better-supabase 0.1.0 → 0.3.0

package/dist/testing/index.d.ts

@@ -1,13 +1,15 @@
-import { d as GeneratorInput, u as Generator, v as ResolvedConfig } from "../index-BD6wKthp.js";
-import { E as SchemaMeta, P as Update, h as Insert, k as TableKey, n as AnyModels, t as AnyFunctions } from "../types-C2fslP1z.js";
-import { r as Executor } from "../executor-Bazhgsgq.js";
-import { P as DbStats, l as CacheAdapter, t as BetterSupabase, y as Db } from "../define-CTfWw-SS.js";
-import { h as RequestContext, n as AnyPlugin } from "../plugin-HvGqCurB.js";
-import { t as SqlClient } from "../executor-Bje4suQF.js";
-import { t as Postgres } from "../pool-BFeqzwQS.js";
-import { n as AuthResolver } from "../resolve-DW8h9NPm.js";
-import { r as EventSink, t as CloudEvent } from "../index-DQVvHzjW.js";
+import { A as SchemaMeta, N as TableKey, R as Update, g as Insert, n as AnyModels, t as AnyFunctions } from "../types-DONv9SHN.js";
+import { r as Executor } from "../executor-DynmIWhq.js";
+import { P as DbStats, l as CacheAdapter, t as BetterSupabase, y as Db } from "../define-DUbydmJa.js";
+import { h as RequestContext, n as AnyPlugin } from "../plugin-DVRB8qNE.js";
+import { b as ResolvedConfig, d as Generator, f as GeneratorInput } from "../config-C1CYcm6o.js";
+import "../index-Cf-D2jk1.js";
+import { t as SqlClient } from "../executor-B26lgbHD.js";
+import { r as Postgres } from "../pool-B9qsLyFR.js";
+import { n as AuthResolver } from "../resolve-BRciX2jK.js";
+import { r as EventSink, t as CloudEvent } from "../index-GV77NpRP.js";
 import { SupabaseClient } from "@supabase/supabase-js";
+import { webcrypto } from "node:crypto";
 //#region src/testing/jwt.d.ts
 interface TestJwtClaims {
   readonly sub: string;
@@ -31,13 +33,32 @@ export declare function localAuth(secret: string): AuthResolver;
 interface TestSigner {
   /** Public JWKS; pass as `jwks` to `resolveAuth` / `createServer({ auth: { jwks } })`. */
   readonly jwks: {
-    readonly keys: readonly JsonWebKey[];
+    readonly keys: readonly webcrypto.JsonWebKey[];
   };
   sign(claims: TestJwtClaims): Promise<string>;
 }
+/** A private ES256 JWK, as `better-supabase keys` writes to `supabase/signing_keys.json`. */
+interface SigningJwk extends webcrypto.JsonWebKey {
+  readonly kid: string;
+}
+/**
+ * Signs an ES256 access token with a private JWK, the way the local stack
+ * signs them once `signing_keys_path` is set. Test-only.
+ */
+export declare function signTestJwtWithKey(key: SigningJwk, claims: TestJwtClaims): Promise<string>;
 /** An in-memory ES256 key pair that signs tokens like Supabase Auth's asymmetric keys. */
 export declare function createTestSigner(): Promise<TestSigner>;
 //#endregion
+//#region src/testing/local-key.d.ts
+/**
+ * The key the local stack signs with: the first entry of the file
+ * `better-supabase keys` wrote. `path` defaults to `$SUPABASE_SIGNING_KEYS_PATH`,
+ * then `signing_keys_path` from the nearest `supabase/config.toml`.
