better-supabase 0.7.0 → 0.8.0

package/dist/{workflow-sdk-world-D-prir6O.js → workflow-sdk-world-CMV1ahFW.js}

@@ -1,529 +1,243 @@
-import { i as sqlString, r as sqlIdent } from "./template--jDkl3UP.js";
-//#region src/sql/modules/workflow-sdk-world-ddl.generated.ts
-/** The `@workflow/world-postgres` version the DDL below was generated from. */
-const WORLD_POSTGRES_VERSION = "5.0.2";
-/** The `workflow` schema after every migration above, as idempotent DDL. */
-const WORLD_POSTGRES_DDL = `create schema if not exists workflow;
-
-do $$ begin
-  create type workflow.status as enum ('pending', 'running', 'completed', 'failed', 'cancelled');
-exception when duplicate_object then null;
-end $$;
+import { a as sqlString, i as sqlIdent } from "./template-lPVh-EwW.js";
+//#region src/sql/shared.ts
+/** What `record` and the other statement helpers return when there is nothing to do. */
+const NOTHING = "null;";
+/** `alter table ... add column if not exists` for each extra column of a managed table. */
+const addExtraColumns = (table, columns) => columns.map((column) => `\nalter table ${table} add column if not exists ${column.ident} ${column.type};`).join("");
+/**
+* A `jsonb` object of `columns` of row `alias`, keyed by column name, so
+* reads return extra columns without exposing the rest of the row.
+*/
+const columnsObject = (alias, columns) => `jsonb_build_object(${columns.map((name) => `${sqlString(name)}, ${alias}.${sqlIdent(name)}`).join(", ")})`;
+const SCHEMA = `create schema if not exists better_supabase;
+grant usage on schema better_supabase to anon, authenticated, service_role;`;
+/**
+* A SQL condition true for the service role and for a direct admin
+* connection (no JWT, a privileged session user), which may act for others.
+*/
+const SERVICE_CALLER = "coalesce(nullif((select auth.jwt()) ->> 'role', ''), session_user::text) in ('service_role', 'postgres', 'supabase_admin')";
+/**
+* The `organization.member_added` record for a module that adds a member, so
+* every module writes the same payload. Each value is a SQL expression.
+*/
+function memberAddedRecord(ctx, member) {
+	return ctx.record({
+		type: "organization.member_added",
+		payload: `jsonb_build_object('organizationId', ${member.tenant}::text, 'userId', ${member.user}, 'role', ${member.role})`,
+		subject: `'organizations/' || ${member.tenant}::text`,
+		tenant: member.tenant,
+		audit: {
+			category: "membership",
+			targetType: "user",
+			recordId: `${member.user}::text`
+		}
+	});
+}
+/** Creates the module's schema when it isn't `better_supabase`, then the module schema. */
+function schemaPreamble(ctx) {
+	if (ctx.schemaName === "better_supabase") return SCHEMA;
+	return `${SCHEMA}
+create schema if not exists ${ctx.schema};
+grant usage on schema ${ctx.schema} to anon, authenticated, service_role;`;
+}
+/**
+* A policy condition for "the caller holds `permission` in this row's
+* tenant". Postgres never inlines `can()` (it is `security definer`), so a
+* `can('tenant', column, ...)` in `using` runs once per row and can't use the
+* tenant index; the `tenant_ids_with` set runs once per statement.
+*/
+function tenantIn(tenant, permission) {
+	return `${tenant} in (select better_supabase.tenant_ids_with(${permission}))`;
+}
+/** A claim from the top level of the token, then `app_metadata`. */
+function jwtClaim(name) {
+	return `coalesce(auth.jwt() ->> ${sqlString(name)}, auth.jwt() -> 'app_metadata' ->> ${sqlString(name)})`;
+}
+/** `table` or `schema.table` as `[schema, table]`, in `public` without a schema. */
+function splitTable(name) {
+	const parts = name.split(".");
+	if (parts.length > 2 || parts.some((part) => part.length === 0)) throw new TypeError(`"${name}" must be "table" or "schema.table"`);
+	return parts.length === 2 ? [parts[0], parts[1]] : ["public", parts[0]];
+}
+/** `table` or `schema.table`, quoted. */
+function quotedTable(name) {
+	const [schema, table] = splitTable(name);
+	return `${sqlIdent(schema)}.${sqlIdent(table)}`;
+}
+/** `schema.table.column` split into its quoted table and column. */
+function columnRef(where, value) {
+	const parts = value.split(".");
+	if (parts.length !== 3 || parts.some((part) => part.length === 0)) throw new TypeError(`${where} must be "schema.table.column", got "${value}"`);
+	const [schema, table, column] = parts;
+	return {
+		table: `${sqlIdent(schema)}.${sqlIdent(table)}`,
+		column: sqlIdent(column)
+	};
+}
+const QUOTED_IDENT = /^"(.*)"$/s;
+/**
+* Replaces the check constraints on one column of a table a module created
+* earlier: `create table if not exists` never changes an inline check, and
+* its generated name follows the table's configured name. For upgrade steps.
+* `column` is a quoted identifier; the catalog stores the bare name.
+*/
+function replaceColumnCheck(check) {
+	const column = QUOTED_IDENT.exec(check.column)?.[1]?.replaceAll("\"\"", "\"") ?? check.column;
+	return `do $$
+declare
+  v_name name;
+begin
+  for v_name in
+    select c.conname from pg_catalog.pg_constraint c
+    join pg_catalog.pg_attribute a on a.attrelid = c.conrelid and a.attnum = c.conkey[1]
+    where c.conrelid = ${sqlString(check.table)}::regclass and c.contype = 'c'
+      and cardinality(c.conkey) = 1 and a.attname = ${sqlString(column)}
+  loop
+    execute format('alter table %s drop constraint %I', ${sqlString(check.table)}, v_name);
+  end loop;
+end;
+$$;
+alter table ${check.table} add constraint ${sqlIdent(check.name)} check (${check.expression});`;
+}
+/**
+* Adds a foreign key to a table a module created earlier, once: `create
+* table if not exists` can't add it to a table that already exists, and the
+* referenced table can come from a module that renders later. Existing rows
+* without a match leave the key unvalidated, with a warning.
+*/
+function addForeignKey(fk) {
+	return `do $$
+begin
+  if not exists (
+    select 1 from pg_constraint
+    where conrelid = ${sqlString(fk.table)}::regclass and conname = ${sqlString(fk.name)}
+  ) then
+    alter table ${fk.table} add constraint ${sqlIdent(fk.name)}
+      foreign key (${fk.column}) references ${fk.references} on delete ${fk.onDelete} not valid;
+    begin
+      alter table ${fk.table} validate constraint ${sqlIdent(fk.name)};
+    exception when foreign_key_violation then
+      raise warning '% has rows without a match, so only new rows are checked. Delete them, then run: alter table % validate constraint %',
+        ${sqlString(fk.table)}, ${sqlString(fk.table)}, ${sqlString(fk.name)};
+    end;
+  end if;
+end;
+$$;`;
+}
+/**
+* An `updated_at` column on a managed table, kept current by the
+* `updated-at` module's `set_updated_at()` (the module must require it).
