better-supabase 0.8.0 → 0.9.0

package/dist/spec/index.d.ts

@@ -1,7 +1,8 @@
-import { C as ModelWorkflow, D as SecurityRequirement, E as ResourceOperation, S as ModelWebhook, T as OperationSource, _ as ModelSecurityProfileRequirement, a as ModelBody, b as ModelStep, c as ModelContent, d as ModelMessage, f as ModelMessageTrait, g as ModelResponseOrRef, h as ModelResponse, i as JsonSchema, l as ModelExample, m as ModelParameter, n as HttpMethod, o as ModelChannel, p as ModelOperation, r as JsonObject, s as ModelChannelOperation, t as ApiModel, u as ModelInfo, v as ModelSecurityScheme, w as OAuthFlow, x as ModelTag, y as ModelServer } from "../model-OgBxvk3N.js";
-import { a as FormatVersion, c as SpecDiagnostic, d as defineDocumentFormat, i as DocumentOf, l as VersionOf, n as DiagnosticSeverity, o as LowerContext, r as DocumentFormat, s as RenderedOf, t as AnyDocumentFormat, u as VersionStatus } from "../format-DTXdu8ya.js";
-import { a as ResourcePlan, r as ResourceDescription } from "../resource--vTrBe6I.js";
-import { C as ApiSource, D as OperationIdContext, E as EnrichHooks, M as DEFAULT_ERRORS, N as PROBLEM_SCHEMA, O as ResourceInput, P as SecurityPreset, S as ApiOptions, T as ComponentNameContext, a as OverlayEngine, c as defineApi, i as OpenApiRenderResult, j as CustomSecurity, k as RouteSpec, n as DefineApiOptions, o as RenderOptions, r as OpenApiRenderOptions, s as RenderResult, t as Api, w as BuiltModel } from "../api-Dnf2q-Ht.js";
+import { C as ModelWebhook, D as ResourceOperation, E as OperationSource, O as SecurityRequirement, S as ModelTag, T as OAuthFlow, _ as ModelResponseOrRef, a as JsonSchema, b as ModelServer, c as ModelChannelOperation, d as ModelInfo, f as ModelMessage, g as ModelResponse, h as ModelParameter, i as JsonObject, l as ModelContent, m as ModelOperation, n as DataApiOperation, o as ModelBody, p as ModelMessageTrait, r as HttpMethod, s as ModelChannel, t as ApiModel, u as ModelExample, v as ModelSecurityProfileRequirement, w as ModelWorkflow, x as ModelStep, y as ModelSecurityScheme } from "../model-lUafmeBQ.js";
+import { a as FormatVersion, c as SpecDiagnostic, d as defineDocumentFormat, i as DocumentOf, l as VersionOf, n as DiagnosticSeverity, o as LowerContext, r as DocumentFormat, s as RenderedOf, t as AnyDocumentFormat, u as VersionStatus } from "../format-CNwSjXUU.js";
+import { a as ResourcePlan, r as ResourceDescription } from "../resource-B4ka8dDH.js";
+import { B as DEFAULT_ERRORS, C as ApiSource, D as OperationIdContext, E as EnrichHooks, F as EventsOptions, H as SecurityPreset, I as TopicInput, L as topicsFrom, O as ResourceInput, R as DataApiOptions, S as ApiOptions, T as ComponentNameContext, V as PROBLEM_SCHEMA, a as OverlayEngine, c as defineApi, i as OpenApiRenderResult, k as RouteSpec, n as DefineApiOptions, o as RenderOptions, r as OpenApiRenderOptions, s as RenderResult, t as Api, w as BuiltModel, z as CustomSecurity } from "../api-TG3jE5aO.js";
+import { t as DescribedFunction } from "../function-contract-B4c0XuTU.js";
 //#region src/spec/build.d.ts
 /**
  * Builds the version-neutral API model once per metadata, plugin list and
@@ -9,6 +10,25 @@ import { C as ApiSource, D as OperationIdContext, E as EnrichHooks, M as DEFAULT
  */
 export declare function buildApiModel<Ref = string>(source: ApiSource, options: ApiOptions<Ref>): BuiltModel;
 //#endregion
+//#region src/spec/function-route.d.ts
+interface FunctionRouteOptions {
+  /** Defaults to `POST`. */
+  readonly method?: RouteSpec["method"];
+  /** Defaults to the function's own `summary`. */
+  readonly summary?: string;
+  readonly tags?: readonly string[];
+}
+/**
+ * The route of a `defineFunction` handler, at `/functions/v1/<name>`: its
+ * input is the request body and its output the 200 response. Pass it in
+ * `routes`; `basePath` goes in front of it like any other route.