+ */
+export declare function localSigningKey(path?: string): Promise<SigningJwk>;
+/** Signs a token with the local stack's ES256 key (see `localSigningKey`). Test-only. */
+export declare function signLocalJwt(claims: TestJwtClaims, path?: string): Promise<string>;
+//#endregion
 //#region src/testing/as-user.d.ts
 /** The local CLI stack's default JWT secret. */
 export declare const LOCAL_JWT_SECRET = "super-secret-jwt-token-with-at-least-32-characters-long";
@@ -46,7 +67,17 @@ interface LocalStack {
   readonly url?: string;
   /** Defaults to `$SUPABASE_PUBLISHABLE_KEY`, then `$SUPABASE_ANON_KEY`. */
   readonly publishableKey?: string;
-  /** Defaults to `$SUPABASE_JWT_SECRET`, then the CLI default. */
+  /**
+   * `ES256` (default) signs with the key `better-supabase keys` wrote, as
+   * the hosted project's asymmetric keys do. `HS256` signs with the shared
+   * JWT secret and only works against a local stack.
+   */
+  readonly alg?: "ES256" | "HS256";
+  /** The private ES256 key. Defaults to the first key in `signingKeysPath`. */
+  readonly signingKey?: SigningJwk;
+  /** Defaults to `$SUPABASE_SIGNING_KEYS_PATH`, then `signing_keys_path` in `supabase/config.toml`. */
+  readonly signingKeysPath?: string;
+  /** For `alg: 'HS256'`. Defaults to `$SUPABASE_JWT_SECRET`, then the CLI default. */
   readonly jwtSecret?: string;
   /** Service-role key for `expectTenantIsolation`; defaults to `$SUPABASE_SECRET_KEY`. */
   readonly secretKey?: string;
@@ -65,10 +96,12 @@ interface TestUser<M extends AnyModels, F extends AnyFunctions, E> {
 }
 /**
  * A test user against the local stack: a signed token and repositories that
- * run as that user, for live RLS tests.
+ * run as that user, for live RLS tests. The token is ES256-signed with the
+ * key from `better-supabase keys`; pass `{ alg: 'HS256' }` for a stack that
+ * still uses the shared JWT secret.
  *
  * ```ts
- * const alice = await asUser(sb, { sub: aliceId, org_id: acme });
+ * const alice = await asUser(sb, { sub: aliceId, tenant_id: acme });
  * expect(await alice.db.customers.count().orThrow()).toBe(3);
  * ```
  */
@@ -247,8 +280,8 @@ interface TenantIsolationOptions<M extends AnyModels> {
  * ```ts
  * await expectTenantIsolation(sb, {
  *   tenants: [
- *     { id: ACME, claims: { sub: alice, org_id: ACME } },
- *     { id: GLOBEX, claims: { sub: bob, org_id: GLOBEX } },
+ *     { id: ACME, claims: { sub: alice, tenant_id: ACME } },
+ *     { id: GLOBEX, claims: { sub: bob, tenant_id: GLOBEX } },
  *   ],
  *   tables: {
  *     tags: {
@@ -291,4 +324,4 @@ export declare function isSeed(value: unknown): value is Seed<unknown>;
  */
 export declare function defineSeed<M extends AnyModels, D, F extends AnyFunctions, E, const S extends SeedFixtures<M>>(sb: BetterSupabase<M, D, F, E>, fixtures: S & ExactSeed<M, S>): Seed<S>;
 //#endregion
-export type { BudgetPage, BudgetResponse, ConformanceCheck, ConformanceReport, DbBudgetExpectation, ExactSeed, IsolationTable, IsolationTables, IsolationTenant, LocalStack, MeasuredRender, Seed, SeedFixtures, TenantIsolationOptions, TestAuthResolverOptions, TestEventSinkOptions, TestExecutorOptions, TestGeneratorOptions, TestJwtClaims, TestPluginOptions, TestSigner, TestUser };
+export type { BudgetPage, BudgetResponse, ConformanceCheck, ConformanceReport, DbBudgetExpectation, ExactSeed, IsolationTable, IsolationTables, IsolationTenant, LocalStack, MeasuredRender, Seed, SeedFixtures, SigningJwk, TenantIsolationOptions, TestAuthResolverOptions, TestEventSinkOptions, TestExecutorOptions, TestGeneratorOptions, TestJwtClaims, TestPluginOptions, TestSigner, TestUser };

package/dist/testing/index.js

@@ -1,20 +1,20 @@
 import { n as dbError } from "../errors-Bl3rkOzo.js";
+import { i as temporalText } from "../temporal-BwshQk0W.js";
+import { t as temporal } from "../temporal-required-CMxeSVPo.js";
 import { i as ok } from "../result-DWXatkd6.js";
-import { t as BetterSupabase } from "../define-QGkq04oe.js";
