better-supabase 0.12.0 → 0.13.0

package/dist/testing/index.d.ts

@@ -1,37 +1,38 @@
-import { B as TableKey, F as SchemaMeta, G as Update, N as Row, S as Insert, a as AnyModels, i as AnyFunctions } from "../types-BrpW5ixT.js";
-import { r as Executor } from "../executor-BnMC0lj3.js";
-import { m as RequestContext, n as AnyPlugin } from "../plugin-D-95Q0w0.js";
-import { c as InlineJwks, t as BetterSupabaseEnv } from "../index-CxmVzT-3.js";
-import { n as AuthResolver } from "../resolve-Ceft-18-.js";
-import { a as CredentialSubject, i as CredentialRef, r as CredentialProvider } from "../provider-DXgx5oSA.js";
-import { n as SqlClient } from "../executor-D1hECPGG.js";
-import { a as BlockTransportMiddleware } from "../block-hooks-DcPJHztl.js";
-import { a as SessionActor, o as SessionDelegation } from "../actor-BAhb-d1S.js";
-import { M as QueueBackend } from "../types-BEEFkNFY.js";
-import { n as Embedder } from "../knowledge-B5zdpDD-.js";
-import { a as AuthorizationProvider } from "../authorization-ClWBcXJi.js";
-import { o as StreamStore } from "../store-B18bIvKc.js";
-import { t as ApiModel } from "../model-lUafmeBQ.js";
-import { l as VersionOf, t as AnyDocumentFormat } from "../format-CNwSjXUU.js";
-import { o as Authorizer } from "../authorizer-eiOjo-3l.js";
-import { i as EventSink, t as CloudEvent } from "../cloud-event-DXkNoI6v.js";
-import { Wt as DbStats, _ as Db, s as CacheAdapter, t as BetterSupabase } from "../define-DYZnvAbs.js";
-import { n as Impersonator } from "../impersonation-D5chOkrO.js";
-import { i as AuthorizationHooks } from "../authorization-hooks-WDQMKIsc.js";
-import { t as BetterPostgres } from "../pool-cM3rpOQr.js";
-import { B as SupportSessionStore, a as ServerContext, c as ServerOptions } from "../server-types-fLdep4gb.js";
-import { r as GuardOptions } from "../respond-BSL36dQp.js";
-import { n as Controller } from "../controller-BZhiIb-N.js";
-import { i as AiTaskRun, o as AiTaskRunner, t as AiTask } from "../ai-tasks-ZvPnNudQ.js";
-import { r as WebhookInput } from "../signatures-BXlDXV3D.js";
-import { n as Money } from "../money-DFpWzQvk.js";
-import { a as Generator, c as GeneratorModel, s as GeneratorInput, x as ResolvedConfig } from "../codegen-C64C0NZG.js";
-import { t as NotificationChannel } from "../channel-D-LHCY11.js";
-import { a as DeliveryTransport } from "../delivery-BeHgwS3k.js";
-import { C as PaymentProvider, l as TaxProvider, r as TaxAddress, y as Payment } from "../tax-DMWDUzKt.js";
-import { B as WorkflowGraph, c as GraphCompiler, i as BuilderStarter, r as BuilderStartCall } from "../types-Bels39_u.js";
-import { O as IncomingDestination, f as WebhookSecretStore, o as WebhookSigner, v as WebhookTransport } from "../signers-BwKV-9S6.js";
-import { t as EveDocumentBackend } from "../eve-B6ru2Bt4.js";
+import { B as TableKey, F as SchemaMeta, G as Update, N as Row, S as Insert, a as AnyModels, i as AnyFunctions } from "../types-DmshMaXz.js";
+import { r as Executor } from "../executor-C29668fO.js";
+import { o as EventHub } from "../events-DhGgwqQA.js";
+import { m as RequestContext, n as AnyPlugin } from "../plugin-DouW0Kvg.js";
+import { c as InlineJwks, t as BetterSupabaseEnv } from "../index-NRMMhhEi.js";
+import { n as AuthResolver } from "../resolve-D57oDWNr.js";
+import { a as CredentialSubject, i as CredentialRef, r as CredentialProvider } from "../provider-Dmsbl8ug.js";
+import { n as SqlClient } from "../executor-DXfgDsKd.js";
+import { a as BlockTransportMiddleware } from "../block-hooks-BadAniNI.js";
+import { a as SessionActor, o as SessionDelegation } from "../actor-CoveJgya.js";
+import { M as QueueBackend } from "../types-CB5MvzuE.js";
+import { n as Embedder } from "../knowledge-CYdNJasZ.js";
+import { a as AuthorizationProvider } from "../authorization-CB69cvnA.js";
+import { o as StreamStore } from "../store-DKqbuNvw.js";
+import { t as ApiModel } from "../model-Btl8X9cs.js";
+import { l as VersionOf, t as AnyDocumentFormat } from "../format-AYHceC2m.js";
+import { o as Authorizer } from "../authorizer-DFP3gHv8.js";
+import { i as EventSink, t as CloudEvent } from "../cloud-event-CidL9jiw.js";
+import { Lt as DbStats, Ut as CacheAdapter, o as Db, t as BetterSupabase } from "../define-D0LSXmUP.js";
+import { n as Impersonator } from "../impersonation-YTa9dZUv.js";
+import { i as AuthorizationHooks } from "../authorization-hooks-HXVZXxUk.js";
+import { s as SqlClaims, t as BetterPostgres } from "../pool-Bu8zXGzI.js";
+import { B as SupportSessionStore, a as ServerContext, c as ServerOptions } from "../server-types-D_cQ6OxZ.js";
+import { r as GuardOptions } from "../respond-QW-f1yio.js";
+import { n as Controller } from "../controller-lWRcKqCl.js";
+import { i as AiTaskRun, o as AiTaskRunner, t as AiTask } from "../ai-tasks-DN-AV7qB.js";
+import { r as WebhookInput } from "../signatures-CzqfLlfV.js";
+import { n as Money } from "../money-BNRdJQzA.js";
+import { a as Generator, c as GeneratorModel, s as GeneratorInput, x as ResolvedConfig } from "../codegen-DGtOsqz9.js";
+import { t as NotificationChannel } from "../channel-BjvGO39m.js";
+import { a as DeliveryTransport } from "../delivery-n6lZGuGx.js";
+import { C as PaymentProvider, l as TaxProvider, r as TaxAddress, y as Payment } from "../tax-BHSCb5Rw.js";
+import { B as WorkflowGraph, c as GraphCompiler, i as BuilderStarter, r as BuilderStartCall } from "../types-vVsLvOUJ.js";
+import { O as IncomingDestination, f as WebhookSecretStore, o as WebhookSigner, v as WebhookTransport } from "../signers-BuVQKDfK.js";
+import { t as EveDocumentBackend } from "../eve-dWNqpd9Z.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { Message, StateAdapter } from "chat";
 import { webcrypto } from "node:crypto";
@@ -51,35 +52,49 @@ interface TestJwtClaims {
 export declare function signTestJwt(secret: string, claims: TestJwtClaims): Promise<string>;
 /**
  * Accepts `signTestJwt` tokens as users, for API servers tested against the
- * local stack: `createServer(betterSupabase, { auth: { resolvers: [localAuth(secret)] } })`.
- * Tokens that are not HS256-signed with `secret` fall through. Test-only.
+ * local stack: `createServer(betterSupabase, { auth: { resolvers:
+ * [localAuth(secret)] } })`. Tokens that are not HS256-signed with `secret`
+ * fall through. Test-only.
  */
 export declare function localAuth(secret: string): AuthResolver;
 interface TestSigner {
-  /** Public JWKS; pass as `jwks` to `resolveAuth` / `createServer({ auth: { jwks } })`. */
+  /**
+   * Public JWKS; pass as `jwks` to `resolveAuth` / `createServer({ auth: { jwks
+   * } })`.
+   */
   readonly jwks: InlineJwks;
   sign(claims: TestJwtClaims): Promise<string>;
 }
-/** A private ES256 JWK, as `better-supabase keys` writes to `supabase/signing_keys.json`. */
+/**
+ * A private ES256 JWK, as `better-supabase keys` writes to
+ * `supabase/signing_keys.json`.
+ */
 interface SigningJwk extends webcrypto.JsonWebKey {
   readonly kid: string;
 }
 /**
- * Signs an ES256 access token with a private JWK, the way the local stack
- * signs them once `signing_keys_path` is set. Test-only.
+ * Signs an ES256 access token with a private JWK, the way the local stack signs
+ * them once `signing_keys_path` is set. Test-only.
  */
 export declare function signTestJwtWithKey(key: SigningJwk, claims: TestJwtClaims): Promise<string>;
-/** An in-memory ES256 key pair that signs tokens like Supabase Auth's asymmetric keys. */
+/**
+ * An in-memory ES256 key pair that signs tokens like Supabase Auth's asymmetric
+ * keys.
