better-supabase 0.12.0 → 0.13.0

package/dist/testing/index.js

@@ -1,27 +1,29 @@
 import { t as DbException } from "../db-exception-CnWcYPxL.js";
-import { n as dbError } from "../errors-BV1SKTVs.js";
-import { d as temporalText } from "../temporal-CB5Fpo5d.js";
-import { t as temporal } from "../temporal-required-nfZ87U-0.js";
-import { a as ok } from "../result-DIeYscA3.js";
-import { t as BetterSupabase } from "../define-Bu1v781m.js";
+import { n as dbError } from "../errors-D7u24ZJH.js";
+import { d as temporalText } from "../temporal-DLZlWbOi.js";
+import { t as temporal } from "../temporal-required-Dt4mcPsi.js";
+import { a as ok } from "../result-DIT_qp4G.js";
+import { t as BetterSupabase } from "../define-DwZ_LQVO.js";
 import { t as isList } from "../guards-6F2bCtQR.js";
-import { a as toBase64Url, r as fromBase64, t as base64ToText } from "../base64-D4aqdnDR.js";
-import { o as resolveConfig } from "../config-NQmw_wsk.js";
-import { a as isScopeName, c as templateFunctions, l as templatePlaceholders, n as TEMPLATE_PLACEHOLDERS, s as scopeProblems, u as templateProblems } from "../access-sql-CTJPHjCL.js";
-import { i as seedLite, n as loadLite, r as migrateLite, t as LITE_INSTALL } from "../runtime-BOXURhEW.js";
+import { a as toBase64Url, r as fromBase64, t as base64ToText } from "../base64-B9Wlsdj7.js";
+import { o as resolveConfig } from "../config-xUf0dj0t.js";
+import { a as isScopeName, c as templateFunctions, l as templatePlaceholders, n as TEMPLATE_PLACEHOLDERS, s as scopeProblems, u as templateProblems } from "../access-sql-BpOdJvfj.js";
+import { i as seedLite, n as loadLite, r as migrateLite, t as LITE_INSTALL } from "../runtime-CoKxZibd.js";
 import { ENV_VARIABLES } from "../env/index.js";
-import { t as defineController } from "../controller-D6NyNrlZ.js";
+import { t as defineController } from "../controller-BEliOBOv.js";
 import "../replicas-BvIL4_jL.js";
-import { a as tenantCredentialRef } from "../provider-C-Ti38J6.js";
-import { n as rawError } from "../block-transport-J7ZepTq2.js";
-import { t as postgresExecutor } from "../executor-CxGQiQN_.js";
-import { i as requestOf, n as checkPermission, r as defineAuthorizer } from "../authorizer-B3yyCVUF.js";
-import { n as parseDbStats } from "../timing-BMCWgpdZ.js";
-import { t as mailHeaders } from "../delivery-B1mKaOen.js";
+import { a as tenantCredentialRef } from "../provider-BhIkKBOh.js";
+import { o as onBlockEvent } from "../block-events-BURaqwyp.js";
+import { n as rawError } from "../block-transport-Ds0C2mUf.js";
+import { t as postgresExecutor } from "../executor-C5uyGttm.js";
+import { i as requestOf, n as checkPermission, r as defineAuthorizer } from "../authorizer-BVR2vPGA.js";
+import { n as parseDbStats } from "../timing-C5NzaEgy.js";
+import { t as organizationsEvents } from "../events-SqJLbb8q.js";
+import { t as mailHeaders } from "../delivery-Bm0jxmzI.js";
 import { toCloudEvents } from "../events/index.js";
-import { d as money, l as isRate } from "../money-95Rff2vT.js";
-import { t as SHIPPING_LINE } from "../tax-wm9g2mD2.js";
-import { t as buildApiModel } from "../build-CT6SPZkI.js";
+import { d as money, l as isRate } from "../money-BZl985O-.js";
+import { t as SHIPPING_LINE } from "../tax-keSd-q_1.js";
+import { t as buildApiModel } from "../build-DxzJf79X.js";
 import { timestamps } from "../plugins/timestamps/index.js";
 import { softDelete } from "../plugins/soft-delete/index.js";
 import { tenant } from "../plugins/tenant/index.js";
@@ -61,8 +63,9 @@ async function signTestJwt(secret, claims) {
 }
 /**
 * Accepts `signTestJwt` tokens as users, for API servers tested against the
-* local stack: `createServer(betterSupabase, { auth: { resolvers: [localAuth(secret)] } })`.
-* Tokens that are not HS256-signed with `secret` fall through. Test-only.
+* local stack: `createServer(betterSupabase, { auth: { resolvers:
+* [localAuth(secret)] } })`. Tokens that are not HS256-signed with `secret`
+* fall through. Test-only.
 */
 function localAuth(secret) {
 	const key = crypto.subtle.importKey("raw", encoder.encode(secret), {
@@ -120,8 +123,8 @@ async function signEs256(key, kid, claims) {
 	return `${header}.${body}.${toBase64Url(new Uint8Array(signature))}`;
 }
 /**
-* Signs an ES256 access token with a private JWK, the way the local stack
-* signs them once `signing_keys_path` is set. Test-only.
+* Signs an ES256 access token with a private JWK, the way the local stack signs
+* them once `signing_keys_path` is set. Test-only.
 */
 async function signTestJwtWithKey(key, claims) {
 	const { kid, ...jwk } = key;
@@ -130,7 +133,10 @@ async function signTestJwtWithKey(key, claims) {
 		namedCurve: "P-256"
 	}, false, ["sign"]), kid, claims);
 }
-/** An in-memory ES256 key pair that signs tokens like Supabase Auth's asymmetric keys. */
+/**
+* An in-memory ES256 key pair that signs tokens like Supabase Auth's asymmetric
+* keys.