-import { r as resolveConfig } from "../config-D-aR2ZoN.js";
-import { t as ENV_VARIABLES } from "../env-BEToab0I.js";
-import { n as postgresExecutor } from "../executor-Ceq60hPM.js";
-import { o as toCloudEvents } from "../events-BuzTgn2D.js";
-import { n as isSeed, t as defineSeed } from "../seed-CzecODcJ.js";
+import { t as BetterSupabase } from "../define-DF341GDj.js";
+import { a as toBase64Url, r as fromBase64, t as base64ToText } from "../base64-CQeB1eSf.js";
+import { r as resolveConfig } from "../config-Be4GwsqI.js";
+import { t as isList } from "../guards-BnzDvFrz.js";
+import { ENV_VARIABLES } from "../env/index.js";
+import { n as postgresExecutor } from "../executor-C57jx2pn.js";
+import { toCloudEvents } from "../events/index.js";
 import { createClient } from "@supabase/supabase-js";
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
 //#region src/testing/jwt.ts
 const encoder = new TextEncoder();
-function base64url(input) {
-	const bytes = typeof input === "string" ? encoder.encode(input) : input;
-	let binary = "";
-	for (const byte of bytes) binary += String.fromCharCode(byte);
-	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
-}
 /**
 * Signs an HS256 access token the local Supabase stack accepts. Test-only:
 * production tokens come from Supabase Auth.
@@ -30,21 +30,17 @@ async function signTestJwt(secret, claims) {
 		exp: now + expiresIn,
 		...rest
 	};
-	const header = base64url(JSON.stringify({
+	const header = toBase64Url(JSON.stringify({
 		alg: "HS256",
 		typ: "JWT"
 	}));
-	const body = base64url(JSON.stringify(payload));
+	const body = toBase64Url(JSON.stringify(payload));
 	const key = await crypto.subtle.importKey("raw", encoder.encode(secret), {
 		name: "HMAC",
 		hash: "SHA-256"
 	}, false, ["sign"]);
 	const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(`${header}.${body}`));
-	return `${header}.${body}.${base64url(new Uint8Array(signature))}`;
-}
-function base64urlDecode(input) {
-	const binary = atob(input.replaceAll("-", "+").replaceAll("_", "/"));
-	return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+	return `${header}.${body}.${toBase64Url(new Uint8Array(signature))}`;
 }
 /**
 * Accepts `signTestJwt` tokens as users, for API servers tested against the
@@ -61,9 +57,9 @@ function localAuth(secret) {
 		async resolve(request) {
 			const token = /^Bearer (.+)$/i.exec(request.headers.get("authorization") ?? "")?.[1];
 			const [header, body, signature] = token?.split(".") ?? [];
-			if (!token || !header || !body || !signature) return void 0;
-			if (!await crypto.subtle.verify("HMAC", await key, base64urlDecode(signature), encoder.encode(`${header}.${body}`)).catch(() => false)) return void 0;
-			const claims = JSON.parse(new TextDecoder().decode(base64urlDecode(body)));
+			if (!token || !header || !body || !signature) return;
+			if (!await crypto.subtle.verify("HMAC", await key, fromBase64(signature), encoder.encode(`${header}.${body}`)).catch(() => false)) return;
+			const claims = JSON.parse(base64ToText(body));
 			if (typeof claims.exp === "number" && claims.exp * 1e3 < Date.now()) return {
 				kind: "invalid",
 				error: dbError("unauthorized", "The token has expired")
@@ -83,6 +79,40 @@ function localAuth(secret) {
 		}
 	};
 }
+async function signEs256(key, kid, claims) {
+	const { expiresIn = 3600, ...rest } = claims;
+	const now = Math.floor(Date.now() / 1e3);
+	const payload = {
+		aud: "authenticated",
+		role: "authenticated",
+		aal: "aal1",
+		iat: now,
+		exp: now + expiresIn,
+		...rest
+	};
+	const header = toBase64Url(JSON.stringify({
+		alg: "ES256",
+		typ: "JWT",
+		kid
+	}));
+	const body = toBase64Url(JSON.stringify(payload));
+	const signature = await crypto.subtle.sign({
+		name: "ECDSA",
+		hash: "SHA-256"
+	}, key, encoder.encode(`${header}.${body}`));
+	return `${header}.${body}.${toBase64Url(new Uint8Array(signature))}`;
+}
+/**
+* Signs an ES256 access token with a private JWK, the way the local stack
+* signs them once `signing_keys_path` is set. Test-only.