+ */
 export declare function createTestSigner(): Promise<TestSigner>;
 //#endregion
 //#region src/testing/local-key.d.ts
 /**
  * The key the local stack signs with: the first entry of the file
- * `better-supabase keys` wrote. `path` defaults to `$SUPABASE_SIGNING_KEYS_PATH`,
- * then `signing_keys_path` from the nearest `supabase/config.toml`.
+ * `better-supabase keys` wrote. `path` defaults to
+ * `$SUPABASE_SIGNING_KEYS_PATH`, then `signing_keys_path` from the nearest
+ * `supabase/config.toml`.
  */
 export declare function localSigningKey(path?: string): Promise<SigningJwk>;
-/** Signs a token with the local stack's ES256 key (see `localSigningKey`). Test-only. */
+/**
+ * Signs a token with the local stack's ES256 key (see `localSigningKey`).
+ * Test-only.
+ */
 export declare function signLocalJwt(claims: TestJwtClaims, path?: string): Promise<string>;
 //#endregion
 //#region src/testing/as-user.d.ts
@@ -91,27 +106,35 @@ interface LocalStack {
   /** Defaults to `$SUPABASE_PUBLISHABLE_KEY`, then `$SUPABASE_ANON_KEY`. */
   readonly publishableKey?: string;
   /**
-   * `ES256` (default) signs with the key `better-supabase keys` wrote, as
-   * the hosted project's asymmetric keys do. `HS256` signs with the shared
-   * JWT secret and only works against a local stack.
+   * `ES256` (default) signs with the key `better-supabase keys` wrote, as the
+   * hosted project's asymmetric keys do. `HS256` signs with the shared JWT
+   * secret and only works against a local stack.
    */
   readonly alg?: "ES256" | "HS256";
   /** The private ES256 key. Defaults to the first key in `signingKeysPath`. */
   readonly signingKey?: SigningJwk;
-  /** Defaults to `$SUPABASE_SIGNING_KEYS_PATH`, then `signing_keys_path` in `supabase/config.toml`. */
+  /**
+   * Defaults to `$SUPABASE_SIGNING_KEYS_PATH`, then `signing_keys_path` in
+   * `supabase/config.toml`.
+   */
   readonly signingKeysPath?: string;
-  /** For `alg: 'HS256'`. Defaults to `$SUPABASE_JWT_SECRET`, then the CLI default. */
+  /**
+   * For `alg: 'HS256'`. Defaults to `$SUPABASE_JWT_SECRET`, then the CLI
+   * default.
+   */
   readonly jwtSecret?: string;
-  /** Service-role key for `expectTenantIsolation`; defaults to `$SUPABASE_SECRET_KEY`. */
+  /**
+   * Service-role key for `expectTenantIsolation`; defaults to
+   * `$SUPABASE_SECRET_KEY`.
+   */
   readonly secretKey?: string;
   /** Enables `sql`: the same user over direct Postgres. */
   readonly postgres?: BetterPostgres;
   /** `fetch` for the user's supabase-js client, e.g. `liteStack().fetch`. */
   readonly fetch?: typeof fetch;
   /**
-   * supabase-js warns when its trace propagation option is on and the
-   * runtime has no OpenTelemetry. Test users switch it off; set `true` to
-   * keep it.
+   * Supabase-js warns when its trace propagation option is on and the runtime
+   * has no OpenTelemetry. Test users switch it off; set `true` to keep it.
    */
   readonly tracePropagation?: boolean;
 }
@@ -123,7 +146,7 @@ interface TestUser<M extends AnyModels, F extends AnyFunctions, E> {
    * that call a command or handler directly with `{ supabase, db, context }`.
    */
   readonly context: RequestContext;
-  /** supabase-js signed in as the user (storage, realtime, functions). */
+  /** Supabase-js signed in as the user (storage, realtime, functions). */
   readonly supabase: SupabaseClient;
   /** Repositories over PostgREST as the user; RLS applies. */
   readonly db: Db<M, F, E, SupabaseClient>;
@@ -131,13 +154,16 @@ interface TestUser<M extends AnyModels, F extends AnyFunctions, E> {
   readonly sql: Db<M, F, E, unknown> | undefined;
 }
 /**
- * A test user against the local stack: a signed token and repositories that
- * run as that user, for live RLS tests. The token is ES256-signed with the
- * key from `better-supabase keys`; pass `{ alg: 'HS256' }` for a stack that
- * still uses the shared JWT secret.
+ * A test user against the local stack: a signed token and repositories that run
+ * as that user, for live RLS tests. The token is ES256-signed with the key from
+ * `better-supabase keys`; pass `{ alg: 'HS256' }` for a stack that still uses
+ * the shared JWT secret.
  *
  * ```ts
- * const alice = await asUser(betterSupabase, { sub: aliceId, tenant_id: acme });
+ * const alice = await asUser(betterSupabase, {
+ *   sub: aliceId,
+ *   tenant_id: acme,
+ * });
  * expect(await alice.db.customers.count().orThrow()).toBe(3);
  * ```
  */
@@ -146,14 +172,20 @@ export declare function asUser<M extends AnyModels, D, F extends AnyFunctions, E
 //#region src/testing/lite.d.ts
 interface LiteStackOptions {
   /**
-   * `sqlite-postgres` (default) stores data in in-memory SQLite and
-   * translates your Postgres SQL, as `lite init` does. `pglite` runs real
-   * Postgres in-process, with `rpc()` and `DEFAULT auth.uid()`.
+   * `sqlite-postgres` (default) stores data in in-memory SQLite and translates
+   * your Postgres SQL, as `lite init` does. `pglite` runs real Postgres
+   * in-process, with `rpc()` and `DEFAULT auth.uid()`.
    */
   readonly driver?: "sqlite-postgres" | "pglite";
-  /** Migration SQL, applied in order before `schemas`. DDL only; put rows in `seed`. */
+  /**
+   * Migration SQL, applied in order before `schemas`. DDL only; put rows in
+   * `seed`.
+   */
   readonly migrations?: readonly string[];
-  /** Declarative schema SQL (`supabase/schemas/*.sql`), applied after `migrations`. */
+  /**
+   * Declarative schema SQL (`supabase/schemas/*.sql`), applied after
+   * `migrations`.
+   */
   readonly schemas?: readonly string[];
   /** Seed SQL, run after the schema as the database owner (RLS does not apply). */
   readonly seed?: string | readonly string[];
@@ -166,26 +198,37 @@ interface LiteStack extends AsyncDisposable {
   readonly publishableKey: string;
   readonly secretKey: string;
   readonly jwtSecret: string;
-  /** Routes requests to the in-process Lite app. Pass it as `fetch` to `createServer`. */
+  /**
+   * Routes requests to the in-process Lite app. Pass it as `fetch` to
+   * `createServer`.
+   */
   readonly fetch: typeof globalThis.fetch;
-  /** The settings `createServer(betterSupabase, { env, backend: "lite", fetch })` takes. */
+  /**
+   * The settings `createServer(betterSupabase, { env, backend: "lite", fetch
+   * })` takes.
+   */
   readonly env: BetterSupabaseEnv;
-  /** supabase-js with the publishable key, as an anonymous caller. */
+  /** Supabase-js with the publishable key, as an anonymous caller. */
   readonly supabase: SupabaseClient;
-  /** supabase-js with the secret key: bypasses RLS, for setup. */
+  /** Supabase-js with the secret key: bypasses RLS, for setup. */
   readonly admin: SupabaseClient;
-  /** A user with an HS256 token, as `asUser` signs it, whose clients route through `fetch`. */
+  /**
+   * A user with an HS256 token, as `asUser` signs it, whose clients route
+   * through `fetch`.
+   */
   asUser<M extends AnyModels, D, F extends AnyFunctions, E>(betterSupabase: BetterSupabase<M, D, F, E>, claims: TestJwtClaims): Promise<TestUser<M, F, E>>;
   /** Closes the database. */
   close(): Promise<void>;
 }
 /**
  * Supabase Lite in this process, for tests without Docker: an in-memory
- * database with your schema, Auth with fresh API keys, and supabase-js
- * clients whose requests go straight to Lite's `fetch` handler (no port).
+ * database with your schema, Auth with fresh API keys, and supabase-js clients
+ * whose requests go straight to Lite's `fetch` handler (no port).
  *
  * ```ts
- * await using stack = await liteStack({ schemas: [await readFile("supabase/schemas/notes.sql", "utf8")] });
+ * await using stack = await liteStack({
+ *   schemas: [await readFile("supabase/schemas/notes.sql", "utf8")],
+ * });
  * const alice = await stack.asUser(betterSupabase, { sub: aliceId });
  * expect(await alice.db.notes.count().orThrow()).toBe(1);
  * ```
@@ -201,7 +244,10 @@ interface BudgetRequest {
 interface BudgetResponse {
   url(): string;
   headers(): Record<string, string>;
-  /** Never settles when the browser aborts the stream, so `requestfailed` ends the wait too. */
+  /**
+   * Never settles when the browser aborts the stream, so `requestfailed` ends
+   * the wait too.