+*/
+function updatedAt(table, column) {
+	return `alter table ${table} add column if not exists ${column} timestamptz not null default now();
+drop trigger if exists bs_updated_at on ${table};
+create trigger bs_updated_at before update on ${table}
+  for each row execute function better_supabase.set_updated_at(${sqlString(column.replaceAll("\"", ""))});`;
+}
+function renameSql(renames) {
+	const schema = sqlString(renames.schema);
+	const q = (name) => `${sqlIdent(renames.schema)}.${sqlIdent(name)}`;
+	const lines = [];
+	let table = renames.table;
+	for (const [from, to] of renames.tables ?? []) {
+		lines.push(`  if to_regclass(${sqlString(`${renames.schema}.${from}`)}) is not null
+    and (select c.relkind from pg_class c where c.oid = to_regclass(${sqlString(`${renames.schema}.${from}`)})) in ('r', 'p')
+    and to_regclass(${sqlString(`${renames.schema}.${to}`)}) is null then
+    alter table ${q(from)} rename to ${sqlIdent(to)};
+  end if;`);
+		if (from === table) table = to;
+	}
+	for (const [from, to] of renames.columns ?? []) lines.push(`  if exists (select 1 from information_schema.columns c
+      where c.table_schema = ${schema} and c.table_name = ${sqlString(table)} and c.column_name = ${sqlString(from)})
+    and not exists (select 1 from information_schema.columns c
+      where c.table_schema = ${schema} and c.table_name = ${sqlString(table)} and c.column_name = ${sqlString(to)}) then
+    alter table ${q(table)} rename column ${sqlIdent(from)} to ${sqlIdent(to)};
+  end if;`);
+	for (const [from, to] of renames.indexes ?? []) lines.push(`  if to_regclass(${sqlString(`${renames.schema}.${from}`)}) is not null
+    and to_regclass(${sqlString(`${renames.schema}.${to}`)}) is null then
+    alter index ${q(from)} rename to ${sqlIdent(to)};
+  end if;`);
+	for (const [from, to, args] of renames.functions ?? []) lines.push(`  if to_regprocedure(${sqlString(`${renames.schema}.${from}(${args})`)}) is not null
+    and to_regprocedure(${sqlString(`${renames.schema}.${to}(${args})`)}) is null then
+    alter function ${q(from)}(${args}) rename to ${sqlIdent(to)};
+  end if;`);
+	if (lines.length === 0) return "";
+	return `do $$
+begin
+${lines.join("\n")}
+end;
+$$;`;
+}
+/**
+* A SQL condition true when `organization` names no row of the installed
+* organizations table. False without the organizations module.
+*/
+function organizationMissing(ctx, organization) {
+	if (!ctx.installed("organizations")) return "false";
+	const organizations = ctx.of("organizations");
+	return `not exists (select 1 from ${organizations.table("organizations")} o where o.${organizations.col("organizations", "id")} = ${organization})`;
+}
+function membershipDisabledAt(ctx) {
+	if (ctx.module !== "tenant" && !ctx.installed("tenant")) return void 0;
+	const tenant = ctx.module === "tenant" ? ctx : ctx.of("tenant");
+	if (!tenant.has("memberships", "disabledAt")) return void 0;
+	if (!tenant.manages && typeof tenant.config.columns["memberships"]?.["disabledAt"] !== "string") return void 0;
+	return tenant.col("memberships", "disabledAt");
+}
+function activeMembership(ctx, alias) {
+	const column = membershipDisabledAt(ctx);
+	return column === void 0 ? "" : ` and ${alias}.${column} is null`;
+}
+function membershipSuspended(ctx, tenant, user) {
+	const column = membershipDisabledAt(ctx);
+	if (column === void 0) return void 0;
+	const t = ctx.module === "tenant" ? ctx : ctx.of("tenant");
+	return `exists (select 1 from ${t.table("memberships")} sm where sm.${t.col("memberships", "tenant")} = ${tenant} and sm.${t.col("memberships", "user")} = ${user} and sm.${column} is not null)`;
+}
+/**
+* `tenant_disabled(id)` and `user_disabled(uuid)` from
+* `sql.modules.access.disabled`. Without a column they return false, so callers
+* don't need to know whether it is configured.
+*/
+function disabledHelpers(ctx) {
+	const disabled = ctx.modules.access?.disabled ?? {};
+	const id = ctx.idType;
+	const organizations = managedOrganizations(ctx);
+	let tenantCheck = "false";
+	if (disabled.tenant !== void 0) tenantCheck = disabledCheck("sql.modules.access.disabled.tenant", disabled.tenant, {
+		key: "\"id\"",
+		alias: "t",
+		value: "tenant_disabled.tenant"
+	});
+	else if (organizations) tenantCheck = `exists (select 1 from ${organizations.table} t where t.${organizations.id} = tenant_disabled.tenant and (${organizations.flags.map((column) => `t.${column} is not null`).join(" or ")}))`;
+	const userCheck = disabled.user === void 0 ? "false" : disabledCheck("sql.modules.access.disabled.user", disabled.user, {
+		key: sqlIdent(disabled.userKey ?? "id"),
+		alias: "u",
+		value: "user_disabled.user_id"
+	});
+	return `
+-- Disabled tenants and users get no permissions and no membership claims
+-- (modules.access.disabled; with the managed organizations module, its
+-- disabled_at and deleted_at columns).
