better-supabase 0.5.0 → 0.6.0

package/dist/sql/index.d.ts

@@ -1,138 +1,58 @@
-import { c as ClaimsMeta } from "../types-Dnf_wRDz.js";
-import { B as ReadSet } from "../define-Bp_BZa5h.js";
-import { b as ResolvedConfig, ct as KitsConfig, lt as ResolvedKitModule, ot as KitMode } from "../config-T_ejwyd3.js";
-import { a as permdockKeys, i as permdockKeyStatus, n as PermdockCatalog, r as PermdockKeyStatus, t as PERMDOCK_SCHEMA } from "../permdock-sql-C2Inc6Xc.js";
-//#region src/sql/context.d.ts
-/** The scope id types kit modules render. */
-export declare const KIT_ID_TYPES: readonly ["uuid", "text", "bigint", "integer"];
-type KitIdType = (typeof KIT_ID_TYPES)[number];
-export declare const isKitIdType: (value: string) => value is KitIdType;
-/**
- * A Postgres type name as one of `KIT_ID_TYPES`: case and spacing are
- * normalised and aliases such as `int8` resolved. `undefined` for any other
- * type, so callers refuse it instead of guessing.
- */
-export declare function kitIdType(value: string): KitIdType | undefined;
-/** One logical table of a module: its default name and logical columns. */
-interface KitTableSpec {
-  /** Default name, in the module's schema. */
-  readonly name: string;
-  /** Logical column to default column name. */
-  readonly columns: Readonly<Record<string, string>>;
-  /**
-   * Logical columns an adopted table may lack (mapped to `null`): the module
-   * leaves out the feature that needs them.
-   */
-  readonly optional?: readonly string[];
-  /** The app may lack the whole table (`kits.<name>.tables.<table>: null`). */
-  readonly optionalTable?: boolean;
-}
-interface KitNames {
-  readonly tables: Readonly<Record<string, KitTableSpec>>;
-  /** The `before_*` and `after_*` hooks the module calls, so `kits.<name>.hooks.functions` is checked. */
-  readonly hooks?: readonly string[];
-  /** The `kits.<name>.options` keys the module reads; any other key is rejected. */
-  readonly options?: readonly string[];
-}
-/** An event a module writes to the outbox, as SQL expressions. */
-interface KitEmit {
-  /** The event type, e.g. `org.created`. */
-  readonly type: string;
-  /** A `jsonb` expression. */
-  readonly payload: string;
-  /** A `text` expression, e.g. `'organizations/' || new_org`. */
-  readonly subject?: string;
-  /** The tenant id expression; it is cast to text. */
-  readonly tenant?: string;
-  /** A `text` idempotency key expression. */
-  readonly key?: string;
-}
-/** A function of a module's contract: what other modules and the TypeScript side call. */
-interface KitContractFunction {
-  readonly name: string;
-  /** Argument types; `{id}` stands for the module's id type. */
-  readonly args: readonly string[];
-  readonly returns: string;
-}
-/** What a module's `build` reads: resolved names for one layout. */
-interface KitContext {
-  readonly module: string;
-  readonly mode: KitMode;
-  readonly config: ResolvedKitModule;
-  /** The quoted schema of the module's functions and managed tables. */
-  readonly schema: string;
-  readonly schemaName: string;
-  readonly idType: KitIdType;
-  readonly claims: ClaimsMeta;
-  readonly kits: KitsConfig;
-  /** `schema.name` of a module function, quoted. */
-  fn(name: string): string;
-  /** `schema.table` of a logical table, quoted. */
-  table(logical: string): string;
-  /** The unquoted schema and name of a logical table. */
-  tableName(logical: string): {
-    readonly schema: string;
-    readonly name: string;
+import { n as AccessPolicySql, u as ClaimsMeta } from "../types-6BdhkmZe.js";
+import { K as ReadSet } from "../define-CJJkkr1-.js";
+import { i as DisabledRow, o as ModuleMode, s as ModulesConfig } from "../modules-DpPwzC7E.js";
+import { n as AuthorizationMembership, o as AuthorizationRoleSource, t as AuthorizationFunctions } from "../authorization-BFCqamMs.js";
+import { a as ModuleAudit, c as ModuleEmit, d as ModuleTableSpec, f as contractSignature, i as ModuleAction, l as ModuleIdType, m as moduleIdType, n as AuditCategory, o as ModuleContext, p as isModuleIdType, r as MODULE_ID_TYPES, s as ModuleContractFunction, t as AUDIT_CATEGORIES, u as ModuleNames } from "../context-BCrWe7ow.js";
+import { D as ResolvedConfig, l as EntitlementPlansSource } from "../config-D44Y7PAv.js";