+*/
+async function signTestJwtWithKey(key, claims) {
+	const { kid, ...jwk } = key;
+	return signEs256(await crypto.subtle.importKey("jwk", jwk, {
+		name: "ECDSA",
+		namedCurve: "P-256"
+	}, false, ["sign"]), kid, claims);
+}
 /** An in-memory ES256 key pair that signs tokens like Supabase Auth's asymmetric keys. */
 async function createTestSigner() {
 	const pair = await crypto.subtle.generateKey({
@@ -97,32 +127,44 @@ async function createTestSigner() {
 			alg: "ES256",
 			use: "sig"
 		}] },
-		async sign(claims) {
-			const { expiresIn = 3600, ...rest } = claims;
-			const now = Math.floor(Date.now() / 1e3);
-			const payload = {
-				aud: "authenticated",
-				role: "authenticated",
-				aal: "aal1",
-				iat: now,
-				exp: now + expiresIn,
-				...rest
-			};
-			const header = base64url(JSON.stringify({
-				alg: "ES256",
-				typ: "JWT",
-				kid
-			}));
-			const body = base64url(JSON.stringify(payload));
-			const signature = await crypto.subtle.sign({
-				name: "ECDSA",
-				hash: "SHA-256"
-			}, pair.privateKey, encoder.encode(`${header}.${body}`));
-			return `${header}.${body}.${base64url(new Uint8Array(signature))}`;
-		}
+		sign: (claims) => signEs256(pair.privateKey, kid, claims)
 	};
 }
 //#endregion
+//#region src/testing/local-key.ts
+const SIGNING_KEYS_PATH = /^\s*signing_keys_path\s*=\s*"([^"]+)"/m;
+/** `supabase/config.toml`'s `signing_keys_path`, else `supabase/signing_keys.json`, in `from` or a parent. */
+async function findSigningKeys(from) {
+	for (let dir = resolve(from);; dir = dirname(dir)) {
+		const supabase = join(dir, "supabase");
+		const toml = join(supabase, "config.toml");
+		if (existsSync(toml)) {
+			const configured = SIGNING_KEYS_PATH.exec(await readFile(toml, "utf8"))?.[1];
+			const path = resolve(supabase, configured ?? "signing_keys.json");
+			if (existsSync(path)) return path;
+		}
+		if (dirname(dir) === dir) return void 0;
+	}
+}
+const isSigningKey = (value) => typeof value === "object" && value !== null && "kid" in value && typeof value.kid === "string" && "d" in value && typeof value.d === "string";
+/**
+* The key the local stack signs with: the first entry of the file
+* `better-supabase keys` wrote. `path` defaults to `$SUPABASE_SIGNING_KEYS_PATH`,
+* then `signing_keys_path` from the nearest `supabase/config.toml`.