+*/
 async function createTestSigner() {
 	const pair = await crypto.subtle.generateKey({
 		name: "ECDSA",
@@ -150,7 +156,10 @@ async function createTestSigner() {
 //#endregion
 //#region src/testing/local-key.ts
 const SIGNING_KEYS_PATH = /^\s*signing_keys_path\s*=\s*"([^"]+)"/m;
-/** `supabase/config.toml`'s `signing_keys_path`, else `supabase/signing_keys.json`, in `from` or a parent. */
+/**
+* `supabase/config.toml`'s `signing_keys_path`, else
+* `supabase/signing_keys.json`, in `from` or a parent.
+*/
 async function findSigningKeys(from) {
 	for (let dir = resolve(from);; dir = dirname(dir)) {
 		const supabase = join(dir, "supabase");
@@ -166,8 +175,9 @@ async function findSigningKeys(from) {
 const isSigningKey = (value) => typeof value === "object" && value !== null && "kid" in value && typeof value.kid === "string" && "d" in value && typeof value.d === "string";
 /**
 * The key the local stack signs with: the first entry of the file
-* `better-supabase keys` wrote. `path` defaults to `$SUPABASE_SIGNING_KEYS_PATH`,
-* then `signing_keys_path` from the nearest `supabase/config.toml`.
+* `better-supabase keys` wrote. `path` defaults to
+* `$SUPABASE_SIGNING_KEYS_PATH`, then `signing_keys_path` from the nearest
+* `supabase/config.toml`.
 */
 async function localSigningKey(path) {
 	const file = path ?? process.env["SUPABASE_SIGNING_KEYS_PATH"] ?? await findSigningKeys(process.cwd());
@@ -177,7 +187,10 @@ async function localSigningKey(path) {
 	if (!isSigningKey(first)) throw new TypeError(`${file} has no private ES256 key first.`);
 	return first;
 }
-/** Signs a token with the local stack's ES256 key (see `localSigningKey`). Test-only. */
+/**
+* Signs a token with the local stack's ES256 key (see `localSigningKey`).
+* Test-only.
+*/
 async function signLocalJwt(claims, path) {
 	return signTestJwtWithKey(await localSigningKey(path), claims);
 }
@@ -186,7 +199,10 @@ async function signLocalJwt(claims, path) {
 /** The local CLI stack's default JWT secret. */
 const LOCAL_JWT_SECRET = "super-secret-jwt-token-with-at-least-32-characters-long";
 const internals = /* @__PURE__ */ new WeakMap();
-/** The pool and identity behind a user from `asUser`, or `undefined` for any other object. */
+/**
+* The pool and identity behind a user from `asUser`, or `undefined` for any
+* other object.
+*/
 function internalsOf(user) {
 	return internals.get(user);
 }
@@ -214,13 +230,16 @@ async function signFor(stack, url, claims) {
 	}
 }
 /**
-* A test user against the local stack: a signed token and repositories that
-* run as that user, for live RLS tests. The token is ES256-signed with the
-* key from `better-supabase keys`; pass `{ alg: 'HS256' }` for a stack that
-* still uses the shared JWT secret.
+* A test user against the local stack: a signed token and repositories that run
+* as that user, for live RLS tests. The token is ES256-signed with the key from
+* `better-supabase keys`; pass `{ alg: 'HS256' }` for a stack that still uses
+* the shared JWT secret.
 *
 * ```ts
-* const alice = await asUser(betterSupabase, { sub: aliceId, tenant_id: acme });
+* const alice = await asUser(betterSupabase, {
+*   sub: aliceId,
+*   tenant_id: acme,
+* });
 * expect(await alice.db.customers.count().orThrow()).toBe(3);
 * ```
 */
@@ -275,11 +294,13 @@ function list(value) {
 }
 /**
 * Supabase Lite in this process, for tests without Docker: an in-memory
-* database with your schema, Auth with fresh API keys, and supabase-js
-* clients whose requests go straight to Lite's `fetch` handler (no port).
+* database with your schema, Auth with fresh API keys, and supabase-js clients
+* whose requests go straight to Lite's `fetch` handler (no port).
 *
 * ```ts
-* await using stack = await liteStack({ schemas: [await readFile("supabase/schemas/notes.sql", "utf8")] });
+* await using stack = await liteStack({
+*   schemas: [await readFile("supabase/schemas/notes.sql", "utf8")],
+* });
 * const alice = await stack.asUser(betterSupabase, { sub: aliceId });
 * expect(await alice.db.notes.count().orThrow()).toBe(1);
 * ```
@@ -461,8 +482,8 @@ async function expectPageBudget(page, expectation) {
 //#endregion
 //#region src/testing/instant.ts
 /**
-* `@next/playwright` is an optional peer: loading it on demand keeps it out
-* of apps that never call `expectInstant`, and a missing install returns
+* `@next/playwright` is an optional peer: loading it on demand keeps it out of
+* apps that never call `expectInstant`, and a missing install returns
 * `undefined` so the caller can say how to add it.
 */
 async function loadInstant() {
@@ -490,9 +511,9 @@ async function assertUnderLock(expectation) {
 }
 /**
 * Runs `during` inside `@next/playwright`'s `instant()`, checks what the
-* prefetched UI shows while the lock holds, and with `maxCalls` or
-* `maxWaves` checks the navigation's database budget like `expectDbBudget`.
-* Needs a `next build` with the testing API exposed.
+* prefetched UI shows while the lock holds, and with `maxCalls` or `maxWaves`
+* checks the navigation's database budget like `expectDbBudget`. Needs a `next
+* build` with the testing API exposed.
 */
 async function expectInstant(page, expectation) {
 	const instant = await loadInstant();
@@ -578,31 +599,31 @@ function statement(table, rows) {
 	});
 	return `insert into ${`${ident(table.schema)}.${ident(table.name)}`} (${columns.map((key) => ident(table.columns[key].db)).join(", ")}) values\n${values.join(",\n")}\non conflict do nothing;`;
 }
+function statementsOf(meta, fixtures, label) {
+	const keys = Object.keys(fixtures).filter((key) => fixtures[key] !== void 0);
+	for (const key of keys) {
+		const table = meta.tables[key];
+		if (!table) throw new TypeError(`${label}: unknown table "${key}"`);
+		if (table.kind === "view") throw new TypeError(`${label}: "${key}" is a view`);
+	}
+	return order(meta, keys).flatMap((key) => {
+		const sql = statement(meta.tables[key], fixtures[key]);
+		return sql ? [sql] : [];
+	});
+}
 /**
-* Typed fixtures shared by `supabase/seeds` and your tests. Rows use app
-* casing and Insert types; `better-supabase seed` renders them to SQL.
