better-supabase 0.5.0 → 0.6.0

package/dist/workflow-sdk-world-D-prir6O.js

@@ -0,0 +1,1397 @@
+import { i as sqlString, r as sqlIdent } from "./template--jDkl3UP.js";
+//#region src/sql/modules/workflow-sdk-world-ddl.generated.ts
+/** The `@workflow/world-postgres` version the DDL below was generated from. */
+const WORLD_POSTGRES_VERSION = "5.0.2";
+/** The `workflow` schema after every migration above, as idempotent DDL. */
+const WORLD_POSTGRES_DDL = `create schema if not exists workflow;
+
+do $$ begin
+  create type workflow.status as enum ('pending', 'running', 'completed', 'failed', 'cancelled');
+exception when duplicate_object then null;
+end $$;
+
+do $$ begin
+  create type workflow.step_status as enum ('pending', 'running', 'completed', 'failed', 'cancelled');
+exception when duplicate_object then null;
+end $$;
+
+do $$ begin
+  create type workflow.wait_status as enum ('waiting', 'completed');
+exception when duplicate_object then null;
+end $$;
+
+create table if not exists workflow.workflow_event_slots (
+  "run_id" character varying not null,
+  constraint "workflow_event_slots_pkey" PRIMARY KEY (run_id)
+);
+
+alter table workflow.workflow_event_slots
+  add column if not exists "run_id" character varying not null;
+
+create table if not exists workflow.workflow_events (
+  "id" character varying not null,
+  "type" character varying not null,
+  "correlation_id" character varying,
+  "created_at" timestamp without time zone not null default now(),
+  "run_id" character varying not null,
+  "payload" jsonb,
+  "payload_cbor" bytea,
+  "spec_version" integer,
+  "resume_id" character varying,
+  "resume_payload_digest" character varying,
+  constraint "workflow_events_run_id_id_pk" PRIMARY KEY (run_id, id)
+);
+
+alter table workflow.workflow_events
+  add column if not exists "id" character varying not null,
+  add column if not exists "type" character varying not null,
+  add column if not exists "correlation_id" character varying,
+  add column if not exists "created_at" timestamp without time zone not null default now(),
+  add column if not exists "run_id" character varying not null,
+  add column if not exists "payload" jsonb,
+  add column if not exists "payload_cbor" bytea,
+  add column if not exists "spec_version" integer,
+  add column if not exists "resume_id" character varying,
+  add column if not exists "resume_payload_digest" character varying;
+
+create index if not exists workflow_events_correlation_id_index ON workflow.workflow_events USING btree (correlation_id);
+
+create unique index if not exists workflow_events_entity_creation_unique ON workflow.workflow_events USING btree (run_id, correlation_id, type) WHERE ((type)::text = ANY ((ARRAY['step_created'::character varying, 'hook_created'::character varying, 'wait_created'::character varying, 'attr_set'::character varying])::text[]));
+
+create unique index if not exists workflow_events_hook_resume_unique ON workflow.workflow_events USING btree (run_id, resume_id) WHERE (((type)::text = 'hook_received'::text) AND (resume_id IS NOT NULL));
+
+create table if not exists workflow.workflow_hooks (
+  "run_id" character varying not null,
+  "hook_id" character varying not null,
+  "token" character varying not null,
+  "owner_id" character varying not null,
+  "project_id" character varying not null,
+  "environment" character varying not null,
+  "created_at" timestamp without time zone not null default now(),
+  "metadata" jsonb,
+  "metadata_cbor" bytea,
+  "spec_version" integer,
+  "is_webhook" boolean default true,
+  "is_system" boolean default false,
+  "resume_context" bytea,
+  "token_retention_until" timestamp with time zone,
+  "claimed_from" bytea,
+  constraint "workflow_hooks_pkey" PRIMARY KEY (hook_id)
+);
+
+alter table workflow.workflow_hooks
+  add column if not exists "run_id" character varying not null,
+  add column if not exists "hook_id" character varying not null,
+  add column if not exists "token" character varying not null,
+  add column if not exists "owner_id" character varying not null,
+  add column if not exists "project_id" character varying not null,
+  add column if not exists "environment" character varying not null,
+  add column if not exists "created_at" timestamp without time zone not null default now(),
+  add column if not exists "metadata" jsonb,
+  add column if not exists "metadata_cbor" bytea,
+  add column if not exists "spec_version" integer,
+  add column if not exists "is_webhook" boolean default true,
+  add column if not exists "is_system" boolean default false,
+  add column if not exists "resume_context" bytea,
+  add column if not exists "token_retention_until" timestamp with time zone,
+  add column if not exists "claimed_from" bytea;
+
+create index if not exists workflow_hooks_run_id_index ON workflow.workflow_hooks USING btree (run_id);
+
+create index if not exists workflow_hooks_token_index ON workflow.workflow_hooks USING btree (token);
+
+create table if not exists workflow.workflow_invocations (
+  "sequence" bigserial,
+  "run_id" character varying not null,
+  "request_id" character varying not null,
+  "payload" bytea,
+  "fingerprint" character varying,
+  "result" bytea,
+  "created_at" timestamp without time zone not null default now(),
+  "responded_at" timestamp without time zone,
+  "expired_at" timestamp without time zone,
+  "result_version" integer not null default 0,
+  constraint "workflow_invocations_pkey" PRIMARY KEY (run_id, request_id)
+);
+
+alter table workflow.workflow_invocations
+  add column if not exists "sequence" bigserial,
+  add column if not exists "run_id" character varying not null,
+  add column if not exists "request_id" character varying not null,
+  add column if not exists "payload" bytea,
+  add column if not exists "fingerprint" character varying,
+  add column if not exists "result" bytea,
+  add column if not exists "created_at" timestamp without time zone not null default now(),
+  add column if not exists "responded_at" timestamp without time zone,
+  add column if not exists "expired_at" timestamp without time zone,
+  add column if not exists "result_version" integer not null default 0;
+
+create index if not exists workflow_invocations_pending ON workflow.workflow_invocations USING btree (run_id, sequence) WHERE (responded_at IS NULL);
+
+create table if not exists workflow.workflow_runs (
+  "id" character varying not null,
+  "output" jsonb,
+  "deployment_id" character varying not null,
+  "status" workflow.status not null,
+  "name" character varying not null,
+  "execution_context" jsonb,
+  "input" jsonb,
+  "error" text,
+  "created_at" timestamp without time zone not null default now(),
+  "updated_at" timestamp without time zone not null default now(),
+  "completed_at" timestamp without time zone,
+  "started_at" timestamp without time zone,
+  "output_cbor" bytea,
+  "execution_context_cbor" bytea,
+  "input_cbor" bytea,
+  "expired_at" timestamp without time zone,
+  "spec_version" character varying,
+  "error_cbor" bytea,
+  "error_code" character varying,
+  "attributes" jsonb not null default '{}'::jsonb,
+  "encryption_public_key" character varying,
+  "dynamic_workflow_code_cbor" bytea,
+  constraint "workflow_runs_pkey" PRIMARY KEY (id)
+);
+
+alter table workflow.workflow_runs
+  add column if not exists "id" character varying not null,
+  add column if not exists "output" jsonb,
+  add column if not exists "deployment_id" character varying not null,
+  add column if not exists "status" workflow.status not null,
+  add column if not exists "name" character varying not null,
+  add column if not exists "execution_context" jsonb,
+  add column if not exists "input" jsonb,
+  add column if not exists "error" text,
+  add column if not exists "created_at" timestamp without time zone not null default now(),
+  add column if not exists "updated_at" timestamp without time zone not null default now(),
+  add column if not exists "completed_at" timestamp without time zone,