+ *
+ * ```ts
+ * defineApi(bs, { routes: [functionRoute("send-invite", sendInvite)] });
+ * ```
+ */
+export declare function functionRoute(name: string, fn: DescribedFunction, options?: FunctionRouteOptions): RouteSpec;
+//#endregion
 //#region src/spec/merge.d.ts
 /** Escapes a key for a JSON Pointer (RFC 6901). */
 export declare function pointerToken(key: string): string;
@@ -131,4 +151,4 @@ interface ScalarPresetOptions {
  */
 export declare function scalarPreset<D extends object>(document: D, options?: ScalarPresetOptions): D;
 //#endregion
-export { type AnyDocumentFormat, type Api, type ApiModel, type ApiOptions, type ApiSource, type BuiltModel, type ComponentNameContext, type CustomSecurity, DEFAULT_ERRORS, type DefineApiOptions, type DiagnosticSeverity, type DocumentFormat, type DocumentOf, type EnrichHooks, type FormatVersion, type HttpMethod, type JsonObject, type JsonSchema, type LowerContext, type ModelBody, type ModelChannel, type ModelChannelOperation, type ModelContent, type ModelExample, type ModelInfo, type ModelMessage, type ModelMessageTrait, type ModelOperation, type ModelParameter, type ModelResponse, type ModelResponseOrRef, type ModelSecurityProfileRequirement, type ModelSecurityScheme, type ModelServer, type ModelStep, type ModelTag, type ModelWebhook, type ModelWorkflow, type OAuthFlow, type OpenApiRenderOptions, type OpenApiRenderResult, type OperationIdContext, type OperationSource, type OverlayEngine, PROBLEM_SCHEMA, type RenderOptions, type RenderResult, type RenderedOf, type ResourceDescription, type ResourceInput, type ResourceOperation, type ResourcePlan, type RouteSpec, type ScalarPresetOptions, type SecurityPreset, type SecurityRequirement, type SerializeOptions, type SpecDiagnostic, type SpecReferenceOptions, type SpecReferenceResponseOptions, type SpecResponseOptions, type SpecUi, type SpecUiAssets, type VersionOf, type VersionStatus, defineApi, defineDocumentFormat };
+export { type AnyDocumentFormat, type Api, type ApiModel, type ApiOptions, type ApiSource, type BuiltModel, type ComponentNameContext, type CustomSecurity, DEFAULT_ERRORS, type DataApiOperation, type DataApiOptions, type DefineApiOptions, type DiagnosticSeverity, type DocumentFormat, type DocumentOf, type EnrichHooks, type EventsOptions, type FormatVersion, type FunctionRouteOptions, type HttpMethod, type JsonObject, type JsonSchema, type LowerContext, type ModelBody, type ModelChannel, type ModelChannelOperation, type ModelContent, type ModelExample, type ModelInfo, type ModelMessage, type ModelMessageTrait, type ModelOperation, type ModelParameter, type ModelResponse, type ModelResponseOrRef, type ModelSecurityProfileRequirement, type ModelSecurityScheme, type ModelServer, type ModelStep, type ModelTag, type ModelWebhook, type ModelWorkflow, type OAuthFlow, type OpenApiRenderOptions, type OpenApiRenderResult, type OperationIdContext, type OperationSource, type OverlayEngine, PROBLEM_SCHEMA, type RenderOptions, type RenderResult, type RenderedOf, type ResourceDescription, type ResourceInput, type ResourceOperation, type ResourcePlan, type RouteSpec, type ScalarPresetOptions, type SecurityPreset, type SecurityRequirement, type SerializeOptions, type SpecDiagnostic, type SpecReferenceOptions, type SpecReferenceResponseOptions, type SpecResponseOptions, type SpecUi, type SpecUiAssets, type TopicInput, type VersionOf, type VersionStatus, defineApi, defineDocumentFormat, topicsFrom };

package/dist/spec/index.js

@@ -1,7 +1,40 @@
 import { r as isPlainObject } from "../clone-dN9XOL1K.js";
-import { a as methodNotAllowed } from "../problem-CJvFeGu7.js";
-import { o as defineDocumentFormat, t as defineApi } from "../api-DtHFC037.js";
-import { c as mergeJson, l as pointerToken, n as DEFAULT_ERRORS, r as PROBLEM_SCHEMA, t as buildApiModel } from "../build-hPwk3_X5.js";
+import { a as methodNotAllowed } from "../problem-pIiL3WbE.js";
+import { t as FUNCTION_DESCRIPTOR } from "../function-contract-DmkBg19r.js";
+import { o as defineDocumentFormat, t as defineApi } from "../api-CFjuYKFY.js";
+import { a as DEFAULT_ERRORS, i as topicsFrom, l as mergeJson, o as PROBLEM_SCHEMA, t as buildApiModel, u as pointerToken } from "../build-Cm0T5MVG.js";
+//#region src/spec/function-route.ts
+function isDescriptor(value) {
+	return typeof value === "object" && value !== null && "input" in value;
+}
+function descriptorOf(fn) {
+	if (typeof fn !== "function" || !(FUNCTION_DESCRIPTOR in fn)) return;
+	const descriptor = fn[FUNCTION_DESCRIPTOR];
+	return isDescriptor(descriptor) ? descriptor : void 0;
+}
+/**
+* The route of a `defineFunction` handler, at `/functions/v1/<name>`: its
+* input is the request body and its output the 200 response. Pass it in
+* `routes`; `basePath` goes in front of it like any other route.
