readonly readPolicy?: unknown;
@@ -2568,13 +2627,13 @@ type ProfilesSqlOptions = {
 //#region src/blocks/promotions/options.d.ts
 /** `blocks.promotions.options`. */
 type PromotionsSqlOptions = {
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/push/options.d.ts
 /** `blocks.push.options`. */
 type PushSqlOptions = {
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/queue/options.d.ts
@@ -2589,7 +2648,7 @@ type RateLimitSqlOptions = {
 };
 /** `blocks.webhook-inbox.options`. */
 type WebhookInboxSqlOptions = {
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/quotes/options.d.ts
@@ -2599,7 +2658,7 @@ type QuotesSqlOptions = {
   readonly contact?: string;
   readonly prefix?: string;
   readonly validDays?: number;
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/reactions/options.d.ts
@@ -2612,14 +2671,14 @@ type ReactionsSqlOptions = {
 /** `blocks.relations.options`. */
 type RelationsSqlOptions = {
   readonly kinds?: unknown;
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/reminders/options.d.ts
 /** `blocks.reminders.options`. */
 type RemindersSqlOptions = {
   readonly ruleFormat?: string;
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/reserved-slugs/options.d.ts
@@ -2637,13 +2696,13 @@ type ReviewsSqlOptions = {
   readonly maxBodyLength?: number;
   readonly moderation?: string;
   readonly requirePurchase?: boolean;
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/saved-views/options.d.ts
 /** `blocks.saved-views.options`. */
 type SavedViewsSqlOptions = {
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/search/options.d.ts
@@ -2662,7 +2721,7 @@ type SecurityEventsSqlOptions = {
 //#region src/blocks/service-accounts/options.d.ts
 /** `blocks["service-accounts"].options`. */
 type ServiceAccountsSqlOptions = {
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/sessions/options.d.ts
@@ -2682,7 +2741,7 @@ type SettingsSqlOptions = {
 //#region src/blocks/share-links/options.d.ts
 /** `blocks.share-links.options`. */
 type ShareLinksSqlOptions = {
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/signing-keys/options.d.ts
@@ -2695,7 +2754,7 @@ type SigningKeysSqlOptions = {
 /** `blocks.sla.options`. */
 type SlaSqlOptions = {
   readonly businessHours?: unknown;
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/sso/options.d.ts
@@ -2724,7 +2783,7 @@ type StreamsSqlOptions = {
 //#region src/blocks/tags/options.d.ts
 /** `blocks.tags.options`. */
 type TagsSqlOptions = {
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/tasks/options.d.ts
@@ -2732,20 +2791,21 @@ type TagsSqlOptions = {
 type TasksSqlOptions = {
   readonly prefix?: string;
   readonly maxAssignees?: number;
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/teams/options.d.ts
 /** `blocks.teams.options`. */
 type TeamsSqlOptions = {
-  readonly teamIdType?: unknown;
-  readonly extraColumns?: unknown;
+  /** The key type of teams. Default `uuid`; `inbox` needs `uuid`. */
+  readonly teamIdType?: "uuid" | "bigint";
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/templates/options.d.ts
 /** `blocks.templates.options`. */
 type TemplatesSqlOptions = {
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/time-tracking/options.d.ts
@@ -2753,14 +2813,14 @@ type TemplatesSqlOptions = {
 type TimeTrackingSqlOptions = {
   readonly policy?: unknown;
   readonly timeZone?: string;
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/trash/options.d.ts
 /** `blocks.trash.options`. */
 type TrashSqlOptions = {
   readonly retentionDays?: number;
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
   /**
    * The column that marks a trashed row on tables outside `on`;
    * `trashExtension` filters on it and sets it on delete.
@@ -2797,7 +2857,7 @@ type VercelMarketplaceSqlOptions = {
 type VersionsSqlOptions = {
   readonly keep?: number;
   readonly debounce?: number;
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/waitlist/options.d.ts
@@ -2806,7 +2866,7 @@ type WaitlistSqlOptions = {
   readonly defaultRole?: string;
   readonly codeField?: string;
   readonly roles?: readonly string[];
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/webhooks/options.d.ts
@@ -2830,7 +2890,7 @@ type WebhooksInSqlOptions = {
 //#region src/blocks/workflow-editor/options.d.ts
 /** `blocks["workflow-editor"].options`. */
 type WorkflowEditorSqlOptions = {
-  readonly extraColumns?: unknown;
+  readonly extraColumns?: ExtraColumns;
 };
 //#endregion
 //#region src/blocks/workflow-sdk/options.d.ts
@@ -3342,10 +3402,12 @@ declare function resolveBlock(config?: BlockConfig): ResolvedBlock;
 /**
  * SQL expression templates the SQL modules and the access policies call.
  * `{permission}` is a text expression (a literal or a parameter), `{user}` a
- * uuid expression, `{tenant}` an expression of the tenant id type and `{role}`
- * a text expression. `{scope}` is the scope's name unquoted, so it can be part
- * of a function name (`app.ids_{scope}({permission})`); write `'{scope}'` to
- * pass it as text.