+  add column if not exists "started_at" timestamp without time zone,
+  add column if not exists "output_cbor" bytea,
+  add column if not exists "execution_context_cbor" bytea,
+  add column if not exists "input_cbor" bytea,
+  add column if not exists "expired_at" timestamp without time zone,
+  add column if not exists "spec_version" character varying,
+  add column if not exists "error_cbor" bytea,
+  add column if not exists "error_code" character varying,
+  add column if not exists "attributes" jsonb not null default '{}'::jsonb,
+  add column if not exists "encryption_public_key" character varying,
+  add column if not exists "dynamic_workflow_code_cbor" bytea;
+
+create index if not exists workflow_runs_name_index ON workflow.workflow_runs USING btree (name);
+
+create index if not exists workflow_runs_status_index ON workflow.workflow_runs USING btree (status);
+
+create table if not exists workflow.workflow_snapshots (
+  "run_id" character varying not null,
+  "data" bytea not null,
+  "events_cursor" character varying,
+  "created_at" timestamp without time zone not null default now(),
+  constraint "workflow_snapshots_pkey" PRIMARY KEY (run_id)
+);
+
+alter table workflow.workflow_snapshots
+  add column if not exists "run_id" character varying not null,
+  add column if not exists "data" bytea not null,
+  add column if not exists "events_cursor" character varying,
+  add column if not exists "created_at" timestamp without time zone not null default now();
+
+create table if not exists workflow.workflow_steps (
+  "run_id" character varying not null,
+  "step_id" character varying not null,
+  "step_name" character varying not null,
+  "status" workflow.step_status not null,
+  "input" jsonb,
+  "output" jsonb,
+  "error" text,
+  "attempt" integer not null,
+  "started_at" timestamp without time zone,
+  "completed_at" timestamp without time zone,
+  "created_at" timestamp without time zone not null default now(),
+  "updated_at" timestamp without time zone not null default now(),
+  "retry_after" timestamp without time zone,
+  "input_cbor" bytea,
+  "output_cbor" bytea,
+  "error_cbor" bytea,
+  "spec_version" integer,
+  constraint "workflow_steps_pkey" PRIMARY KEY (step_id)
+);
+
+alter table workflow.workflow_steps
+  add column if not exists "run_id" character varying not null,
+  add column if not exists "step_id" character varying not null,
+  add column if not exists "step_name" character varying not null,
+  add column if not exists "status" workflow.step_status not null,
+  add column if not exists "input" jsonb,
+  add column if not exists "output" jsonb,
+  add column if not exists "error" text,
+  add column if not exists "attempt" integer not null,
+  add column if not exists "started_at" timestamp without time zone,
+  add column if not exists "completed_at" timestamp without time zone,
+  add column if not exists "created_at" timestamp without time zone not null default now(),
+  add column if not exists "updated_at" timestamp without time zone not null default now(),
+  add column if not exists "retry_after" timestamp without time zone,
+  add column if not exists "input_cbor" bytea,
+  add column if not exists "output_cbor" bytea,
+  add column if not exists "error_cbor" bytea,
+  add column if not exists "spec_version" integer;
+
+create index if not exists workflow_steps_run_id_index ON workflow.workflow_steps USING btree (run_id);
+
+create index if not exists workflow_steps_status_index ON workflow.workflow_steps USING btree (status);
+
+create table if not exists workflow.workflow_stream_chunks (
+  "id" character varying not null,
+  "stream_id" character varying not null,
+  "data" bytea not null,
+  "created_at" timestamp without time zone not null default now(),
+  "eof" boolean not null,
+  "run_id" character varying,
+  constraint "workflow_stream_chunks_stream_id_id_pk" PRIMARY KEY (stream_id, id)
+);
+
+alter table workflow.workflow_stream_chunks
+  add column if not exists "id" character varying not null,
+  add column if not exists "stream_id" character varying not null,
+  add column if not exists "data" bytea not null,
+  add column if not exists "created_at" timestamp without time zone not null default now(),
+  add column if not exists "eof" boolean not null,
+  add column if not exists "run_id" character varying;
+
+create index if not exists workflow_stream_chunks_run_id_index ON workflow.workflow_stream_chunks USING btree (run_id);
+
+create table if not exists workflow.workflow_waits (
+  "wait_id" character varying not null,
+  "run_id" character varying not null,
+  "status" workflow.wait_status not null,
+  "resume_at" timestamp without time zone,
+  "completed_at" timestamp without time zone,
+  "created_at" timestamp without time zone not null default now(),
+  "updated_at" timestamp without time zone not null default now(),
+  "spec_version" integer,
+  constraint "workflow_waits_pkey" PRIMARY KEY (wait_id)
+);
+
+alter table workflow.workflow_waits
+  add column if not exists "wait_id" character varying not null,
+  add column if not exists "run_id" character varying not null,
+  add column if not exists "status" workflow.wait_status not null,
+  add column if not exists "resume_at" timestamp without time zone,
+  add column if not exists "completed_at" timestamp without time zone,
+  add column if not exists "created_at" timestamp without time zone not null default now(),
+  add column if not exists "updated_at" timestamp without time zone not null default now(),
+  add column if not exists "spec_version" integer;
+
+create index if not exists workflow_waits_run_id_index ON workflow.workflow_waits USING btree (run_id);
+`;
+//#endregion
+//#region src/sql/shared.ts
+/** What `record` and the other statement helpers return when there is nothing to do. */
+const NOTHING = "null;";
+/** `alter table ... add column if not exists` for each extra column of a managed table. */
+const addExtraColumns = (table, columns) => columns.map((column) => `\nalter table ${table} add column if not exists ${column.ident} ${column.type};`).join("");
+/**
+* A `jsonb` object of `columns` of row `alias`, keyed by column name, so
+* reads return extra columns without exposing the rest of the row.
+*/
+const columnsObject = (alias, columns) => `jsonb_build_object(${columns.map((name) => `${sqlString(name)}, ${alias}.${sqlIdent(name)}`).join(", ")})`;
+const SCHEMA = `create schema if not exists better_supabase;
+grant usage on schema better_supabase to anon, authenticated, service_role;`;
+/**
+* A SQL condition true for the service role and for a direct admin
+* connection (no JWT, a privileged session user), which may act for others.
+*/
+const SERVICE_CALLER = "coalesce(nullif((select auth.jwt()) ->> 'role', ''), session_user::text) in ('service_role', 'postgres', 'supabase_admin')";
+/**
+* The `organization.member_added` record for a module that adds a member, so
+* every module writes the same payload. Each value is a SQL expression.
+*/
+function memberAddedRecord(ctx, member) {
+	return ctx.record({
+		type: "organization.member_added",
+		payload: `jsonb_build_object('organizationId', ${member.tenant}::text, 'userId', ${member.user}, 'role', ${member.role})`,
+		subject: `'organizations/' || ${member.tenant}::text`,
+		tenant: member.tenant,
+		audit: {
+			category: "membership",
+			targetType: "user",
+			recordId: `${member.user}::text`
+		}
+	});
+}
+/** Creates the module's schema when it isn't `better_supabase`, then the module schema. */
+function schemaPreamble(ctx) {
+	if (ctx.schemaName === "better_supabase") return SCHEMA;
+	return `${SCHEMA}
+create schema if not exists ${ctx.schema};
+grant usage on schema ${ctx.schema} to anon, authenticated, service_role;`;
+}
+/**
+* A policy condition for "the caller holds `permission` in this row's
+* tenant". Postgres never inlines `can()` (it is `security definer`), so a
+* `can('tenant', column, ...)` in `using` runs once per row and can't use the
+* tenant index; the `tenant_ids_with` set runs once per statement.