+*/
+async function localSigningKey(path) {
+	const file = path ?? process.env["SUPABASE_SIGNING_KEYS_PATH"] ?? await findSigningKeys(process.cwd());
+	if (!file || !existsSync(file)) throw new TypeError("No local signing key. Run `better-supabase keys`, set `signing_keys_path` in supabase/config.toml and restart the stack, or pass { alg: \"HS256\" } to sign with the local JWT secret.");
+	const keys = JSON.parse(await readFile(file, "utf8"));
+	const first = Array.isArray(keys) ? keys[0] : void 0;
+	if (!isSigningKey(first)) throw new TypeError(`${file} has no private ES256 key first.`);
+	return first;
+}
+/** Signs a token with the local stack's ES256 key (see `localSigningKey`). Test-only. */
+async function signLocalJwt(claims, path) {
+	return signTestJwtWithKey(await localSigningKey(path), claims);
+}
+//#endregion
 //#region src/testing/as-user.ts
 /** The local CLI stack's default JWT secret. */
 const LOCAL_JWT_SECRET = "super-secret-jwt-token-with-at-least-32-characters-long";
@@ -133,12 +175,30 @@ function env$1(...names) {
 		if (value) return value;
 	}
 }
+const LOCAL_HOSTS = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]",
+	"host.docker.internal"
+]);
+async function signFor(stack, url, claims) {
+	const alg = stack.alg ?? "ES256";
+	switch (alg) {
+		case "ES256": return signTestJwtWithKey(stack.signingKey ?? await localSigningKey(stack.signingKeysPath), claims);
+		case "HS256":
+			if (!LOCAL_HOSTS.has(new URL(url).hostname)) throw new TypeError(`asUser signs HS256 tokens only for a local stack, not ${url}. Use the ES256 key from \`better-supabase keys\`.`);
+			return signTestJwt(stack.jwtSecret ?? env$1("SUPABASE_JWT_SECRET") ?? "super-secret-jwt-token-with-at-least-32-characters-long", claims);
+		default: throw new TypeError(`asUser: unknown alg "${String(alg)}"`);
+	}
+}
 /**
 * A test user against the local stack: a signed token and repositories that
-* run as that user, for live RLS tests.
+* run as that user, for live RLS tests. The token is ES256-signed with the
+* key from `better-supabase keys`; pass `{ alg: 'HS256' }` for a stack that
+* still uses the shared JWT secret.
 *
 * ```ts
-* const alice = await asUser(sb, { sub: aliceId, org_id: acme });
+* const alice = await asUser(sb, { sub: aliceId, tenant_id: acme });
 * expect(await alice.db.customers.count().orThrow()).toBe(3);
 * ```
 */
@@ -146,7 +206,7 @@ async function asUser(sb, claims, stack = {}) {
 	const url = stack.url ?? env$1(...ENV_VARIABLES.url) ?? "http://127.0.0.1:54321";
 	const publishableKey = stack.publishableKey ?? env$1(...ENV_VARIABLES.publishableKey, "SUPABASE_ANON_KEY");
 	if (!publishableKey) throw new TypeError("asUser needs publishableKey or $SUPABASE_PUBLISHABLE_KEY. Run `better-supabase env` to write it to .env.local.");
-	const token = await signTestJwt(stack.jwtSecret ?? env$1("SUPABASE_JWT_SECRET") ?? "super-secret-jwt-token-with-at-least-32-characters-long", claims);
+	const token = await signFor(stack, url, claims);
 	const full = {
 		role: "authenticated",
 		...claims
@@ -179,7 +239,9 @@ function settle(promise, ms) {
 	let timer;
 	return Promise.race([promise, new Promise((done) => {
 		timer = setTimeout(done, ms);
-	})]).finally(() => clearTimeout(timer));
+	})]).finally(() => {
+		clearTimeout(timer);
+	});
 }
 /**
 * Measures every document and RSC navigation response during `during` and
@@ -299,7 +361,9 @@ function tableKey(sb, table) {
 	if (!key || !(key in sb.meta.tables)) throw new TypeError(`better-supabase: unknown table "${String(key)}"`);
 	return key;
 }
-const hasName = (subject) => ["has a name", () => expect(typeof subject.name === "string" && subject.name.length > 0, "name must be a non-empty string")];
+const hasName = (subject) => ["has a name", () => {