+* Typed fixtures shared by `supabase/seeds` and your tests. Rows use app casing
+* and Insert types; `better-supabase seed` renders them to SQL.
 *
 * ```ts
 * export const seed = defineSeed(betterSupabase, {
-*   organizations: { acme: { id: ACME, name: 'Acme' } },
-*   customers: { first: { organizationId: ACME, name: 'First customer' } },
+*   organizations: { acme: { id: ACME, name: "Acme" } },
+*   customers: { first: { organizationId: ACME, name: "First customer" } },
 * });
 * ```
 */
 function defineSeed(betterSupabase, fixtures) {
-	const meta = betterSupabase.meta;
-	const statements = () => {
-		const keys = Object.keys(fixtures).filter((key) => fixtures[key] !== void 0);
-		for (const key of keys) {
-			const table = meta.tables[key];
-			if (!table) throw new TypeError(`seed: unknown table "${key}"`);
-			if (table.kind === "view") throw new TypeError(`seed: "${key}" is a view`);
-		}
-		return order(meta, keys).flatMap((key) => {
-			const sql = statement(meta.tables[key], fixtures[key]);
-			return sql ? [sql] : [];
-		});
-	};
+	const statements = () => statementsOf(betterSupabase.meta, fixtures, "seed");
 	return {
 		[SEED]: true,
 		rows: fixtures,
@@ -613,6 +634,33 @@ function defineSeed(betterSupabase, fixtures) {
 		}
 	};
 }
+const TENANT_SEED = Symbol.for("better-supabase.tenant-seed");
+function isTenantSeed(value) {
+	return typeof value === "object" && value !== null && TENANT_SEED in value;
+}
+/**
+* Fixtures for one tenant, built from its id. `better-supabase seed --tenant`
+* applies them to existing tenants, and `seedTenantOnCreate` to each tenant
+* created in development.
+*
+* ```ts
+* export const seed = defineTenantSeed(betterSupabase, (tenant) => ({
+*   projects: {
+*     demo: { organizationId: tenant.id, name: "Demo project" },
+*   },
+* }));
+* ```
+*/
+function defineTenantSeed(betterSupabase, fixtures) {
+	const statements = (tenant) => statementsOf(betterSupabase.meta, fixtures(tenant), "tenant seed");
+	return {
+		[TENANT_SEED]: true,
+		statements,
+		async insert(sql, tenant) {
+			for (const text of statements(tenant)) await sql.queryRaw(text);
+		}
+	};
+}
 //#endregion
 //#region src/testing/scope.ts
 function env$1(names) {
@@ -623,21 +671,31 @@ function env$1(names) {
 	}
 }
 /**
-* Fresh rows for one test, so tests that run at the same time never share
-* data. It creates a new tenant id, inserts the fixtures that `build` returns
-* through the service role (RLS and plugins don't apply), and hands back the
-* inserted rows. Call `cleanup()` in `afterEach` (or `await using`) to delete
-* them. A user from `asUser` then reads them over PostgREST like any other.
+* Fresh rows for one test, so tests that run at the same time never share data.
+* It creates a new tenant id, inserts the fixtures that `build` returns through
+* the service role (RLS and plugins don't apply), and hands back the inserted
+* rows. Call `cleanup()` in `afterEach` (or `await using`) to delete them. A
+* user from `asUser` then reads them over PostgREST like any other.
 *
 * ```ts
 * const scope = await scopedSeed(
 *   betterSupabase,
 *   ({ tenant, id }) => ({
-*     customers: { first: { organizationId: tenant, name: `first-${id()}` } },
+*     customers: {
+*       first: { organizationId: tenant, name: `first-${id()}` },
+*     },
 *   }),
-*   { tenant: { table: 'organizations', row: (id) => ({ id, name: id, slug: id }) } },
+*   {
+*     tenant: {
+*       table: "organizations",
+*       row: (id) => ({ id, name: id, slug: id }),
+*     },
+*   },
 * );
-* const alice = await asUser(betterSupabase, { sub: aliceId, tenant_id: scope.tenant });
+* const alice = await asUser(betterSupabase, {
+*   sub: aliceId,
+*   tenant_id: scope.tenant,
+* });
 * expect(await alice.db.customers.count().orThrow()).toBe(1);
 * await scope.cleanup();
 * ```
@@ -672,7 +730,7 @@ async function scopedSeed(betterSupabase, build, options = {}) {
 		return created;
 	};
 	const remove = async () => {
-		const pending = cleanup.splice(0).reverse();
+		const pending = cleanup.splice(0).toReversed();
 		let failure;
 		for (const run of pending) try {
 			await run();
@@ -700,18 +758,21 @@ async function scopedSeed(betterSupabase, build, options = {}) {
 		[Symbol.asyncDispose]: remove
 	};
 }
-/** The error `withRollback` throws to end its transaction; never reaches callers. */
+/**
+* The error `withRollback` throws to end its transaction; never reaches
+* callers.
+*/
 var Rollback = class extends Error {};
 /**
-* Runs `fn` as the user over direct Postgres inside one transaction and
-* always rolls it back, so the test leaves no rows behind. `fn` gets the same
+* Runs `fn` as the user over direct Postgres inside one transaction and always
+* rolls it back, so the test leaves no rows behind. `fn` gets the same
 * repositories as `user.sql`. Only the `sql` path rolls back: `user.db` talks
 * to PostgREST over HTTP and commits on its own.