+*/
+function tenantIn(tenant, permission) {
+	return `${tenant} in (select better_supabase.tenant_ids_with(${permission}))`;
+}
+/** A claim from the top level of the token, then `app_metadata`. */
+function jwtClaim(name) {
+	return `coalesce(auth.jwt() ->> ${sqlString(name)}, auth.jwt() -> 'app_metadata' ->> ${sqlString(name)})`;
+}
+/** `table` or `schema.table` as `[schema, table]`, in `public` without a schema. */
+function splitTable(name) {
+	const parts = name.split(".");
+	if (parts.length > 2 || parts.some((part) => part.length === 0)) throw new TypeError(`"${name}" must be "table" or "schema.table"`);
+	return parts.length === 2 ? [parts[0], parts[1]] : ["public", parts[0]];
+}
+/** `table` or `schema.table`, quoted. */
+function quotedTable(name) {
+	const [schema, table] = splitTable(name);
+	return `${sqlIdent(schema)}.${sqlIdent(table)}`;
+}
+/** `schema.table.column` split into its quoted table and column. */
+function columnRef(where, value) {
+	const parts = value.split(".");
+	if (parts.length !== 3 || parts.some((part) => part.length === 0)) throw new TypeError(`${where} must be "schema.table.column", got "${value}"`);
+	const [schema, table, column] = parts;
+	return {
+		table: `${sqlIdent(schema)}.${sqlIdent(table)}`,
+		column: sqlIdent(column)
+	};
+}
+const QUOTED_IDENT = /^"(.*)"$/s;
+/**
+* Replaces the check constraints on one column of a table a module created
+* earlier: `create table if not exists` never changes an inline check, and
+* its generated name follows the table's configured name. For upgrade steps.
+* `column` is a quoted identifier; the catalog stores the bare name.
+*/
+function replaceColumnCheck(check) {
+	const column = QUOTED_IDENT.exec(check.column)?.[1]?.replaceAll("\"\"", "\"") ?? check.column;
+	return `do $$
+declare
+  v_name name;
+begin
+  for v_name in
+    select c.conname from pg_catalog.pg_constraint c
+    join pg_catalog.pg_attribute a on a.attrelid = c.conrelid and a.attnum = c.conkey[1]
+    where c.conrelid = ${sqlString(check.table)}::regclass and c.contype = 'c'
+      and cardinality(c.conkey) = 1 and a.attname = ${sqlString(column)}
+  loop
+    execute format('alter table %s drop constraint %I', ${sqlString(check.table)}, v_name);
+  end loop;
+end;
+$$;
+alter table ${check.table} add constraint ${sqlIdent(check.name)} check (${check.expression});`;
+}
+/**
+* Adds a foreign key to a table a module created earlier, once: `create
+* table if not exists` can't add it to a table that already exists, and the
+* referenced table can come from a module that renders later. Existing rows
+* without a match leave the key unvalidated, with a warning.
+*/
+function addForeignKey(fk) {
+	return `do $$
+begin
+  if not exists (
+    select 1 from pg_constraint
+    where conrelid = ${sqlString(fk.table)}::regclass and conname = ${sqlString(fk.name)}
+  ) then
+    alter table ${fk.table} add constraint ${sqlIdent(fk.name)}
+      foreign key (${fk.column}) references ${fk.references} on delete ${fk.onDelete} not valid;
+    begin
+      alter table ${fk.table} validate constraint ${sqlIdent(fk.name)};
+    exception when foreign_key_violation then
+      raise warning '% has rows without a match, so only new rows are checked. Delete them, then run: alter table % validate constraint %',
+        ${sqlString(fk.table)}, ${sqlString(fk.table)}, ${sqlString(fk.name)};
+    end;
+  end if;
+end;
+$$;`;
+}
+/**
+* An `updated_at` column on a managed table, kept current by the
+* `updated-at` module's `set_updated_at()` (the module must require it).
+*/
+function updatedAt(table, column) {
+	return `alter table ${table} add column if not exists ${column} timestamptz not null default now();
+drop trigger if exists bs_updated_at on ${table};
+create trigger bs_updated_at before update on ${table}
+  for each row execute function better_supabase.set_updated_at(${sqlString(column.replaceAll("\"", ""))});`;
+}
+function renameSql(renames) {
+	const schema = sqlString(renames.schema);
+	const q = (name) => `${sqlIdent(renames.schema)}.${sqlIdent(name)}`;
+	const lines = [];
+	let table = renames.table;
+	for (const [from, to] of renames.tables ?? []) {
+		lines.push(`  if to_regclass(${sqlString(`${renames.schema}.${from}`)}) is not null
+    and (select c.relkind from pg_class c where c.oid = to_regclass(${sqlString(`${renames.schema}.${from}`)})) in ('r', 'p')
+    and to_regclass(${sqlString(`${renames.schema}.${to}`)}) is null then
+    alter table ${q(from)} rename to ${sqlIdent(to)};
+  end if;`);
+		if (from === table) table = to;
+	}
+	for (const [from, to] of renames.columns ?? []) lines.push(`  if exists (select 1 from information_schema.columns c
+      where c.table_schema = ${schema} and c.table_name = ${sqlString(table)} and c.column_name = ${sqlString(from)})
+    and not exists (select 1 from information_schema.columns c
+      where c.table_schema = ${schema} and c.table_name = ${sqlString(table)} and c.column_name = ${sqlString(to)}) then
+    alter table ${q(table)} rename column ${sqlIdent(from)} to ${sqlIdent(to)};
+  end if;`);
+	for (const [from, to] of renames.indexes ?? []) lines.push(`  if to_regclass(${sqlString(`${renames.schema}.${from}`)}) is not null
+    and to_regclass(${sqlString(`${renames.schema}.${to}`)}) is null then
+    alter index ${q(from)} rename to ${sqlIdent(to)};
+  end if;`);
+	for (const [from, to, args] of renames.functions ?? []) lines.push(`  if to_regprocedure(${sqlString(`${renames.schema}.${from}(${args})`)}) is not null
+    and to_regprocedure(${sqlString(`${renames.schema}.${to}(${args})`)}) is null then
+    alter function ${q(from)}(${args}) rename to ${sqlIdent(to)};
+  end if;`);
+	if (lines.length === 0) return "";
+	return `do $$
+begin
+${lines.join("\n")}
+end;
+$$;`;
+}
+/**
+* A SQL condition true when `organization` names no row of the installed
+* organizations table. False without the organizations module.
+*/
+function organizationMissing(ctx, organization) {
+	if (!ctx.installed("organizations")) return "false";
+	const organizations = ctx.of("organizations");
+	return `not exists (select 1 from ${organizations.table("organizations")} o where o.${organizations.col("organizations", "id")} = ${organization})`;
+}
+function membershipDisabledAt(ctx) {
+	if (ctx.module !== "tenant" && !ctx.installed("tenant")) return void 0;
+	const tenant = ctx.module === "tenant" ? ctx : ctx.of("tenant");
+	if (!tenant.has("memberships", "disabledAt")) return void 0;
+	if (!tenant.manages && typeof tenant.config.columns["memberships"]?.["disabledAt"] !== "string") return void 0;
+	return tenant.col("memberships", "disabledAt");
+}
+function activeMembership(ctx, alias) {
+	const column = membershipDisabledAt(ctx);
+	return column === void 0 ? "" : ` and ${alias}.${column} is null`;
+}
+function membershipSuspended(ctx, tenant, user) {
+	const column = membershipDisabledAt(ctx);
+	if (column === void 0) return void 0;
+	const t = ctx.module === "tenant" ? ctx : ctx.of("tenant");
+	return `exists (select 1 from ${t.table("memberships")} sm where sm.${t.col("memberships", "tenant")} = ${tenant} and sm.${t.col("memberships", "user")} = ${user} and sm.${column} is not null)`;
+}
+/**
+* `tenant_disabled(id)` and `user_disabled(uuid)` from
+* `sql.modules.access.disabled`. Without a column they return false, so callers
+* don't need to know whether it is configured.