+	expect(typeof subject.name === "string" && subject.name.length > 0, "name must be a non-empty string");
+}];
 /**
 * Proves an `Executor` meets the contract: rows keyed by the selection's
 * aliases, counts, `aborted` errors, failures returned as `Result`s rather
@@ -313,7 +377,7 @@ function testExecutor(executor, options) {
 	const { sb } = options;
 	const table = tableKey(sb, options.table);
 	const context = { errorMappers: [] };
-	const read = () => captureOp(sb, (db) => db[table].findMany({ limit: 2 }));
+	const read = () => captureOp(sb, (db) => db[table]["findMany"]({ limit: 2 }));
 	const create = options.create;
 	return conform(`Executor "${executor.name}"`, [
 		hasName(executor),
@@ -321,7 +385,7 @@ function testExecutor(executor, options) {
 			const op = await read();
 			const result = await executor.execute(op, context);
 			expect(result.ok, `select failed: ${result.ok ? "" : result.error.message}`);
-			expect(Array.isArray(result.data.rows), "rows must be an array");
+			expect(isList(result.data.rows), "rows must be an array");
 			expect(result.data.rows.length <= 2, `limit 2 returned ${result.data.rows.length} rows`);
 			expect(result.data.count === null || typeof result.data.count === "number", "count must be a number or null");
 			if (op.kind !== "select") return;
@@ -332,7 +396,7 @@ function testExecutor(executor, options) {
 			}
 		}],
 		["counts rows", async () => {
-			const op = await captureOp(sb, (db) => db[table].count());
+			const op = await captureOp(sb, (db) => db[table]["count"]());
 			const result = await executor.execute(op, context);
 			expect(result.ok, `count failed: ${result.ok ? "" : result.error.message}`);
 			expect(typeof result.data.count === "number" && result.data.count >= 0, "count must be a number");
@@ -380,7 +444,7 @@ function testExecutor(executor, options) {
 		}],
 		executor.batch && ["batch returns one result per operation, in order", async () => {
 			const rows = await read();
-			const count = await captureOp(sb, (db) => db[table].count());
+			const count = await captureOp(sb, (db) => db[table]["count"]());
 			const missing = {
 				...rows,
 				table: {
@@ -401,15 +465,15 @@ function testExecutor(executor, options) {
 		}],
 		create && ["round-trips a write", async () => {
 			const repository = sb.connect(executor)[table];
-			const created = await repository.create(create);
+			const created = await repository["create"](create);
 			expect(created.ok, `create failed: ${JSON.stringify(created.error)}`);
 			const row = created.data;
 			for (const [key, value] of Object.entries(create)) expect(same(row[key], value), `created row has ${key} = ${JSON.stringify(row[key])}`);
 			const [primary] = sb.meta.tables[table].primaryKey;
 			expect(primary, "write checks need a table with a primary key");
-			const removed = await repository.delete(row[primary]);
+			const removed = await repository["delete"](row[primary]);
 			expect(removed.ok, `delete failed: ${JSON.stringify(removed.error)}`);
-			const again = await repository.findFirst({ where: { [primary]: row[primary] } });
+			const again = await repository["findFirst"]({ where: { [primary]: row[primary] } });
 			expect(again.ok && again.data === null, "the deleted row is still readable");
 		}]
 	]);
@@ -557,7 +621,7 @@ function testGenerator(generator, options) {
 		hasName(generator),
 		["writes files inside the project", async () => {
 			const files = await generator.generate(input());
-			expect(Array.isArray(files), "generate() must return an array");
+			expect(isList(files), "generate() must return an array");
 			for (const file of files) {
 				expect(typeof file.path === "string" && typeof file.contents === "string", "files need a path and contents");