+   */
   finished(): Promise<unknown>;
   request(): BudgetRequest;
 }
@@ -231,14 +277,14 @@ interface DbBudgetExpectation {
   readonly timeoutMs?: number;
   /**
    * How long to keep listening once `during` resolves and no new response
-   * arrives, for renders it started that answer later (the dynamic render
-   * after an `instant()` lock releases). Defaults to 500 ms.
+   * arrives, for renders it started that answer later (the dynamic render after
+   * an `instant()` lock releases). Defaults to 500 ms.
    */
   readonly settleMs?: number;
   /**
-   * When no document or RSC response carries `x-bs-request-id`, throw
-   * (the default) or return `[]`. Cache-only navigations never hit the
-   * proxy, so they have no request id.
+   * When no document or RSC response carries `x-bs-request-id`, throw (the
+   * default) or return `[]`. Cache-only navigations never hit the proxy, so
+   * they have no request id.
    */
   readonly requireRequest?: boolean;
 }
@@ -263,9 +309,9 @@ type ResponseDbStats = Pick<DbStats, "calls" | "waves" | "ms">;
  */
 export declare function expectDbBudget(response: Response, expectation: ResponseBudgetExpectation): ResponseDbStats;
 /**
- * Measures every document and RSC navigation response during `during` and
- * fails when one render makes more database calls or waves than allowed.
- * Needs `createNext(betterSupabase, { debug })` and `bs.debugRoute()` in the app.
+ * Measures every document and RSC navigation response during `during` and fails
+ * when one render makes more database calls or waves than allowed. Needs
+ * `createNext(betterSupabase, { debug })` and `bs.debugRoute()` in the app.
  */
 export declare function expectDbBudget(page: BudgetPage, expectation: DbBudgetExpectation): Promise<readonly MeasuredRender[]>;
 //#endregion
@@ -308,14 +354,17 @@ interface InstantExpectation {
   /** Locators that must not exist while the lock holds. */
   readonly absent?: readonly InstantLocator[];
   /**
-   * Fails when one render of the navigation makes more database calls, or
-   * when no render reached the proxy (a navigation the client cache served
-   * has nothing to measure: drop the budget for it).
+   * Fails when one render of the navigation makes more database calls, or when
+   * no render reached the proxy (a navigation the client cache served has
+   * nothing to measure: drop the budget for it).
    */
   readonly maxCalls?: number;
   /** Fails when one render of the navigation makes more sequential waves. */
   readonly maxWaves?: number;
-  /** How long to wait for the render that streams in after the lock releases. Defaults to 500 ms. */
+  /**
+   * How long to wait for the render that streams in after the lock releases.
+   * Defaults to 500 ms.
+   */
   readonly settleMs?: number;
   /** Scopes the lock on a page that has not loaded yet. */
   readonly baseURL?: string;
@@ -324,9 +373,9 @@ interface InstantExpectation {
 }
 /**
  * Runs `during` inside `@next/playwright`'s `instant()`, checks what the
- * prefetched UI shows while the lock holds, and with `maxCalls` or
- * `maxWaves` checks the navigation's database budget like `expectDbBudget`.
- * Needs a `next build` with the testing API exposed.
+ * prefetched UI shows while the lock holds, and with `maxCalls` or `maxWaves`
+ * checks the navigation's database budget like `expectDbBudget`. Needs a `next
+ * build` with the testing API exposed.
  */
 export declare function expectInstant(page: InstantPage, expectation: InstantExpectation): Promise<readonly MeasuredRender[]>;
 //#endregion
@@ -338,27 +387,62 @@ type ExactSeed<M extends AnyModels, S> = { readonly [K in keyof S]: K extends ke
 declare const SEED: unique symbol;
 interface Seed<S> {
   readonly [SEED]: true;
-  /** The fixtures as given, so tests can reference `seed.rows.customers.acme.id`. */
+  /**
+   * The fixtures as given, so tests can reference
+   * `seed.rows.customers.acme.id`.
+   */
   readonly rows: S;
   /** One `insert ... on conflict do nothing` per table, parents before children. */
   statements(): string[];
   sql(): string;
-  /** Inserts the fixtures, e.g. in a test's `beforeAll`. Needs a service-role client. */
+  /**
+   * Inserts the fixtures, e.g. in a test's `beforeAll`. Needs a service-role
+   * client.
+   */
   insert(sql: SqlClient): Promise<void>;
 }
 export declare function isSeed(value: unknown): value is Seed<unknown>;
 /**
- * Typed fixtures shared by `supabase/seeds` and your tests. Rows use app
- * casing and Insert types; `better-supabase seed` renders them to SQL.
+ * Typed fixtures shared by `supabase/seeds` and your tests. Rows use app casing
+ * and Insert types; `better-supabase seed` renders them to SQL.
  *
  * ```ts
  * export const seed = defineSeed(betterSupabase, {
- *   organizations: { acme: { id: ACME, name: 'Acme' } },
- *   customers: { first: { organizationId: ACME, name: 'First customer' } },
+ *   organizations: { acme: { id: ACME, name: "Acme" } },
+ *   customers: { first: { organizationId: ACME, name: "First customer" } },
  * });
  * ```
  */
 export declare function defineSeed<M extends AnyModels, D, F extends AnyFunctions, E, const S extends SeedFixtures<M>>(betterSupabase: BetterSupabase<M, D, F, E>, fixtures: S & ExactSeed<M, S>): Seed<S>;
+/** The tenant a tenant seed fills. `slug` and `name` are set when known. */
+interface TenantSeedTarget {
+  readonly id: string;
+  readonly slug?: string | undefined;
+  readonly name?: string | undefined;
+}
+declare const TENANT_SEED: unique symbol;
+interface TenantSeed {
+  readonly [TENANT_SEED]: true;
+  /** One `insert ... on conflict do nothing` per table, parents before children. */
+  statements(tenant: TenantSeedTarget): string[];
+  /** Inserts the tenant's fixtures. Needs a service-role client. */
+  insert(sql: SqlClient, tenant: TenantSeedTarget): Promise<void>;
+}
+export declare function isTenantSeed(value: unknown): value is TenantSeed;
+/**
+ * Fixtures for one tenant, built from its id. `better-supabase seed --tenant`
+ * applies them to existing tenants, and `seedTenantOnCreate` to each tenant
+ * created in development.
+ *
+ * ```ts
+ * export const seed = defineTenantSeed(betterSupabase, (tenant) => ({
+ *   projects: {
+ *     demo: { organizationId: tenant.id, name: "Demo project" },
+ *   },
+ * }));
+ * ```
+ */
+export declare function defineTenantSeed<M extends AnyModels, D, F extends AnyFunctions, E, const S extends SeedFixtures<M>>(betterSupabase: BetterSupabase<M, D, F, E>, fixtures: (tenant: TenantSeedTarget) => S & ExactSeed<M, S>): TenantSeed;
 //#endregion
 //#region src/testing/scope.d.ts
 /** What a `scopedSeed` builder receives for one test. */
@@ -374,7 +458,10 @@ type ScopedTenant<M extends AnyModels> = { readonly [K in TableKey<M>]: {
   readonly row: (id: string) => Insert<M, K>;
 }; }[TableKey<M>];
 interface ScopedSeedOptions<M extends AnyModels> {
-  /** The table and row for the tenant; leave it out when the tenant is only an id. */
+  /**
+   * The table and row for the tenant; leave it out when the tenant is only an
+   * id.
+   */
   readonly tenant?: ScopedTenant<M>;
   /** Defaults to `$SUPABASE_URL` and `$SUPABASE_SECRET_KEY`. */
   readonly stack?: LocalStack;
@@ -389,41 +476,72 @@ interface ScopedSeed<M extends AnyModels, S> {
   [Symbol.asyncDispose](): Promise<void>;
 }
 /**
- * Fresh rows for one test, so tests that run at the same time never share
- * data. It creates a new tenant id, inserts the fixtures that `build` returns
- * through the service role (RLS and plugins don't apply), and hands back the
- * inserted rows. Call `cleanup()` in `afterEach` (or `await using`) to delete
- * them. A user from `asUser` then reads them over PostgREST like any other.
+ * Fresh rows for one test, so tests that run at the same time never share data.
+ * It creates a new tenant id, inserts the fixtures that `build` returns through
+ * the service role (RLS and plugins don't apply), and hands back the inserted
+ * rows. Call `cleanup()` in `afterEach` (or `await using`) to delete them. A
+ * user from `asUser` then reads them over PostgREST like any other.