+*/
+function disabledHelpers(ctx) {
+	const disabled = ctx.modules.access?.disabled ?? {};
+	const id = ctx.idType;
+	const organizations = managedOrganizations(ctx);
+	let tenantCheck = "false";
+	if (disabled.tenant !== void 0) tenantCheck = disabledCheck("sql.modules.access.disabled.tenant", disabled.tenant, {
+		key: "\"id\"",
+		alias: "t",
+		value: "tenant_disabled.tenant"
+	});
+	else if (organizations) tenantCheck = `exists (select 1 from ${organizations.table} t where t.${organizations.id} = tenant_disabled.tenant and (${organizations.flags.map((column) => `t.${column} is not null`).join(" or ")}))`;
+	const userCheck = disabled.user === void 0 ? "false" : disabledCheck("sql.modules.access.disabled.user", disabled.user, {
+		key: sqlIdent(disabled.userKey ?? "id"),
+		alias: "u",
+		value: "user_disabled.user_id"
+	});
+	return `
+-- Disabled tenants and users get no permissions and no membership claims
+-- (modules.access.disabled; with the managed organizations module, its
+-- disabled_at and deleted_at columns).
+create or replace function better_supabase.tenant_disabled(tenant ${id})
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select ${tenantCheck}
+$$;
+
+create or replace function better_supabase.user_disabled(user_id uuid)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select ${userCheck}
+$$;
+
+revoke execute on function better_supabase.tenant_disabled(${id}) from public, anon, authenticated;
+revoke execute on function better_supabase.user_disabled(uuid) from public, anon, authenticated;
+grant execute on function better_supabase.tenant_disabled(${id}) to service_role, supabase_auth_admin;
+grant execute on function better_supabase.user_disabled(uuid) to service_role, supabase_auth_admin;`;
+}
+/**
+* Whether `disabledHelpers` reads the managed organizations table, which a
+* later file creates: the caller turns `check_function_bodies` off around it.
+*/
+/**
+* The condition that `value` is disabled: a set column (`schema.table.column`,
+* matched on `key`), or no active row (an authorization provider's
+* suspension row, where a missing row counts as disabled).
+*/
+function disabledCheck(where, config, match) {
+	const { alias: d, value } = match;
+	if (typeof config === "string") {
+		const ref = columnRef(where, config);
+		return `exists (select 1 from ${ref.table} ${d} where ${d}.${match.key} = ${value} and ${d}.${ref.column} is not null)`;
+	}
+	const parts = config.table.split(".");
+	if (parts.length !== 2 || parts.some((part) => part.length === 0)) throw new TypeError(`${where}.table must be "schema.table", got "${config.table}"`);
+	const active = [`${d}.${sqlIdent(config.id)} = ${value}`];
+	if (config.disabledAt !== void 0) active.push(`${d}.${sqlIdent(config.disabledAt)} is null`);
+	if (config.status !== void 0) {
+		if (!config.active || config.active.length === 0) throw new TypeError(`${where}.status needs the active values in active`);
+		active.push(`${d}.${sqlIdent(config.status)}::text in (${config.active.map(sqlString).join(", ")})`);
+	}
+	if (config.disabledAt === void 0 && config.status === void 0) throw new TypeError(`${where} needs disabledAt, status or both`);
+	return `not exists (select 1 from ${parts.map((part) => sqlIdent(part)).join(".")} ${d} where ${active.join(" and ")})`;
+}
+/**
+* Whether the `access` module's file defines `tenant_disabled` and
+* `user_disabled`: it does whenever it is installed (or configured) outside
+* custom mode, and the `tenant` module's file then leaves them out, so each
+* function is defined in one file.
+*/
+function accessDefinesDisabledHelpers(ctx) {
+	const access = ctx.modules.access;
+	if (!ctx.installed("access") && access === void 0) return false;
+	return (access?.mode ?? "managed") !== "custom";
+}
+function disabledHelpersNeedLaterTables(ctx) {
+	return !ctx.modules.access?.disabled?.tenant && managedOrganizations(ctx) !== void 0;
+}
+/** The managed organizations table and its disabling columns, when installed and managed. */
+function managedOrganizations(ctx) {
+	if (!ctx.installed("organizations")) return void 0;
+	const organizations = ctx.of("organizations");
+	if (!organizations.manages) return void 0;
+	const flags = ["disabledAt", "deletedAt"].filter((logical) => organizations.has("organizations", logical)).map((logical) => organizations.col("organizations", logical));
+	if (flags.length === 0) return void 0;
+	return {
+		table: organizations.table("organizations"),
+		id: organizations.col("organizations", "id"),
+		flags
+	};
+}
+/**
+* Another row trigger on `target` whose function name matches `pattern` does
+* the module trigger's job twice. `track_*` warns about it, or drops it with
+* `replace_trigger => true`.
+*/
+const EQUIVALENT_TRIGGERS = `
+create or replace function better_supabase.replace_equivalent_triggers(
+  target regclass,
+  module_trigger text,
+  pattern text,
+  replace_trigger boolean
+)
+returns void
+language plpgsql
+set search_path = ''
+as $$
+declare
+  found record;
+begin
+  for found in
+    select t.tgname as name, p.proname as fn
+    from pg_catalog.pg_trigger t
+    join pg_catalog.pg_proc p on p.oid = t.tgfoid
+    where t.tgrelid = replace_equivalent_triggers.target
+      and not t.tgisinternal
+      and t.tgname <> replace_equivalent_triggers.module_trigger
+      and p.proname ~* replace_equivalent_triggers.pattern
+  loop
+    if replace_trigger then
+      execute format('drop trigger %I on %s', found.name, target);
+    else
+      raise warning '% already has trigger % (%), which does what % does. Pass replace_trigger => true to drop it.',
+        target, found.name, found.fn, module_trigger;
+    end if;
+  end loop;
+end;
+$$;
+revoke execute on function better_supabase.replace_equivalent_triggers(regclass, text, text, boolean) from public, anon, authenticated;`;
+/** FNV-1a, as 8 hex digits: a stable suffix that keeps two names apart. */
+function shortHash(text) {
+	let hash = 2166136261;
+	for (let index = 0; index < text.length; index += 1) {
+		hash ^= text.codePointAt(index) ?? 0;
+		hash = Math.imul(hash, 16777619) >>> 0;
+	}
+	return hash.toString(16).padStart(8, "0");
+}
+/**
+* Adds CHECK `name` on `table` (quoted) unless a re-run finds it already
+* checking `expression`: the constraint comment records a hash of the
+* expression, so an unchanged check skips the table scan under ACCESS
+* EXCLUSIVE. `notValid` leaves existing rows unchecked.
+*/
+function ensureCheck(table, name, expression, options = {}) {
+	const marker = sqlString(`better-supabase check ${shortHash(`${expression}|${options.notValid === true}`)}`);
+	const constraint = sqlIdent(name);
+	return `do $$
+begin
+  if coalesce(obj_description((
+    select c.oid from pg_catalog.pg_constraint c
+    where c.conrelid = ${sqlString(table)}::regclass and c.conname = ${sqlString(name)}
+  ), 'pg_constraint'), '') <> ${marker} then
+    alter table ${table} drop constraint if exists ${constraint};
+    alter table ${table} add constraint ${constraint} check (${expression})${options.notValid === true ? " not valid" : ""};
+    comment on constraint ${constraint} on ${table} is ${marker};
+  end if;
+end;
+$$;`;
+}
+/**
+* The constraint and trigger name of a check. A key that sanitizing or the
+* 63-byte limit would change (`notify.email`, `notify-email`, a long key)
+* gets a hash of the key, so two keys never share a name and drop each
+* other's check.