+*
+* ```ts
+* defineApi(bs, { routes: [functionRoute("send-invite", sendInvite)] });
+* ```
+*/
+function functionRoute(name, fn, options = {}) {
+	const descriptor = descriptorOf(fn);
+	if (!descriptor) throw new TypeError(`better-supabase/spec: functionRoute("${name}") needs a handler from defineFunction`);
+	const summary = options.summary ?? descriptor.summary;
+	return {
+		method: options.method ?? "post",
+		path: `/functions/v1/${name}`,
+		input: descriptor.input,
+		...descriptor.output ? { output: descriptor.output } : {},
+		...summary === void 0 ? {} : { summary },
+		...options.tags ? { tags: options.tags } : {}
+	};
+}
+//#endregion
 //#region src/spec/serialize.ts
 function normalize(value, sortKeys, pointer) {
 	if (typeof value === "number" && !Number.isFinite(value)) throw new TypeError(`better-supabase/spec: ${String(value)} at "${pointer}" has no JSON form`);
@@ -350,4 +383,4 @@ function scalarPreset(document, options = {}) {
 	return copy;
 }
 //#endregion
-export { DEFAULT_ERRORS, PROBLEM_SCHEMA, SPEC_UIS, SPEC_UI_PACKAGES, buildApiModel, defineApi, defineDocumentFormat, mergeJson, pointerToken, scalarPreset, serializeDocument, specReference, specReferenceCsp, specReferenceHtml, specResponse };
+export { DEFAULT_ERRORS, PROBLEM_SCHEMA, SPEC_UIS, SPEC_UI_PACKAGES, buildApiModel, defineApi, defineDocumentFormat, functionRoute, mergeJson, pointerToken, scalarPreset, serializeDocument, specReference, specReferenceCsp, specReferenceHtml, specResponse, topicsFrom };

package/dist/spec-pins-Dqpml2dZ.d.ts

@@ -0,0 +1,84 @@
+//#region src/core/spec-pins.d.ts
+/**
+ * Versions of evolving specs and conventions the code follows. Moving a pin
+ * is a minor release with a changeset (see the standards docs page).
+ */
+declare const SPEC_PINS: {
+  readonly otelSemconv: "1.37.0";
+  /** OTLP/HTTP JSON that the webhooks block's `otlpLogs()` encoder writes. */
+  readonly otlp: "1.7.0";
+  readonly mcp: "2026-07-28";
+  /** The default OpenAPI version `createOpenApi` emits. */
+  readonly openapi: "3.1.2";
+  readonly openapi30: "3.0.4";
+  readonly openapi31: "3.1.2";
+  readonly openapi32: "3.2.1";
+  /** `src/oas.md` on the `v3.3-dev` branch of OAI/OpenAPI-Specification. */
+  readonly openapi33Preview: "aa2f6c0";
+  /** OAI sig-security discussion #50, as of this date. */
+  readonly securityProfiles: "sig-security#50@2026-05-05";
+  readonly overlay10: "1.0.0";
+  readonly overlay11: "1.1.0";
+  readonly overlay12: "1.2.0";
+  readonly arazzo10: "1.0.1";
+  readonly arazzo11: "1.1.0";
+  readonly asyncapi30: "3.0.0";
+  readonly asyncapi31: "3.1.0";
+  /** OpenID AuthZEN Authorization API, the vocabulary of `Authorizer`. */
+  readonly authzen: "1.0";
+  readonly cloudevents: "1.0.2";
+  readonly standardWebhooks: "1.0.0";
+  readonly sarif: "2.1.0";
+  readonly jsonSchema: "2020-12";
+  readonly postgrestAggregates: "12";
+  readonly serverTiming: "WD-20260407";
+  readonly stripeSyncEngine: "0.48.5";
+  readonly pgvector: "0.8";
+  readonly ocsf: "1.9.0";
+  readonly openfeature: "0.9.0";
+  readonly scim: "2.0";
+  readonly supabaseSdkCapabilities: "1.14.0";
+  readonly aiMessage: "1";
+  readonly aiSdkUiMessageStream: "v1";
+  readonly anthropicMemoryTool: "20250818";
+  /** RFC 5545 recurrence rules expanded by the reminders block. */
+  readonly rfc5545: "2009-09";
+  /** RFC 4180 CSV read by `parseCsv` and written by `toCsv`. */
+  readonly rfc4180: "2005-10";
+  /** ISO 4217 List One publication behind `better-supabase/commerce` minor units. */
+  readonly iso4217: "2026-09-17";
+  /** RFC 6902 JSON Patch that the versions block's `createPatch` writes and `applyPatch` applies. */
+  readonly rfc6902: "2013-04";
+  /** RFC 9396 `authorization_details` that delegated tokens and job envelopes carry. */
+  readonly rfc9396: "2023-05";
+  /** RFC 9864 fully specified JOSE algorithms; `Ed25519` is the alg the signing-keys block can write instead of `EdDSA`. */
+  readonly rfc9864: "2025-10";
+  /** RFC 8417 Security Event Tokens that the shared-signals block mints and verifies. */
+  readonly rfc8417: "2018-07";
+  /** RFC 8935 push delivery of SETs: the `set` webhook format and the receiver's push endpoint. */
+  readonly rfc8935: "2020-11";
+  /** RFC 8936 poll delivery of SETs that the transmitter serves and the receiver runs. */
+  readonly rfc8936: "2020-11";
+  /** OpenID Shared Signals Framework: metadata, streams, status and verification. */
+  readonly ssf: "1.0";
+  /** OpenID CAEP event types in `CAEP_EVENTS`. */