+//#region src/sql/shared.d.ts
+/** A `pg_jsonschema` check on a jsonb column, for the `jsonb-schemas` module and key-value tables. */
+interface JsonSchemaCheck {
+  /** `table` or `schema.table`. */
+  readonly table: string;
+  readonly column: string;
+  readonly schema: Readonly<Record<string, unknown>>;
+  /** Checks only rows whose `where.column` equals `where.value` (a settings key). */
+  readonly where?: {
+    readonly column: string;
+    readonly value: string;
   };
-  /** A logical column, quoted. Throws when an adopted table lacks it. */
-  col(table: string, column: string): string;
-  /** Whether a logical column exists (adopted tables can map it to `null`). */
-  has(table: string, column: string): boolean;
-  /** Whether an optional logical table exists (it can be mapped to `null`). */
-  hasTable(table: string): boolean;
-  /** Whether the module owns `table` (managed mode). */
-  readonly manages: boolean;
-  /** The permission key for a kit action, as a SQL literal. */
-  permission(action: string, fallback: string): string;
-  /** The permission key for a kit action. */
-  permissionKey(action: string, fallback: string): string;
-  /** A trigger name with the module's prefix, quoted. */
-  trigger(name: string): string;
-  /** Whether `module` is installed alongside this one. */
-  installed(module: string): boolean;
-  /** The context of another module in the same layout. */
-  of(module: string): KitContext;
-  /** A string module option (`kits.<name>.options`). */
-  text(name: string, fallback: string): string;
-  number(name: string, fallback: number): number;
-  flag(name: string, fallback: boolean): boolean;
-  /** A module option that is a list of strings. */
-  list(name: string, fallback: readonly string[]): readonly string[];
-  /** A declared module option as configured, for object-shaped options. */
-  option(name: string): unknown;
-  /**
-   * PL/pgSQL that calls the app's hook function when it exists, with
-   * `[type, expression]` arguments: `if to_regprocedure(...) is not null
-   * then perform ...; end if;`.
-   */
-  hook(name: string, args: readonly (readonly [string, string])[]): string;
-  /** The app function a hook calls, quoted, for hooks that return a value. */
-  hookTarget(name: string): string;
-  /**
-   * PL/pgSQL that writes the event to the outbox (`emit_event`) when the
-   * `outbox` module is installed and `kits.<name>.events` isn't false;
-   * otherwise an empty string.
-   */
-  emit(event: KitEmit): string;
 }
-/** The contract's argument list with `{id}` resolved, as Postgres prints it. */
-export declare function contractSignature(fn: KitContractFunction, idType: string): string;
 //#endregion
-//#region src/sql/kit.d.ts
+//#region src/sql/audit-registrations.d.ts
+/** A table registered with `better_supabase.audit(...)` in a SQL file. */
+interface AuditedTable {
+  /** `schema.table`, unquoted; an unqualified name is in `public`. */
+  readonly target: string;
+  readonly ignore: readonly string[];
+  readonly redact: readonly string[];
+}
+/**
+ * The tables `files` register with `better_supabase.audit(...)` or a static
+ * `create trigger bs_audit ... execute function
+ * better_supabase.audit_row_change('{...}')`, in file order: a later
+ * registration for the same table replaces the earlier one, and
+ * `unaudit(...)` or a `drop table` removes it. Calls with non-literal
+ * arguments are skipped.
+ */
+export declare function auditRegistrations(files: readonly {
+  readonly text: string;
+}[]): AuditedTable[];
+//#endregion
+//#region src/sql/registry.d.ts
 /** The step from one module version to the next, for `sql upgrade`. */
-interface KitUpgrade {
+interface ModuleUpgrade {
   /** The installed version this step upgrades from. */
   readonly from: number;
   readonly description: string;
   /** SQL run before the module's current file, e.g. renames and backfills. */
-  readonly sql: (ctx: KitContext) => string;
+  readonly sql: (ctx: ModuleContext) => string;
 }
 /**
- * A renamed kit symbol. It keeps a compatibility wrapper for at least one
+ * A renamed module symbol. It keeps a compatibility wrapper for at least one
  * minor release, then is removed; doctor reports uses of both (BS309), and
  * the name stays reserved.