+create or replace function better_supabase.tenant_disabled(tenant ${id})
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select ${tenantCheck}
+$$;
 
-do $$ begin
-  create type workflow.step_status as enum ('pending', 'running', 'completed', 'failed', 'cancelled');
-exception when duplicate_object then null;
-end $$;
-
-do $$ begin
-  create type workflow.wait_status as enum ('waiting', 'completed');
-exception when duplicate_object then null;
-end $$;
-
-create table if not exists workflow.workflow_event_slots (
-  "run_id" character varying not null,
-  constraint "workflow_event_slots_pkey" PRIMARY KEY (run_id)
-);
-
-alter table workflow.workflow_event_slots
-  add column if not exists "run_id" character varying not null;
-
-create table if not exists workflow.workflow_events (
-  "id" character varying not null,
-  "type" character varying not null,
-  "correlation_id" character varying,
-  "created_at" timestamp without time zone not null default now(),
-  "run_id" character varying not null,
-  "payload" jsonb,
-  "payload_cbor" bytea,
-  "spec_version" integer,
-  "resume_id" character varying,
-  "resume_payload_digest" character varying,
-  constraint "workflow_events_run_id_id_pk" PRIMARY KEY (run_id, id)
-);
-
-alter table workflow.workflow_events
-  add column if not exists "id" character varying not null,
-  add column if not exists "type" character varying not null,
-  add column if not exists "correlation_id" character varying,
-  add column if not exists "created_at" timestamp without time zone not null default now(),
-  add column if not exists "run_id" character varying not null,
-  add column if not exists "payload" jsonb,
-  add column if not exists "payload_cbor" bytea,
-  add column if not exists "spec_version" integer,
-  add column if not exists "resume_id" character varying,
-  add column if not exists "resume_payload_digest" character varying;
-
-create index if not exists workflow_events_correlation_id_index ON workflow.workflow_events USING btree (correlation_id);
-
-create unique index if not exists workflow_events_entity_creation_unique ON workflow.workflow_events USING btree (run_id, correlation_id, type) WHERE ((type)::text = ANY ((ARRAY['step_created'::character varying, 'hook_created'::character varying, 'wait_created'::character varying, 'attr_set'::character varying])::text[]));
-
-create unique index if not exists workflow_events_hook_resume_unique ON workflow.workflow_events USING btree (run_id, resume_id) WHERE (((type)::text = 'hook_received'::text) AND (resume_id IS NOT NULL));
-
-create table if not exists workflow.workflow_hooks (
-  "run_id" character varying not null,
-  "hook_id" character varying not null,
-  "token" character varying not null,
-  "owner_id" character varying not null,
-  "project_id" character varying not null,
-  "environment" character varying not null,
-  "created_at" timestamp without time zone not null default now(),
-  "metadata" jsonb,
-  "metadata_cbor" bytea,
-  "spec_version" integer,
-  "is_webhook" boolean default true,
-  "is_system" boolean default false,
-  "resume_context" bytea,
-  "token_retention_until" timestamp with time zone,
-  "claimed_from" bytea,
-  constraint "workflow_hooks_pkey" PRIMARY KEY (hook_id)
-);
-
-alter table workflow.workflow_hooks
-  add column if not exists "run_id" character varying not null,
-  add column if not exists "hook_id" character varying not null,
-  add column if not exists "token" character varying not null,
-  add column if not exists "owner_id" character varying not null,
-  add column if not exists "project_id" character varying not null,
-  add column if not exists "environment" character varying not null,
-  add column if not exists "created_at" timestamp without time zone not null default now(),
-  add column if not exists "metadata" jsonb,
-  add column if not exists "metadata_cbor" bytea,
-  add column if not exists "spec_version" integer,
-  add column if not exists "is_webhook" boolean default true,
-  add column if not exists "is_system" boolean default false,
-  add column if not exists "resume_context" bytea,
-  add column if not exists "token_retention_until" timestamp with time zone,
-  add column if not exists "claimed_from" bytea;
-
-create index if not exists workflow_hooks_run_id_index ON workflow.workflow_hooks USING btree (run_id);
-
-create index if not exists workflow_hooks_token_index ON workflow.workflow_hooks USING btree (token);
-
-create table if not exists workflow.workflow_invocations (
-  "sequence" bigserial,
-  "run_id" character varying not null,
-  "request_id" character varying not null,
-  "payload" bytea,
-  "fingerprint" character varying,
-  "result" bytea,
-  "created_at" timestamp without time zone not null default now(),
-  "responded_at" timestamp without time zone,
-  "expired_at" timestamp without time zone,
-  "result_version" integer not null default 0,
-  constraint "workflow_invocations_pkey" PRIMARY KEY (run_id, request_id)
-);
-
-alter table workflow.workflow_invocations
-  add column if not exists "sequence" bigserial,
-  add column if not exists "run_id" character varying not null,
-  add column if not exists "request_id" character varying not null,
-  add column if not exists "payload" bytea,
-  add column if not exists "fingerprint" character varying,
-  add column if not exists "result" bytea,
-  add column if not exists "created_at" timestamp without time zone not null default now(),
-  add column if not exists "responded_at" timestamp without time zone,
-  add column if not exists "expired_at" timestamp without time zone,
-  add column if not exists "result_version" integer not null default 0;
-
-create index if not exists workflow_invocations_pending ON workflow.workflow_invocations USING btree (run_id, sequence) WHERE (responded_at IS NULL);
-
-create table if not exists workflow.workflow_runs (
-  "id" character varying not null,
-  "output" jsonb,
-  "deployment_id" character varying not null,
-  "status" workflow.status not null,
-  "name" character varying not null,
-  "execution_context" jsonb,
-  "input" jsonb,
-  "error" text,
-  "created_at" timestamp without time zone not null default now(),
-  "updated_at" timestamp without time zone not null default now(),
-  "completed_at" timestamp without time zone,
-  "started_at" timestamp without time zone,
-  "output_cbor" bytea,
-  "execution_context_cbor" bytea,
-  "input_cbor" bytea,
-  "expired_at" timestamp without time zone,
-  "spec_version" character varying,
-  "error_cbor" bytea,
-  "error_code" character varying,
-  "attributes" jsonb not null default '{}'::jsonb,
-  "encryption_public_key" character varying,
-  "dynamic_workflow_code_cbor" bytea,
-  constraint "workflow_runs_pkey" PRIMARY KEY (id)
-);
-
-alter table workflow.workflow_runs
-  add column if not exists "id" character varying not null,
-  add column if not exists "output" jsonb,
-  add column if not exists "deployment_id" character varying not null,
-  add column if not exists "status" workflow.status not null,
-  add column if not exists "name" character varying not null,
-  add column if not exists "execution_context" jsonb,
-  add column if not exists "input" jsonb,
-  add column if not exists "error" text,
-  add column if not exists "created_at" timestamp without time zone not null default now(),
-  add column if not exists "updated_at" timestamp without time zone not null default now(),
-  add column if not exists "completed_at" timestamp without time zone,
-  add column if not exists "started_at" timestamp without time zone,
-  add column if not exists "output_cbor" bytea,
-  add column if not exists "execution_context_cbor" bytea,
-  add column if not exists "input_cbor" bytea,
-  add column if not exists "expired_at" timestamp without time zone,