+*/
+function jsonCheckName(check) {
+	const base = `bs_json_${check.column}`;
+	if (!check.where) return base.slice(0, 63);
+	const key = check.where.value;
+	const clean = key.replaceAll(/[^a-z0-9_]/gi, "_");
+	const plain = `${base}_${clean}`;
+	if (clean === key && plain.length <= 63) return plain;
+	return `${plain.slice(0, 54)}_${shortHash(key)}`;
+}
+function jsonSchemaChecks(checks) {
+	if (checks.length === 0) return "";
+	return `\n-- config.json schemas
+-- Each check is added not valid and validated separately. On a large table,
+-- move the validate statements to a later migration: adding a not valid check
+-- blocks writes only briefly, and validating takes a lock that lets writes
+-- continue. The trigger of the same name reports which part of the schema failed.
+${checks.map((check) => {
+		const target = quotedTable(check.table);
+		const name = sqlIdent(jsonCheckName(check));
+		const schemaText = sqlString(JSON.stringify(check.schema));
+		const matches = `extensions.jsonb_matches_schema(${schemaText}::json, ${sqlIdent(check.column)})`;
+		const columns = check.where ? `${sqlIdent(check.column)}, ${sqlIdent(check.where.column)}` : sqlIdent(check.column);
+		const args = [
+			sqlString(check.column),
+			schemaText,
+			...check.where ? [sqlString(check.where.column), sqlString(check.where.value)] : []
+		].join(", ");
+		return [
+			`alter table ${target} drop constraint if exists ${name};`,
+			`alter table ${target} add constraint ${name}`,
+			`  check (${check.where ? `${sqlIdent(check.where.column)} <> ${sqlString(check.where.value)} or ` : ""}${matches}) not valid;`,
+			`alter table ${target} validate constraint ${name};`,
+			`drop trigger if exists ${name} on ${target};`,
+			`create trigger ${name} before insert or update of ${columns} on ${target}`,
+			`  for each row execute function better_supabase.check_json_schema(${args});`
+		].join("\n");
+	}).join("\n\n")}\n`;
+}
+/** SQL that grants a function to signed-in users and the service role. */
+const userGrant = (signature) => `revoke execute on function ${signature} from public, anon;
+grant execute on function ${signature} to authenticated, service_role;`;
+/** SQL that grants a function to the service role only. */
+const serviceGrant = (signature) => `revoke execute on function ${signature} from public, anon, authenticated;
+grant execute on function ${signature} to service_role;`;
+/**
+* `serviceGrant` for each function in `schema` (as SQL, e.g. `ctx.schema`),
+* one statement per function, so `sql.modules.<module>.api` sees the grants
+* and writes an entry point for each.
+*/
+function serviceOnly(signatures, schema = "better_supabase") {
+	return signatures.map((signature) => serviceGrant(`${schema}.${signature}`)).join("\n");
+}
+/** `raise exception` with an errcode and a hint the TypeScript side maps. */
+const raise = (message, errcode, hint, ...args) => `raise exception ${sqlString(message)}${args.map((arg) => `, ${arg}`).join("")} using errcode = '${errcode}', hint = '${hint}';`;
+/** `coalesce(can('tenant', tenant, permission), false)`. */
+const canIn = (tenant, permission) => `coalesce(better_supabase.can('tenant', ${tenant}, ${permission}), false)`;
+/** The hex SHA-256 of a `text` expression, as tokens and codes are stored. */
+const sha256Hex = (value) => `encode(extensions.digest(${value}, 'sha256'), 'hex')`;
+/** A page size: `value`, or `fallback` when null, clamped to `min`..`max`. */
+const pageSize = (value, fallback, max, min = 1) => `least(greatest(coalesce(${value}, ${String(fallback)}), ${String(min)}), ${String(max)})`;
+/**
+* A row trigger that records writes to a table that callers change through
+* `security invoker` functions or policies, which can't call `emit_event` or
+* `audit_event` themselves. `written` and `removed` are `ctx.record`
+* statements over `v_row`, the new row (or the old one on delete). When
+* both are `null;` the trigger and its function are dropped.
+*/
+function recordTrigger(ctx, options) {
+	const fn = ctx.fn(options.name);
+	const trigger = ctx.trigger(options.name);
+	if (options.written === "null;" && options.removed === "null;") return `drop trigger if exists ${trigger} on ${options.table};
+drop function if exists ${fn}();`;
+	return `create or replace function ${fn}()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  v_row ${options.table};
+begin
+  if tg_op = 'DELETE' then
+    v_row := old;
+    ${options.removed}
+  else
+    v_row := new;
+    ${options.written}
+  end if;
+  return null;
+end;
+$$;
+revoke execute on function ${fn}() from public, anon, authenticated;
+drop trigger if exists ${trigger} on ${options.table};
+create trigger ${trigger} after insert or update or delete on ${options.table}
+  for each row execute function ${fn}();`;
+}
+//#endregion
+//#region src/sql/modules/access-model.ts
+/**
+* The `roles` model's defaults. Module actions name these keys (see
+* `MODULE_PERMISSIONS`); `*` grants everything and `prefix.*` a prefix.
+*/
+const DEFAULT_ROLES = {
+	owner: ["*"],
+	admin: [
+		"organization.read",
+		"organization.update",
+		"members.*",
+		"audit.read",
+		"webhooks.*",
+		"notifications.*",
+		"billing.*",
+		"api_keys.*",
+		"settings.*",
+		"usage.*",
+		"comments.*",
+		"activity.read",
+		"attachments.*",
+		"organization.export",
+		"onboarding.*",
+		"inbox.*",
+		"ai_chat.*",
+		"ai.*"
+	],
+	member: [
+		"organization.read",
+		"members.read",
+		"notifications.read",
+		"api_keys.own",
+		"settings.read",
+		"comments.read",
+		"comments.create",
+		"activity.read",
+		"attachments.read",
+		"attachments.upload",
+		"onboarding.read",
+		"inbox.read",
+		"inbox.reply",
+		"ai_chat.read",
+		"ai_chat.create",
+		"ai_chat.share",
+		"ai.read",
+		"ai.create",
+		"ai.share"
+	],
+	viewer: ["organization.read"]
+};
+/**
+* The permission key each module action checks by default, overridable per
+* module in `sql.modules.<name>.permissions`. Keys are `<area>.<verb>`, with `read`
+* for viewing; platform-wide actions use the `platform` area or a key that
+* `is_platform()` checks. The AI blocks other than ai-chat check `ai.*` keys.