  */
-interface KitDeprecation {
+interface ModuleDeprecation {
   readonly kind: "function" | "claim" | "table" | "column";
   /** The old name: `schema.function`, a claim name, `schema.table` or `table.column`. */
   readonly symbol: string;
@@ -147,10 +67,10 @@ interface KitDeprecation {
    * old name that calls the new one and a `comment on function ... is
    * 'deprecated: use X'`.
    */
-  readonly wrapper?: (ctx: KitContext) => string;
+  readonly wrapper?: (ctx: ModuleContext) => string;
 }
 /**
- * SQL kit modules for `better-supabase sql add`. Every module is idempotent
+ * SQL modules for `better-supabase sql add`. Every module is idempotent
  * (`create or replace`, `if not exists`), so re-running it upgrades in place.
  */
 interface SqlModule {
@@ -159,66 +79,118 @@ interface SqlModule {
   readonly description: string;
   /** Modules this one needs, added along with it. */
   readonly requires: readonly string[];
-  /** What it needs instead when the layout has `permdock`. */
-  readonly permdockRequires?: readonly string[];
-  /** What it needs for this layout, e.g. per `kits.access.model`; overrides both. */
-  readonly dependencies?: (layout: KitLayout) => readonly string[];
+  /** What it needs instead when an authorization provider supplies memberships. */
+  readonly providerRequires?: readonly string[];
+  /**
+   * The optional `authorization.functions` templates it calls under the
+   * `provider` access model, such as `idsWithFor` to check another user.
+   * Doctor warns (BS411) when the provider doesn't set one.
+   */
+  readonly providerFunctions?: readonly (keyof AuthorizationFunctions)[];
+  /**
+   * Modules it works with when they are installed, without needing them.
+   * `ctx.installed` and `ctx.of` accept only these and what it requires;
+   * `record` reaches the outbox and the audit log without listing them.
+   * `*` stands for every module, for one that reads them all (`data-lifecycle`).
+   */
+  readonly integrates?: readonly string[];
+  /** What it needs for this layout, e.g. per `sql.modules.access.model`; overrides both. */
+  readonly dependencies?: (layout: ModuleLayout) => readonly string[];
   /** `schema` files go with your schemas; `test` files go to `supabase/tests`. */
   readonly target: "schema" | "test";
   /** The module with the default claim names. */
   readonly sql: string;
   /** The module for configured claim names (`config.claims`), when it reads claims. */
-  readonly render?: (claims: ClaimsMeta, layout: KitLayout) => string;
+  readonly render?: (claims: ClaimsMeta, layout: ModuleLayout) => string;
   /** Bumped when installed databases need an upgrade step. Defaults to 1. */
   readonly version?: number;
-  /** The modes `kits.<name>.mode` accepts. Defaults to `managed` only. */
-  readonly modes?: readonly KitMode[];
-  /** The logical tables and columns `kits.<name>.tables` and `columns` map. */
-  readonly names?: KitNames;
+  /** The modes `sql.modules.<name>.mode` accepts. Defaults to `managed` only. */
+  readonly modes?: readonly ModuleMode[];
+  /** The logical tables and columns `sql.modules.<name>.tables` and `columns` map. */
+  readonly names?: ModuleNames;
   /** The functions other modules and the TypeScript side call. */
-  readonly contract?: (ctx: KitContext) => readonly KitContractFunction[];
+  readonly contract?: (ctx: ModuleContext) => readonly ModuleContractFunction[];
   /** Renders the module for a layout; takes precedence over `render`. */
-  readonly build?: (ctx: KitContext, layout: KitLayout) => string;
-  readonly upgrades?: readonly KitUpgrade[];
-  readonly deprecated?: readonly KitDeprecation[];
+  readonly build?: (ctx: ModuleContext, layout: ModuleLayout) => string;
+  readonly upgrades?: readonly ModuleUpgrade[];
+  readonly deprecated?: readonly ModuleDeprecation[];
   /**
    * Rows, role settings and calls that a schema diff doesn't capture. They
    * go to `better-supabase-data/` next to the schema folder and a migration
    * (`sql data`) instead of the schema file.
