better-supabase 0.12.0 → 0.14.0

package/dist/testing/index.js

@@ -1,27 +1,31 @@
-import { t as DbException } from "../db-exception-CnWcYPxL.js";
-import { n as dbError } from "../errors-BV1SKTVs.js";
-import { d as temporalText } from "../temporal-CB5Fpo5d.js";
-import { t as temporal } from "../temporal-required-nfZ87U-0.js";
-import { a as ok } from "../result-DIeYscA3.js";
-import { t as BetterSupabase } from "../define-Bu1v781m.js";
+import { t as DbException } from "../db-exception-Lngc1W49.js";
+import { n as dbError } from "../errors-03ysrOt4.js";
+import { d as temporalText } from "../temporal-DLZlWbOi.js";
+import { t as temporal } from "../temporal-required-B8qQHYbI.js";
+import { a as ok } from "../result-B3m7xtRY.js";
+import { t as BetterSupabase } from "../define-DQznpZYl.js";
 import { t as isList } from "../guards-6F2bCtQR.js";
-import { a as toBase64Url, r as fromBase64, t as base64ToText } from "../base64-D4aqdnDR.js";
-import { o as resolveConfig } from "../config-NQmw_wsk.js";
-import { a as isScopeName, c as templateFunctions, l as templatePlaceholders, n as TEMPLATE_PLACEHOLDERS, s as scopeProblems, u as templateProblems } from "../access-sql-CTJPHjCL.js";
-import { i as seedLite, n as loadLite, r as migrateLite, t as LITE_INSTALL } from "../runtime-BOXURhEW.js";
+import { a as toBase64Url, r as fromBase64, t as base64ToText } from "../base64-B9Wlsdj7.js";
+import { c as resolveConfig } from "../config-Dn0cC3bM.js";
+import { a as isScopeName, c as templateFunctions, l as templatePlaceholders, n as TEMPLATE_PLACEHOLDERS, s as scopeProblems, u as templateProblems } from "../access-sql-CPoq9F86.js";
+import { r as TRACKING_STATUSES, t as LABEL_FORMATS } from "../statuses-zRcc2TeZ.js";
+import { i as seedLite, n as loadLite, r as migrateLite, t as LITE_INSTALL } from "../runtime-CoKxZibd.js";
 import { ENV_VARIABLES } from "../env/index.js";
-import { t as defineController } from "../controller-D6NyNrlZ.js";
+import { t as defineController } from "../controller-BEliOBOv.js";
+import { t as onBlockEvent } from "../block-event-listener-Bu6G0TFH.js";
+import { V as rawError } from "../block-helpers-CiKtrb6g.js";
 import "../replicas-BvIL4_jL.js";
-import { a as tenantCredentialRef } from "../provider-C-Ti38J6.js";
-import { n as rawError } from "../block-transport-J7ZepTq2.js";
-import { t as postgresExecutor } from "../executor-CxGQiQN_.js";
-import { i as requestOf, n as checkPermission, r as defineAuthorizer } from "../authorizer-B3yyCVUF.js";
-import { n as parseDbStats } from "../timing-BMCWgpdZ.js";
-import { t as mailHeaders } from "../delivery-B1mKaOen.js";
+import { a as tenantCredentialRef } from "../provider-EJ0-5GwJ.js";
+import { t as postgresExecutor } from "../executor-BDAGTc_O.js";
+import { i as requestOf, n as checkPermission, r as defineAuthorizer } from "../authorizer-DPTeL-7h.js";
+import { n as parseDbStats } from "../timing-C5NzaEgy.js";
+import { r as subjectKey } from "../block-subjects-Dzq5Xn_0.js";
+import { t as organizationsEvents } from "../events-SqJLbb8q.js";
+import { t as mailHeaders } from "../delivery-Bm0jxmzI.js";
 import { toCloudEvents } from "../events/index.js";
-import { d as money, l as isRate } from "../money-95Rff2vT.js";
-import { t as SHIPPING_LINE } from "../tax-wm9g2mD2.js";
-import { t as buildApiModel } from "../build-CT6SPZkI.js";
+import { c as isMoney, d as money, l as isRate } from "../money-BZl985O-.js";
+import { t as SHIPPING_LINE } from "../tax-DmOMjrYc.js";
+import { t as buildApiModel } from "../build-DCfpwg78.js";
 import { timestamps } from "../plugins/timestamps/index.js";
 import { softDelete } from "../plugins/soft-delete/index.js";
 import { tenant } from "../plugins/tenant/index.js";
@@ -61,8 +65,9 @@ async function signTestJwt(secret, claims) {
 }
 /**
 * Accepts `signTestJwt` tokens as users, for API servers tested against the
-* local stack: `createServer(betterSupabase, { auth: { resolvers: [localAuth(secret)] } })`.