+  readonly caep: "1.0";
+  /** OpenID RISC event types in `RISC_EVENTS`. */
+  readonly risc: "1.0";
+  /** RFC 9068 JWT access tokens that `accessTokenResolver` verifies. */
+  readonly rfc9068: "2021-10";
+  /** RFC 7591 client registration metadata the oauth-server block stores. */
+  readonly rfc7591: "2015-07";
+  /** RFC 7636 PKCE; the oauth-server block accepts only the S256 method. */
+  readonly rfc7636: "2015-09";
+  /** RFC 8628 device authorization that the oauth-server block's device codes follow. */
+  readonly rfc8628: "2019-08";
+  /** RFC 9700 OAuth security best current practice behind code reuse and redirect URI rules. */
+  readonly rfc9700: "2025-01";
+  /** draft-ietf-httpapi-ratelimit-headers revision behind `rateLimitHeader` and the Hono and oRPC `rateLimit()`. */
+  readonly ratelimitHeaders: "draft-11";
+  /** The shadcn release whose registry schemas the `@better-supabase` items follow. */
+  readonly shadcnRegistry: "4.21.4";
+};
+//#endregion
+export { SPEC_PINS as t };

package/dist/spec-pins-S4PymRxp.js

@@ -0,0 +1,60 @@
+//#region src/core/spec-pins.ts
+/**
+* Versions of evolving specs and conventions the code follows. Moving a pin
+* is a minor release with a changeset (see the standards docs page).
+*/
+const SPEC_PINS = {
+	otelSemconv: "1.37.0",
+	otlp: "1.7.0",
+	mcp: "2026-07-28",
+	openapi: "3.1.2",
+	openapi30: "3.0.4",
+	openapi31: "3.1.2",
+	openapi32: "3.2.1",
+	openapi33Preview: "aa2f6c0",
+	securityProfiles: "sig-security#50@2026-05-05",
+	overlay10: "1.0.0",
+	overlay11: "1.1.0",
+	overlay12: "1.2.0",
+	arazzo10: "1.0.1",
+	arazzo11: "1.1.0",
+	asyncapi30: "3.0.0",
+	asyncapi31: "3.1.0",
+	authzen: "1.0",
+	cloudevents: "1.0.2",
+	standardWebhooks: "1.0.0",
+	sarif: "2.1.0",
+	jsonSchema: "2020-12",
+	postgrestAggregates: "12",
+	serverTiming: "WD-20260407",
+	stripeSyncEngine: "0.48.5",
+	pgvector: "0.8",
+	ocsf: "1.9.0",
+	openfeature: "0.9.0",
+	scim: "2.0",
+	supabaseSdkCapabilities: "1.14.0",
+	aiMessage: "1",
+	aiSdkUiMessageStream: "v1",
+	anthropicMemoryTool: "20250818",
+	rfc5545: "2009-09",
+	rfc4180: "2005-10",
+	iso4217: "2026-09-17",
+	rfc6902: "2013-04",
+	rfc9396: "2023-05",
+	rfc9864: "2025-10",
+	rfc8417: "2018-07",
+	rfc8935: "2020-11",
+	rfc8936: "2020-11",
+	ssf: "1.0",
+	caep: "1.0",
+	risc: "1.0",
+	rfc9068: "2021-10",
+	rfc7591: "2015-07",
+	rfc7636: "2015-09",
+	rfc8628: "2019-08",
+	rfc9700: "2025-01",
+	ratelimitHeaders: "draft-11",
+	shadcnRegistry: "4.21.4"
+};
+//#endregion
+export { SPEC_PINS as t };

package/dist/sql/index.d.ts

@@ -1,9 +1,9 @@
-import { n as AccessPolicySql, u as ClaimsMeta } from "../types-CoE5Zwy4.js";
-import { q as ReadSet } from "../define-DmcfoNXB.js";
-import { i as DisabledRow, o as ModuleMode, s as ModulesConfig } from "../modules-DpPwzC7E.js";
-import { n as AuthorizationMembership, o as AuthorizationRoleSource, t as AuthorizationFunctions } from "../authorization-BFCqamMs.js";
-import { a as ModuleAudit, c as ModuleEmit, d as ModuleTableSpec, f as contractSignature, i as ModuleAction, l as ModuleIdType, m as moduleIdType, n as AuditCategory, o as ModuleContext, p as isModuleIdType, r as MODULE_ID_TYPES, s as ModuleContractFunction, t as AUDIT_CATEGORIES, u as ModuleNames } from "../context-DsV2SueA.js";
-import { B as ResolvedConfig, Q as EntitlementPlansSource } from "../index-Ba1SI-uO.js";
+import { n as AccessPolicySql, u as ClaimsMeta } from "../types-YfwpIE-d.js";
+import { C as BLOCK_OPTION_SCHEMAS, S as resolveModule, g as BlockScope, h as BlockMode, n as AuthorizationMembership, p as AnyBlocksConfig, r as AuthorizationOperation, s as AuthorizationRoleSource, t as AuthorizationFunctions, w as BlockOptionsRegistry, x as SqlNaming, y as DisabledRow } from "../authorization-DpRfs6Wx.js";
+import { q as ReadSet } from "../define-DxHHbNEb.js";
+import { n as SubjectsConfig, t as SubjectConfig } from "../subjects-z8VWA_lF.js";
+import { a as ModuleAudit, c as ModuleEmit, d as ModuleTableSpec, f as contractSignature, i as ModuleAction, l as ModuleIdType, m as moduleIdType, n as AuditCategory, o as ModuleContext, p as isModuleIdType, r as MODULE_ID_TYPES, s as ModuleContractFunction, t as AUDIT_CATEGORIES, u as ModuleNames } from "../context-1sSWcd7_.js";
+import { S as EntitlementPlansSource, Sn as AppTablesConfig, x as ResolvedConfig } from "../codegen-DeoSt1mi.js";
 //#region src/sql/shared.d.ts
 /** A `pg_jsonschema` check on a jsonb column, for the `jsonb-schemas` module and key-value tables. */