 *
 * ```ts
 * const alice = await asUser(betterSupabase, claims, { postgres });
 * await withRollback(alice, async (db) => {
-*   await db.customers.create({ organizationId, name: 'Temp' }).orThrow();
+*   await db.customers.create({ organizationId, name: "Temp" }).orThrow();
 *   expect(await db.customers.count().orThrow()).toBe(1);
 * });
 * ```
@@ -719,12 +780,40 @@ var Rollback = class extends Error {};
 async function withRollback(user, fn) {
 	const internal = internalsOf(user);
 	if (!internal?.postgres) throw new TypeError("withRollback needs a user from asUser(betterSupabase, claims, { postgres }): it rolls back over direct Postgres, not PostgREST.");
+	return rolledBack(internal.postgres, internal.claims, async (client) => {
+		return fn(internal.connect(client));
+	});
+}
+/**
+* Runs `fn` over direct Postgres as the user that `claims` describe, inside one
+* transaction that always rolls back. The transaction sets `role` (from
+* `claims.role`, else `authenticated`) and `request.jwt.claims`, so
+* `auth.uid()`, `auth.jwt()` and RLS answer as they would for that user's
+* request. Use it for raw SQL; `withRollback` gives repositories instead.
+*
+* ```ts
+* await withClaims(
+*   postgres,
+*   { sub: aliceId, tenant_id: orgId },
+*   async (sql) => {
+*     const [row] = await sql.queryRaw<{ id: string }>(
+*       "select auth.uid() as id",
+*     );
+*     expect(row?.id).toBe(aliceId);
+*   },
+* );
+* ```
+*/
+function withClaims(postgres, claims, fn) {
+	return rolledBack(postgres, claims, fn);
+}
+async function rolledBack(postgres, claims, fn) {
 	let outcome;
 	try {
-		await internal.postgres.transaction(async (client) => {
-			outcome = { value: await fn(internal.connect(client)) };
+		await postgres.transaction(async (client) => {
+			outcome = { value: await fn(client) };
 			throw new Rollback("rollback");
-		}, { claims: internal.claims });
+		}, { claims });
 	} catch (error) {
 		if (!(error instanceof Rollback) || !outcome) throw error;
 	}
@@ -732,7 +821,10 @@ async function withRollback(user, fn) {
 }
 //#endregion
 //#region src/testing/conformance.ts
-/** Thrown by a conformance kit when any check fails. Lists every failure, not just the first. */
+/**
+* Thrown by a conformance kit when any check fails. Lists every failure, not
+* just the first.
+*/
 var ConformanceError = class extends Error {
 	report;
 	constructor(report) {
@@ -803,9 +895,9 @@ function env(names) {
 /**
 * Checks row-level security between two tenants against a running stack: for
 * each table, a user of one tenant must not select, insert, update or delete
-* the other tenant's rows. Runs without `betterSupabase`'s plugins, so the `tenant()`
-* plugin can't hide a missing policy. Throws a `ConformanceError` naming each
-* table and command that leaks; removes every row it created.
+* the other tenant's rows. Runs without `betterSupabase`'s plugins, so the
+* `tenant()` plugin can't hide a missing policy. Throws a `ConformanceError`
+* naming each table and command that leaks; removes every row it created.
 *
 * ```ts
 * await expectTenantIsolation(betterSupabase, {
@@ -815,8 +907,11 @@ function env(names) {
 *   ],
 *   tables: {
 *     tags: {
-*       row: (tenant, n) => ({ organizationId: tenant.id, name: `iso-${n}` }),
-*       update: { name: 'changed' },
+*       row: (tenant, n) => ({
+*         organizationId: tenant.id,
+*         name: `iso-${n}`,
+*       }),
+*       update: { name: "changed" },
 *     },
 *   },
 * });
@@ -890,7 +985,7 @@ async function expectTenantIsolation(betterSupabase, options) {
 		}
 		return await conform("Tenant isolation", [...reads, ...deletes]);
 	} finally {
-		for (const remove of cleanup.reverse()) await remove();
+		for (const remove of cleanup.toReversed()) await remove();
 	}
 }
 //#endregion
@@ -925,13 +1020,13 @@ const agentActReadOnly = {
 	act: chain
 };
 /**
-* `supportSession` and `supportSessionReadOnly` are what `supportClaims`
-* mints (`act.kind: "support"`), `impersonation` what `actingAs` mints
-* (`act.kind: "impersonation"`), `oauthClient` a Supabase OAuth server
-* token (its identity scopes `openid` and `email` are left out of the
-* delegation), `agentChain` an RFC 8693 chain without `kind`, and
-* `agentRun` and `agentRunReadOnly` what `agentClaims` mints over that
-* chain (`act.kind: "agent"`, with `readOnly: true` for the second).
+* `supportSession` and `supportSessionReadOnly` are what `supportClaims` mints
+* (`act.kind: "support"`), `impersonation` what `actingAs` mints (`act.kind:
+* "impersonation"`), `oauthClient` a Supabase OAuth server token (its identity
+* scopes `openid` and `email` are left out of the delegation), `agentChain` an
+* RFC 8693 chain without `kind`, and `agentRun` and `agentRunReadOnly` what
+* `agentClaims` mints over that chain (`act.kind: "agent"`, with `readOnly:
+* true` for the second).
 */
 const supabaseClaimFixtures = {
 	supportSession: {
@@ -1091,12 +1186,12 @@ const refused = {
 	code: "ACTOR_INVALID"
 };
 /**
-* `legacySupportSession` is a 0.5.0 support token: `session_id` without
-* `kind`. better-supabase refuses it instead of reading it as a support
-* session; mint a new one with `supportClaims`. The others are malformed
-* levels: a support or agent `read_only` that is not a boolean, an agent
-* with a `session_id`, an empty tool name or `tools` that is not a list, a
-* `kind` better-supabase does not know, and a nested level without `sub`.
+* `legacySupportSession` is a 0.5.0 support token: `session_id` without `kind`.
+* better-supabase refuses it instead of reading it as a support session; mint a
+* new one with `supportClaims`. The others are malformed levels: a support or
+* agent `read_only` that is not a boolean, an agent with a `session_id`, an
+* empty tool name or `tools` that is not a list, a `kind` better-supabase does
+* not know, and a nested level without `sub`.