    */
-  readonly data?: (ctx: KitContext, layout: KitLayout) => string;
+  readonly data?: (ctx: ModuleContext, layout: ModuleLayout) => string;
+  /** pgTAP files for this layout, written to the tests folder next to the `pgtap` module's. */
+  readonly tests?: (ctx: ModuleContext, layout: ModuleLayout) => readonly ModuleTestFile[];
+  readonly topics?: (ctx: ModuleContext) => readonly string[];
+  /**
+   * Functions granted to `anon` or `authenticated` only so the module's
+   * policies and triggers can call them as the client. `api` writes no
+   * entry point for them.
+   */
+  readonly internal?: readonly string[];
+  readonly adoptOptional?: (ctx: ModuleContext) => Readonly<Record<string, readonly string[]>>;
+}
+/** A pgTAP file a module writes for the layout, e.g. one per audited table. */
+interface ModuleTestFile {
+  /** The file name's suffix, after the module's slug. */
+  readonly name: string;
+  readonly sql: string;
 }
 export declare const moduleVersion: (module: SqlModule) => number;
+/** `entitlements.claim`: what `feature_claims` puts in the token. */
+type FeatureClaimOption = false | {
+  /** At most this many tenants, the lowest ids first. */
+  readonly maxTenants?: number;
+  /** Short codes written instead of the feature keys: `{ exports: "x" }`. */
+  readonly keys?: Readonly<Record<string, string>>;
+};
 /** New modules go at the end: the position is part of the file name. */
 export declare const SQL_MODULES: Readonly<Record<string, SqlModule>>;
 /** The modules to install for `names`, dependencies first. Throws on an unknown name. */
-export declare function resolveModules(names: readonly string[], layout?: KitLayout): SqlModule[];
-interface KitFile {
+export declare function resolveModules(names: readonly string[], layout?: ModuleLayout): SqlModule[];
+interface ModuleFile {
   readonly module: string;
   /** `schema` and `test` files are diffed; `data` files go in a migration too. */
   readonly kind: "schema" | "data" | "test";
   readonly path: string;
   readonly contents: string;
 }
-interface KitLayout {
+interface ModuleLayout {
   /** Directory for schema modules. Defaults to `supabase/schemas`. */
   readonly dir?: string;
+  /** The declarative schema folder the diff engine loads. Defaults to `supabase/schemas`. */
+  readonly schemasDir?: string;
   /** File prefix. Defaults to `900_better_supabase`. */
   readonly prefix?: string;
   /** Directory for pgTAP files. Defaults to `supabase/tests`. */
   readonly testsDir?: string;
+  /** The `better_supabase.audit(...)` calls in the SQL files: the `audit` module writes a pgTAP file per table. */
+  readonly auditedTables?: readonly AuditedTable[];
   /** Version stamped into the header. */
   readonly version?: string;
   /** `config.realtime.tables`: registered at the end of the `realtime-tables` module. */
   readonly realtimeTables?: readonly string[];
   /** `config.realtime.global`: tables registered with `tenant_column => null`. */
   readonly realtimeGlobal?: readonly string[];
+  /** `config.realtime.users`: tables registered with `user_column`. */
+  readonly realtimeUsers?: Readonly<Record<string, string>>;
   /** Tenant column passed to `track_realtime` for the other tables. */
   readonly tenantColumn?: string;
   /** Check constraints for the `jsonb-schemas` module. */
   readonly jsonSchemas?: readonly JsonSchemaCheck[];
   /** `config.expose`: the grants the `grants` module writes. */
   readonly grants?: readonly TableGrant[];
+  /** `config.expose` functions: the roles that may execute each one. */
+  readonly functionGrants?: readonly FunctionGrant[];
+  /**
+   * Grants the permissive policies in the schema files imply, for
+   * `sql.modules.grants.options.fromPolicies`. Tables in `grants` keep
+   * their listed privileges.