-  add column if not exists "spec_version" character varying,
-  add column if not exists "error_cbor" bytea,
-  add column if not exists "error_code" character varying,
-  add column if not exists "attributes" jsonb not null default '{}'::jsonb,
-  add column if not exists "encryption_public_key" character varying,
-  add column if not exists "dynamic_workflow_code_cbor" bytea;
-
-create index if not exists workflow_runs_name_index ON workflow.workflow_runs USING btree (name);
-
-create index if not exists workflow_runs_status_index ON workflow.workflow_runs USING btree (status);
-
-create table if not exists workflow.workflow_snapshots (
-  "run_id" character varying not null,
-  "data" bytea not null,
-  "events_cursor" character varying,
-  "created_at" timestamp without time zone not null default now(),
-  constraint "workflow_snapshots_pkey" PRIMARY KEY (run_id)
-);
-
-alter table workflow.workflow_snapshots
-  add column if not exists "run_id" character varying not null,
-  add column if not exists "data" bytea not null,
-  add column if not exists "events_cursor" character varying,
-  add column if not exists "created_at" timestamp without time zone not null default now();
-
-create table if not exists workflow.workflow_steps (
-  "run_id" character varying not null,
-  "step_id" character varying not null,
-  "step_name" character varying not null,
-  "status" workflow.step_status not null,
-  "input" jsonb,
-  "output" jsonb,
-  "error" text,
-  "attempt" integer not null,
-  "started_at" timestamp without time zone,
-  "completed_at" timestamp without time zone,
-  "created_at" timestamp without time zone not null default now(),
-  "updated_at" timestamp without time zone not null default now(),
-  "retry_after" timestamp without time zone,
-  "input_cbor" bytea,
-  "output_cbor" bytea,
-  "error_cbor" bytea,
-  "spec_version" integer,
-  constraint "workflow_steps_pkey" PRIMARY KEY (step_id)
-);
-
-alter table workflow.workflow_steps
-  add column if not exists "run_id" character varying not null,
-  add column if not exists "step_id" character varying not null,
-  add column if not exists "step_name" character varying not null,
-  add column if not exists "status" workflow.step_status not null,
-  add column if not exists "input" jsonb,
-  add column if not exists "output" jsonb,
-  add column if not exists "error" text,
-  add column if not exists "attempt" integer not null,
-  add column if not exists "started_at" timestamp without time zone,
-  add column if not exists "completed_at" timestamp without time zone,
-  add column if not exists "created_at" timestamp without time zone not null default now(),
-  add column if not exists "updated_at" timestamp without time zone not null default now(),
-  add column if not exists "retry_after" timestamp without time zone,
-  add column if not exists "input_cbor" bytea,
-  add column if not exists "output_cbor" bytea,
-  add column if not exists "error_cbor" bytea,
-  add column if not exists "spec_version" integer;
-
-create index if not exists workflow_steps_run_id_index ON workflow.workflow_steps USING btree (run_id);
-
-create index if not exists workflow_steps_status_index ON workflow.workflow_steps USING btree (status);
-
-create table if not exists workflow.workflow_stream_chunks (
-  "id" character varying not null,
-  "stream_id" character varying not null,
-  "data" bytea not null,
-  "created_at" timestamp without time zone not null default now(),
-  "eof" boolean not null,
-  "run_id" character varying,
-  constraint "workflow_stream_chunks_stream_id_id_pk" PRIMARY KEY (stream_id, id)
-);
-
-alter table workflow.workflow_stream_chunks
-  add column if not exists "id" character varying not null,
-  add column if not exists "stream_id" character varying not null,
-  add column if not exists "data" bytea not null,
-  add column if not exists "created_at" timestamp without time zone not null default now(),
-  add column if not exists "eof" boolean not null,
-  add column if not exists "run_id" character varying;
-
-create index if not exists workflow_stream_chunks_run_id_index ON workflow.workflow_stream_chunks USING btree (run_id);
-
-create table if not exists workflow.workflow_waits (
-  "wait_id" character varying not null,
-  "run_id" character varying not null,
-  "status" workflow.wait_status not null,
-  "resume_at" timestamp without time zone,
-  "completed_at" timestamp without time zone,
-  "created_at" timestamp without time zone not null default now(),
-  "updated_at" timestamp without time zone not null default now(),
-  "spec_version" integer,
-  constraint "workflow_waits_pkey" PRIMARY KEY (wait_id)
-);
-
-alter table workflow.workflow_waits
-  add column if not exists "wait_id" character varying not null,
-  add column if not exists "run_id" character varying not null,
-  add column if not exists "status" workflow.wait_status not null,
-  add column if not exists "resume_at" timestamp without time zone,
-  add column if not exists "completed_at" timestamp without time zone,
-  add column if not exists "created_at" timestamp without time zone not null default now(),
-  add column if not exists "updated_at" timestamp without time zone not null default now(),
-  add column if not exists "spec_version" integer;
-
-create index if not exists workflow_waits_run_id_index ON workflow.workflow_waits USING btree (run_id);
-`;
-//#endregion
-//#region src/sql/shared.ts
-/** What `record` and the other statement helpers return when there is nothing to do. */
-const NOTHING = "null;";
-/** `alter table ... add column if not exists` for each extra column of a managed table. */
-const addExtraColumns = (table, columns) => columns.map((column) => `\nalter table ${table} add column if not exists ${column.ident} ${column.type};`).join("");
-/**
-* A `jsonb` object of `columns` of row `alias`, keyed by column name, so
-* reads return extra columns without exposing the rest of the row.
-*/
-const columnsObject = (alias, columns) => `jsonb_build_object(${columns.map((name) => `${sqlString(name)}, ${alias}.${sqlIdent(name)}`).join(", ")})`;
-const SCHEMA = `create schema if not exists better_supabase;
-grant usage on schema better_supabase to anon, authenticated, service_role;`;
-/**
-* A SQL condition true for the service role and for a direct admin
-* connection (no JWT, a privileged session user), which may act for others.
-*/
-const SERVICE_CALLER = "coalesce(nullif((select auth.jwt()) ->> 'role', ''), session_user::text) in ('service_role', 'postgres', 'supabase_admin')";
-/**
-* The `organization.member_added` record for a module that adds a member, so
-* every module writes the same payload. Each value is a SQL expression.
-*/
-function memberAddedRecord(ctx, member) {
-	return ctx.record({
-		type: "organization.member_added",
-		payload: `jsonb_build_object('organizationId', ${member.tenant}::text, 'userId', ${member.user}, 'role', ${member.role})`,
-		subject: `'organizations/' || ${member.tenant}::text`,
-		tenant: member.tenant,
-		audit: {
-			category: "membership",
-			targetType: "user",
-			recordId: `${member.user}::text`
-		}
-	});
-}
-/** Creates the module's schema when it isn't `better_supabase`, then the module schema. */
-function schemaPreamble(ctx) {
-	if (ctx.schemaName === "better_supabase") return SCHEMA;
-	return `${SCHEMA}
-create schema if not exists ${ctx.schema};
-grant usage on schema ${ctx.schema} to anon, authenticated, service_role;`;
-}
-/**
-* A policy condition for "the caller holds `permission` in this row's
-* tenant". Postgres never inlines `can()` (it is `security definer`), so a
-* `can('tenant', column, ...)` in `using` runs once per row and can't use the
-* tenant index; the `tenant_ids_with` set runs once per statement.