  *
  * ```ts
  * const scope = await scopedSeed(
  *   betterSupabase,
  *   ({ tenant, id }) => ({
- *     customers: { first: { organizationId: tenant, name: `first-${id()}` } },
+ *     customers: {
+ *       first: { organizationId: tenant, name: `first-${id()}` },
+ *     },
  *   }),
- *   { tenant: { table: 'organizations', row: (id) => ({ id, name: id, slug: id }) } },
+ *   {
+ *     tenant: {
+ *       table: "organizations",
+ *       row: (id) => ({ id, name: id, slug: id }),
+ *     },
+ *   },
  * );
- * const alice = await asUser(betterSupabase, { sub: aliceId, tenant_id: scope.tenant });
+ * const alice = await asUser(betterSupabase, {
+ *   sub: aliceId,
+ *   tenant_id: scope.tenant,
+ * });
  * expect(await alice.db.customers.count().orThrow()).toBe(1);
  * await scope.cleanup();
  * ```
  */
 export declare function scopedSeed<M extends AnyModels, D, F extends AnyFunctions, E, const S extends SeedFixtures<M>>(betterSupabase: BetterSupabase<M, D, F, E>, build: (scope: Scope) => S & ExactSeed<M, S>, options?: ScopedSeedOptions<M>): Promise<ScopedSeed<M, S>>;
 /**
- * Runs `fn` as the user over direct Postgres inside one transaction and
- * always rolls it back, so the test leaves no rows behind. `fn` gets the same
+ * Runs `fn` as the user over direct Postgres inside one transaction and always
+ * rolls it back, so the test leaves no rows behind. `fn` gets the same
  * repositories as `user.sql`. Only the `sql` path rolls back: `user.db` talks
  * to PostgREST over HTTP and commits on its own.
  *
  * ```ts
  * const alice = await asUser(betterSupabase, claims, { postgres });
  * await withRollback(alice, async (db) => {
- *   await db.customers.create({ organizationId, name: 'Temp' }).orThrow();
+ *   await db.customers.create({ organizationId, name: "Temp" }).orThrow();
  *   expect(await db.customers.count().orThrow()).toBe(1);
  * });
  * ```
  */
 export declare function withRollback<M extends AnyModels, F extends AnyFunctions, E, T>(user: TestUser<M, F, E>, fn: (db: Db<M, F, E, unknown>) => Promise<T>): Promise<T>;
+/**
+ * Runs `fn` over direct Postgres as the user that `claims` describe, inside one
+ * transaction that always rolls back. The transaction sets `role` (from
+ * `claims.role`, else `authenticated`) and `request.jwt.claims`, so
+ * `auth.uid()`, `auth.jwt()` and RLS answer as they would for that user's
+ * request. Use it for raw SQL; `withRollback` gives repositories instead.
+ *
+ * ```ts
+ * await withClaims(
+ *   postgres,
+ *   { sub: aliceId, tenant_id: orgId },
+ *   async (sql) => {
+ *     const [row] = await sql.queryRaw<{ id: string }>(
+ *       "select auth.uid() as id",
+ *     );
+ *     expect(row?.id).toBe(aliceId);
+ *   },
+ * );
+ * ```
+ */
+export declare function withClaims<T>(postgres: BetterPostgres, claims: SqlClaims, fn: (sql: SqlClient) => Promise<T>): Promise<T>;
 //#endregion
 //#region src/testing/conformance.d.ts
 interface ConformanceCheck {
@@ -436,7 +554,10 @@ interface ConformanceReport {
   readonly subject: string;
   readonly checks: readonly ConformanceCheck[];
 }
-/** Thrown by a conformance kit when any check fails. Lists every failure, not just the first. */
+/**
+ * Thrown by a conformance kit when any check fails. Lists every failure, not
+ * just the first.
+ */
 export declare class ConformanceError extends Error {
   readonly report: ConformanceReport;
   constructor(report: ConformanceReport);
@@ -454,7 +575,8 @@ interface IsolationTenant {
 interface IsolationTable<M extends AnyModels, K extends keyof M> {
   /**
    * A row owned by `tenant`. `n` is 0 for the row seeded through the service
-   * role and 1 for the other tenant's insert attempt: put it in unique columns.
+   * role and 1 for the other tenant's insert attempt: put it in unique
+   * columns.
    */
   readonly row: (tenant: IsolationTenant, n: 0 | 1) => Insert<M, K>;
   /** A change the other tenant tries to make. It must differ from `row`. */
@@ -464,17 +586,23 @@ type IsolationTables<M extends AnyModels> = { readonly [K in TableKey<M>]?: Isol
 interface TenantIsolationOptions<M extends AnyModels> {
   readonly tenants: readonly [IsolationTenant, IsolationTenant];
   readonly tables: IsolationTables<M>;
-  /** Defaults to `$SUPABASE_URL`, `$SUPABASE_PUBLISHABLE_KEY` and `$SUPABASE_SECRET_KEY`. */
+  /**
+   * Defaults to `$SUPABASE_URL`, `$SUPABASE_PUBLISHABLE_KEY` and
+   * `$SUPABASE_SECRET_KEY`.
+   */
   readonly stack?: LocalStack;
-  /** Runs before any row is created, e.g. `() => seed.insert(sql)` for the tenants and their memberships. */
+  /**
+   * Runs before any row is created, e.g. `() => seed.insert(sql)` for the
+   * tenants and their memberships.
+   */
   readonly seed?: () => Promise<void>;
 }
 /**
  * Checks row-level security between two tenants against a running stack: for
  * each table, a user of one tenant must not select, insert, update or delete
- * the other tenant's rows. Runs without `betterSupabase`'s plugins, so the `tenant()`
- * plugin can't hide a missing policy. Throws a `ConformanceError` naming each
- * table and command that leaks; removes every row it created.
+ * the other tenant's rows. Runs without `betterSupabase`'s plugins, so the
+ * `tenant()` plugin can't hide a missing policy. Throws a `ConformanceError`
+ * naming each table and command that leaks; removes every row it created.
  *
  * ```ts
  * await expectTenantIsolation(betterSupabase, {
@@ -484,8 +612,11 @@ interface TenantIsolationOptions<M extends AnyModels> {
  *   ],
  *   tables: {
  *     tags: {
- *       row: (tenant, n) => ({ organizationId: tenant.id, name: `iso-${n}` }),
- *       update: { name: 'changed' },
+ *       row: (tenant, n) => ({
+ *         organizationId: tenant.id,
+ *         name: `iso-${n}`,
+ *       }),
+ *       update: { name: "changed" },
  *     },
  *   },
  * });
@@ -495,10 +626,10 @@ export declare function expectTenantIsolation<M extends AnyModels, D, F extends
 //#endregion
 //#region src/testing/claims-fixtures.d.ts
 /**
- * Claims of a Supabase access token where someone acts for the user, with
- * what `toSession` reads from them: `actor`, `impersonator` and
- * `delegation`. Plain data, so another library that reads the same `act`
- * claim (RFC 8693) can test against the same fixtures.
+ * Claims of a Supabase access token where someone acts for the user, with what
+ * `toSession` reads from them: `actor`, `impersonator` and `delegation`. Plain
+ * data, so another library that reads the same `act` claim (RFC 8693) can test
+ * against the same fixtures.
  */
 interface SupabaseClaimFixture {
   /** Without `iat` and `exp`, so a test signer sets them. */
@@ -510,25 +641,28 @@ interface SupabaseClaimFixture {
     readonly actor: SessionActor;
     /** Set for support and impersonated sessions only. */
     readonly impersonator?: Impersonator;
-    /** Set for an `oauth-client` actor, and an `agent` on a token with a `scope`. */
+    /**
+     * Set for an `oauth-client` actor, and an `agent` on a token with a
+     * `scope`.
+     */
     readonly delegation?: SessionDelegation;
   };
 }
 type SupabaseClaimFixtureName = "supportSession" | "supportSessionReadOnly" | "impersonation" | "oauthClient" | "agentChain" | "agentRun" | "agentRunReadOnly";
 /**
- * `supportSession` and `supportSessionReadOnly` are what `supportClaims`
- * mints (`act.kind: "support"`), `impersonation` what `actingAs` mints
- * (`act.kind: "impersonation"`), `oauthClient` a Supabase OAuth server
- * token (its identity scopes `openid` and `email` are left out of the
- * delegation), `agentChain` an RFC 8693 chain without `kind`, and
- * `agentRun` and `agentRunReadOnly` what `agentClaims` mints over that
- * chain (`act.kind: "agent"`, with `readOnly: true` for the second).
+ * `supportSession` and `supportSessionReadOnly` are what `supportClaims` mints
+ * (`act.kind: "support"`), `impersonation` what `actingAs` mints (`act.kind:
+ * "impersonation"`), `oauthClient` a Supabase OAuth server token (its identity
+ * scopes `openid` and `email` are left out of the delegation), `agentChain` an
+ * RFC 8693 chain without `kind`, and `agentRun` and `agentRunReadOnly` what
+ * `agentClaims` mints over that chain (`act.kind: "agent"`, with `readOnly:
+ * true` for the second).
  */
 export declare const supabaseClaimFixtures: Readonly<Record<SupabaseClaimFixtureName, SupabaseClaimFixture>>;
 /**
- * Claims whose `act` chain better-supabase refuses, so the session must
- * not pass as the user alone. `resolveAuth` and `toSession` both answer
- * with this verdict.
+ * Claims whose `act` chain better-supabase refuses, so the session must not
+ * pass as the user alone. `resolveAuth` and `toSession` both answer with this
+ * verdict.