+ * uuid expression, `{tenant}` an expression of the tenant id type, `{role}` a
+ * text expression and `{roles}` a `text[]` of the roles being assigned
+ * (`array[{role}]` for one role, the whole set with
+ * `blocks.memberships.options.roles.many`). `{scope}` is the scope's name
+ * unquoted, so it can be part of a function name
+ * (`app.ids_{scope}({permission})`); write `'{scope}'` to pass it as text.
  */
 interface AuthorizationFunctions {
   /**
@@ -3373,9 +3435,15 @@ interface AuthorizationFunctions {
    * `collections`, call it instead of reading `team_members`.
    */
   readonly teamIdsOf?: string;
-  /** Whether the caller may assign `{role}` in `{tenant}`. */
+  /**
+   * Whether the caller may assign `{role}` (or every one of `{roles}`) in
+   * `{tenant}`.
+   */
   readonly canAssign?: string;
-  /** Whether `{user}` may assign `{role}` in `{tenant}`. */
+  /**
+   * Whether `{user}` may assign `{role}` (or every one of `{roles}`) in
+   * `{tenant}`.
+   */
   readonly canAssignFor?: string;
   /**
    * The permission keys `{user}` holds in `{tenant}`, as a `text[]`. It fills
@@ -3498,6 +3566,13 @@ interface AuthorizationMembership {
     readonly value: string;
   };
   readonly idColumn: string;
+  /**
+   * `schema.table` of the membership's role set, one row per `(scope id, user,
+   * role)`, when a member can hold several roles. better-supabase's own is
+   * `better_supabase.membership_roles`
+   * (`blocks.memberships.options.roles.many`).
+   */
+  readonly rolesTable?: string;
 }
 /** A membership table whose role column points into a roles table. */
 interface AuthorizationRoleSource {
@@ -3519,6 +3594,13 @@ interface AuthorizationTokenHook {
   readonly function: string;
   /** The claim it writes the active tenant id to. */
   readonly tenantClaim?: string;
+  /**
+   * Where it reads the active organization from: the `auth.organization.claim`
+   * key in `app_metadata` (`"claim"`), a profile column, or the request
+   * (`"resolver"`). Doctor BS409 warns when `switch_organization` writes it
+   * somewhere else (`blocks.permissions.activeTenant`).
+   */
+  readonly activeOrganizationFrom?: ActiveTenantSource;
   /** Claims it writes itself, which a second writer would contradict. */
   readonly ownedClaims: readonly string[];
   /**
@@ -3608,4 +3690,4 @@ declare function providerApiProblem(provider: {
   readonly apiVersion?: unknown;
 }): string | undefined;
 //#endregion
-export { tenantNameOf as A, EntityConfig as C, OwnTablePolicies as D, NamedInstance as E, TablesOf as F, BlockNameRegistry as I, BlockOptionsRegistry as M, MessagingSqlOptions as N, ResolvedBlock as O, CommentsSqlOptions as P, EntitiesConfig as S, InstanceOn as T, BlockName as _, AuthorizationProvider as a, DEFAULT_ACTIVE_TENANT as b, AuthorizationScope as c, AccessBlockConfig as d, ActiveTenantSource as f, BlockMode as g, BlockConfigOf as h, AuthorizationPermission as i, BLOCK_OPTION_SCHEMAS as j, resolveBlock as k, AuthorizationTokenHook as l, BlockConfig as m, AuthorizationMembership as n, AuthorizationRequirement as o, AnyBlocksConfig as p, AuthorizationOperation as r, AuthorizationRoleSource as s, AuthorizationFunctions as t, providerApiProblem as u, BlockScope as v, InstanceKeys as w, DisabledRow as x, BlocksConfig as y };
+export { tenantNameOf as A, EntityConfig as C, OwnTablePolicies as D, NamedInstance as E, CommentsSqlOptions as F, TablesOf as I, BlockNameRegistry as L, BlockOptionsRegistry as M, PlatformRolesOption as N, ResolvedBlock as O, MessagingSqlOptions as P, EntitiesConfig as S, InstanceOn as T, BlockName as _, AuthorizationProvider as a, DEFAULT_ACTIVE_TENANT as b, AuthorizationScope as c, AccessBlockConfig as d, ActiveTenantSource as f, BlockMode as g, BlockConfigOf as h, AuthorizationPermission as i, BLOCK_OPTION_SCHEMAS as j, resolveBlock as k, AuthorizationTokenHook as l, BlockConfig as m, AuthorizationMembership as n, AuthorizationRequirement as o, AnyBlocksConfig as p, AuthorizationOperation as r, AuthorizationRoleSource as s, AuthorizationFunctions as t, providerApiProblem as u, BlockScope as v, InstanceKeys as w, DisabledRow as x, BlocksConfig as y };