-*/
-function tenantIn(tenant, permission) {
-	return `${tenant} in (select better_supabase.tenant_ids_with(${permission}))`;
-}
-/** A claim from the top level of the token, then `app_metadata`. */
-function jwtClaim(name) {
-	return `coalesce(auth.jwt() ->> ${sqlString(name)}, auth.jwt() -> 'app_metadata' ->> ${sqlString(name)})`;
-}
-/** `table` or `schema.table` as `[schema, table]`, in `public` without a schema. */
-function splitTable(name) {
-	const parts = name.split(".");
-	if (parts.length > 2 || parts.some((part) => part.length === 0)) throw new TypeError(`"${name}" must be "table" or "schema.table"`);
-	return parts.length === 2 ? [parts[0], parts[1]] : ["public", parts[0]];
-}
-/** `table` or `schema.table`, quoted. */
-function quotedTable(name) {
-	const [schema, table] = splitTable(name);
-	return `${sqlIdent(schema)}.${sqlIdent(table)}`;
-}
-/** `schema.table.column` split into its quoted table and column. */
-function columnRef(where, value) {
-	const parts = value.split(".");
-	if (parts.length !== 3 || parts.some((part) => part.length === 0)) throw new TypeError(`${where} must be "schema.table.column", got "${value}"`);
-	const [schema, table, column] = parts;
-	return {
-		table: `${sqlIdent(schema)}.${sqlIdent(table)}`,
-		column: sqlIdent(column)
-	};
-}
-const QUOTED_IDENT = /^"(.*)"$/s;
-/**
-* Replaces the check constraints on one column of a table a module created
-* earlier: `create table if not exists` never changes an inline check, and
-* its generated name follows the table's configured name. For upgrade steps.
-* `column` is a quoted identifier; the catalog stores the bare name.
-*/
-function replaceColumnCheck(check) {
-	const column = QUOTED_IDENT.exec(check.column)?.[1]?.replaceAll("\"\"", "\"") ?? check.column;
-	return `do $$
-declare
-  v_name name;
-begin
-  for v_name in
-    select c.conname from pg_catalog.pg_constraint c
-    join pg_catalog.pg_attribute a on a.attrelid = c.conrelid and a.attnum = c.conkey[1]
-    where c.conrelid = ${sqlString(check.table)}::regclass and c.contype = 'c'
-      and cardinality(c.conkey) = 1 and a.attname = ${sqlString(column)}
-  loop
-    execute format('alter table %s drop constraint %I', ${sqlString(check.table)}, v_name);
-  end loop;
-end;
-$$;
-alter table ${check.table} add constraint ${sqlIdent(check.name)} check (${check.expression});`;
-}
-/**
-* Adds a foreign key to a table a module created earlier, once: `create
-* table if not exists` can't add it to a table that already exists, and the
-* referenced table can come from a module that renders later. Existing rows
-* without a match leave the key unvalidated, with a warning.
-*/
-function addForeignKey(fk) {
-	return `do $$
-begin
-  if not exists (
-    select 1 from pg_constraint
-    where conrelid = ${sqlString(fk.table)}::regclass and conname = ${sqlString(fk.name)}
-  ) then
-    alter table ${fk.table} add constraint ${sqlIdent(fk.name)}
-      foreign key (${fk.column}) references ${fk.references} on delete ${fk.onDelete} not valid;
-    begin
-      alter table ${fk.table} validate constraint ${sqlIdent(fk.name)};
-    exception when foreign_key_violation then
-      raise warning '% has rows without a match, so only new rows are checked. Delete them, then run: alter table % validate constraint %',
-        ${sqlString(fk.table)}, ${sqlString(fk.table)}, ${sqlString(fk.name)};
-    end;
-  end if;
-end;
-$$;`;
-}
-/**
-* An `updated_at` column on a managed table, kept current by the
-* `updated-at` module's `set_updated_at()` (the module must require it).
-*/
-function updatedAt(table, column) {
-	return `alter table ${table} add column if not exists ${column} timestamptz not null default now();
-drop trigger if exists bs_updated_at on ${table};
-create trigger bs_updated_at before update on ${table}
-  for each row execute function better_supabase.set_updated_at(${sqlString(column.replaceAll("\"", ""))});`;
-}
-function renameSql(renames) {
-	const schema = sqlString(renames.schema);
-	const q = (name) => `${sqlIdent(renames.schema)}.${sqlIdent(name)}`;
-	const lines = [];
-	let table = renames.table;
-	for (const [from, to] of renames.tables ?? []) {
-		lines.push(`  if to_regclass(${sqlString(`${renames.schema}.${from}`)}) is not null
-    and (select c.relkind from pg_class c where c.oid = to_regclass(${sqlString(`${renames.schema}.${from}`)})) in ('r', 'p')
-    and to_regclass(${sqlString(`${renames.schema}.${to}`)}) is null then
-    alter table ${q(from)} rename to ${sqlIdent(to)};
-  end if;`);
-		if (from === table) table = to;
-	}
-	for (const [from, to] of renames.columns ?? []) lines.push(`  if exists (select 1 from information_schema.columns c
-      where c.table_schema = ${schema} and c.table_name = ${sqlString(table)} and c.column_name = ${sqlString(from)})
-    and not exists (select 1 from information_schema.columns c
-      where c.table_schema = ${schema} and c.table_name = ${sqlString(table)} and c.column_name = ${sqlString(to)}) then
-    alter table ${q(table)} rename column ${sqlIdent(from)} to ${sqlIdent(to)};
-  end if;`);
-	for (const [from, to] of renames.indexes ?? []) lines.push(`  if to_regclass(${sqlString(`${renames.schema}.${from}`)}) is not null
-    and to_regclass(${sqlString(`${renames.schema}.${to}`)}) is null then
-    alter index ${q(from)} rename to ${sqlIdent(to)};
-  end if;`);
-	for (const [from, to, args] of renames.functions ?? []) lines.push(`  if to_regprocedure(${sqlString(`${renames.schema}.${from}(${args})`)}) is not null
-    and to_regprocedure(${sqlString(`${renames.schema}.${to}(${args})`)}) is null then
-    alter function ${q(from)}(${args}) rename to ${sqlIdent(to)};
-  end if;`);
-	if (lines.length === 0) return "";
-	return `do $$
-begin
-${lines.join("\n")}
-end;
-$$;`;
-}
-/**
-* A SQL condition true when `organization` names no row of the installed
-* organizations table. False without the organizations module.