  */
 interface SupabaseInvalidClaimFixture {
   /** Without `iat` and `exp`, so a test signer sets them. */
@@ -544,20 +678,46 @@ interface SupabaseInvalidClaimFixture {
 }
 type SupabaseInvalidClaimFixtureName = "legacySupportSession" | "supportReadOnlyNotBoolean" | "agentWithSessionId" | "agentEmptyToolName" | "agentToolsNotArray" | "agentReadOnlyNotBoolean" | "unknownKind" | "levelWithoutSub";
 /**
- * `legacySupportSession` is a 0.5.0 support token: `session_id` without
- * `kind`. better-supabase refuses it instead of reading it as a support
- * session; mint a new one with `supportClaims`. The others are malformed
- * levels: a support or agent `read_only` that is not a boolean, an agent
- * with a `session_id`, an empty tool name or `tools` that is not a list, a
- * `kind` better-supabase does not know, and a nested level without `sub`.
+ * `legacySupportSession` is a 0.5.0 support token: `session_id` without `kind`.
+ * better-supabase refuses it instead of reading it as a support session; mint a
+ * new one with `supportClaims`. The others are malformed levels: a support or
+ * agent `read_only` that is not a boolean, an agent with a `session_id`, an
+ * empty tool name or `tools` that is not a list, a `kind` better-supabase does
+ * not know, and a nested level without `sub`.
  */
 export declare const supabaseInvalidClaimFixtures: Readonly<Record<SupabaseInvalidClaimFixtureName, SupabaseInvalidClaimFixture>>;
 //#endregion
+//#region src/testing/tenant-seed.d.ts
+interface SeedTenantOnCreateOptions {
+  /** A service-role client the seed inserts through. */
+  readonly sql: SqlClient;
+  /** Defaults to `NODE_ENV === 'development'`. */
+  readonly enabled?: boolean;
+  /** Called when the seed fails. Defaults to `console.error`. */
+  readonly onError?: (error: unknown, organizationId: string) => void;
+}
+/**
+ * Applies `seed` to each organization created through the organizations block,
+ * so a new tenant starts with demo data in development. The seed runs after the
+ * event and can never change the result of the create call. Returns a function
+ * that stops listening.
+ *
+ * ```ts
+ * seedTenantOnCreate(betterSupabase, tenantSeed, { sql: serviceSql });
+ * ```
+ */
+export declare function seedTenantOnCreate(betterSupabase: {
+  readonly events: EventHub;
+}, seed: TenantSeed, options: SeedTenantOnCreateOptions): () => void;
+//#endregion
 //#region src/testing/kits/auth-resolver.d.ts
 interface TestAuthResolverOptions {
   /** Requests with credentials this resolver owns but that must not verify. */
   readonly invalid: readonly Request[];
-  /** Requests that must resolve to a user or service, optionally with the expected user id. */
+  /**
+   * Requests that must resolve to a user or service, optionally with the
+   * expected user id.
+   */
   readonly valid?: readonly {
     readonly request: Request;
     readonly userId?: string;
@@ -582,30 +742,50 @@ export declare function testCacheAdapter(adapter: CacheAdapter, options?: {
 //#endregion
 //#region src/testing/kits/event-sink.d.ts
 interface TestEventSinkOptions {
-  /** Events the sink delivered, for sinks that can be read back (an outbox, a test queue). */
+  /**
+   * Events the sink delivered, for sinks that can be read back (an outbox, a
+   * test queue).
+   */
   readonly received?: () => readonly CloudEvent[] | Promise<readonly CloudEvent[]>;
 }
-/** Proves an `EventSink` accepts empty and full batches without mutating them, and delivers them when readable. */
+/**
+ * Proves an `EventSink` accepts empty and full batches without mutating them,
+ * and delivers them when readable.
+ */
 export declare function testEventSink(sink: EventSink, options?: TestEventSinkOptions): Promise<ConformanceReport>;
 //#endregion
 //#region src/testing/kits/executor.d.ts
 type AnySupabase$1 = BetterSupabase<any, any, any, any>;
 interface TestExecutorOptions {
-  /** A definition whose schema matches the executor's database. Install no plugins. */
+  /**
+   * A definition whose schema matches the executor's database. Install no
+   * plugins.
+   */
   readonly betterSupabase: AnySupabase$1;
-  /** App key of a table with rows the executor can read. Defaults to the first table. */
+  /**
+   * App key of a table with rows the executor can read. Defaults to the first
+   * table.
+   */
   readonly table?: string;
-  /** A row to insert and delete again, to check writes. Skips write checks when omitted. */
+  /**
+   * A row to insert and delete again, to check writes. Skips write checks when
+   * omitted.
+   */
   readonly create?: Readonly<Record<string, unknown>>;
 }
 /**
  * Proves an `Executor` meets the contract: rows keyed by the selection's
- * aliases, counts, `aborted` errors, failures returned as `Result`s rather
- * than thrown, and (with `create`) a write round trip and a `deleteMany`
- * that `maxAffected` refuses without deleting anything.
+ * aliases, counts, `aborted` errors, failures returned as `Result`s rather than
+ * thrown, and (with `create`) a write round trip and a `deleteMany` that
+ * `maxAffected` refuses without deleting anything.
  *
  * ```ts
- * it('conforms', () => testExecutor(myExecutor, { betterSupabase, table: 'tags', create: { name: 'x' } }));
+ * it("conforms", () =>
+ *   testExecutor(myExecutor, {
+ *     betterSupabase,
+ *     table: "tags",
+ *     create: { name: "x" },
+ *   }));
  * ```
  */
 export declare function testExecutor(executor: Executor, options: TestExecutorOptions): Promise<ConformanceReport>;
@@ -615,15 +795,15 @@ interface TestPaymentProviderOptions {
   /** What the kit charges. Defaults to 10.00 EUR. */
   readonly amount?: Money;
   /**
-   * Has the customer approve a `manual` payment, so it reaches
-   * `authorized` (with Stripe, confirm it with a test card). Without it
-   * the capture and refund checks are skipped.
+   * Has the customer approve a `manual` payment, so it reaches `authorized`
+   * (with Stripe, confirm it with a test card). Without it the capture and
+   * refund checks are skipped.
    */
   readonly authorize?: (payment: Payment) => void | Promise<void>;
   /**
-   * A delivery the provider's endpoint would receive for `payment`, signed
-   * with the provider's secret, and the same delivery with its body
-   * changed. Without it the webhook checks are skipped.
+   * A delivery the provider's endpoint would receive for `payment`, signed with
+   * the provider's secret, and the same delivery with its body changed. Without
+   * it the webhook checks are skipped.
    */
   readonly webhook?: (payment: Payment) => Promise<{
     readonly valid: WebhookInput;
@@ -632,11 +812,11 @@ interface TestPaymentProviderOptions {
 }
 /**
  * Runs the `PaymentProvider` contract against `provider`: the API version,
- * refused amounts, a created payment and its fields, an idempotency key
- * that pays once, `not_found` for an unknown payment, and, with the
- * options that drive them, capture and refunds of an authorized payment
- * and webhook verification. Every call carries a fresh reference, so the
- * kit runs against a test account without cleanup.
+ * refused amounts, a created payment and its fields, an idempotency key that
+ * pays once, `not_found` for an unknown payment, and, with the options that
+ * drive them, capture and refunds of an authorized payment and webhook
+ * verification. Every call carries a fresh reference, so the kit runs against a
+ * test account without cleanup.
  */
 export declare function testPaymentProvider(provider: PaymentProvider, options?: TestPaymentProviderOptions): Promise<ConformanceReport>;
 //#endregion
@@ -652,11 +832,11 @@ interface TestTaxProviderOptions {
   readonly expectTax?: boolean;
 }
 /**
- * Runs the `TaxProvider` contract against `provider`: the API version,
- * refused carts, a quote with one line per cart line in order and a total
- * that adds up, inclusive prices, shipping, exempt customers, commit, and
- * full and partial reversals with their limits. Every commit carries a
- * fresh reference, so the kit runs against a test account without cleanup.
+ * Runs the `TaxProvider` contract against `provider`: the API version, refused
+ * carts, a quote with one line per cart line in order and a total that adds up,
+ * inclusive prices, shipping, exempt customers, commit, and full and partial
+ * reversals with their limits. Every commit carries a fresh reference, so the
+ * kit runs against a test account without cleanup.
  */
 export declare function testTaxProvider(provider: TaxProvider, options: TestTaxProviderOptions): Promise<ConformanceReport>;
 //#endregion
@@ -670,8 +850,8 @@ interface TestIncomingDestinationOptions {
 /**
  * Proves an `IncomingDestination` accepts a delivery once per endpoint and
  * message id: a repeat reports the first id as a duplicate, while another
- * message id or another endpoint is new.
- * It delivers four messages with random endpoint ids; the destination keeps them.
+ * message id or another endpoint is new. It delivers four messages with random
+ * endpoint ids; the destination keeps them.