 */
 const supabaseInvalidClaimFixtures = {
 	legacySupportSession: {
@@ -1189,6 +1284,31 @@ const supabaseInvalidClaimFixtures = {
 	}
 };
 //#endregion
+//#region src/testing/tenant-seed.ts
+const development = () => process.env["NODE_ENV"] === "development";
+/**
+* Applies `seed` to each organization created through the organizations block,
+* so a new tenant starts with demo data in development. The seed runs after the
+* event and can never change the result of the create call. Returns a function
+* that stops listening.
+*
+* ```ts
+* seedTenantOnCreate(betterSupabase, tenantSeed, { sql: serviceSql });
+* ```
+*/
+function seedTenantOnCreate(betterSupabase, seed, options) {
+	if (!(options.enabled ?? development())) return () => {};
+	const report = options.onError ?? ((error, organizationId) => {
+		console.error(`better-supabase: the tenant seed failed for ${organizationId}`, error);
+	});
+	return onBlockEvent(betterSupabase, organizationsEvents, "organization.created", (event) => {
+		const id = event.data.organizationId;
+		seed.insert(options.sql, { id }).catch((error) => {
+			report(error, id);
+		});
+	});
+}
+//#endregion
 //#region src/testing/kits/executor.ts
 const recorder = (ops) => ({
 	name: "recorder",
@@ -1200,7 +1320,10 @@ const recorder = (ops) => ({
 		}));
 	}
 });
-/** The operation `run` sends to the executor, built by `betterSupabase` without touching a database. */
+/**
+* The operation `run` sends to the executor, built by `betterSupabase` without
+* touching a database.
+*/
 async function captureOp(betterSupabase, run) {
 	const ops = [];
 	await run(betterSupabase.connect(recorder(ops)));
@@ -1218,12 +1341,17 @@ const hasName = (subject) => ["has a name", () => {
 }];
 /**
 * Proves an `Executor` meets the contract: rows keyed by the selection's
-* aliases, counts, `aborted` errors, failures returned as `Result`s rather
-* than thrown, and (with `create`) a write round trip and a `deleteMany`
-* that `maxAffected` refuses without deleting anything.
+* aliases, counts, `aborted` errors, failures returned as `Result`s rather than
+* thrown, and (with `create`) a write round trip and a `deleteMany` that
+* `maxAffected` refuses without deleting anything.
 *
 * ```ts
-* it('conforms', () => testExecutor(myExecutor, { betterSupabase, table: 'tags', create: { name: 'x' } }));
+* it("conforms", () =>
+*   testExecutor(myExecutor, {
+*     betterSupabase,
+*     table: "tags",
+*     create: { name: "x" },
+*   }));
 * ```
 */
 function testExecutor(executor, options) {
@@ -1442,7 +1570,10 @@ function testCacheAdapter(adapter, options = {}) {
 }
 //#endregion
 //#region src/testing/kits/event-sink.ts
-/** Proves an `EventSink` accepts empty and full batches without mutating them, and delivers them when readable. */
+/**
+* Proves an `EventSink` accepts empty and full batches without mutating them,
+* and delivers them when readable.
+*/
 function testEventSink(sink, options = {}) {
 	const events = toCloudEvents({
 		table: "customers",
@@ -1475,11 +1606,11 @@ const half = (value) => ({
 });
 /**
 * Runs the `PaymentProvider` contract against `provider`: the API version,
-* refused amounts, a created payment and its fields, an idempotency key
-* that pays once, `not_found` for an unknown payment, and, with the
-* options that drive them, capture and refunds of an authorized payment
-* and webhook verification. Every call carries a fresh reference, so the
-* kit runs against a test account without cleanup.
+* refused amounts, a created payment and its fields, an idempotency key that
+* pays once, `not_found` for an unknown payment, and, with the options that
+* drive them, capture and refunds of an authorized payment and webhook
+* verification. Every call carries a fresh reference, so the kit runs against a
+* test account without cleanup.
 */
 function testPaymentProvider(provider, options = {}) {
 	const amount = options.amount ?? money(1000n, "EUR");
@@ -1602,11 +1733,11 @@ function testPaymentProvider(provider, options = {}) {
 const kindOf$1 = (result) => result.ok ? "ok" : result.error.kind;
 const sum = (values) => values.reduce((total, value) => total + value.amount, 0n);
 /**
-* Runs the `TaxProvider` contract against `provider`: the API version,
-* refused carts, a quote with one line per cart line in order and a total
-* that adds up, inclusive prices, shipping, exempt customers, commit, and
-* full and partial reversals with their limits. Every commit carries a
-* fresh reference, so the kit runs against a test account without cleanup.
+* Runs the `TaxProvider` contract against `provider`: the API version, refused
+* carts, a quote with one line per cart line in order and a total that adds up,
+* inclusive prices, shipping, exempt customers, commit, and full and partial
+* reversals with their limits. Every commit carries a fresh reference, so the
+* kit runs against a test account without cleanup.
 */
 function testTaxProvider(provider, options) {
 	const currency = options.currency ?? "EUR";
@@ -1740,8 +1871,8 @@ function testTaxProvider(provider, options) {
 /**
 * Proves an `IncomingDestination` accepts a delivery once per endpoint and
 * message id: a repeat reports the first id as a duplicate, while another
-* message id or another endpoint is new.
-* It delivers four messages with random endpoint ids; the destination keeps them.
+* message id or another endpoint is new. It delivers four messages with random
+* endpoint ids; the destination keeps them.
 */
 function testIncomingDestination(destination, options) {
 	const endpoint = crypto.randomUUID();
@@ -1782,11 +1913,11 @@ function testIncomingDestination(destination, options) {
 //#endregion
 //#region src/testing/kits/plugin.ts
 /**
-* Proves a `Plugin` targets API v1, installs cleanly on its own and next to
-* the first-party plugins in either order, adds repository methods without
-* replacing base ones, keeps `context`, `transformQuery` and
-* `beforeMutation` pure and deterministic, and keeps executors'
-* results intact when it wraps them.