 interface JsonSchemaCheck {
@@ -38,6 +38,25 @@ export declare function auditRegistrations(files: readonly {
   readonly text: string;
 }[]): AuditedTable[];
 //#endregion
+//#region src/sql/foreign-keys.d.ts
+/** A foreign key the schema files declare. */
+interface DeclaredForeignKey {
+  /** `schema.table`, unquoted. */
+  readonly table: string;
+  readonly columns: readonly string[];
+  /** The referenced `schema.table`, unquoted. */
+  readonly references: string;
+  /**
+   * The referenced columns. Without a column list, the referenced table's
+   * declared primary key, or `id` when the files don't declare one.
+   */
+  readonly referencedColumns: readonly string[];
+}
+/** The layout fields `blocks.tenant.options.sameTenant.auto` derives its entries from. */
+export declare function sameTenantLayout(files: readonly {
+  readonly text: string;
+}[], schemas: readonly string[]): Required<Pick<ModuleLayout, "foreignKeys" | "declaredColumns">>;
+//#endregion
 //#region src/sql/modules/entitlements-checks.d.ts
 /** `entitlements.claim`: what `feature_claims` puts in the token. */
 type FeatureClaimOption = false | {
@@ -139,7 +158,7 @@ interface ModuleDeprecation {
   readonly wrapper?: (ctx: ModuleContext) => string;
 }
 /**
- * SQL modules for `better-supabase sql add`. Every module is idempotent
+ * SQL modules for `better-supabase add`. Every module is idempotent
  * (`create or replace`, `if not exists`), so re-running it upgrades in place.
  */
 interface SqlModule {
@@ -148,6 +167,20 @@ interface SqlModule {
   readonly description: string;
   /** Modules this one needs, added along with it. */
   readonly requires: readonly string[];
+  /**
+   * The scopes the module runs in. A module that needs tenants declares
+   * `["tenant"]`; unset, it runs in every scope. Outside `tenant` scope a
+   * module needs neither `tenant` nor `access`, so they drop from
+   * `requires`.
+   */
+  readonly scopes?: readonly BlockScope[];
+  /**
+   * A module this one renders and is numbered ahead of, for a module that
+   * owns a subject table the `case` checks of `comments` or `attachments`
+   * name, or that `search` puts its index trigger on. The file takes the
+   * number before it, so later files keep theirs.
+   */
+  readonly before?: string;
   /** What it needs instead when an authorization provider supplies memberships. */
   readonly providerRequires?: readonly string[];
   /**
@@ -163,24 +196,22 @@ interface SqlModule {
    * `*` stands for every module, for one that reads them all (`data-lifecycle`).
    */
   readonly integrates?: readonly string[];
-  /** What it needs for this layout, e.g. per `sql.modules.access.model`; overrides both. */
+  /** What it needs for this layout, e.g. per `blocks.access.model`; overrides both. */
   readonly dependencies?: (layout: ModuleLayout) => readonly string[];
   /** `schema` files go with your schemas; `test` files go to `supabase/tests`. */
   readonly target: "schema" | "test";
-  /** The module with the default claim names. */
+  /** The module built for the default layout. */
   readonly sql: string;
-  /** The module for configured claim names (`config.claims`), when it reads claims. */
-  readonly render?: (claims: ClaimsMeta, layout: ModuleLayout) => string;
   /** Bumped when installed databases need an upgrade step. Defaults to 1. */
   readonly version?: number;
-  /** The modes `sql.modules.<name>.mode` accepts. Defaults to `managed` only. */
-  readonly modes?: readonly ModuleMode[];
-  /** The logical tables and columns `sql.modules.<name>.tables` and `columns` map. */
+  /** The modes `blocks.<name>.mode` accepts. Defaults to `managed` only. */
+  readonly modes?: readonly BlockMode[];
+  /** The logical tables and columns `blocks.<name>.tables` and `columns` map. */
   readonly names?: ModuleNames;
   /** The functions other modules and the TypeScript side call. */
   readonly contract?: (ctx: ModuleContext) => readonly ModuleContractFunction[];
-  /** Renders the module for a layout; takes precedence over `render`. */
-  readonly build?: (ctx: ModuleContext, layout: ModuleLayout) => string;
+  /** Renders the module for a layout. */
+  readonly build: (ctx: ModuleContext, layout: ModuleLayout) => string;
   /**
    * SQL appended after the module's body that depends on the whole layout, for
    * example the grants for the tables in `expose`. Unlike `build`, it stays out
@@ -204,7 +235,23 @@ interface SqlModule {
    * entry point for them.