+*/
+const MODULE_PERMISSIONS = {
+	organizations: {
+		update: "organization.update",
+		delete: "organization.delete",
+		removeMember: "members.remove",
+		suspendMember: "members.remove",
+		updateRole: "members.update_role",
+		transferOwnership: "organization.transfer_ownership"
+	},
+	invitations: {
+		invite: "members.invite",
+		revoke: "members.invite",
+		view: "members.invite",
+		invitePlatform: "platform.invite"
+	},
+	audit: {
+		view: "audit.read",
+		viewAll: "audit.read"
+	},
+	"support-sessions": {
+		start: "support.start",
+		view: "support.read",
+		revoke: "support.revoke"
+	},
+	notifications: {
+		send: "notifications.send",
+		read: "notifications.read"
+	},
+	"webhooks-out": {
+		manage: "webhooks.manage",
+		view: "webhooks.read"
+	},
+	"webhooks-in": {
+		create: "webhooks.manage",
+		update: "webhooks.manage",
+		delete: "webhooks.manage",
+		view: "webhooks.read"
+	},
+	"api-keys": {
+		manage: "api_keys.manage",
+		own: "api_keys.own"
+	},
+	settings: {
+		read: "settings.read",
+		update: "settings.update",
+		platform: "settings.manage"
+	},
+	usage: {
+		read: "usage.read",
+		record: "usage.record"
+	},
+	billing: {
+		read: "billing.read",
+		manage: "billing.manage",
+		viewAll: "billing.read"
+	},
+	comments: {
+		read: "comments.read",
+		create: "comments.create",
+		moderate: "comments.moderate",
+		activity: "activity.read"
+	},
+	"data-lifecycle": {
+		export: "organization.export",
+		delete: "organization.delete"
+	},
+	attachments: {
+		read: "attachments.read",
+		upload: "attachments.upload",
+		manage: "attachments.manage"
+	},
+	sso: { manage: "sso.manage" },
+	onboarding: {
+		read: "onboarding.read",
+		complete: "onboarding.complete"
+	},
+	announcements: { manage: "announcements.manage" },
+	waitlist: {
+		manage: "waitlist.manage",
+		invite: "members.invite"
+	},
+	flags: { manage: "flags.manage" },
+	workflows: {
+		read: "workflow.read",
+		run: "workflow.run",
+		admin: "workflow.admin"
+	},
+	"workflow-builder": {
+		read: "workflow.read",
+		run: "workflow.run",
+		edit: "workflow.edit",
+		publish: "workflow.publish",
+		admin: "workflow.admin"
+	},
+	inbox: {
+		read: "inbox.read",
+		reply: "inbox.reply",
+		assign: "inbox.assign",
+		manage: "inbox.manage"
+	},
+	"ai-chat": {
+		read: "ai_chat.read",
+		create: "ai_chat.create",
+		share: "ai_chat.share",
+		moderate: "ai_chat.moderate",
+		admin: "ai_chat.admin"
+	},
+	"ai-files": {
+		upload: "ai.create",
+		manage: "ai.admin"
+	},
+	knowledge: {
+		read: "ai.read",
+		write: "ai.create",
+		manage: "ai.admin"
+	},
+	memory: {
+		read: "ai.read",
+		manage: "ai.admin"
+	},
+	agents: {
+		read: "ai.read",
+		create: "ai.create",
+		publish: "ai.share",
+		moderate: "ai.moderate"
+	},
+	connectors: {
+		read: "ai.read",
+		use: "ai.create",
+		manage: "ai.admin"
+	},
+	"ai-tasks": {
+		create: "ai.create",
+		manage: "ai.admin"
+	},
+	"ai-providers": {
+		use: "ai.create",
+		manage: "ai.admin"
+	}
+};
+/**
+* Where each module action checks its key: `tenant` through `member_can`,
+* `can` or `tenant_ids_with` (a provider's `idsWith`), and `platform`
+* through `is_platform` or `platform_can` (a provider's `isPlatform`).
+*/
+const MODULE_PERMISSION_SCOPES = {
+	organizations: {
+		update: "tenant",
+		delete: "tenant",
+		removeMember: "tenant",
+		suspendMember: "tenant",
+		updateRole: "tenant",
+		transferOwnership: "tenant"
+	},
+	invitations: {
+		invite: "tenant",
+		revoke: "tenant",
+		view: "tenant",
+		invitePlatform: "platform"
+	},
+	audit: {
+		view: "tenant",
+		viewAll: "platform"
+	},
+	"support-sessions": {
+		start: "platform",
+		view: "platform",
+		revoke: "platform"
+	},
+	notifications: {
+		send: "tenant",
+		read: "tenant"
+	},
+	"webhooks-out": {
+		manage: "tenant",
+		view: "tenant"
+	},
+	"webhooks-in": {
+		create: "tenant",
+		update: "tenant",
+		delete: "tenant",
+		view: "tenant"
+	},
+	"api-keys": {
+		manage: "tenant",
+		own: "tenant"
+	},
+	settings: {
+		read: "tenant",
+		update: "tenant",
+		platform: "platform"
+	},
+	usage: {
+		read: "tenant",
+		record: "tenant"
+	},
+	billing: {
+		read: "tenant",
+		manage: "tenant",
+		viewAll: "platform"
+	},
+	comments: {
+		read: "tenant",
+		create: "tenant",
+		moderate: "tenant",
+		activity: "tenant"
+	},
+	attachments: {
+		read: "tenant",
+		upload: "tenant",
+		manage: "tenant"
+	},
+	"data-lifecycle": {
+		export: "tenant",
+		delete: "tenant"
+	},
+	sso: { manage: "tenant" },
+	onboarding: {
+		read: "tenant",
+		complete: "tenant"
+	},
+	announcements: { manage: "platform" },
+	waitlist: {
+		manage: "platform",
+		invite: "tenant"
+	},
+	flags: { manage: "platform" },
+	workflows: {
+		read: "tenant",
+		run: "tenant",
+		admin: "tenant"
+	},
+	"workflow-builder": {
+		read: "tenant",
+		run: "tenant",
+		edit: "tenant",
+		publish: "tenant",
+		admin: "tenant"
+	},
+	inbox: {
+		read: "tenant",
+		reply: "tenant",
+		assign: "tenant",
+		manage: "tenant"
+	},
+	"ai-chat": {
+		read: "tenant",
+		create: "tenant",
+		share: "tenant",
+		moderate: "tenant",
+		admin: "tenant"
+	},
+	"ai-files": {
+		upload: "tenant",
+		manage: "tenant"
+	},
+	knowledge: {
+		read: "tenant",
+		write: "tenant",
+		manage: "tenant"
+	},
+	memory: {
+		read: "tenant",
+		manage: "tenant"
+	},
+	agents: {
+		read: "tenant",
+		create: "tenant",
+		publish: "tenant",
+		moderate: "tenant"
+	},
+	connectors: {
+		read: "tenant",
+		use: "tenant",
+		manage: "tenant"
+	},
+	"ai-tasks": {
+		create: "tenant",
+		manage: "tenant"
+	},
+	"ai-providers": {
+		use: "tenant",
+		manage: "tenant"
+	}
+};
+function accessModel(ctx) {
+	return ctx.modules.access?.model ?? "roles";
+}
+function rolesOf(ctx) {
+	return ctx.modules.access?.roles ?? DEFAULT_ROLES;
+}
+const roleNames = (ctx) => Object.keys(rolesOf(ctx));
+/**
+* The scope name tenants use in `can(scope, id, permission)`
+* (`sql.modules.access.options.scope`, default `organization`). `tenant` is
+* accepted too.