+* Proves a `Plugin` targets API v1, installs cleanly on its own and next to the
+* first-party plugins in either order, adds repository methods without
+* replacing base ones, keeps `context`, `transformQuery` and `beforeMutation`
+* pure and deterministic, and keeps executors' results intact when it wraps
+* them.
 */
 function testPlugin(plugin, options) {
 	const { betterSupabase } = options;
@@ -1923,9 +2054,9 @@ function claimedJob(queue, row) {
 }
 /**
 * Proves a `QueueBackend` round-trips payloads, hides claimed messages for
-* their lease, counts attempts, retries and dead-letters on `fail`, and
-* (when it has `leases`) rejects a stale attempt and extends a lease. It
-* writes to `options.queue` on the backend's real store.
+* their lease, counts attempts, retries and dead-letters on `fail`, and (when
+* it has `leases`) rejects a stale attempt and extends a lease. It writes to
+* `options.queue` on the backend's real store.
 */
 function testQueueBackend(backend, options) {
 	const { queue } = options;
@@ -2005,11 +2136,11 @@ function testQueueBackend(backend, options) {
 //#endregion
 //#region src/testing/kits/support-session-store.ts
 /**
-* Proves a `SupportSessionStore` starts sessions with the input it was
-* given, shows a running session only to its admin, ends the admin's
-* previous session on start, ends a session once, lists sessions and, with
-* `expire`, leaves running sessions alone.
-* It writes sessions to the store; they are all ended when it returns.
+* Proves a `SupportSessionStore` starts sessions with the input it was given,
+* shows a running session only to its admin, ends the admin's previous session
+* on start, ends a session once, lists sessions and, with `expire`, leaves
+* running sessions alone. It writes sessions to the store; they are all ended
+* when it returns.
 */
 function testSupportSessionStore(store, options) {
 	const { admin } = options;
@@ -2207,9 +2338,9 @@ const MODULE_SERVER = {
 };
 /**
 * Proves a framework adapter refuses callers its guard rejects, answers
-* `DbError`s with their status, hides unexpected errors, applies the
-* context's cookies and hands pending event sends to `waitUntil`, the way
-* `handle()` from `better-supabase/server` does.
+* `DbError`s with their status, hides unexpected errors, applies the context's
+* cookies and hands pending event sends to `waitUntil`, the way `handle()` from
+* `better-supabase/server` does.
 */
 function testAdapter(name, options) {
 	const { events } = options.betterSupabase;
@@ -2284,13 +2415,14 @@ const REQUEST = {
 	}
 };
 /**
-* Proves a `BlockTransportMiddleware` meets the contract: it declares API 1
-* and a name, calls `next` at most once per call, leaves the request it got
+* Proves a `BlockTransportMiddleware` meets the contract: it declares API 1 and
+* a name, calls `next` at most once per call, leaves the request it got
 * unchanged, resolves when `next` does, and rejects with the database error
 * `next` rejected with, so blocks still map it to a `DbError`.
 *
 * ```ts
-* it('conforms', () => testBlockTransportMiddleware(statementTimeout('5s')));
+* it("conforms", () =>
+*   testBlockTransportMiddleware(statementTimeout("5s")));
 * ```
 */
 function testBlockTransportMiddleware(middleware) {
@@ -2348,11 +2480,11 @@ function expectRow(where, row) {
 	expect(row.status === void 0 === (row.active === void 0), `${where} needs status and active together`);
 }
 /**
-* Proves an `AuthorizationProvider` targets API v1, is plain JSON, names
-* valid scopes with a tenant scope that has an id type, writes templates
-* that are safe to inline and use the placeholders they need, lists every
-* function its templates call in `requires`, and keeps its token hook,
-* suspension rows, role sources and deciding columns well formed.
+* Proves an `AuthorizationProvider` targets API v1, is plain JSON, names valid
+* scopes with a tenant scope that has an id type, writes templates that are
+* safe to inline and use the placeholders they need, lists every function its
+* templates call in `requires`, and keeps its token hook, suspension rows, role
+* sources and deciding columns well formed.
 */
 function testAuthorizationProvider(provider) {
 	const scopes = new Set(provider.scopes.map((scope) => scope.name));
@@ -2458,12 +2590,12 @@ function testAuthorizationProvider(provider) {
 //#region src/testing/authorization-hooks.ts
 /**
 * Proves `AuthorizationHooks` target API v1 and fail closed for strangers:
-* fan-out returns only subscribers it was given, an identity nobody linked
-* and a forged ticket resolve to `null`, a requester never approves their
-* own request, an unknown publisher can neither publish nor run, an
-* unlinked chat author gets nothing, an admin with no claims cannot start
-* a support session and never approves their own, and a delegated token
-* with no scopes maps to no permissions.
+* fan-out returns only subscribers it was given, an identity nobody linked and
+* a forged ticket resolve to `null`, a requester never approves their own
+* request, an unknown publisher can neither publish nor run, an unlinked chat
+* author gets nothing, an admin with no claims cannot start a support session
+* and never approves their own, and a delegated token with no scopes maps to no
+* permissions.
 */
 function testAuthorizationHooks(hooks) {
 	const stranger = crypto.randomUUID();
@@ -2595,10 +2727,10 @@ function testAuthorizationHooks(hooks) {
 //#region src/testing/delivery-transport.ts
 const KEY = "00000000-0000-4000-8000-00000000d0f0";
 /**
-* Runs the `DeliveryTransport` contract against `transport`: API version 1,
-* the `email` channel, a provider name, and one frozen sample message it
-* sends without mutating, with the delivery id as its idempotency key.
-* Throws a `ConformanceError` listing every failed check.
+* Runs the `DeliveryTransport` contract against `transport`: API version 1, the
+* `email` channel, a provider name, and one frozen sample message it sends
+* without mutating, with the delivery id as its idempotency key. Throws a
+* `ConformanceError` listing every failed check.