 				expect(!file.path.startsWith("/") && !/^[A-Za-z]:/.test(file.path), `${file.path} must be relative`);
@@ -587,25 +651,27 @@ function testPlugin(plugin, options) {
 		schema: sb.meta,
 		context,
 		options: {},
-		now: () => /* @__PURE__ */ new Date(0)
+		now: () => temporal().Instant.fromEpochMilliseconds(0)
 	});
 	const create = options.create;
 	return conform(`Plugin "${plugin.name}"`, [
 		hasName(plugin),
-		["targets plugin API v1", () => expect(plugin.apiVersion === 1, `apiVersion is ${String(plugin.apiVersion)}`)],
+		["targets plugin API v1", () => {
+			expect(plugin.apiVersion === 1, `apiVersion is ${String(plugin.apiVersion)}`);
+		}],
 		["installs and builds repositories", () => {
 			const db = sb.use(plugin).connect(recorder([]), context);
 			for (const key of Object.keys(sb.meta.tables)) expect(db[key], `db.${key} is missing`);
 		}],
 		plugin.transformQuery && ["transformQuery is pure and deterministic", async () => {
-			const op = await captureOp(sb, (db) => db[table].findMany({ limit: 1 }));
+			const op = await captureOp(sb, (db) => db[table]["findMany"]({ limit: 1 }));
 			const first = plugin.transformQuery(frozenCopy(op), hook(op));
 			const second = plugin.transformQuery(frozenCopy(op), hook(op));
 			expect(typeof first === "object" && first !== null && first.kind === op.kind, "must return an operation of the same kind");
 			expect(same(first, second), "two calls with the same input differ");
 		}],
 		plugin.beforeMutation && create && ["beforeMutation is pure and deterministic", async () => {
-			const op = await captureOp(sb, (db) => db[table].create(create));
+			const op = await captureOp(sb, (db) => db[table]["create"](create));
 			if (op.kind === "select") throw new Violation("create did not produce a mutation");
 			const first = await plugin.beforeMutation(frozenCopy(op), hook(op));
 			const second = await plugin.beforeMutation(frozenCopy(op), hook(op));
@@ -613,7 +679,7 @@ function testPlugin(plugin, options) {
 			expect(same(first, second), "two calls with the same input differ");
 		}],
 		plugin.wrapExecutor && ["wrapExecutor keeps results intact", async () => {
-			const op = await captureOp(sb, (db) => db[table].findMany({ limit: 1 }));
+			const op = await captureOp(sb, (db) => db[table]["findMany"]({ limit: 1 }));
 			const data = {
 				rows: [{ marker: "conformance" }],
 				count: 1
@@ -664,8 +730,8 @@ function env(names) {
 * ```ts
 * await expectTenantIsolation(sb, {
 *   tenants: [
-*     { id: ACME, claims: { sub: alice, org_id: ACME } },
-*     { id: GLOBEX, claims: { sub: bob, org_id: GLOBEX } },
+*     { id: ACME, claims: { sub: alice, tenant_id: ACME } },
+*     { id: GLOBEX, claims: { sub: bob, tenant_id: GLOBEX } },
 *   ],
 *   tables: {
 *     tags: {
@@ -748,4 +814,105 @@ async function expectTenantIsolation(sb, options) {
 	}
 }
 //#endregion
-export { ConformanceError, LOCAL_JWT_SECRET, asUser, createTestSigner, defineSeed, expectDbBudget, expectTenantIsolation, isSeed, localAuth, signTestJwt, testAuthResolver, testCacheAdapter, testEventSink, testExecutor, testGenerator, testPlugin };
+//#region src/testing/seed.ts
+const SEED = Symbol.for("better-supabase.seed");
+function isSeed(value) {
+	return typeof value === "object" && value !== null && SEED in value;
+}
+const quote = (text) => `'${text.replaceAll("'", "''")}'`;
+function arrayLiteral(values) {
+	return `{${values.map((value) => {
+		if (value === null) return "NULL";
+		if (Array.isArray(value)) return arrayLiteral(value);
+		return `"${(temporalText(value) ?? String(value)).replaceAll(/[\\"]/g, "\\$&")}"`;
+	}).join(",")}}`;
+}
+function literal(value, column, where) {
+	if (value === null) return "null";