    */
   readonly internal?: readonly string[];
+  /**
+   * Soft-delete columns, as logical `table.column`: a write can set them to
+   * hide a row but never clear them again, so doctor BS213 doesn't count
+   * them as columns that grant access.
+   */
+  readonly hidingColumns?: readonly string[];
   readonly adoptOptional?: (ctx: ModuleContext) => Readonly<Record<string, readonly string[]>>;
+  /**
+   * Adopted tables a subject carries (`options.subjects.<type>.<key>`),
+   * checked by `adoptedColumnProblems`. A null column is mapped away.
+   */
+  readonly adoptSubjectTables?: (ctx: ModuleContext) => readonly {
+    readonly logical: string;
+    readonly schema: string;
+    readonly table: string;
+    readonly columns: Readonly<Record<string, string | null>>;
+  }[];
 }
 /** A pgTAP file a module writes for the layout, e.g. one per audited table. */
 interface ModuleTestFile {
@@ -249,14 +296,18 @@ interface ModuleLayout {
   readonly functionGrants?: readonly FunctionGrant[];
   /**
    * Grants the permissive policies in the schema files imply, for
-   * `sql.modules.grants.options.fromPolicies`. Tables in `grants` keep
+   * `blocks.grants.options.fromPolicies`. Tables in `grants` keep
    * their listed privileges.
    */
   readonly policyGrants?: readonly TableGrant[];
-  /** The tables the schema files create, for `sql.modules.sessions.options.policies`. */
+  /** The tables the schema files create, for `blocks.sessions.options.policies`. */
   readonly declaredTables?: readonly string[];
   /** The declared tables with row level security on, for tables `fromPolicies` makes service-only. */
   readonly rlsTables?: readonly string[];
+  /** The foreign keys the schema files declare, for `blocks.tenant.options.sameTenant.auto`. */
+  readonly foreignKeys?: readonly DeclaredForeignKey[];
+  /** Each declared table's columns, `schema.table` to names, for `sameTenant.auto`. */
+  readonly declaredColumns?: Readonly<Record<string, readonly string[]>>;
   /** `config.readSets`, compiled: the functions the `read-sets` module writes. */
   readonly readSets?: readonly {
     readonly name: string;
@@ -273,10 +324,20 @@ interface ModuleLayout {
   readonly entitlementsProvider?: ModuleEntitlementsProvider;
   /** The authorization provider the `access` module's `provider` model calls. */
   readonly accessProvider?: ModuleAccessProvider;
-  /** `config.sql.modules`: modes, names and permission keys per module. */
-  readonly modules?: ModulesConfig;
+  /** `config.blocks`: modes, names and permission keys per module. */
+  readonly modules?: AnyBlocksConfig;
+  /** `sql.scope`: the scope of every block that sets none. Defaults to `tenant`. */
+  readonly scope?: BlockScope;
+  /** `sql.naming`: the tenant concept's name in tables, functions and columns. */
+  readonly naming?: SqlNaming;
+  /** `config.subjects`: the app-wide subject registry (ADR 0020). */
+  readonly subjects?: SubjectsConfig;
+  /** `config.appTables`: the tables the app owns, rendered after the blocks (ADR 0040). */
+  readonly appTables?: AppTablesConfig;
   /** The authorization provider's permission keys, for `api-keys` scopes. */
   readonly permissionCatalog?: readonly string[];
+  /** `authorization.delegation.scopes`: the access module's `scope_permissions` (with `blocks.access.scopes` merged over it). */
+  readonly delegationScopes?: Readonly<Record<string, readonly string[]>>;
 }
 /** Where the `entitlements` module reads the provider's memberships, and the tables behind them. */
 interface ModuleEntitlementsProvider {
@@ -297,6 +358,8 @@ interface ModuleAccessProvider {
   readonly name: string;
   /** The provider scope tenants are. */
   readonly scope: string;
+  /** Every scope it declares, for `options.subjects.<type>.scope`. */
+  readonly scopes?: readonly string[];
   readonly idType: ModuleIdType;
   readonly functions: AuthorizationFunctions;
   /** The access module's `disabled` setting defaults to these. */
@@ -310,6 +373,8 @@ interface ModuleAccessProvider {
   readonly approvals?: {
     readonly distinctApprover?: boolean;
   };
+  /** The provider's operations table; `operationPermission` reads it. */
+  readonly operations?: Readonly<Record<string, AuthorizationOperation>>;
 }
 //#endregion
 //#region src/sql/render.d.ts
@@ -384,7 +449,7 @@ export declare function sameModuleFile(current: string | undefined, expected: st
 /** A permission key a SQL module checks, from `modulePermissionKeys`. */
 interface ModulePermissionKey {
   readonly module: string;
-  /** The action in `sql.modules.<module>.permissions` that overrides the key. */
+  /** The action in `blocks.<module>.permissions` that overrides the key. */
   readonly action: string;
   readonly key: string;
   /**
@@ -395,16 +460,21 @@ interface ModulePermissionKey {
 }
 /**
  * Every permission key the modules `names` install (with what they pull
- * in) check, after `sql.modules.<module>.permissions` overrides. Modules in custom
+ * in) check, after `blocks.<module>.permissions` overrides. Modules in custom
  * mode are skipped, and so is `invitations.invitePlatform` without platform
  * roles.