-*/
-function organizationMissing(ctx, organization) {
-	if (!ctx.installed("organizations")) return "false";
-	const organizations = ctx.of("organizations");
-	return `not exists (select 1 from ${organizations.table("organizations")} o where o.${organizations.col("organizations", "id")} = ${organization})`;
-}
-function membershipDisabledAt(ctx) {
-	if (ctx.module !== "tenant" && !ctx.installed("tenant")) return void 0;
-	const tenant = ctx.module === "tenant" ? ctx : ctx.of("tenant");
-	if (!tenant.has("memberships", "disabledAt")) return void 0;
-	if (!tenant.manages && typeof tenant.config.columns["memberships"]?.["disabledAt"] !== "string") return void 0;
-	return tenant.col("memberships", "disabledAt");
-}
-function activeMembership(ctx, alias) {
-	const column = membershipDisabledAt(ctx);
-	return column === void 0 ? "" : ` and ${alias}.${column} is null`;
-}
-function membershipSuspended(ctx, tenant, user) {
-	const column = membershipDisabledAt(ctx);
-	if (column === void 0) return void 0;
-	const t = ctx.module === "tenant" ? ctx : ctx.of("tenant");
-	return `exists (select 1 from ${t.table("memberships")} sm where sm.${t.col("memberships", "tenant")} = ${tenant} and sm.${t.col("memberships", "user")} = ${user} and sm.${column} is not null)`;
-}
-/**
-* `tenant_disabled(id)` and `user_disabled(uuid)` from
-* `sql.modules.access.disabled`. Without a column they return false, so callers
-* don't need to know whether it is configured.
-*/
-function disabledHelpers(ctx) {
-	const disabled = ctx.modules.access?.disabled ?? {};
-	const id = ctx.idType;
-	const organizations = managedOrganizations(ctx);
-	let tenantCheck = "false";
-	if (disabled.tenant !== void 0) tenantCheck = disabledCheck("sql.modules.access.disabled.tenant", disabled.tenant, {
-		key: "\"id\"",
-		alias: "t",
-		value: "tenant_disabled.tenant"
-	});
-	else if (organizations) tenantCheck = `exists (select 1 from ${organizations.table} t where t.${organizations.id} = tenant_disabled.tenant and (${organizations.flags.map((column) => `t.${column} is not null`).join(" or ")}))`;
-	const userCheck = disabled.user === void 0 ? "false" : disabledCheck("sql.modules.access.disabled.user", disabled.user, {
-		key: sqlIdent(disabled.userKey ?? "id"),
-		alias: "u",
-		value: "user_disabled.user_id"
-	});
-	return `
--- Disabled tenants and users get no permissions and no membership claims
--- (modules.access.disabled; with the managed organizations module, its
--- disabled_at and deleted_at columns).
-create or replace function better_supabase.tenant_disabled(tenant ${id})
-returns boolean
-language sql
-stable
-security definer
-set search_path = ''
-as $$
-  select ${tenantCheck}
-$$;
-
-create or replace function better_supabase.user_disabled(user_id uuid)
-returns boolean
-language sql
-stable
-security definer
-set search_path = ''
-as $$
-  select ${userCheck}
-$$;
+create or replace function better_supabase.user_disabled(user_id uuid)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select ${userCheck}
+$$;
 
 revoke execute on function better_supabase.tenant_disabled(${id}) from public, anon, authenticated;
 revoke execute on function better_supabase.user_disabled(uuid) from public, anon, authenticated;
@@ -712,6 +426,8 @@ function serviceOnly(signatures, schema = "better_supabase") {
 }
 /** `raise exception` with an errcode and a hint the TypeScript side maps. */
 const raise = (message, errcode, hint, ...args) => `raise exception ${sqlString(message)}${args.map((arg) => `, ${arg}`).join("")} using errcode = '${errcode}', hint = '${hint}';`;
+/** `raise` for a module function: the hint first, the errcode defaulting to insufficient privilege. */
+const fail = (code, message, errcode = "42501") => raise(message, errcode, code);
 /** `coalesce(can('tenant', tenant, permission), false)`. */
 const canIn = (tenant, permission) => `coalesce(better_supabase.can('tenant', ${tenant}, ${permission}), false)`;
 /** The hex SHA-256 of a `text` expression, as tokens and codes are stored. */
@@ -1192,6 +908,292 @@ function modulePermissionKey(ctx, action, fallback) {
 }
 const modulePermission = (ctx, action, fallback) => sqlString(modulePermissionKey(ctx, action, fallback));
 //#endregion
+//#region src/sql/modules/workflow-sdk-world-ddl.generated.ts
+/** The `@workflow/world-postgres` version the DDL below was generated from. */
+const WORLD_POSTGRES_VERSION = "5.0.2";
+/** The `workflow` schema after every migration above, as idempotent DDL. */
+const WORLD_POSTGRES_DDL = `create schema if not exists workflow;
+
+do $$ begin
+  create type workflow.status as enum ('pending', 'running', 'completed', 'failed', 'cancelled');
+exception when duplicate_object then null;
+end $$;
+
+do $$ begin
+  create type workflow.step_status as enum ('pending', 'running', 'completed', 'failed', 'cancelled');
+exception when duplicate_object then null;
+end $$;
+
+do $$ begin
+  create type workflow.wait_status as enum ('waiting', 'completed');
+exception when duplicate_object then null;
+end $$;
+
+create table if not exists workflow.workflow_event_slots (
+  "run_id" character varying not null,
+  constraint "workflow_event_slots_pkey" PRIMARY KEY (run_id)
+);
+
+alter table workflow.workflow_event_slots
+  add column if not exists "run_id" character varying not null;
+
+create table if not exists workflow.workflow_events (
+  "id" character varying not null,
+  "type" character varying not null,
+  "correlation_id" character varying,
+  "created_at" timestamp without time zone not null default now(),
+  "run_id" character varying not null,
+  "payload" jsonb,
+  "payload_cbor" bytea,
+  "spec_version" integer,
+  "resume_id" character varying,
+  "resume_payload_digest" character varying,
+  constraint "workflow_events_run_id_id_pk" PRIMARY KEY (run_id, id)
+);
+
+alter table workflow.workflow_events
+  add column if not exists "id" character varying not null,
+  add column if not exists "type" character varying not null,
+  add column if not exists "correlation_id" character varying,
+  add column if not exists "created_at" timestamp without time zone not null default now(),
+  add column if not exists "run_id" character varying not null,
+  add column if not exists "payload" jsonb,
+  add column if not exists "payload_cbor" bytea,
+  add column if not exists "spec_version" integer,
+  add column if not exists "resume_id" character varying,
+  add column if not exists "resume_payload_digest" character varying;
+
+create index if not exists workflow_events_correlation_id_index ON workflow.workflow_events USING btree (correlation_id);
+