  */
 export declare function testIncomingDestination(destination: IncomingDestination, options: TestIncomingDestinationOptions): Promise<ConformanceReport>;
 //#endregion
@@ -687,11 +867,11 @@ interface TestPluginOptions {
   readonly create?: Readonly<Record<string, unknown>>;
 }
 /**
- * Proves a `Plugin` targets API v1, installs cleanly on its own and next to
- * the first-party plugins in either order, adds repository methods without
- * replacing base ones, keeps `context`, `transformQuery` and
- * `beforeMutation` pure and deterministic, and keeps executors'
- * results intact when it wraps them.
+ * Proves a `Plugin` targets API v1, installs cleanly on its own and next to the
+ * first-party plugins in either order, adds repository methods without
+ * replacing base ones, keeps `context`, `transformQuery` and `beforeMutation`
+ * pure and deterministic, and keeps executors' results intact when it wraps
+ * them.
  */
 export declare function testPlugin(plugin: AnyPlugin, options: TestPluginOptions): Promise<ConformanceReport>;
 //#endregion
@@ -699,14 +879,17 @@ export declare function testPlugin(plugin: AnyPlugin, options: TestPluginOptions
 interface TestQueueBackendOptions {
   /** A queue the kit may fill and drain; use a fresh name per run. */
   readonly queue: string;
-  /** Check that a repeated dedupe key returns the first id. Defaults to `backend.leases`. */
+  /**
+   * Check that a repeated dedupe key returns the first id. Defaults to
+   * `backend.leases`.
+   */
   readonly dedupe?: boolean;
 }
 /**
  * Proves a `QueueBackend` round-trips payloads, hides claimed messages for
- * their lease, counts attempts, retries and dead-letters on `fail`, and
- * (when it has `leases`) rejects a stale attempt and extends a lease. It
- * writes to `options.queue` on the backend's real store.
+ * their lease, counts attempts, retries and dead-letters on `fail`, and (when
+ * it has `leases`) rejects a stale attempt and extends a lease. It writes to
+ * `options.queue` on the backend's real store.
  */
 export declare function testQueueBackend(backend: QueueBackend, options: TestQueueBackendOptions): Promise<ConformanceReport>;
 //#endregion
@@ -721,11 +904,11 @@ interface TestSupportSessionStoreOptions {
   readonly targets: readonly [string, string];
 }
 /**
- * Proves a `SupportSessionStore` starts sessions with the input it was
- * given, shows a running session only to its admin, ends the admin's
- * previous session on start, ends a session once, lists sessions and, with
- * `expire`, leaves running sessions alone.
- * It writes sessions to the store; they are all ended when it returns.
+ * Proves a `SupportSessionStore` starts sessions with the input it was given,
+ * shows a running session only to its admin, ends the admin's previous session
+ * on start, ends a session once, lists sessions and, with `expire`, leaves
+ * running sessions alone. It writes sessions to the store; they are all ended
+ * when it returns.
  */
 export declare function testSupportSessionStore(store: SupportSessionStore, options: TestSupportSessionStoreOptions): Promise<ConformanceReport>;
 //#endregion
@@ -749,13 +932,16 @@ interface MountedBinding {
   readonly unmount: () => void | Promise<void>;
 }
 interface ControllerBindingHarness {
-  /** Mounts the binding over the controller `create` returns, as a component would. */
+  /**
+   * Mounts the binding over the controller `create` returns, as a component
+   * would.
+   */
   readonly mount: (create: () => ProbeController) => MountedBinding | Promise<MountedBinding>;
   /** Lets the framework apply pending updates: a tick, a flush. */
   readonly settle?: () => void | Promise<void>;
   /**
-   * Whether unmounting disposes the controller. React keeps it for
-   * StrictMode's second mount and only stops its work. Default true.
+   * Whether unmounting disposes the controller. React keeps it for StrictMode's
+   * second mount and only stops its work. Default true.
    */
   readonly disposes?: boolean;
 }
@@ -772,14 +958,17 @@ type AnySupabase = BetterSupabase<any, any, any, any>;
 /** What the adapter module asks a handler to do with the caller's context. */
 type AdapterRun = (ctx: Pick<ServerContext<AnyModels, AnyFunctions, unknown>, "auth" | "replica">) => unknown;
 interface TestAdapterOptions {
-  /** The definition the adapter is built from: the module tracks event sends on its `events`. */
+  /**
+   * The definition the adapter is built from: the module tracks event sends on
+   * its `events`.
+   */
   readonly betterSupabase: AnySupabase;
   /**
    * Builds the adapter with `server` (pass it to `createX(betterSupabase,
-   * server)`) and returns a fetch function that answers a request with
-   * `run` as the caller, behind a guard that allows `allow`. Translate the
-   * module's bare GET into what the adapter expects (a JSON-RPC `tools/call`,
-   * an oRPC call) inside the function.
+   * server)`) and returns a fetch function that answers a request with `run` as
+   * the caller, behind a guard that allows `allow`. Translate the module's bare
+   * GET into what the adapter expects (a JSON-RPC `tools/call`, an oRPC call)
+   * inside the function.
    */
   readonly serve: (server: ServerOptions & {
     readonly exposeErrors: false;
@@ -787,51 +976,55 @@ interface TestAdapterOptions {
     readonly allow: NonNullable<GuardOptions["allow"]>;
     readonly waitUntil: (promise: Promise<unknown>) => void;
   }) => (request: Request) => Promise<Response>;
-  /** The adapter answers handler errors in a 200 body (MCP tool results), not with HTTP statuses. */
+  /**
+   * The adapter answers handler errors in a 200 body (MCP tool results), not
+   * with HTTP statuses.
+   */
   readonly errorsInBody?: boolean;
   /** The adapter sends no cookies (bearer-only transports such as MCP). */
   readonly cookies?: false;
 }
 /**
  * Proves a framework adapter refuses callers its guard rejects, answers
- * `DbError`s with their status, hides unexpected errors, applies the
- * context's cookies and hands pending event sends to `waitUntil`, the way
- * `handle()` from `better-supabase/server` does.
+ * `DbError`s with their status, hides unexpected errors, applies the context's
+ * cookies and hands pending event sends to `waitUntil`, the way `handle()` from
+ * `better-supabase/server` does.
  */
 export declare function testAdapter(name: string, options: TestAdapterOptions): Promise<ConformanceReport>;
 //#endregion
 //#region src/testing/transport-middleware.d.ts
 /**
- * Proves a `BlockTransportMiddleware` meets the contract: it declares API 1
- * and a name, calls `next` at most once per call, leaves the request it got
+ * Proves a `BlockTransportMiddleware` meets the contract: it declares API 1 and
+ * a name, calls `next` at most once per call, leaves the request it got
  * unchanged, resolves when `next` does, and rejects with the database error
  * `next` rejected with, so blocks still map it to a `DbError`.
  *
  * ```ts
- * it('conforms', () => testBlockTransportMiddleware(statementTimeout('5s')));
+ * it("conforms", () =>
+ *   testBlockTransportMiddleware(statementTimeout("5s")));
  * ```
  */
 export declare function testBlockTransportMiddleware(middleware: BlockTransportMiddleware): Promise<ConformanceReport>;
 //#endregion
 //#region src/testing/authorization-provider.d.ts
 /**
- * Proves an `AuthorizationProvider` targets API v1, is plain JSON, names
- * valid scopes with a tenant scope that has an id type, writes templates
- * that are safe to inline and use the placeholders they need, lists every
- * function its templates call in `requires`, and keeps its token hook,
- * suspension rows, role sources and deciding columns well formed.
+ * Proves an `AuthorizationProvider` targets API v1, is plain JSON, names valid
+ * scopes with a tenant scope that has an id type, writes templates that are
+ * safe to inline and use the placeholders they need, lists every function its
+ * templates call in `requires`, and keeps its token hook, suspension rows, role
+ * sources and deciding columns well formed.
  */
 export declare function testAuthorizationProvider(provider: AuthorizationProvider): Promise<ConformanceReport>;
 //#endregion
 //#region src/testing/authorization-hooks.d.ts
 /**
  * Proves `AuthorizationHooks` target API v1 and fail closed for strangers:
- * fan-out returns only subscribers it was given, an identity nobody linked
- * and a forged ticket resolve to `null`, a requester never approves their
- * own request, an unknown publisher can neither publish nor run, an
- * unlinked chat author gets nothing, an admin with no claims cannot start
- * a support session and never approves their own, and a delegated token
- * with no scopes maps to no permissions.
+ * fan-out returns only subscribers it was given, an identity nobody linked and
+ * a forged ticket resolve to `null`, a requester never approves their own
+ * request, an unknown publisher can neither publish nor run, an unlinked chat
+ * author gets nothing, an admin with no claims cannot start a support session
+ * and never approves their own, and a delegated token with no scopes maps to no
+ * permissions.
  */
 export declare function testAuthorizationHooks(hooks: AuthorizationHooks): Promise<ConformanceReport>;
 //#endregion
@@ -845,16 +1038,16 @@ interface TestDeliveryTransportOptions {
   /** The sample's recipient. Defaults to `delivered@example.test`. */
   readonly to?: string;
   /**
-   * What the provider received, read after the kit sends. When given, the
-   * kit checks that the idempotency key and the headers arrived as sent.