  */
-export declare function modulePermissionKeys(config: ModulesConfig, names: readonly string[]): ModulePermissionKey[];
+export declare function modulePermissionKeys(config: AnyBlocksConfig, names: readonly string[]): ModulePermissionKey[];
 interface ModuleExtension {
   readonly name: string;
   readonly statement: string;
 }
 export declare const moduleSchemaExtensions: (files: readonly ModuleFile[]) => ModuleExtension[];
+/**
+ * The installed modules' soft-delete columns (`SqlModule.hidingColumns`), as
+ * `schema.table.column` after the layout's renames, for doctor BS213.
+ */
+export declare function moduleHidingColumns(installed: readonly string[], layout: ModuleLayout): string[];
 /**
  * The event triggers each of these modules creates, as its default file
  * renders them, for doctor's check of a database.
@@ -420,16 +490,107 @@ export declare const SQL_MODULES: Readonly<Record<string, SqlModule>>;
 /** The modules to install for `names`, dependencies first. Throws on an unknown name. */
 export declare function resolveModules(names: readonly string[], layout?: ModuleLayout): SqlModule[];
 //#endregion
+//#region src/sql/modules/app-tables.d.ts
+/**
+ * The `module` of the files `renderModules` writes for `appTables`. App
+ * tables aren't a block: no `SQL_MODULES` entry, no preset, no row in
+ * `better_supabase.modules` (ADR 0040).
+ */
+export declare const APP_TABLES_MODULE = "app-tables";
+/** The first line after the title of the app tables schema file. */
+export declare const APP_TABLES_MARKER = "-- @bs-app-tables";
+/**
+ * The files for `layout.appTables`: one schema file that creates every app
+ * table in `public` (implicit columns first, then each column with `add
+ * column if not exists`, so a later column reaches an existing table),
+ * with row level security, the grants and policies of its scope, indexes
+ * on the scope and reference columns, and the `updated_at` trigger when
+ * the `updated-at` block is installed; and one pgTAP file that checks the
+ * policies and grants. Empty without app tables. `installed` is every
+ * block module `renderModules` resolved.
+ */
+export declare function appTablesFiles(layout: ModuleLayout, installed: readonly string[]): ModuleFile[];
+//#endregion
 //#region src/sql/adopted-columns.d.ts
+/** A table an adopt-mode module reads and writes, with the columns it uses. */
+interface AdoptedTable {
+  readonly module: string;
+  readonly logical: string;
+  readonly schema: string;
+  readonly table: string;
+  /** Logical column to the physical column the module's SQL names. */
+  readonly columns: Readonly<Record<string, string>>;
+}
+/**
+ * Every table the adopt-mode modules in `modules` use, with the columns
+ * their SQL names: mapped to `null` and unused optional columns are left out.
+ */
+export declare function adoptedTables(modules: AnyBlocksConfig): readonly AdoptedTable[];
 /**
  * Adopt-mode modules that default an optional column to its physical name
  * while the adopted `create table` has no such column. `sql sync` refuses
  * those configs so `has()` does not treat a missing column as present.
  */
-export declare function adoptedColumnProblems(modules: ModulesConfig, files: readonly {
+export declare function adoptedColumnProblems(modules: AnyBlocksConfig, files: readonly {
   readonly text: string;
 }[], schemas: readonly string[]): readonly string[];
 //#endregion
+//#region src/sql/expose-columns.d.ts
+/**
+ * The columns `privilege(*, -a, -b)` leaves out, unquoted. Empty for any
+ * other privilege.
+ */
+export declare function excludedColumns(privilege: string): readonly string[];
+/**
+ * `grants` with every `privilege(*, -col)` turned into the explicit column
+ * list the `create table` in `files` declares, in declaration order. Throws
+ * for a table no file declares, or when the exclusions leave no column.