+create unique index if not exists workflow_events_entity_creation_unique ON workflow.workflow_events USING btree (run_id, correlation_id, type) WHERE ((type)::text = ANY ((ARRAY['step_created'::character varying, 'hook_created'::character varying, 'wait_created'::character varying, 'attr_set'::character varying])::text[]));
+
+create unique index if not exists workflow_events_hook_resume_unique ON workflow.workflow_events USING btree (run_id, resume_id) WHERE (((type)::text = 'hook_received'::text) AND (resume_id IS NOT NULL));
+
+create table if not exists workflow.workflow_hooks (
+  "run_id" character varying not null,
+  "hook_id" character varying not null,
+  "token" character varying not null,
+  "owner_id" character varying not null,
+  "project_id" character varying not null,
+  "environment" character varying not null,
+  "created_at" timestamp without time zone not null default now(),
+  "metadata" jsonb,
+  "metadata_cbor" bytea,
+  "spec_version" integer,
+  "is_webhook" boolean default true,
+  "is_system" boolean default false,
+  "resume_context" bytea,
+  "token_retention_until" timestamp with time zone,
+  "claimed_from" bytea,
+  constraint "workflow_hooks_pkey" PRIMARY KEY (hook_id)
+);
+
+alter table workflow.workflow_hooks
+  add column if not exists "run_id" character varying not null,
+  add column if not exists "hook_id" character varying not null,
+  add column if not exists "token" character varying not null,
+  add column if not exists "owner_id" character varying not null,
+  add column if not exists "project_id" character varying not null,
+  add column if not exists "environment" character varying not null,
+  add column if not exists "created_at" timestamp without time zone not null default now(),
+  add column if not exists "metadata" jsonb,
+  add column if not exists "metadata_cbor" bytea,
+  add column if not exists "spec_version" integer,
+  add column if not exists "is_webhook" boolean default true,
+  add column if not exists "is_system" boolean default false,
+  add column if not exists "resume_context" bytea,
+  add column if not exists "token_retention_until" timestamp with time zone,
+  add column if not exists "claimed_from" bytea;
+
+create index if not exists workflow_hooks_run_id_index ON workflow.workflow_hooks USING btree (run_id);
+
+create index if not exists workflow_hooks_token_index ON workflow.workflow_hooks USING btree (token);
+
+create table if not exists workflow.workflow_invocations (
+  "sequence" bigserial,
+  "run_id" character varying not null,
+  "request_id" character varying not null,
+  "payload" bytea,
+  "fingerprint" character varying,
+  "result" bytea,
+  "created_at" timestamp without time zone not null default now(),
+  "responded_at" timestamp without time zone,
+  "expired_at" timestamp without time zone,
+  "result_version" integer not null default 0,
+  constraint "workflow_invocations_pkey" PRIMARY KEY (run_id, request_id)
+);
+
+alter table workflow.workflow_invocations
+  add column if not exists "sequence" bigserial,
+  add column if not exists "run_id" character varying not null,
+  add column if not exists "request_id" character varying not null,
+  add column if not exists "payload" bytea,
+  add column if not exists "fingerprint" character varying,
+  add column if not exists "result" bytea,
+  add column if not exists "created_at" timestamp without time zone not null default now(),
+  add column if not exists "responded_at" timestamp without time zone,
+  add column if not exists "expired_at" timestamp without time zone,
+  add column if not exists "result_version" integer not null default 0;
+
+create index if not exists workflow_invocations_pending ON workflow.workflow_invocations USING btree (run_id, sequence) WHERE (responded_at IS NULL);
+
+create table if not exists workflow.workflow_runs (
+  "id" character varying not null,
+  "output" jsonb,
+  "deployment_id" character varying not null,
+  "status" workflow.status not null,
+  "name" character varying not null,
+  "execution_context" jsonb,
+  "input" jsonb,
+  "error" text,
+  "created_at" timestamp without time zone not null default now(),
+  "updated_at" timestamp without time zone not null default now(),
+  "completed_at" timestamp without time zone,
+  "started_at" timestamp without time zone,
+  "output_cbor" bytea,
+  "execution_context_cbor" bytea,
+  "input_cbor" bytea,
+  "expired_at" timestamp without time zone,
+  "spec_version" character varying,
+  "error_cbor" bytea,
+  "error_code" character varying,
+  "attributes" jsonb not null default '{}'::jsonb,
+  "encryption_public_key" character varying,
+  "dynamic_workflow_code_cbor" bytea,
+  constraint "workflow_runs_pkey" PRIMARY KEY (id)
+);
+
+alter table workflow.workflow_runs
+  add column if not exists "id" character varying not null,
+  add column if not exists "output" jsonb,
+  add column if not exists "deployment_id" character varying not null,
+  add column if not exists "status" workflow.status not null,
+  add column if not exists "name" character varying not null,
+  add column if not exists "execution_context" jsonb,
+  add column if not exists "input" jsonb,
+  add column if not exists "error" text,
+  add column if not exists "created_at" timestamp without time zone not null default now(),
+  add column if not exists "updated_at" timestamp without time zone not null default now(),
+  add column if not exists "completed_at" timestamp without time zone,
+  add column if not exists "started_at" timestamp without time zone,
+  add column if not exists "output_cbor" bytea,
+  add column if not exists "execution_context_cbor" bytea,
+  add column if not exists "input_cbor" bytea,
+  add column if not exists "expired_at" timestamp without time zone,
+  add column if not exists "spec_version" character varying,
+  add column if not exists "error_cbor" bytea,
+  add column if not exists "error_code" character varying,
+  add column if not exists "attributes" jsonb not null default '{}'::jsonb,
+  add column if not exists "encryption_public_key" character varying,
+  add column if not exists "dynamic_workflow_code_cbor" bytea;
+
+create index if not exists workflow_runs_name_index ON workflow.workflow_runs USING btree (name);
+
+create index if not exists workflow_runs_status_index ON workflow.workflow_runs USING btree (status);
+
+create table if not exists workflow.workflow_snapshots (
+  "run_id" character varying not null,
+  "data" bytea not null,
+  "events_cursor" character varying,
+  "created_at" timestamp without time zone not null default now(),
+  constraint "workflow_snapshots_pkey" PRIMARY KEY (run_id)
+);
+
+alter table workflow.workflow_snapshots
+  add column if not exists "run_id" character varying not null,
+  add column if not exists "data" bytea not null,