+*/
+const tenantScope = (ctx) => ctx.of("access").text("scope", "organization");
+const isPlain = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const quotedRef = (where, table, column) => {
+	const parts = `${table}.${column}`.split(".");
+	if (parts.length !== 3 || parts.some((part) => !/^[A-Za-z_][A-Za-z0-9_$]*$/.test(part))) throw new TypeError(`${where}: "${table}" must be "schema.table" and "${column}" a column`);
+	return {
+		table: `${sqlIdent(parts[0])}.${sqlIdent(parts[1])}`,
+		column: sqlIdent(parts[2])
+	};
+};
+/** The `provider` model's platform role table, or `undefined` without one. */
+function providerPlatformRoles(ctx) {
+	if (accessModel(ctx) !== "provider" || !ctx.installed("invitations")) return;
+	const value = ctx.of("invitations").option("platformRoles");
+	if (value === void 0) return void 0;
+	const where = "sql.modules.invitations.options.platformRoles";
+	if (!isPlain(value) || typeof value["table"] !== "string" || typeof value["user"] !== "string" || typeof value["role"] !== "string" || value["canAssign"] !== void 0 && typeof value["canAssign"] !== "string" || value["canAssignFor"] !== void 0 && (typeof value["canAssignFor"] !== "string" || !value["canAssignFor"].includes("{user}"))) throw new TypeError(`${where} must be { table: "schema.table", user: "<user column>", role: "<role column>", through?: { table, id, column }, canAssign?: "<SQL template>", canAssignFor?: "<SQL template with {user}>" }`);
+	const user = quotedRef(where, value["table"], value["user"]);
+	const role = quotedRef(where, value["table"], value["role"]);
+	const through = value["through"];
+	let lookup;
+	if (through !== void 0) {
+		if (!isPlain(through) || typeof through["table"] !== "string" || typeof through["id"] !== "string" || typeof through["column"] !== "string" || through["where"] !== void 0 && (typeof through["where"] !== "string" || !through["where"].includes("{row}"))) throw new TypeError(`${where}.through must be { table: "schema.table", id: "<key column>", column: "<role name column>", where?: "<condition on {row}>" }`);
+		const id = quotedRef(`${where}.through`, through["table"], through["id"]);
+		lookup = {
+			table: id.table,
+			id: id.column,
+			column: quotedRef(`${where}.through`, through["table"], through["column"]).column,
+			...typeof through["where"] === "string" ? { where: through["where"] } : {}
+		};
+	}
+	return {
+		table: user.table,
+		user: user.column,
+		role: role.column,
+		...lookup ? { through: lookup } : {},
+		...typeof value["canAssign"] === "string" ? { canAssign: value["canAssign"] } : {},
+		...typeof value["canAssignFor"] === "string" ? { canAssignFor: value["canAssignFor"] } : {}
+	};
+}
+/** Whether the catalog has platform roles, and so platform invitations. */
+function hasPlatformRoles(ctx) {
+	if (providerPlatformRoles(ctx)) return true;
+	return accessModel(ctx) === "catalog" && ctx.of("access").hasTable("platformAssignments");
+}
+/**
+* Whether catalog role row `alias` is a tenant or a platform role, or
+* `undefined` when roles carry no scope. Managed catalogs have a `scope`
+* column; an adopted one maps `roles.scope` and names its values in
+* `sql.modules.access.options.tenantRoleScope` and `platformRoleScope`.
+*/
+function roleScopeIs(ctx, alias, scope) {
+	if (accessModel(ctx) !== "catalog") return void 0;
+	const access = ctx.of("access");
+	if (!access.manages && access.config.columns["roles"]?.["scope"] == null) return;
+	const value = scope === "tenant" ? access.text("tenantRoleScope", "tenant") : access.text("platformRoleScope", "platform");
+	return `${alias}.${access.col("roles", "scope")}::text = ${sqlString(value)}`;
+}
+const MODULE_PERMISSION_SHORTHANDS = {
+	organizations: { suspendMember: "removeMember" },
+	invitations: {
+		revoke: "invite",
+		view: "invite"
+	},
+	audit: { viewAll: "view" },
+	billing: { viewAll: "read" },
+	waitlist: { invite: {
+		module: "invitations",
+		action: "invite"
+	} },
+	"webhooks-in": {
+		create: "manage",
+		update: "manage",
+		delete: "manage"
+	}
+};
+function modulePermissionKey(ctx, action, fallback) {
+	const shorthand = MODULE_PERMISSION_SHORTHANDS[ctx.module]?.[action];
+	if (shorthand === void 0) return ctx.permissionKey(action, fallback);
+	const target = typeof shorthand === "string" ? modulePermissionKey(ctx, shorthand, fallback) : modulePermissionKey(ctx.of(shorthand.module), shorthand.action, fallback);
+	return ctx.permissionKey(action, target);
+}
+const modulePermission = (ctx, action, fallback) => sqlString(modulePermissionKey(ctx, action, fallback));
+//#endregion
+//#region src/sql/modules/workflow-sdk-world.ts
+/** The Vault secret names the pg_net dispatcher reads. */
+const WORKFLOW_VAULT_SECRETS = {
+	flowUrl: "workflow_flow_url",
+	deliverySecret: "workflow_delivery_secret",
+	encryptionKey: "workflow_encryption_key"
+};
+const WORKFLOW_DELIVERY_QUEUE = "workflow_deliveries";
+function deliveryModeOf(ctx) {
+	const mode = ctx.text("delivery", "poll");
+	if (mode !== "poll" && mode !== "pg_net") throw new TypeError(`sql.modules.workflow-sdk-world.options.delivery must be "poll" or "pg_net", got "${mode}"`);
+	return mode;
+}
+const IDENT = /^[a-z_][a-z0-9_]{0,40}$/;
+function deliveryQueueOf(ctx) {
+	const queue = ctx.text("queue", WORKFLOW_DELIVERY_QUEUE);
+	if (!IDENT.test(queue)) throw new TypeError(`sql.modules.workflow-sdk-world.options.queue: "${queue}" is not a queue name`);
+	return queue;
+}
+function build(ctx) {
+	if (ctx.mode === "custom") return "";
+	const fn = (name) => ctx.fn(name);
+	const workflows = ctx.of("workflows");
+	const record = workflows.fn("record_workflow_run");
+	const runKey = workflows.permission("run", MODULE_PERMISSIONS.workflows.run);
+	const claimJobs = ctx.of("jobs").fn("claim_jobs");
+	const id = ctx.idType;
+	const queue = sqlString(deliveryQueueOf(ctx));
+	const batch = Math.max(1, Math.trunc(ctx.number("batch", 20)));
+	const timeout = Math.max(1e3, Math.trunc(ctx.number("timeout", 3e4)));
+	const lease = Math.ceil(timeout / 1e3) + 30;
+	const mirror = ctx.trigger("workflow_sdk_runs_mirror");
+	return `${schemaPreamble(ctx)}
+-- The Workflow SDK World's tables (@workflow/world-postgres ${WORLD_POSTGRES_VERSION}).
+-- Only the service role reads them: the app reads runs from workflow_runs in
+-- the workflows module.
+${WORLD_POSTGRES_DDL}
+revoke all on schema workflow from public, anon, authenticated;
+grant usage on schema workflow to service_role;
+do $$
+declare
+  t record;
+begin
+  for t in select c.relname from pg_catalog.pg_class c
+    join pg_catalog.pg_namespace n on n.oid = c.relnamespace
+    where n.nspname = 'workflow' and c.relkind = 'r'
+  loop
+    execute format('alter table workflow.%I enable row level security', t.relname);
+    execute format('revoke all on workflow.%I from public, anon, authenticated', t.relname);
+    execute format('grant all on workflow.%I to service_role', t.relname);
+  end loop;
+end;
+$$;
+grant usage, select on all sequences in schema workflow to service_role;
+create index if not exists workflow_runs_attributes_idx on workflow.workflow_runs using gin (attributes jsonb_path_ops);
+
+-- Copies each World run into workflow_runs: its tenant and actor come from
+-- the bs.tenant and bs.actor attributes that startFor sets. A run with an
+-- actor keeps its tenant only when the actor holds workflow.run there; a
+-- run without one was started by the server, which is trusted.