 */
 function testDeliveryTransport(transport, options = {}) {
 	const message = deepFreeze({
@@ -2670,12 +2802,12 @@ const FORGED = {
 };
 /**
 * Proves an `Authorizer` targets API v1, keys every permission to the same
-* string each time (and after a JSON round trip, so references are plain
-* JSON), answers every request with a known outcome without mutating it,
-* keeps the request order in `evaluations`, decides from the subject rather
-* than the input (forged roles, claims and memberships in the resource
-* properties or the context never turn a denial into a grant), never grants an unknown permission, and grants
-* `options.granted` through `checkPermission`.
+* string each time (and after a JSON round trip, so references are plain JSON),
+* answers every request with a known outcome without mutating it, keeps the
+* request order in `evaluations`, decides from the subject rather than the
+* input (forged roles, claims and memberships in the resource properties or the
+* context never turn a denial into a grant), never grants an unknown
+* permission, and grants `options.granted` through `checkPermission`.
 */
 function testAuthorizer(authorizer, options) {
 	const { subject, context } = requestOf(void 0);
@@ -2759,9 +2891,9 @@ function testAuthorizer(authorizer, options) {
 	]);
 }
 /**
-* An in-memory `Authorizer` for tests and examples: permissions come from
-* the subject's `role` and id only, never from the request's resource or
-* context, and it ignores `subject.properties.claims`.
+* An in-memory `Authorizer` for tests and examples: permissions come from the
+* subject's `role` and id only, never from the request's resource or context,
+* and it ignores `subject.properties.claims`.
 */
 function staticAuthorizer(options) {
 	const approvals = new Set(options.approvals);
@@ -2920,12 +3052,11 @@ function diagnosticProblem(diagnostic) {
 }
 /**
 * Proves a `DocumentFormat` targets API v1, lists versions with pins and a
-* known status, defaults to a version it lists that is not a preview, and,
-* for every version: lowers the model without mutating it (also when the
-* model is frozen), renders the same document twice, renders plain JSON or
-* text, reports diagnostics with a kebab-case code, a severity and a
-* message, finds no error in its own output with `lint`, and names a bare,
-* stable file.
+* known status, defaults to a version it lists that is not a preview, and, for
+* every version: lowers the model without mutating it (also when the model is
+* frozen), renders the same document twice, renders plain JSON or text, reports
+* diagnostics with a kebab-case code, a severity and a message, finds no error
+* in its own output with `lint`, and names a bare, stable file.
 */
 function testDocumentFormat(format, options = {}) {
 	const subject = format;
@@ -3024,7 +3155,10 @@ function relativeImport(from, to) {
 	const path = [...Array.from({ length: fromParts.length - common }, () => ".."), ...toParts.slice(common)].join("/");
 	return path.startsWith(".") ? path : `./${path}`;
 }
-/** A `GeneratorModel` from schema metadata, for generators tested without a database. */
+/**
+* A `GeneratorModel` from schema metadata, for generators tested without a
+* database.
+*/
 function modelFromMeta(meta) {
 	return {
 		tables: Object.values(meta.tables).map((table) => ({
@@ -3063,7 +3197,10 @@ const EMPTY_INTROSPECTION = {
 	functions: [],
 	types: []
 };
-/** Proves a `Generator` writes relative, unique paths, is deterministic and doesn't mutate its input. */
+/**
+* Proves a `Generator` writes relative, unique paths, is deterministic and
+* doesn't mutate its input.
+*/
 function testGenerator(generator, options) {
 	const config = options.config ?? resolveConfig({}, "/project");
 	const input = () => ({
@@ -3119,8 +3256,8 @@ const rejects = async (run) => {
 };
 /**
 * Proves an `Embedder` for the knowledge and memory blocks names its model,
-* embeds an empty list to nothing, and returns one finite vector per value,
-* all of the same length on every call. It calls the real model.
+* embeds an empty list to nothing, and returns one finite vector per value, all
+* of the same length on every call. It calls the real model.
 */
 function testEmbedder(embedder, options = {}) {
 	const values = options.values ?? ["The first text.", "A second text."];
@@ -3186,8 +3323,8 @@ function testGraphCompiler(compile, options) {
 	]);
 }
 /**
-* Proves a `BuilderStarter` returns a run id and returns the same id when
-* the same idempotency key starts again. It starts real runs.
+* Proves a `BuilderStarter` returns a run id and returns the same id when the
+* same idempotency key starts again. It starts real runs.
 */
 function testBuilderStarter(start, options) {
 	const { call } = options;
@@ -3261,9 +3398,9 @@ function sample(channel, email) {
 	});
 }
 /**
-* Runs the `NotificationChannel` contract against `channel`: the API version,
-* a name, and one frozen sample message it must send without mutating.
-* Throws a `ConformanceError` listing every failed check.
+* Runs the `NotificationChannel` contract against `channel`: the API version, a
+* name, and one frozen sample message it must send without mutating. Throws a
+* `ConformanceError` listing every failed check.
 */
 function testNotificationChannel(channel, options = {}) {
 	const message = sample(channel.name, options.email ?? null);
@@ -3301,9 +3438,9 @@ function isHeaders(value) {
 	return typeof value === "object" && value !== null && Object.values(value).every((entry) => typeof entry === "string");
 }
 /**
-* Runs the `WebhookSigner` contract against `signer`: the API version, a
-* name, string headers that depend on the body and are stable for the same
-* input, and, with `verify`, a signature the receiver accepts.
+* Runs the `WebhookSigner` contract against `signer`: the API version, a name,
+* string headers that depend on the body and are stable for the same input,
+* and, with `verify`, a signature the receiver accepts.
 */
 function testWebhookSigner(signer, options = {}) {
 	const body = JSON.stringify({
@@ -3341,9 +3478,9 @@ function testWebhookSigner(signer, options = {}) {
 	]);
 }
 /**
-* Runs the `WebhookTransport` contract against `transport`: the API version,
-* a name, and one POST to `options.url` that returns an HTTP status and a
-* string body.
+* Runs the `WebhookTransport` contract against `transport`: the API version, a
+* name, and one POST to `options.url` that returns an HTTP status and a string
+* body.