+   */
+  readonly policyGrants?: readonly TableGrant[];
+  /** The tables the schema files create, for `sql.modules.sessions.options.policies`. */
+  readonly declaredTables?: readonly string[];
   /** `config.readSets`, compiled: the functions the `read-sets` module writes. */
   readonly readSets?: readonly {
     readonly name: string;
@@ -228,34 +200,50 @@ interface KitLayout {
   readonly entitlements?: EntitlementsSource;
   /** `config.vectorSearch`: the tables the `vector-search` module writes a search function for. */
   readonly vectorSearch?: readonly VectorSearchTable[];
+  readonly vectorSchema?: string;
   /** `config.claims`: claim names the modules read and write. */
   readonly claims?: ClaimsMeta;
-  /** PermDock's helpers and membership sources, from its manifest: `entitlements` reads them instead of `tenant`. */
-  readonly permdock?: KitPermdock;
-  /** `config.kits`: modes, names and permission keys per module. */
-  readonly kits?: KitsConfig;
+  /** The authorization provider's memberships: `entitlements` reads them instead of `tenant`'s. */
+  readonly entitlementsProvider?: ModuleEntitlementsProvider;
+  /** The authorization provider the `access` module's `provider` model calls. */
+  readonly accessProvider?: ModuleAccessProvider;
+  /** `config.sql.modules`: modes, names and permission keys per module. */
+  readonly modules?: ModulesConfig;
+  /** The authorization provider's permission keys, for `api-keys` scopes. */
+  readonly permissionCatalog?: readonly string[];
 }
-/** One PermDock membership source, from the manifest's `memberships`. */
-interface KitMembershipSource {
-  /** `schema.table`. */
-  readonly table: string;
-  readonly userColumn: string;
-  readonly scope: {
-    readonly column: string;
-  } | {
-    readonly value: string;
-  };
-  readonly idColumn: string;
+/** Where the `entitlements` module reads the provider's memberships, and the tables behind them. */
+interface ModuleEntitlementsProvider {
+  /** The provider's name, for comments. */
+  readonly name: string;
+  /** The provider scope tenants are, e.g. `organization`. */
+  readonly scope: string;
+  readonly idType: ModuleIdType;
+  /** `authorization.functions.memberIds`. */
+  readonly memberIds: string;
+  /** `authorization.functions.memberIdsFor`. */
+  readonly memberIdsFor: string;
+  readonly memberships: readonly AuthorizationMembership[];
 }
-/** Where PermDock's `member_<scope>_ids` helpers live, and the tables behind them. */
-interface KitPermdock {
-  /** PermDock's `rls.schema`. */
-  readonly schema: string;
-  /** The PermDock scope tenants map to, e.g. `organization`. */
+/** What the `access` module's `provider` model calls. */
+interface ModuleAccessProvider {
+  /** The provider's name, for comments and errors. */
+  readonly name: string;
+  /** The provider scope tenants are. */
   readonly scope: string;
-  /** The scope's id type, from the manifest's `rls.scopes[].type`. */
-  readonly idType: KitIdType;
-  readonly memberships: readonly KitMembershipSource[];
+  readonly idType: ModuleIdType;
+  readonly functions: AuthorizationFunctions;
+  /** The access module's `disabled` setting defaults to these. */
+  readonly suspension?: {
+    readonly user?: DisabledRow;
+    readonly tenant?: DisabledRow;
+  };
+  /** An adopted `tenant` module on one of these tables reads role names the same way. */
+  readonly roleSources?: readonly AuthorizationRoleSource[];
+  /** How `ai-chat` applies `functions.canApprove`. */
+  readonly approvals?: {
+    readonly distinctApprover?: boolean;
+  };
 }
 /** An embedding column `db.$search` can query. */
 interface VectorSearchTable {
@@ -263,6 +251,28 @@ interface VectorSearchTable {
   readonly table: string;
   readonly column: string;
   readonly distance: "cosine" | "l2" | "inner_product";
+  /** The column's type: pgvector's `vector` (default) or `halfvec`. */
+  readonly type?: "vector" | "halfvec";
+  /** The primary key column the scores function returns. Defaults to `id`. */
+  readonly key?: string;
+  /** Full-text ranking fused with the vector ranking (reciprocal rank fusion). */
+  readonly hybrid?: {
+    readonly tsvector: string;
+    /** The text search configuration of the query. Defaults to `simple`. */
+    readonly config?: string;
+    /** The RRF constant. Defaults to 60. */
+    readonly k?: number;
+  };
+  /** A SQL expression over the row `t` the score is multiplied by, such as `t.priority`. */
+  readonly boost?: string;
+  /** Columns `filter` narrows before ranking, such as `organization_id`. */
+  readonly prefilter?: readonly string[];