+   * What the provider received, read after the kit sends. When given, the kit
+   * checks that the idempotency key and the headers arrived as sent.
    */
   readonly received?: () => Promise<readonly ReceivedDelivery[]>;
 }
 /**
- * Runs the `DeliveryTransport` contract against `transport`: API version 1,
- * the `email` channel, a provider name, and one frozen sample message it
- * sends without mutating, with the delivery id as its idempotency key.
- * Throws a `ConformanceError` listing every failed check.
+ * Runs the `DeliveryTransport` contract against `transport`: API version 1, the
+ * `email` channel, a provider name, and one frozen sample message it sends
+ * without mutating, with the delivery id as its idempotency key. Throws a
+ * `ConformanceError` listing every failed check.
  */
 export declare function testDeliveryTransport(transport: DeliveryTransport, options?: TestDeliveryTransportOptions): Promise<ConformanceReport>;
 //#endregion
@@ -867,17 +1060,20 @@ interface TestAuthorizerOptions<Ref> {
     readonly permission: Ref;
     readonly context: RequestContext;
   };
-  /** A permission reference the authorizer doesn't know; it must never be granted. */
+  /**
+   * A permission reference the authorizer doesn't know; it must never be
+   * granted.
+   */
   readonly unknown?: Ref;
 }
 /**
  * Proves an `Authorizer` targets API v1, keys every permission to the same
- * string each time (and after a JSON round trip, so references are plain
- * JSON), answers every request with a known outcome without mutating it,
- * keeps the request order in `evaluations`, decides from the subject rather
- * than the input (forged roles, claims and memberships in the resource
- * properties or the context never turn a denial into a grant), never grants an unknown permission, and grants
- * `options.granted` through `checkPermission`.
+ * string each time (and after a JSON round trip, so references are plain JSON),
+ * answers every request with a known outcome without mutating it, keeps the
+ * request order in `evaluations`, decides from the subject rather than the
+ * input (forged roles, claims and memberships in the resource properties or the
+ * context never turn a denial into a grant), never grants an unknown
+ * permission, and grants `options.granted` through `checkPermission`.
  */
 export declare function testAuthorizer<Ref>(authorizer: Authorizer<Ref>, options: TestAuthorizerOptions<Ref>): Promise<ConformanceReport>;
 interface StaticAuthorizerOptions<Ref extends string> {
@@ -888,21 +1084,24 @@ interface StaticAuthorizerOptions<Ref extends string> {
   readonly roles?: Readonly<Record<string, readonly Ref[]>>;
   /** Permissions per subject id, on top of the role's. */
   readonly grants?: Readonly<Record<string, readonly Ref[]>>;
-  /** Permissions that answer `approval-required` with the approval id `approval:<permission>`. */
+  /**
+   * Permissions that answer `approval-required` with the approval id
+   * `approval:<permission>`.
+   */
   readonly approvals?: readonly Ref[];
 }
 /**
- * An in-memory `Authorizer` for tests and examples: permissions come from
- * the subject's `role` and id only, never from the request's resource or
- * context, and it ignores `subject.properties.claims`.
+ * An in-memory `Authorizer` for tests and examples: permissions come from the
+ * subject's `role` and id only, never from the request's resource or context,
+ * and it ignores `subject.properties.claims`.
  */
 export declare function staticAuthorizer<Ref extends string>(options: StaticAuthorizerOptions<Ref>): Authorizer<Ref>;
 //#endregion
 //#region src/testing/document-format.d.ts
 interface TestDocumentFormatOptions<V extends string = string> {
   /**
-   * The model to lower. Defaults to a small model with a route, a stream,
-   * a webhook, a Realtime channel and a workflow.
+   * The model to lower. Defaults to a small model with a route, a stream, a
+   * webhook, a Realtime channel and a workflow.
    */
   readonly model?: ApiModel;
   /** The versions to lower. Defaults to every version the format lists. */
@@ -910,12 +1109,11 @@ interface TestDocumentFormatOptions<V extends string = string> {
 }
 /**
  * Proves a `DocumentFormat` targets API v1, lists versions with pins and a
- * known status, defaults to a version it lists that is not a preview, and,
- * for every version: lowers the model without mutating it (also when the
- * model is frozen), renders the same document twice, renders plain JSON or
- * text, reports diagnostics with a kebab-case code, a severity and a
- * message, finds no error in its own output with `lint`, and names a bare,
- * stable file.
+ * known status, defaults to a version it lists that is not a preview, and, for
+ * every version: lowers the model without mutating it (also when the model is
+ * frozen), renders the same document twice, renders plain JSON or text, reports
+ * diagnostics with a kebab-case code, a severity and a message, finds no error
+ * in its own output with `lint`, and names a bare, stable file.
  */
 export declare function testDocumentFormat<F extends AnyDocumentFormat>(format: F, options?: TestDocumentFormatOptions<VersionOf<F>>): Promise<ConformanceReport>;
 //#endregion
@@ -927,10 +1125,16 @@ interface TestGeneratorOptions {
   readonly introspection?: GeneratorInput["introspection"];
   readonly extras?: GeneratorInput["extras"];
   readonly config?: ResolvedConfig;
-  /** Defaults to one built from `meta`, with `unknown` for column types it can't name. */
+  /**
+   * Defaults to one built from `meta`, with `unknown` for column types it can't
+   * name.
+   */
   readonly model?: GeneratorModel;
 }
-/** Proves a `Generator` writes relative, unique paths, is deterministic and doesn't mutate its input. */
+/**
+ * Proves a `Generator` writes relative, unique paths, is deterministic and
+ * doesn't mutate its input.
+ */
 export declare function testGenerator(generator: Generator, options: TestGeneratorOptions): Promise<ConformanceReport>;
 //#endregion
 //#region src/testing/injectables.d.ts
@@ -940,8 +1144,8 @@ interface TestEmbedderOptions {
 }
 /**
  * Proves an `Embedder` for the knowledge and memory blocks names its model,
- * embeds an empty list to nothing, and returns one finite vector per value,
- * all of the same length on every call. It calls the real model.
+ * embeds an empty list to nothing, and returns one finite vector per value, all
+ * of the same length on every call. It calls the real model.
  */
 export declare function testEmbedder(embedder: Embedder, options?: TestEmbedderOptions): Promise<ConformanceReport>;
 interface TestAiTaskRunnerOptions {
@@ -970,8 +1174,8 @@ interface TestBuilderStarterOptions {
   readonly call: BuilderStartCall;
 }
 /**
- * Proves a `BuilderStarter` returns a run id and returns the same id when
- * the same idempotency key starts again. It starts real runs.
+ * Proves a `BuilderStarter` returns a run id and returns the same id when the
+ * same idempotency key starts again. It starts real runs.
  */
 export declare function testBuilderStarter(start: BuilderStarter, options: TestBuilderStarterOptions): Promise<ConformanceReport>;
 interface TestEveDocumentBackendOptions {
@@ -996,9 +1200,9 @@ interface TestNotificationChannelOptions {
   readonly received?: () => Promise<readonly string[]>;
 }
 /**
- * Runs the `NotificationChannel` contract against `channel`: the API version,
- * a name, and one frozen sample message it must send without mutating.
- * Throws a `ConformanceError` listing every failed check.
+ * Runs the `NotificationChannel` contract against `channel`: the API version, a
+ * name, and one frozen sample message it must send without mutating. Throws a
+ * `ConformanceError` listing every failed check.
  */
 export declare function testNotificationChannel(channel: NotificationChannel, options?: TestNotificationChannelOptions): Promise<ConformanceReport>;
 //#endregion
@@ -1014,9 +1218,9 @@ interface TestWebhookSignerOptions {
   }, secret: string) => Promise<boolean>;
 }
 /**
- * Runs the `WebhookSigner` contract against `signer`: the API version, a
- * name, string headers that depend on the body and are stable for the same
- * input, and, with `verify`, a signature the receiver accepts.
+ * Runs the `WebhookSigner` contract against `signer`: the API version, a name,
+ * string headers that depend on the body and are stable for the same input,
+ * and, with `verify`, a signature the receiver accepts.
  */
 export declare function testWebhookSigner(signer: WebhookSigner, options?: TestWebhookSignerOptions): Promise<ConformanceReport>;
 interface TestWebhookTransportOptions {
@@ -1026,9 +1230,9 @@ interface TestWebhookTransportOptions {
   readonly received?: () => Promise<readonly string[]>;
 }
 /**
- * Runs the `WebhookTransport` contract against `transport`: the API version,
- * a name, and one POST to `options.url` that returns an HTTP status and a
- * string body.
+ * Runs the `WebhookTransport` contract against `transport`: the API version, a
+ * name, and one POST to `options.url` that returns an HTTP status and a string
+ * body.
  */
 export declare function testWebhookTransport(transport: WebhookTransport, options: TestWebhookTransportOptions): Promise<ConformanceReport>;
 interface TestWebhookSecretStoreOptions {
@@ -1037,14 +1241,17 @@ interface TestWebhookSecretStoreOptions {
 }
 /**
  * Runs the `WebhookSecretStore` contract against `store`: the API version, a
- * list of strings, and, when it can rotate, a new secret listed first while
- * the previous one keeps signing.