+ */
+export declare function resolveExposeColumns(grants: readonly TableGrant[], files: readonly {
+  readonly text: string;
+}[], schemas: readonly string[]): readonly TableGrant[];
+//#endregion
+//#region src/sql/modules/data-lifecycle-secrets.d.ts
+/** Column names that usually hold a credential, matched case-insensitively. */
+export declare const SECRET_COLUMNS = "token|secret|_hash|password|api_key|license_key";
+/** What doctor needs to tell which columns a data export reads. */
+interface DataExportPlan {
+  /** The listed and module tables an export reads, `schema.table`, with the columns it leaves out. */
+  readonly tables: readonly {
+    readonly name: string;
+    readonly omit: readonly string[];
+  }[];
+  /** `options.autoTables`: the tables in `schemas` with one of `columns`, minus `excluded` and the listed ones. */
+  readonly auto: {
+    readonly schemas: readonly string[];
+    readonly columns: readonly string[];
+    readonly excluded: (name: string) => boolean;
+  } | undefined;
+  /** `options.omitPattern`, resolved. */
+  readonly omitPattern: string | undefined;
+}
+/** The export tables for doctor. Undefined without the `data-lifecycle` module. */
+export declare function dataExportPlan(layout: ModuleLayout, installed: readonly string[]): DataExportPlan | undefined;
+//#endregion
+//#region src/sql/modules/tenant-same.d.ts
+/** The unquoted trigger name `sameTenant` gives `column`, within Postgres' 63 bytes. */
+export declare function sameTenantTrigger(column: string): string;
+/** The tenant column `sameTenant` entries default to: the memberships tenant column. */
+export declare function sameTenantColumn(layout: ModuleLayout): string;
+//#endregion
+//#region src/sql/flag-lifecycle.d.ts
+/**
+ * The flags past their `expires_at`, as doctor reads them: `expires_at` and
+ * `owner` are optional `extraColumns` of the flags table, and an archived
+ * flag is left out. Undefined when the flags module isn't installed or has
+ * no `expires_at` column.
+ */
+export declare function expiredFlagsQuery(layout: ModuleLayout, installed: readonly string[]): string | undefined;
+//#endregion
+//#region src/sql/subject-registry.d.ts
+/** Every column a registry entry names, keyed by the config path that names it. */
+export declare function subjectColumns(entry: SubjectConfig): readonly (readonly [path: string, column: string])[];
+//#endregion
 //#region src/sql/schema-scan.d.ts
 /** Privileges one role gets on a table, from the policies that name it. */
 interface PolicyGrant {
@@ -509,14 +670,14 @@ interface MigrationOptionUse {
   readonly option: string;
   readonly value: unknown;
   readonly adopted: boolean;
-  /** `sql.modules.<module>.options.<option> ... It <effect>.` */
+  /** `blocks.<module>.options.<option> ... It <effect>.` */
   readonly message: string;
 }
 /**
- * The migration-only options `sql.modules` sets to a value other than the managed
+ * The migration-only options `blocks` sets to a value other than the managed
  * default. They are accepted in `adopt` mode only; doctor warns about each.
  */
-export declare function migrationOptionUses(modules?: ModulesConfig): MigrationOptionUse[];
+export declare function migrationOptionUses(modules?: AnyBlocksConfig): MigrationOptionUse[];
 //#endregion
 //#region src/sql/shared-roles.d.ts
 /**
@@ -545,4 +706,4 @@ export declare function compileReadSet(set: ReadSet): Promise<CompiledReadSet>;
 /** Compiles every set, sorted by name. Throws on a duplicate name. */
 export declare function compileReadSets(sets: readonly ReadSet[]): Promise<CompiledReadSet[]>;
 //#endregion
-export { AUDIT_CATEGORIES, type AuditCategory, type AuditedTable, type CompiledReadSet, type InstalledModule, MODULE_ID_TYPES, type MigrationOptionUse, type ModuleAccessProvider, type ModuleAction, type ModuleAudit, type ModuleContext, type ModuleContractFunction, type ModuleDeprecation, type ModuleEmit, type ModuleEntitlementsProvider, type ModuleExtension, type ModuleFile, type ModuleIdType, type ModuleLayout, type ModuleNames, type ModulePermissionKey, type ModuleTableSpec, type ModuleTestFile, type ModuleTopic, type ModuleUpgrade, type ModuleUpgradePlan, type PolicyGrant, type SqlModule, contractSignature, isModuleIdType, moduleIdType };
+export { AUDIT_CATEGORIES, type AdoptedTable, type AuditCategory, type AuditedTable, BLOCK_OPTION_SCHEMAS, type BlockOptionsRegistry, type CompiledReadSet, type DataExportPlan, type DeclaredForeignKey, type InstalledModule, MODULE_ID_TYPES, type MigrationOptionUse, type ModuleAccessProvider, type ModuleAction, type ModuleAudit, type ModuleContext, type ModuleContractFunction, type ModuleDeprecation, type ModuleEmit, type ModuleEntitlementsProvider, type ModuleExtension, type ModuleFile, type ModuleIdType, type ModuleLayout, type ModuleNames, type ModulePermissionKey, type ModuleTableSpec, type ModuleTestFile, type ModuleTopic, type ModuleUpgrade, type ModuleUpgradePlan, type PolicyGrant, type SqlModule, contractSignature, isModuleIdType, moduleIdType, resolveModule };