+  add column if not exists "events_cursor" character varying,
+  add column if not exists "created_at" timestamp without time zone not null default now();
+
+create table if not exists workflow.workflow_steps (
+  "run_id" character varying not null,
+  "step_id" character varying not null,
+  "step_name" character varying not null,
+  "status" workflow.step_status not null,
+  "input" jsonb,
+  "output" jsonb,
+  "error" text,
+  "attempt" integer not null,
+  "started_at" timestamp without time zone,
+  "completed_at" timestamp without time zone,
+  "created_at" timestamp without time zone not null default now(),
+  "updated_at" timestamp without time zone not null default now(),
+  "retry_after" timestamp without time zone,
+  "input_cbor" bytea,
+  "output_cbor" bytea,
+  "error_cbor" bytea,
+  "spec_version" integer,
+  constraint "workflow_steps_pkey" PRIMARY KEY (step_id)
+);
+
+alter table workflow.workflow_steps
+  add column if not exists "run_id" character varying not null,
+  add column if not exists "step_id" character varying not null,
+  add column if not exists "step_name" character varying not null,
+  add column if not exists "status" workflow.step_status not null,
+  add column if not exists "input" jsonb,
+  add column if not exists "output" jsonb,
+  add column if not exists "error" text,
+  add column if not exists "attempt" integer not null,
+  add column if not exists "started_at" timestamp without time zone,
+  add column if not exists "completed_at" timestamp without time zone,
+  add column if not exists "created_at" timestamp without time zone not null default now(),
+  add column if not exists "updated_at" timestamp without time zone not null default now(),
+  add column if not exists "retry_after" timestamp without time zone,
+  add column if not exists "input_cbor" bytea,
+  add column if not exists "output_cbor" bytea,
+  add column if not exists "error_cbor" bytea,
+  add column if not exists "spec_version" integer;
+
+create index if not exists workflow_steps_run_id_index ON workflow.workflow_steps USING btree (run_id);
+
+create index if not exists workflow_steps_status_index ON workflow.workflow_steps USING btree (status);
+
+create table if not exists workflow.workflow_stream_chunks (
+  "id" character varying not null,
+  "stream_id" character varying not null,
+  "data" bytea not null,
+  "created_at" timestamp without time zone not null default now(),
+  "eof" boolean not null,
+  "run_id" character varying,
+  constraint "workflow_stream_chunks_stream_id_id_pk" PRIMARY KEY (stream_id, id)
+);
+
+alter table workflow.workflow_stream_chunks
+  add column if not exists "id" character varying not null,
+  add column if not exists "stream_id" character varying not null,
+  add column if not exists "data" bytea not null,
+  add column if not exists "created_at" timestamp without time zone not null default now(),
+  add column if not exists "eof" boolean not null,
+  add column if not exists "run_id" character varying;
+
+create index if not exists workflow_stream_chunks_run_id_index ON workflow.workflow_stream_chunks USING btree (run_id);
+
+create table if not exists workflow.workflow_waits (
+  "wait_id" character varying not null,
+  "run_id" character varying not null,
+  "status" workflow.wait_status not null,
+  "resume_at" timestamp without time zone,
+  "completed_at" timestamp without time zone,
+  "created_at" timestamp without time zone not null default now(),
+  "updated_at" timestamp without time zone not null default now(),
+  "spec_version" integer,
+  constraint "workflow_waits_pkey" PRIMARY KEY (wait_id)
+);
+
+alter table workflow.workflow_waits
+  add column if not exists "wait_id" character varying not null,
+  add column if not exists "run_id" character varying not null,
+  add column if not exists "status" workflow.wait_status not null,
+  add column if not exists "resume_at" timestamp without time zone,
+  add column if not exists "completed_at" timestamp without time zone,
+  add column if not exists "created_at" timestamp without time zone not null default now(),
+  add column if not exists "updated_at" timestamp without time zone not null default now(),
+  add column if not exists "spec_version" integer;
+
+create index if not exists workflow_waits_run_id_index ON workflow.workflow_waits USING btree (run_id);
+`;
+//#endregion
 //#region src/sql/modules/workflow-sdk-world.ts
 /** The Vault secret names the pg_net dispatcher reads. */
 const WORKFLOW_VAULT_SECRETS = {
@@ -1394,4 +1396,4 @@ const WORKFLOW_SDK_WORLD = {
 	data
 };
 //#endregion
-export { jwtClaim as A, replaceColumnCheck as B, canIn as C, disabledHelpersNeedLaterTables as D, disabledHelpers as E, pageSize as F, splitTable as G, serviceGrant as H, quotedTable as I, userGrant as J, tenantIn as K, raise as L, membershipDisabledAt as M, membershipSuspended as N, ensureCheck as O, organizationMissing as P, recordTrigger as R, addForeignKey as S, columnsObject as T, serviceOnly as U, schemaPreamble as V, sha256Hex as W, WORLD_POSTGRES_VERSION as Y, SCHEMA as _, MODULE_PERMISSION_SCOPES as a, activeMembership as b, modulePermission as c, roleNames as d, roleScopeIs as f, NOTHING as g, EQUIVALENT_TRIGGERS as h, MODULE_PERMISSIONS as i, memberAddedRecord as j, jsonSchemaChecks as k, modulePermissionKey as l, tenantScope as m, WORKFLOW_SDK_WORLD as n, accessModel as o, rolesOf as p, updatedAt as q, WORKFLOW_VAULT_SECRETS as r, hasPlatformRoles as s, WORKFLOW_DELIVERY_QUEUE as t, providerPlatformRoles as u, SERVICE_CALLER as v, columnRef as w, addExtraColumns as x, accessDefinesDisabledHelpers as y, renameSql as z };
+export { fail as A, recordTrigger as B, addForeignKey as C, disabledHelpers as D, columnsObject as E, membershipSuspended as F, serviceOnly as G, replaceColumnCheck as H, organizationMissing as I, tenantIn as J, sha256Hex as K, pageSize as L, jwtClaim as M, memberAddedRecord as N, disabledHelpersNeedLaterTables as O, membershipDisabledAt as P, quotedTable as R, addExtraColumns as S, columnRef as T, schemaPreamble as U, renameSql as V, serviceGrant as W, userGrant as X, updatedAt as Y, NOTHING as _, MODULE_PERMISSIONS as a, accessDefinesDisabledHelpers as b, hasPlatformRoles as c, providerPlatformRoles as d, roleNames as f, EQUIVALENT_TRIGGERS as g, tenantScope as h, WORLD_POSTGRES_VERSION as i, jsonSchemaChecks as j, ensureCheck as k, modulePermission as l, rolesOf as m, WORKFLOW_SDK_WORLD as n, MODULE_PERMISSION_SCOPES as o, roleScopeIs as p, splitTable as q, WORKFLOW_VAULT_SECRETS as r, accessModel as s, WORKFLOW_DELIVERY_QUEUE as t, modulePermissionKey as u, SCHEMA as v, canIn as w, activeMembership as x, SERVICE_CALLER as y, raise as z };