-* Tokens that are not HS256-signed with `secret` fall through. Test-only.
+* local stack: `createServer(betterSupabase, { auth: { resolvers:
+* [localAuth(secret)] } })`. Tokens that are not HS256-signed with `secret`
+* fall through. Test-only.
 */
 function localAuth(secret) {
 	const key = crypto.subtle.importKey("raw", encoder.encode(secret), {
@@ -120,8 +125,8 @@ async function signEs256(key, kid, claims) {
 	return `${header}.${body}.${toBase64Url(new Uint8Array(signature))}`;
 }
 /**
-* Signs an ES256 access token with a private JWK, the way the local stack
-* signs them once `signing_keys_path` is set. Test-only.
+* Signs an ES256 access token with a private JWK, the way the local stack signs
+* them once `signing_keys_path` is set. Test-only.
 */
 async function signTestJwtWithKey(key, claims) {
 	const { kid, ...jwk } = key;
@@ -130,7 +135,10 @@ async function signTestJwtWithKey(key, claims) {
 		namedCurve: "P-256"
 	}, false, ["sign"]), kid, claims);
 }
-/** An in-memory ES256 key pair that signs tokens like Supabase Auth's asymmetric keys. */
+/**
+* An in-memory ES256 key pair that signs tokens like Supabase Auth's asymmetric
+* keys.
+*/
 async function createTestSigner() {
 	const pair = await crypto.subtle.generateKey({
 		name: "ECDSA",
@@ -150,7 +158,10 @@ async function createTestSigner() {
 //#endregion
 //#region src/testing/local-key.ts
 const SIGNING_KEYS_PATH = /^\s*signing_keys_path\s*=\s*"([^"]+)"/m;
-/** `supabase/config.toml`'s `signing_keys_path`, else `supabase/signing_keys.json`, in `from` or a parent. */
+/**
+* `supabase/config.toml`'s `signing_keys_path`, else
+* `supabase/signing_keys.json`, in `from` or a parent.
+*/
 async function findSigningKeys(from) {
 	for (let dir = resolve(from);; dir = dirname(dir)) {
 		const supabase = join(dir, "supabase");
@@ -166,8 +177,9 @@ async function findSigningKeys(from) {
 const isSigningKey = (value) => typeof value === "object" && value !== null && "kid" in value && typeof value.kid === "string" && "d" in value && typeof value.d === "string";
 /**
 * The key the local stack signs with: the first entry of the file
-* `better-supabase keys` wrote. `path` defaults to `$SUPABASE_SIGNING_KEYS_PATH`,
-* then `signing_keys_path` from the nearest `supabase/config.toml`.
+* `better-supabase keys` wrote. `path` defaults to
+* `$SUPABASE_SIGNING_KEYS_PATH`, then `signing_keys_path` from the nearest
+* `supabase/config.toml`.
 */
 async function localSigningKey(path) {
 	const file = path ?? process.env["SUPABASE_SIGNING_KEYS_PATH"] ?? await findSigningKeys(process.cwd());
@@ -177,7 +189,10 @@ async function localSigningKey(path) {
 	if (!isSigningKey(first)) throw new TypeError(`${file} has no private ES256 key first.`);
 	return first;
 }
-/** Signs a token with the local stack's ES256 key (see `localSigningKey`). Test-only. */
+/**
+* Signs a token with the local stack's ES256 key (see `localSigningKey`).