+  /** A SQL condition over the row `t` every candidate must meet. */
+  readonly predicate?: string;
+  /** How `boost` combines with the score. Defaults to `multiply`. */
+  readonly boostMode?: "multiply" | "add";
+  /** A SQL `order by` list over the row `t` that breaks score ties. */
+  readonly order?: string;
 }
 /** The table holding each tenant's Stripe customer id. */
 interface EntitlementsSource {
@@ -272,30 +282,69 @@ interface EntitlementsSource {
   readonly column?: string;
   /** Column with the tenant id. */
   readonly key: string;
+  /** Where entitlements come from; the customer lookups are for `stripe-sync` only. */
+  readonly source?: "stripe-sync" | "custom" | EntitlementPlansSource;
+  readonly claim?: FeatureClaimOption;
 }
-/** Privileges one Data API role gets on a table or view. */
+/** Privileges one role gets on a table or view. */
 interface TableGrant {
   /** `table` or `schema.table`. */
   readonly table: string;
-  readonly role: "anon" | "authenticated";
-  readonly privileges: readonly ("select" | "insert" | "update" | "delete")[];
+  readonly role: "anon" | "authenticated" | "service_role";
+  readonly privileges: readonly string[];
 }
-/** A jsonb column and the JSON Schema its values must match. */
-interface JsonSchemaCheck {
-  /** `table` or `schema.table`. */
-  readonly table: string;
-  readonly column: string;
-  readonly schema: Readonly<Record<string, unknown>>;
+/** The roles that may execute a function. */
+interface FunctionGrant {
+  /** `name(argument types)` or `schema.name(argument types)`. */
+  readonly function: string;
+  readonly roles: readonly ("anon" | "authenticated" | "service_role")[];
 }
-/** Whether an installed file matches, ignoring the version stamped in its header. */
-export declare function sameKitFile(current: string | undefined, expected: string): boolean;
-/** The installed version of a kit file, from its `@bs-kit` line. */
-export declare function kitFileVersion(contents: string): {
+/** Whether an installed file matches, ignoring the version stamped in its header and line endings. */
+export declare function sameModuleFile(current: string | undefined, expected: string): boolean;
+/** The installed version of a module file, from its `@bs-module` line. */
+export declare function moduleFileVersion(contents: string): {
   readonly module: string;
   readonly version: number;
 } | undefined;
 /** A module's SQL for `layout`, without header; `undefined` in custom mode. */
-export declare function moduleBody(name: string, layout?: KitLayout): string | undefined;
+export declare function moduleBody(name: string, layout?: ModuleLayout): string | undefined;
+/**
+ * The schema or test file `renderModules` writes for each of `names` and the
+ * modules they pull in, without rendering: modules in custom mode have none.
+ */
+export declare function moduleFilePaths(names: readonly string[], layout?: ModuleLayout): ReadonlyMap<string, string>;
+/** A permission key a SQL module checks, from `modulePermissionKeys`. */
+interface ModulePermissionKey {
+  readonly module: string;
+  /** The action in `sql.modules.<module>.permissions` that overrides the key. */
+  readonly action: string;
+  readonly key: string;
+  /**
+   * `tenant` for keys checked in a tenant (`member_can`, `can`,
+   * `tenant_ids_with`), `platform` for `is_platform` and `platform_can`.
+   */
+  readonly scope: "tenant" | "platform";
+}
+/**
+ * Every permission key the modules `names` install (with what they pull
+ * in) check, after `sql.modules.<module>.permissions` overrides. Modules in custom
+ * mode are skipped, and so is `invitations.invitePlatform` without platform
+ * roles.
+ */
+export declare function modulePermissionKeys(config: ModulesConfig, names: readonly string[]): ModulePermissionKey[];
+interface ModuleExtension {
+  readonly name: string;
+  readonly statement: string;
+}
+export declare const moduleSchemaExtensions: (files: readonly ModuleFile[]) => ModuleExtension[];
+/**
+ * The event triggers each of these modules creates, as its default file
+ * renders them, for doctor's check of a database.
+ */
+export declare function moduleEventTriggers(names: readonly string[], modules?: Readonly<Record<string, SqlModule>>): {
+  readonly module: string;
+  readonly name: string;
+}[];
 /**
  * The files `sql add` writes for these modules. Modules in `custom` mode
  * write nothing: the app implements their contract. A schema module's rows,
@@ -303,14 +352,19 @@ export declare function moduleBody(name: string, layout?: KitLayout): string | u
  * second file in `better-supabase-data/` (`kind: 'data'`), which
  * `sql data` writes into a migration.