+ * list of strings, and, when it can rotate, a new secret listed first while the
+ * previous one keeps signing.
  */
 export declare function testWebhookSecretStore(store: WebhookSecretStore, options: TestWebhookSecretStoreOptions): Promise<ConformanceReport>;
 //#endregion
 //#region src/testing/chat-state.d.ts
 interface TestChatStateOptions {
-  /** Builds a queued message, e.g. `createTestMessage(id, text)` from `@chat-adapter/tests`. */
+  /**
+   * Builds a queued message, e.g. `createTestMessage(id, text)` from
+   * `@chat-adapter/tests`.
+   */
   readonly message: (id: string, text: string) => Message;
   /** A fresh key or thread id per call. Defaults to `conformance-<uuid>`. */
   readonly id?: () => string;
@@ -1052,10 +1259,10 @@ interface TestChatStateOptions {
   readonly ttlMs?: number;
 }
 /**
- * Runs the Chat SDK `StateAdapter` contract against `state`: subscriptions,
- * one lock holder at a time with token-checked release and extension, lock
- * and cache TTLs, `setIfNotExists`, list trimming, and a per-thread queue
- * that keeps the newest entries, reports its depth and drops expired ones.
+ * Runs the Chat SDK `StateAdapter` contract against `state`: subscriptions, one
+ * lock holder at a time with token-checked release and extension, lock and
+ * cache TTLs, `setIfNotExists`, list trimming, and a per-thread queue that
+ * keeps the newest entries, reports its depth and drops expired ones.
  */
 export declare function testChatState(state: StateAdapter, options: TestChatStateOptions): Promise<ConformanceReport>;
 //#endregion
@@ -1067,10 +1274,10 @@ interface TestStreamStoreOptions {
   readonly timeoutMs?: number;
 }
 /**
- * Runs the `StreamStore` contract against `store`: the API version, open
- * once, idempotent appends that refuse gaps, reads from any index that end
- * when the stream closes, a live read that sees later appends, cancel seen by
- * the writer, a closed stream that refuses appends, and a missing stream.
+ * Runs the `StreamStore` contract against `store`: the API version, open once,
+ * idempotent appends that refuse gaps, reads from any index that end when the
+ * stream closes, a live read that sees later appends, cancel seen by the
+ * writer, a closed stream that refuses appends, and a missing stream.
  */
 export declare function testStreamStore(store: StreamStore, options?: TestStreamStoreOptions): Promise<ConformanceReport>;
 //#endregion
@@ -1082,7 +1289,10 @@ interface TestCredentialProviderOptions {
   readonly seed: (ref: CredentialRef, subject: CredentialSubject, value: string) => Promise<void>;
   /** A per-user ref, for providers that keep one credential per user. */
   readonly userRef?: CredentialRef;
-  /** A ref with an inbound scheme and a function that signs a request with `secret`. */
+  /**
+   * A ref with an inbound scheme and a function that signs a request with
+   * `secret`.
+   */
   readonly inbound?: {
     readonly ref: CredentialRef;
     readonly sign: (body: string, secret: string) => Promise<Request>;
@@ -1090,16 +1300,19 @@ interface TestCredentialProviderOptions {
 }
 /**
  * Runs the `CredentialProvider` contract against `provider`: the API version,
- * an unknown ref, a stored token with its headers, a new value seen after it
- * is stored, separate credentials per user and per tenant (`ref` with a
- * `tenant`, which `seed` must store too), revoke (per user, as the
- * organization purger revokes connector grants), and inbound checks that
- * accept a signed request and refuse a tampered one.
+ * an unknown ref, a stored token with its headers, a new value seen after it is
+ * stored, separate credentials per user and per tenant (`ref` with a `tenant`,
+ * which `seed` must store too), revoke (per user, as the organization purger
+ * revokes connector grants), and inbound checks that accept a signed request
+ * and refuse a tampered one.
  */
 export declare function testCredentialProvider(provider: CredentialProvider, options: TestCredentialProviderOptions): Promise<ConformanceReport>;
 //#endregion
 //#region src/testing/act-cases.d.ts
-/** One `act` claim set, with what `actorOf` and `actor_may_write()` say about it. */
+/**
+ * One `act` claim set, with what `actorOf` and `actor_may_write()` say about
+ * it.
+ */
 interface ActCase {
   readonly name: string;
   /** Only the claims the verdict reads: `act`, `client_id` and `scope`. */
@@ -1115,16 +1328,19 @@ interface ActCase {
   /** What `better_supabase.actor_may_write()` returns for these claims. */
   readonly mayWrite: boolean;
 }
-/** `better-supabase/testing/act-cases.json`, versioned so other parsers can pin it. */
+/**
+ * `better-supabase/testing/act-cases.json`, versioned so other parsers can pin
+ * it.
+ */
 interface ActCases {
   readonly version: 1;
   readonly cases: readonly ActCase[];
 }
 /**
- * The RFC 8693 `act` chains better-supabase accepts and refuses, as plain
- * JSON (`better-supabase/testing/act-cases.json`), so another library that
- * reads the same claims can run the same cases.
+ * The RFC 8693 `act` chains better-supabase accepts and refuses, as plain JSON
+ * (`better-supabase/testing/act-cases.json`), so another library that reads the
+ * same claims can run the same cases.
  */
 export declare const actCases: ActCases;
 //#endregion
-export type { ActCase, ActCases, AdapterRun, BudgetPage, BudgetRequest, BudgetResponse, ConformanceCheck, ConformanceReport, ControllerBindingHarness, DbBudgetExpectation, ExactSeed, InstantBrowserContext, InstantExpectation, InstantLocator, InstantPage, IsolationTable, IsolationTables, IsolationTenant, LiteStack, LiteStackOptions, LocalStack, MeasuredRender, MountedBinding, ProbeActions, ProbeController, ProbeSnapshot, ReceivedDelivery, ResponseBudgetExpectation, ResponseDbStats, Scope, ScopedRows, ScopedSeed, ScopedSeedOptions, ScopedTenant, Seed, SeedFixtures, SigningJwk, StaticAuthorizerOptions, SupabaseClaimFixture, SupabaseClaimFixtureName, SupabaseInvalidClaimFixture, SupabaseInvalidClaimFixtureName, TenantIsolationOptions, TestAdapterOptions, TestAiTaskRunnerOptions, TestAuthResolverOptions, TestAuthorizerOptions, TestBuilderStarterOptions, TestChatStateOptions, TestCredentialProviderOptions, TestDeliveryTransportOptions, TestDocumentFormatOptions, TestEmbedderOptions, TestEveDocumentBackendOptions, TestEventSinkOptions, TestExecutorOptions, TestGeneratorOptions, TestGraphCompilerOptions, TestIncomingDestinationOptions, TestJwtClaims, TestNotificationChannelOptions, TestPaymentProviderOptions, TestPluginOptions, TestQueueBackendOptions, TestSigner, TestStreamStoreOptions, TestSupportSessionStoreOptions, TestTaxProviderOptions, TestUser, TestWebhookSecretStoreOptions, TestWebhookSignerOptions, TestWebhookTransportOptions };
+export type { ActCase, ActCases, AdapterRun, BudgetPage, BudgetRequest, BudgetResponse, ConformanceCheck, ConformanceReport, ControllerBindingHarness, DbBudgetExpectation, ExactSeed, InstantBrowserContext, InstantExpectation, InstantLocator, InstantPage, IsolationTable, IsolationTables, IsolationTenant, LiteStack, LiteStackOptions, LocalStack, MeasuredRender, MountedBinding, ProbeActions, ProbeController, ProbeSnapshot, ReceivedDelivery, ResponseBudgetExpectation, ResponseDbStats, Scope, ScopedRows, ScopedSeed, ScopedSeedOptions, ScopedTenant, Seed, SeedFixtures, SeedTenantOnCreateOptions, SigningJwk, StaticAuthorizerOptions, SupabaseClaimFixture, SupabaseClaimFixtureName, SupabaseInvalidClaimFixture, SupabaseInvalidClaimFixtureName, TenantIsolationOptions, TenantSeed, TenantSeedTarget, TestAdapterOptions, TestAiTaskRunnerOptions, TestAuthResolverOptions, TestAuthorizerOptions, TestBuilderStarterOptions, TestChatStateOptions, TestCredentialProviderOptions, TestDeliveryTransportOptions, TestDocumentFormatOptions, TestEmbedderOptions, TestEveDocumentBackendOptions, TestEventSinkOptions, TestExecutorOptions, TestGeneratorOptions, TestGraphCompilerOptions, TestIncomingDestinationOptions, TestJwtClaims, TestNotificationChannelOptions, TestPaymentProviderOptions, TestPluginOptions, TestQueueBackendOptions, TestSigner, TestStreamStoreOptions, TestSupportSessionStoreOptions, TestTaxProviderOptions, TestUser, TestWebhookSecretStoreOptions, TestWebhookSignerOptions, TestWebhookTransportOptions };