+* Test-only.
+*/
 async function signLocalJwt(claims, path) {
 	return signTestJwtWithKey(await localSigningKey(path), claims);
 }
@@ -186,7 +201,10 @@ async function signLocalJwt(claims, path) {
 /** The local CLI stack's default JWT secret. */
 const LOCAL_JWT_SECRET = "super-secret-jwt-token-with-at-least-32-characters-long";
 const internals = /* @__PURE__ */ new WeakMap();
-/** The pool and identity behind a user from `asUser`, or `undefined` for any other object. */
+/**
+* The pool and identity behind a user from `asUser`, or `undefined` for any
+* other object.
+*/
 function internalsOf(user) {
 	return internals.get(user);
 }
@@ -214,13 +232,16 @@ async function signFor(stack, url, claims) {
 	}
 }
 /**
-* A test user against the local stack: a signed token and repositories that
-* run as that user, for live RLS tests. The token is ES256-signed with the
-* key from `better-supabase keys`; pass `{ alg: 'HS256' }` for a stack that
-* still uses the shared JWT secret.
+* A test user against the local stack: a signed token and repositories that run
+* as that user, for live RLS tests. The token is ES256-signed with the key from
+* `better-supabase keys`; pass `{ alg: 'HS256' }` for a stack that still uses
+* the shared JWT secret.
 *
 * ```ts
-* const alice = await asUser(betterSupabase, { sub: aliceId, tenant_id: acme });
+* const alice = await asUser(betterSupabase, {
+*   sub: aliceId,
+*   tenant_id: acme,
+* });
 * expect(await alice.db.customers.count().orThrow()).toBe(3);
 * ```
 */
@@ -275,11 +296,13 @@ function list(value) {
 }
 /**
 * Supabase Lite in this process, for tests without Docker: an in-memory
-* database with your schema, Auth with fresh API keys, and supabase-js
-* clients whose requests go straight to Lite's `fetch` handler (no port).
+* database with your schema, Auth with fresh API keys, and supabase-js clients
+* whose requests go straight to Lite's `fetch` handler (no port).
 *
 * ```ts
-* await using stack = await liteStack({ schemas: [await readFile("supabase/schemas/notes.sql", "utf8")] });
+* await using stack = await liteStack({
+*   schemas: [await readFile("supabase/schemas/notes.sql", "utf8")],
+* });
 * const alice = await stack.asUser(betterSupabase, { sub: aliceId });
 * expect(await alice.db.notes.count().orThrow()).toBe(1);
 * ```
@@ -461,8 +484,8 @@ async function expectPageBudget(page, expectation) {
 //#endregion
 //#region src/testing/instant.ts
 /**
-* `@next/playwright` is an optional peer: loading it on demand keeps it out
-* of apps that never call `expectInstant`, and a missing install returns
+* `@next/playwright` is an optional peer: loading it on demand keeps it out of
+* apps that never call `expectInstant`, and a missing install returns
 * `undefined` so the caller can say how to add it.
 */
 async function loadInstant() {
@@ -490,9 +513,9 @@ async function assertUnderLock(expectation) {
 }
 /**
 * Runs `during` inside `@next/playwright`'s `instant()`, checks what the
-* prefetched UI shows while the lock holds, and with `maxCalls` or
-* `maxWaves` checks the navigation's database budget like `expectDbBudget`.
-* Needs a `next build` with the testing API exposed.
+* prefetched UI shows while the lock holds, and with `maxCalls` or `maxWaves`
+* checks the navigation's database budget like `expectDbBudget`. Needs a `next
+* build` with the testing API exposed.