  */
-export declare function renderKit(names: readonly string[], layout?: KitLayout): KitFile[];
-/** An installed module, from its file's `@bs-kit` line or `kit_modules`. */
-interface InstalledKitModule {
+export declare function renderModules(names: readonly string[], layout?: ModuleLayout): ModuleFile[];
+interface ModuleTopic {
+  readonly module: string;
+  readonly topic: string;
+}
+export declare function moduleTopics(names: readonly string[], layout?: ModuleLayout): ModuleTopic[];
+/** An installed module, from its file's `@bs-module` line or `modules`. */
+interface InstalledModule {
   readonly module: string;
   readonly version: number;
 }
 /** What `sql upgrade` runs for one module behind the current version. */
-interface KitUpgradePlan {
+interface ModuleUpgradePlan {
   readonly module: string;
   readonly from: number;
   readonly to: number;
@@ -325,22 +379,92 @@ interface KitUpgradePlan {
  * without a step needs none: the module file upgrades in place. Modules in
  * custom mode belong to the app and are skipped.
  */
-export declare function upgradePlan(installed: readonly InstalledKitModule[], layout?: KitLayout, modules?: Readonly<Record<string, SqlModule>>): KitUpgradePlan[];
-/** Every deprecated or removed kit symbol, with its module. */
-export declare function kitDeprecations(modules?: Readonly<Record<string, SqlModule>>): readonly (KitDeprecation & {
+export declare function upgradePlan(installed: readonly InstalledModule[], layout?: ModuleLayout, modules?: Readonly<Record<string, SqlModule>>): ModuleUpgradePlan[];
+/** Every deprecated or removed module symbol, with its module. */
+export declare function moduleDeprecations(modules?: Readonly<Record<string, SqlModule>>): readonly (ModuleDeprecation & {
   readonly module: string;
 })[];
 /** The contract functions of the modules in `custom` mode, for doctor. */
-export declare function customContracts(names: readonly string[], layout?: KitLayout): {
+export declare function customContracts(names: readonly string[], layout?: ModuleLayout): {
   readonly module: string;
   readonly schema: string;
-  readonly idType: KitIdType;
-  readonly functions: readonly KitContractFunction[];
+  readonly idType: ModuleIdType;
+  readonly functions: readonly ModuleContractFunction[];
 }[];
 //#endregion
+//#region src/sql/adopted-columns.d.ts
+/**
+ * Adopt-mode modules that default an optional column to its physical name
+ * while the adopted `create table` has no such column. `sql sync` refuses
+ * those configs so `has()` does not treat a missing column as present.
+ */
+export declare function adoptedColumnProblems(modules: ModulesConfig, files: readonly {
+  readonly text: string;
+}[], schemas: readonly string[]): readonly string[];
+//#endregion
+//#region src/sql/schema-scan.d.ts
+/** Privileges one role gets on a table, from the policies that name it. */
+interface PolicyGrant {
+  /** `schema.table`, unquoted; an unqualified name is in `public`. */
+  readonly table: string;
+  readonly role: "anon" | "authenticated";
+  readonly privileges: readonly ("select" | "insert" | "update" | "delete")[];
+}
+/**
+ * The tables `files` create (`create table`), as `schema.table`, in the
+ * order they first appear. Only tables in `schemas` are kept.
+ */
+export declare function declaredTables(files: readonly {
+  readonly text: string;
+}[], schemas: readonly string[]): string[];
+/**
+ * The privileges the permissive policies in `files` imply, per table and
+ * role: `for all` gives the four commands, `to public` (or no `to`) counts
+ * for `authenticated` only, so `anon` needs a policy that names it.
+ * Restrictive policies grant nothing. Only tables in `schemas` are kept.
+ */
+export declare function policyGrants(files: readonly {
+  readonly text: string;
+}[], schemas: readonly string[]): PolicyGrant[];
+export declare function extensionSchema(sources: readonly {
+  readonly text: string;
+}[], extension: string): string | undefined;
+//#endregion
+//#region src/core/access-sql.d.ts
+/** The Postgres types a scope's ids can have. */
+export declare const SCOPE_ID_TYPES: readonly string[];
+/**
+ * What is wrong with a provider's scopes: an unknown tenant scope or
+ * parent, a parent cycle, an id type outside `SCOPE_ID_TYPES`, or a tenant
+ * scope without one.