 */
 function testWebhookTransport(transport, options) {
 	const body = JSON.stringify({
@@ -3375,8 +3512,8 @@ function testWebhookTransport(transport, options) {
 }
 /**
 * Runs the `WebhookSecretStore` contract against `store`: the API version, a
-* list of strings, and, when it can rotate, a new secret listed first while
-* the previous one keeps signing.
+* list of strings, and, when it can rotate, a new secret listed first while the
+* previous one keeps signing.
 */
 function testWebhookSecretStore(store, options) {
 	return conform("WebhookSecretStore", [
@@ -3405,10 +3542,10 @@ const sleep = (ms) => new Promise((resolve) => {
 	setTimeout(resolve, ms);
 });
 /**
-* Runs the Chat SDK `StateAdapter` contract against `state`: subscriptions,
-* one lock holder at a time with token-checked release and extension, lock
-* and cache TTLs, `setIfNotExists`, list trimming, and a per-thread queue
-* that keeps the newest entries, reports its depth and drops expired ones.
+* Runs the Chat SDK `StateAdapter` contract against `state`: subscriptions, one
+* lock holder at a time with token-checked release and extension, lock and
+* cache TTLs, `setIfNotExists`, list trimming, and a per-thread queue that
+* keeps the newest entries, reports its depth and drops expired ones.
 */
 function testChatState(state, options) {
 	const fresh = options.id ?? (() => `conformance-${crypto.randomUUID()}`);
@@ -3545,10 +3682,10 @@ async function collect(stream, timeoutMs) {
 }
 const hintOf = (result) => result.ok ? void 0 : result.error.hint;
 /**
-* Runs the `StreamStore` contract against `store`: the API version, open
-* once, idempotent appends that refuse gaps, reads from any index that end
-* when the stream closes, a live read that sees later appends, cancel seen by
-* the writer, a closed stream that refuses appends, and a missing stream.
+* Runs the `StreamStore` contract against `store`: the API version, open once,
+* idempotent appends that refuse gaps, reads from any index that end when the
+* stream closes, a live read that sees later appends, cancel seen by the
+* writer, a closed stream that refuses appends, and a missing stream.
 */
 function testStreamStore(store, options = {}) {
 	const fresh = options.id ?? (() => `conformance-${crypto.randomUUID()}`);
@@ -3644,11 +3781,11 @@ const APP = { type: "app" };
 const kindOf = (result) => result.ok ? void 0 : result.error.kind;
 /**
 * Runs the `CredentialProvider` contract against `provider`: the API version,
-* an unknown ref, a stored token with its headers, a new value seen after it
-* is stored, separate credentials per user and per tenant (`ref` with a
-* `tenant`, which `seed` must store too), revoke (per user, as the
-* organization purger revokes connector grants), and inbound checks that
-* accept a signed request and refuse a tampered one.
+* an unknown ref, a stored token with its headers, a new value seen after it is
+* stored, separate credentials per user and per tenant (`ref` with a `tenant`,
+* which `seed` must store too), revoke (per user, as the organization purger
+* revokes connector grants), and inbound checks that accept a signed request
+* and refuse a tampered one.
 */
 function testCredentialProvider(provider, options) {
 	const value = () => `token-${crypto.randomUUID()}`;
@@ -3765,9 +3902,9 @@ function testCredentialProvider(provider, options) {
 //#endregion
 //#region src/testing/act-cases.ts
 /**
-* The RFC 8693 `act` chains better-supabase accepts and refuses, as plain
-* JSON (`better-supabase/testing/act-cases.json`), so another library that
-* reads the same claims can run the same cases.
+* The RFC 8693 `act` chains better-supabase accepts and refuses, as plain JSON
+* (`better-supabase/testing/act-cases.json`), so another library that reads the
+* same claims can run the same cases.
 */
 const actCases = {
 	version: 1,
@@ -4086,4 +4223,4 @@ const actCases = {
 	]
 };
 //#endregion
-export { ConformanceError, LOCAL_JWT_SECRET, PROBE_INITIAL, actCases, asUser, createTestSigner, defineSeed, expectDbBudget, expectInstant, expectTenantIsolation, isSeed, liteStack, localAuth, localSigningKey, scopedSeed, signLocalJwt, signTestJwt, signTestJwtWithKey, staticAuthorizer, supabaseClaimFixtures, supabaseInvalidClaimFixtures, testAdapter, testAiTaskRunner, testAuthResolver, testAuthorizationHooks, testAuthorizationProvider, testAuthorizer, testBlockTransportMiddleware, testBuilderStarter, testCacheAdapter, testChatState, testControllerBinding, testCredentialProvider, testDeliveryTransport, testDocumentFormat, testEmbedder, testEveDocumentBackend, testEventSink, testExecutor, testGenerator, testGraphCompiler, testIncomingDestination, testNotificationChannel, testPaymentProvider, testPlugin, testQueueBackend, testStreamStore, testSupportSessionStore, testTaxProvider, testWebhookSecretStore, testWebhookSigner, testWebhookTransport, withRollback };
+export { ConformanceError, LOCAL_JWT_SECRET, PROBE_INITIAL, actCases, asUser, createTestSigner, defineSeed, defineTenantSeed, expectDbBudget, expectInstant, expectTenantIsolation, isSeed, isTenantSeed, liteStack, localAuth, localSigningKey, scopedSeed, seedTenantOnCreate, signLocalJwt, signTestJwt, signTestJwtWithKey, staticAuthorizer, supabaseClaimFixtures, supabaseInvalidClaimFixtures, testAdapter, testAiTaskRunner, testAuthResolver, testAuthorizationHooks, testAuthorizationProvider, testAuthorizer, testBlockTransportMiddleware, testBuilderStarter, testCacheAdapter, testChatState, testControllerBinding, testCredentialProvider, testDeliveryTransport, testDocumentFormat, testEmbedder, testEveDocumentBackend, testEventSink, testExecutor, testGenerator, testGraphCompiler, testIncomingDestination, testNotificationChannel, testPaymentProvider, testPlugin, testQueueBackend, testStreamStore, testSupportSessionStore, testTaxProvider, testWebhookSecretStore, testWebhookSigner, testWebhookTransport, withClaims, withRollback };