 */
 async function expectInstant(page, expectation) {
 	const instant = await loadInstant();
@@ -578,31 +601,31 @@ function statement(table, rows) {
 	});
 	return `insert into ${`${ident(table.schema)}.${ident(table.name)}`} (${columns.map((key) => ident(table.columns[key].db)).join(", ")}) values\n${values.join(",\n")}\non conflict do nothing;`;
 }
+function statementsOf(meta, fixtures, label) {
+	const keys = Object.keys(fixtures).filter((key) => fixtures[key] !== void 0);
+	for (const key of keys) {
+		const table = meta.tables[key];
+		if (!table) throw new TypeError(`${label}: unknown table "${key}"`);
+		if (table.kind === "view") throw new TypeError(`${label}: "${key}" is a view`);
+	}
+	return order(meta, keys).flatMap((key) => {
+		const sql = statement(meta.tables[key], fixtures[key]);
+		return sql ? [sql] : [];
+	});
+}
 /**
-* Typed fixtures shared by `supabase/seeds` and your tests. Rows use app
-* casing and Insert types; `better-supabase seed` renders them to SQL.
+* Typed fixtures shared by `supabase/seeds` and your tests. Rows use app casing
+* and Insert types; `better-supabase seed` renders them to SQL.
 *
 * ```ts
 * export const seed = defineSeed(betterSupabase, {
-*   organizations: { acme: { id: ACME, name: 'Acme' } },
-*   customers: { first: { organizationId: ACME, name: 'First customer' } },
+*   organizations: { acme: { id: ACME, name: "Acme" } },
+*   customers: { first: { organizationId: ACME, name: "First customer" } },
 * });
 * ```
 */
 function defineSeed(betterSupabase, fixtures) {
-	const meta = betterSupabase.meta;
-	const statements = () => {
-		const keys = Object.keys(fixtures).filter((key) => fixtures[key] !== void 0);
-		for (const key of keys) {
-			const table = meta.tables[key];
-			if (!table) throw new TypeError(`seed: unknown table "${key}"`);
-			if (table.kind === "view") throw new TypeError(`seed: "${key}" is a view`);
-		}
-		return order(meta, keys).flatMap((key) => {
-			const sql = statement(meta.tables[key], fixtures[key]);
-			return sql ? [sql] : [];
-		});
-	};
+	const statements = () => statementsOf(betterSupabase.meta, fixtures, "seed");
 	return {
 		[SEED]: true,
 		rows: fixtures,
@@ -613,6 +636,33 @@ function defineSeed(betterSupabase, fixtures) {
 		}
 	};
 }
+const TENANT_SEED = Symbol.for("better-supabase.tenant-seed");
+function isTenantSeed(value) {
+	return typeof value === "object" && value !== null && TENANT_SEED in value;
+}
+/**
+* Fixtures for one tenant, built from its id. `better-supabase seed --tenant`
+* applies them to existing tenants, and `seedTenantOnCreate` to each tenant
+* created in development.
+*
+* ```ts
+* export const seed = defineTenantSeed(betterSupabase, (tenant) => ({
+*   projects: {
+*     demo: { organizationId: tenant.id, name: "Demo project" },
+*   },
+* }));
+* ```
+*/
+function defineTenantSeed(betterSupabase, fixtures) {
+	const statements = (tenant) => statementsOf(betterSupabase.meta, fixtures(tenant), "tenant seed");
+	return {
+		[TENANT_SEED]: true,
+		statements,
+		async insert(sql, tenant) {
+			for (const text of statements(tenant)) await sql.queryRaw(text);
+		}
+	};
+}
 //#endregion
 //#region src/testing/scope.ts
 function env$1(names) {
@@ -623,21 +673,31 @@ function env$1(names) {
 	}
 }
 /**
-* Fresh rows for one test, so tests that run at the same time never share
-* data. It creates a new tenant id, inserts the fixtures that `build` returns
-* through the service role (RLS and plugins don't apply), and hands back the
-* inserted rows. Call `cleanup()` in `afterEach` (or `await using`) to delete
-* them. A user from `asUser` then reads them over PostgREST like any other.
+* Fresh rows for one test, so tests that run at the same time never share data.
+* It creates a new tenant id, inserts the fixtures that `build` returns through
+* the service role (RLS and plugins don't apply), and hands back the inserted
+* rows. Call `cleanup()` in `afterEach` (or `await using`) to delete them. A
+* user from `asUser` then reads them over PostgREST like any other.