+ */
+export declare function scopeProblems(provider: {
+  readonly scopes: readonly {
+    readonly name: string;
+    readonly idType?: string | undefined;
+    readonly parent?: string | undefined;
+  }[];
+  readonly tenantScope: string;
+}): string[];
+/** The `schema.name` of every schema-qualified function a template calls, with `{scope}` filled. */
+export declare function templateFunctions(template: string, scope?: string): string[];
+/** What a bucket or topic access policy decides with. */
+interface AccessTarget {
+  /** `tenant` (default), `platform`, or with `sql` any scope its templates take. */
+  readonly scope?: string;
+  /** `"provider"` is replaced with `authorization.functions` by `gen`. */
+  readonly sql?: AccessPolicySql | "provider";
+}
+/**
+ * `target` with `sql: "provider"` replaced by the provider's `idsWith` and
+ * `isPlatform`. `where` names the policy in the error when there is no
+ * provider.
+ */
+export declare function resolveProviderSql<T extends AccessTarget>(where: string, target: T, functions: AuthorizationFunctions | undefined): T;
+//#endregion
 //#region src/sql/layout.d.ts
-/** Where and how `sql add` writes kit files for this config. */
-export declare function kitLayout(config: ResolvedConfig, testsDir?: string, readSets?: KitLayout["readSets"], permdock?: KitPermdock): KitLayout;
+/** Where and how `sql add` writes module files for this config. */
+export declare function moduleLayout(config: ResolvedConfig, testsDir?: string, readSets?: ModuleLayout["readSets"], entitlementsProvider?: ModuleEntitlementsProvider, accessProvider?: ModuleAccessProvider, permissionCatalog?: readonly string[]): ModuleLayout;
 //#endregion
 //#region src/sql/migration-options.d.ts
 /** A migration-only option a config sets. */
@@ -349,14 +473,26 @@ interface MigrationOptionUse {
   readonly option: string;
   readonly value: unknown;
   readonly adopted: boolean;
-  /** `kits.<module>.options.<option> ... It <effect>.` */
+  /** `sql.modules.<module>.options.<option> ... It <effect>.` */
   readonly message: string;
 }
 /**
- * The migration-only options `kits` sets to a value other than the managed
+ * The migration-only options `sql.modules` sets to a value other than the managed
  * default. They are accepted in `adopt` mode only; doctor warns about each.
  */
-export declare function migrationOptionUses(kits?: KitsConfig): MigrationOptionUse[];
+export declare function migrationOptionUses(modules?: ModulesConfig): MigrationOptionUse[];
+//#endregion
+//#region src/sql/shared-roles.d.ts
+/**
+ * Why a roles table that holds both tenant and platform roles (the tenant
+ * module's `roleThrough` and the invitations module's
+ * `platformRoles.through` under the `provider` model) can't tell them apart:
+ * the setting that lacks `where` and why. Empty when the modules don't share a roles table.
+ */
+export declare function sharedRolesProblems(names: readonly string[], layout: ModuleLayout): {
+  readonly setting: string;
+  readonly message: string;
+}[];
 //#endregion
 //#region src/sql/read-sets.d.ts
 /** A read set compiled to the SQL of its function. */
@@ -373,4 +509,4 @@ export declare function compileReadSet(set: ReadSet): Promise<CompiledReadSet>;
 /** Compiles every set, sorted by name. Throws on a duplicate name. */
 export declare function compileReadSets(sets: readonly ReadSet[]): Promise<CompiledReadSet[]>;
 //#endregion
-export { type CompiledReadSet, type InstalledKitModule, type KitContext, type KitContractFunction, type KitDeprecation, type KitFile, type KitIdType, type KitLayout, type KitNames, type KitPermdock, type KitTableSpec, type KitUpgrade, type KitUpgradePlan, type MigrationOptionUse, PERMDOCK_SCHEMA, type PermdockCatalog, type PermdockKeyStatus, type SqlModule, permdockKeyStatus, permdockKeys };
+export { AUDIT_CATEGORIES, type AuditCategory, type AuditedTable, type CompiledReadSet, type InstalledModule, MODULE_ID_TYPES, type MigrationOptionUse, type ModuleAccessProvider, type ModuleAction, type ModuleAudit, type ModuleContext, type ModuleContractFunction, type ModuleDeprecation, type ModuleEmit, type ModuleEntitlementsProvider, type ModuleExtension, type ModuleFile, type ModuleIdType, type ModuleLayout, type ModuleNames, type ModulePermissionKey, type ModuleTableSpec, type ModuleTestFile, type ModuleTopic, type ModuleUpgrade, type ModuleUpgradePlan, type PolicyGrant, type SqlModule, contractSignature, isModuleIdType, moduleIdType };