+	if (column.json) return quote(JSON.stringify(value));
+	if (Array.isArray(value)) return quote(arrayLiteral(value));
+	const temporalValue = temporalText(value);
+	if (temporalValue !== void 0) return quote(temporalValue);
+	const kind = typeof value;
+	switch (kind) {
+		case "string": return quote(value);
+		case "boolean":
+		case "bigint": return String(value);
+		case "number":
+			if (!Number.isFinite(value)) throw new TypeError(`${where}: ${String(value)} is not a finite number`);
+			return String(value);
+		case "object":
+		case "function":
+		case "symbol":
+		case "undefined": throw new TypeError(`${where}: unsupported value of type ${kind}`);
+		default: throw new TypeError(`${where}: unsupported value of type ${String(kind)}`);
+	}
+}
+const ident = (name) => `"${name.replaceAll("\"", "\"\"")}"`;
+/** Parents first (by forward relations), otherwise in the order given. */
+function order(meta, keys) {
+	const sorted = [];
+	const visiting = /* @__PURE__ */ new Set();
+	const visit = (key) => {
+		if (sorted.includes(key) || visiting.has(key)) return;
+		visiting.add(key);
+		for (const relation of Object.values(meta.tables[key]?.relations ?? {})) if (relation.direction === "forward" && relation.table !== key && keys.includes(relation.table)) visit(relation.table);
+		visiting.delete(key);
+		sorted.push(key);
+	};
+	for (const key of keys) visit(key);
+	return sorted;
+}
+function statement(table, rows) {
+	const entries = Object.entries(rows);
+	if (entries.length === 0) return void 0;
+	const columns = [];
+	for (const [, row] of entries) for (const [key, value] of Object.entries(row)) {
+		if (value === void 0 || columns.includes(key)) continue;
+		const column = table.columns[key];
+		if (!column) throw new TypeError(`seed ${table.key}: unknown column "${key}"`);
+		if (column.generated) throw new TypeError(`seed ${table.key}: "${key}" is a generated column`);
+		columns.push(key);
+	}
+	const values = entries.map(([name, row]) => {
+		return `  (${columns.map((key) => row[key] === void 0 ? "default" : literal(row[key], table.columns[key], `seed ${table.key}.${name}.${key}`)).join(", ")})`;
+	});
+	return `insert into ${`${ident(table.schema)}.${ident(table.name)}`} (${columns.map((key) => ident(table.columns[key].db)).join(", ")}) values\n${values.join(",\n")}\non conflict do nothing;`;
+}
+/**
+* Typed fixtures shared by `supabase/seeds` and your tests. Rows use app
+* casing and Insert types; `better-supabase seed` renders them to SQL.
+*
+* ```ts
+* export const seed = defineSeed(sb, {
+*   organizations: { acme: { id: ACME, name: 'Acme' } },
+*   customers: { first: { organizationId: ACME, name: 'First customer' } },
+* });
+* ```
+*/
+function defineSeed(sb, fixtures) {
+	const meta = sb.meta;
+	const statements = () => {
+		const keys = Object.keys(fixtures).filter((key) => fixtures[key] !== void 0);
+		for (const key of keys) {
+			const table = meta.tables[key];
+			if (!table) throw new TypeError(`seed: unknown table "${key}"`);
+			if (table.kind === "view") throw new TypeError(`seed: "${key}" is a view`);
+		}
+		return order(meta, keys).flatMap((key) => {
+			const sql = statement(meta.tables[key], fixtures[key]);
+			return sql ? [sql] : [];
+		});
+	};
+	return {
+		[SEED]: true,
+		rows: fixtures,
+		statements,
+		sql: () => statements().join("\n\n"),
+		async insert(sql) {
+			for (const text of statements()) await sql.queryRaw(text);
+		}
+	};
+}
+//#endregion
+export { ConformanceError, LOCAL_JWT_SECRET, asUser, createTestSigner, defineSeed, expectDbBudget, expectTenantIsolation, isSeed, localAuth, localSigningKey, signLocalJwt, signTestJwt, signTestJwtWithKey, testAuthResolver, testCacheAdapter, testEventSink, testExecutor, testGenerator, testPlugin };