 *
 * ```ts
 * const scope = await scopedSeed(
 *   betterSupabase,
 *   ({ tenant, id }) => ({
-*     customers: { first: { organizationId: tenant, name: `first-${id()}` } },
+*     customers: {
+*       first: { organizationId: tenant, name: `first-${id()}` },
+*     },
 *   }),
-*   { tenant: { table: 'organizations', row: (id) => ({ id, name: id, slug: id }) } },
+*   {
+*     tenant: {
+*       table: "organizations",
+*       row: (id) => ({ id, name: id, slug: id }),
+*     },
+*   },
 * );
-* const alice = await asUser(betterSupabase, { sub: aliceId, tenant_id: scope.tenant });
+* const alice = await asUser(betterSupabase, {
+*   sub: aliceId,
+*   tenant_id: scope.tenant,
+* });
 * expect(await alice.db.customers.count().orThrow()).toBe(1);
 * await scope.cleanup();
 * ```
@@ -672,7 +732,7 @@ async function scopedSeed(betterSupabase, build, options = {}) {
 		return created;
 	};
 	const remove = async () => {
-		const pending = cleanup.splice(0).reverse();
+		const pending = cleanup.splice(0).toReversed();
 		let failure;
 		for (const run of pending) try {
 			await run();
@@ -700,18 +760,21 @@ async function scopedSeed(betterSupabase, build, options = {}) {
 		[Symbol.asyncDispose]: remove
 	};
 }
-/** The error `withRollback` throws to end its transaction; never reaches callers. */
+/**
+* The error `withRollback` throws to end its transaction; never reaches
+* callers.
+*/
 var Rollback = class extends Error {};
 /**
-* Runs `fn` as the user over direct Postgres inside one transaction and
-* always rolls it back, so the test leaves no rows behind. `fn` gets the same
+* Runs `fn` as the user over direct Postgres inside one transaction and always
+* rolls it back, so the test leaves no rows behind. `fn` gets the same
 * repositories as `user.sql`. Only the `sql` path rolls back: `user.db` talks
 * to PostgREST over HTTP and commits on its own.
 *
 * ```ts
 * const alice = await asUser(betterSupabase, claims, { postgres });
 * await withRollback(alice, async (db) => {
-*   await db.customers.create({ organizationId, name: 'Temp' }).orThrow();
+*   await db.customers.create({ organizationId, name: "Temp" }).orThrow();
 *   expect(await db.customers.count().orThrow()).toBe(1);
 * });
 * ```
@@ -719,20 +782,102 @@ var Rollback = class extends Error {};
 async function withRollback(user, fn) {
 	const internal = internalsOf(user);
 	if (!internal?.postgres) throw new TypeError("withRollback needs a user from asUser(betterSupabase, claims, { postgres }): it rolls back over direct Postgres, not PostgREST.");
+	return rolledBack(internal.postgres, internal.claims, async (client) => {
+		return fn(internal.connect(client));
+	});
+}
+/**
+* Runs `fn` over direct Postgres as the user that `claims` describe, inside one
+* transaction that always rolls back. The transaction sets `role` (from
+* `claims.role`, else `authenticated`) and `request.jwt.claims`, so
+* `auth.uid()`, `auth.jwt()` and RLS answer as they would for that user's
+* request. Use it for raw SQL; `withRollback` gives repositories instead.