+create or replace function ${fn("workflow_sdk_mirror_run")}()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  v_tenant ${id};
+  v_actor uuid;
+begin
+  begin
+    v_tenant := (new.attributes ->> 'bs.tenant')::${id};
+  exception when others then
+    v_tenant := null;
+  end;
+  begin
+    v_actor := (new.attributes ->> 'bs.actor')::uuid;
+  exception when others then
+    v_actor := null;
+  end;
+  if v_tenant is not null and v_actor is not null
+    and not coalesce(better_supabase.can_user(v_actor, 'tenant', v_tenant, ${runKey}), false) then
+    v_tenant := null;
+  end if;
+  perform ${record}(
+    'workflow-sdk',
+    new.id,
+    new.name,
+    case new.status::text when 'pending' then 'queued' else new.status::text end,
+    v_tenant,
+    v_actor,
+    coalesce(new.attributes, '{}'::jsonb) - 'bs.tenant' - 'bs.actor',
+    case when new.status::text = 'failed' then coalesce(new.error_code, left(new.error, 4000)) end,
+    new.started_at at time zone 'UTC',
+    new.completed_at at time zone 'UTC'
+  );
+  return null;
+end;
+$$;
+revoke execute on function ${fn("workflow_sdk_mirror_run")}() from public, anon, authenticated;
+drop trigger if exists ${mirror} on workflow.workflow_runs;
+create trigger ${mirror} after insert or update of status, attributes, error on workflow.workflow_runs
+  for each row execute function ${fn("workflow_sdk_mirror_run")}();
+
+-- pg_net delivery: posts up to batch due messages to the flow route in the
+-- Vault secret ${WORKFLOW_VAULT_SECRETS.flowUrl}, signed with ${WORKFLOW_VAULT_SECRETS.deliverySecret}
+-- (x-bs-signature: t=<unix>,v1=hex(hmac_sha256(t.job.body))). The body is
+-- the stored message; the route completes or fails the job, so a delivery
+-- whose response is lost runs again after the lease.
+create or replace function ${fn("dispatch_workflow_deliveries")}(batch integer default ${String(batch)})
+returns integer
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  v_url text;
+  v_secret text;
+  v_job record;
+  v_body jsonb;
+  v_t text;
+  v_job_header text;
+  v_count integer := 0;
+  -- pg_net is optional: http_post is looked up, not named, so plpgsql_check
+  -- (supabase db lint) passes without the extension.
+  v_post regprocedure := pg_catalog.to_regprocedure('net.http_post(text, jsonb, jsonb, jsonb, integer)');
+begin
+  if v_post is null then
+    raise exception 'dispatch_workflow_deliveries needs pg_net: create extension pg_net, or deliver with the poll mode';
+  end if;
+  select ds.decrypted_secret into v_url from vault.decrypted_secrets ds where ds.name = ${sqlString(WORKFLOW_VAULT_SECRETS.flowUrl)};
+  select ds.decrypted_secret into v_secret from vault.decrypted_secrets ds where ds.name = ${sqlString(WORKFLOW_VAULT_SECRETS.deliverySecret)};
+  if v_url is null or v_secret is null then
+    raise exception 'Set the Vault secrets ${WORKFLOW_VAULT_SECRETS.flowUrl} and ${WORKFLOW_VAULT_SECRETS.deliverySecret} before dispatching' using hint = 'WORKFLOW_DELIVERY_UNCONFIGURED';
+  end if;
+  for v_job in select * from ${claimJobs}(${queue}, ${String(lease)}, greatest(coalesce(batch, ${String(batch)}), 1)) loop
+    v_body := coalesce(v_job.message -> 'payload', '{}'::jsonb);
+    v_t := floor(extract(epoch from now()))::bigint::text;
+    v_job_header := ${queue} || ':' || v_job.id::text || ':' || v_job.attempts::text;
+    execute format('select %s(url := $1, body := $2, headers := $3, timeout_milliseconds := $4)', v_post::oid::regproc)
+      using v_url, v_body, jsonb_build_object(
+        'content-type', 'application/json',
+        'x-bs-job', v_job_header,
+        'x-bs-signature', 't=' || v_t || ',v1=' || encode(extensions.hmac(v_t || '.' || v_job_header || '.' || v_body::text, v_secret, 'sha256'), 'hex')
+      ), ${String(timeout)};
+    v_count := v_count + 1;
+  end loop;
+  return v_count;
+end;
+$$;
+revoke execute on function ${fn("dispatch_workflow_deliveries")}(integer) from public, anon, authenticated;
+grant execute on function ${fn("dispatch_workflow_deliveries")}(integer) to service_role;`;
+}
+function data(ctx) {
+	if (ctx.mode === "custom" || deliveryModeOf(ctx) !== "pg_net") return "";
+	const schedule = ctx.text("schedule", "1 seconds");
+	return `-- Delivers workflow messages through pg_net every ${schedule} when pg_cron is installed.
+do $$
+begin
+  if pg_catalog.to_regnamespace('cron') is not null then
+    perform cron.schedule('better-supabase-workflow-deliveries', ${sqlString(schedule)}, ${sqlString(`select ${ctx.fn("dispatch_workflow_deliveries")}()`)});
+  else
+    raise notice 'pg_cron is not installed: call ${ctx.fn("dispatch_workflow_deliveries").replaceAll("'", "")}() on a schedule to deliver workflow messages';
+  end if;
+end;
+$$;`;
+}
+function contract() {
+	return [{
+		name: "dispatch_workflow_deliveries",
+		args: ["integer"],
+		returns: "integer"
+	}];
+}
+const WORKFLOW_SDK_WORLD = {
+	name: "workflow-sdk-world",
+	title: "Workflow SDK World",
+	description: `The tables of the Workflow SDK World (@workflow/world-postgres ${WORLD_POSTGRES_VERSION}) in the workflow schema, closed to the API roles; a trigger that copies each run into workflow_runs, and a pg_net dispatcher for the delivery queue on a pg_cron schedule.`,
+	requires: [
+		"workflows",
+		"jobs",
+		"access"
+	],
+	providerFunctions: ["idsWithFor"],
+	target: "schema",
+	modes: ["managed", "custom"],
+	version: 1,
+	names: {
+		tables: {},
+		options: [
+			"delivery",
+			"queue",
+			"batch",
+			"timeout",
+			"schedule"
+		]
+	},
+	contract,
+	build,
+	data
+};
+//#endregion
+export { jwtClaim as A, replaceColumnCheck as B, canIn as C, disabledHelpersNeedLaterTables as D, disabledHelpers as E, pageSize as F, splitTable as G, serviceGrant as H, quotedTable as I, userGrant as J, tenantIn as K, raise as L, membershipDisabledAt as M, membershipSuspended as N, ensureCheck as O, organizationMissing as P, recordTrigger as R, addForeignKey as S, columnsObject as T, serviceOnly as U, schemaPreamble as V, sha256Hex as W, WORLD_POSTGRES_VERSION as Y, SCHEMA as _, MODULE_PERMISSION_SCOPES as a, activeMembership as b, modulePermission as c, roleNames as d, roleScopeIs as f, NOTHING as g, EQUIVALENT_TRIGGERS as h, MODULE_PERMISSIONS as i, memberAddedRecord as j, jsonSchemaChecks as k, modulePermissionKey as l, tenantScope as m, WORKFLOW_SDK_WORLD as n, accessModel as o, rolesOf as p, updatedAt as q, WORKFLOW_VAULT_SECRETS as r, hasPlatformRoles as s, WORKFLOW_DELIVERY_QUEUE as t, providerPlatformRoles as u, SERVICE_CALLER as v, columnRef as w, addExtraColumns as x, accessDefinesDisabledHelpers as y, renameSql as z };