+*
+* ```ts
+* await withClaims(
+*   postgres,
+*   { sub: aliceId, tenant_id: orgId },
+*   async (sql) => {
+*     const [row] = await sql.queryRaw<{ id: string }>(
+*       "select auth.uid() as id",
+*     );
+*     expect(row?.id).toBe(aliceId);
+*   },
+* );
+* ```
+*/
+function withClaims(postgres, claims, fn) {
+	return rolledBack(postgres, claims, fn);
+}
+async function rolledBack(postgres, claims, fn) {
 	let outcome;
 	try {
-		await internal.postgres.transaction(async (client) => {
-			outcome = { value: await fn(internal.connect(client)) };
+		await postgres.transaction(async (client) => {
+			outcome = { value: await fn(client) };
 			throw new Rollback("rollback");
-		}, { claims: internal.claims });
+		}, { claims });
 	} catch (error) {
 		if (!(error instanceof Rollback) || !outcome) throw error;
 	}
 	return outcome.value;
 }
 //#endregion
+//#region src/testing/factory.ts
+function isRow(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) && Object.getPrototypeOf(value) === Object.prototype;
+}
+/**
+* A factory from the defaults of call `n` and the foreign keys it resolves,
+* each mapped to the column it references in the parent row. `factories()`
+* generates one per table:
+*
+* ```ts
+* const tasks = defineFactory<
+*   InsertOf<"tasks">,
+*   "customerId",
+*   "customerId"
+* >((n) => ({ title: `title ${n}` }), { customerId: "id" });
+* tasks({ customerId: acme });
+* ```
+*/
+function defineFactory(defaults, refs) {
+	const columns = refs;
+	let calls = 0;
+	const build = (input = {}) => {
+		calls += 1;
+		const row = { ...defaults(calls) };
+		for (const [key, value] of Object.entries(input)) {
+			const column = columns[key];
+			row[key] = column !== void 0 && isRow(value) ? value[column] : value;
+		}
+		return row;
+	};
+	const factory = (...args) => build(args[0]);
+	return Object.assign(factory, {
+		many: (count, ...args) => Array.from({ length: count }, () => build(args[0])),
+		create: (repository, ...args) => repository.create(build(args[0]))
+	});
+}
+/** A storage path in bucket `B` for a factory default. */
+function factoryPath(_bucket, path) {
+	return path;
+}
+/**
+* The fixed times the generated factories use (2026-01-01), read through the
+* Temporal the app provides.
+*/
+const factoryTime = {
+	instant: () => temporal().Instant.from("2026-01-01T00:00:00Z"),
+	plainDate: () => temporal().PlainDate.from("2026-01-01"),
+	plainDateTime: () => temporal().PlainDateTime.from("2026-01-01T00:00:00"),
+	plainTime: () => temporal().PlainTime.from("00:00:00")
+};
+//#endregion
 //#region src/testing/conformance.ts
-/** Thrown by a conformance kit when any check fails. Lists every failure, not just the first. */
+/**
+* Thrown by a conformance kit when any check fails. Lists every failure, not
+* just the first.
+*/
 var ConformanceError = class extends Error {
 	report;
 	constructor(report) {
@@ -803,9 +948,9 @@ function env(names) {
 /**
 * Checks row-level security between two tenants against a running stack: for
 * each table, a user of one tenant must not select, insert, update or delete
-* the other tenant's rows. Runs without `betterSupabase`'s plugins, so the `tenant()`
-* plugin can't hide a missing policy. Throws a `ConformanceError` naming each
-* table and command that leaks; removes every row it created.
+* the other tenant's rows. Runs without `betterSupabase`'s plugins, so the
+* `tenant()` plugin can't hide a missing policy. Throws a `ConformanceError`
+* naming each table and command that leaks; removes every row it created.
 *
 * ```ts
 * await expectTenantIsolation(betterSupabase, {
@@ -815,8 +960,11 @@ function env(names) {
 *   ],
 *   tables: {
 *     tags: {
-*       row: (tenant, n) => ({ organizationId: tenant.id, name: `iso-${n}` }),
-*       update: { name: 'changed' },
+*       row: (tenant, n) => ({
+*         organizationId: tenant.id,
+*         name: `iso-${n}`,
+*       }),
+*       update: { name: "changed" },
 *     },
 *   },
 * });
@@ -890,7 +1038,7 @@ async function expectTenantIsolation(betterSupabase, options) {
 		}
 		return await conform("Tenant isolation", [...reads, ...deletes]);
 	} finally {
-		for (const remove of cleanup.reverse()) await remove();
+		for (const remove of cleanup.toReversed()) await remove();
 	}
 }
 //#endregion
@@ -925,13 +1073,13 @@ const agentActReadOnly = {
 	act: chain
 };
 /**
-* `supportSession` and `supportSessionReadOnly` are what `supportClaims`
-* mints (`act.kind: "support"`), `impersonation` what `actingAs` mints
-* (`act.kind: "impersonation"`), `oauthClient` a Supabase OAuth server
-* token (its identity scopes `openid` and `email` are left out of the
-* delegation), `agentChain` an RFC 8693 chain without `kind`, and
-* `agentRun` and `agentRunReadOnly` what `agentClaims` mints over that
-* chain (`act.kind: "agent"`, with `readOnly: true` for the second).
+* `supportSession` and `supportSessionReadOnly` are what `supportClaims` mints
+* (`act.kind: "support"`), `impersonation` what `actingAs` mints (`act.kind:
+* "impersonation"`), `oauthClient` a Supabase OAuth server token (its identity
+* scopes `openid` and `email` are left out of the delegation), `agentChain` an
+* RFC 8693 chain without `kind`, and `agentRun` and `agentRunReadOnly` what
+* `agentClaims` mints over that chain (`act.kind: "agent"`, with `readOnly:
+* true` for the second).
 */
 const supabaseClaimFixtures = {
 	supportSession: {
@@ -1091,12 +1239,12 @@ const refused = {
 	code: "ACTOR_INVALID"
 };
 /**
-* `legacySupportSession` is a 0.5.0 support token: `session_id` without
-* `kind`. better-supabase refuses it instead of reading it as a support
-* session; mint a new one with `supportClaims`. The others are malformed
-* levels: a support or agent `read_only` that is not a boolean, an agent
-* with a `session_id`, an empty tool name or `tools` that is not a list, a
-* `kind` better-supabase does not know, and a nested level without `sub`.
+* `legacySupportSession` is a 0.5.0 support token: `session_id` without `kind`.
+* better-supabase refuses it instead of reading it as a support session; mint a
+* new one with `supportClaims`. The others are malformed levels: a support or
+* agent `read_only` that is not a boolean, an agent with a `session_id`, an
+* empty tool name or `tools` that is not a list, a `kind` better-supabase does
+* not know, and a nested level without `sub`.
 */
 const supabaseInvalidClaimFixtures = {
 	legacySupportSession: {
@@ -1189,6 +1337,31 @@ const supabaseInvalidClaimFixtures = {
 	}
 };
 //#endregion
+//#region src/testing/tenant-seed.ts
+const development = () => process.env["NODE_ENV"] === "development";
+/**
+* Applies `seed` to each organization created through the organizations block,
+* so a new tenant starts with demo data in development. The seed runs after the
+* event and can never change the result of the create call. Returns a function
+* that stops listening.
+*
+* ```ts
+* seedTenantOnCreate(betterSupabase, tenantSeed, { sql: serviceSql });
+* ```
+*/
+function seedTenantOnCreate(betterSupabase, seed, options) {
+	if (!(options.enabled ?? development())) return () => {};
+	const report = options.onError ?? ((error, organizationId) => {
+		console.error(`better-supabase: the tenant seed failed for ${organizationId}`, error);
+	});
+	return onBlockEvent(betterSupabase, organizationsEvents, "organization.created", (event) => {
+		const id = event.data.organizationId;
+		seed.insert(options.sql, { id }).catch((error) => {
+			report(error, id);
+		});
+	});
+}
+//#endregion
 //#region src/testing/kits/executor.ts
 const recorder = (ops) => ({
 	name: "recorder",
@@ -1200,7 +1373,10 @@ const recorder = (ops) => ({
 		}));
 	}
 });
-/** The operation `run` sends to the executor, built by `betterSupabase` without touching a database. */
+/**
+* The operation `run` sends to the executor, built by `betterSupabase` without
+* touching a database.
+*/
 async function captureOp(betterSupabase, run) {
 	const ops = [];
 	await run(betterSupabase.connect(recorder(ops)));
@@ -1218,12 +1394,17 @@ const hasName = (subject) => ["has a name", () => {
 }];
 /**
 * Proves an `Executor` meets the contract: rows keyed by the selection's
-* aliases, counts, `aborted` errors, failures returned as `Result`s rather
-* than thrown, and (with `create`) a write round trip and a `deleteMany`
-* that `maxAffected` refuses without deleting anything.
+* aliases, counts, `aborted` errors, failures returned as `Result`s rather than
+* thrown, and (with `create`) a write round trip and a `deleteMany` that
+* `maxAffected` refuses without deleting anything.
 *
 * ```ts
-* it('conforms', () => testExecutor(myExecutor, { betterSupabase, table: 'tags', create: { name: 'x' } }));
+* it("conforms", () =>
+*   testExecutor(myExecutor, {
+*     betterSupabase,
+*     table: "tags",
+*     create: { name: "x" },
+*   }));
 * ```
 */
 function testExecutor(executor, options) {
@@ -1442,7 +1623,10 @@ function testCacheAdapter(adapter, options = {}) {
 }
 //#endregion
 //#region src/testing/kits/event-sink.ts
-/** Proves an `EventSink` accepts empty and full batches without mutating them, and delivers them when readable. */
+/**
+* Proves an `EventSink` accepts empty and full batches without mutating them,
+* and delivers them when readable.
+*/
 function testEventSink(sink, options = {}) {
 	const events = toCloudEvents({
 		table: "customers",
@@ -1468,18 +1652,18 @@ function testEventSink(sink, options = {}) {
 }
 //#endregion
 //#region src/testing/kits/payment-provider.ts
-const kindOf$2 = (result) => result.ok ? "ok" : result.error.kind;
+const kindOf$3 = (result) => result.ok ? "ok" : result.error.kind;
 const half = (value) => ({
 	amount: value.amount / 2n,
 	currency: value.currency
 });
 /**
 * Runs the `PaymentProvider` contract against `provider`: the API version,
-* refused amounts, a created payment and its fields, an idempotency key
-* that pays once, `not_found` for an unknown payment, and, with the
-* options that drive them, capture and refunds of an authorized payment
-* and webhook verification. Every call carries a fresh reference, so the
-* kit runs against a test account without cleanup.
+* refused amounts, a created payment and its fields, an idempotency key that
+* pays once, `not_found` for an unknown payment, and, with the options that
+* drive them, capture and refunds of an authorized payment and webhook
+* verification. Every call carries a fresh reference, so the kit runs against a
+* test account without cleanup.
 */
 function testPaymentProvider(provider, options = {}) {
 	const amount = options.amount ?? money(1000n, "EUR");
@@ -1508,12 +1692,12 @@ function testPaymentProvider(provider, options = {}) {
 				},
 				reference: reference()
 			});
-			expect(kindOf$2(zero) === "invalid_input", `zero gave ${kindOf$2(zero)}`);
+			expect(kindOf$3(zero) === "invalid_input", `zero gave ${kindOf$3(zero)}`);
 			const plain = await provider.createPayment({
 				amount: 1e3,
 				reference: reference()
 			});
-			expect(kindOf$2(plain) === "invalid_input", `a number gave ${kindOf$2(plain)}`);
+			expect(kindOf$3(plain) === "invalid_input", `a number gave ${kindOf$3(plain)}`);
 		}],
 		["creates a payment with its amount, reference and provider", async () => {
 			const ref = reference();
@@ -1541,9 +1725,9 @@ function testPaymentProvider(provider, options = {}) {
 		["returns not_found for an unknown payment", async () => {
 			const id = `conformance_missing_${crypto.randomUUID()}`;
 			const captured = await provider.capture(id);
-			expect(kindOf$2(captured) === "not_found", `capture gave ${kindOf$2(captured)}`);
+			expect(kindOf$3(captured) === "not_found", `capture gave ${kindOf$3(captured)}`);
 			const refunded = await provider.refund(id);
-			expect(kindOf$2(refunded) === "not_found", `refund gave ${kindOf$2(refunded)}`);
+			expect(kindOf$3(refunded) === "not_found", `refund gave ${kindOf$3(refunded)}`);
 		}],
 		provider.get !== void 0 && ["reads a payment back", async () => {
 			const created = await provider.createPayment({
@@ -1569,7 +1753,7 @@ function testPaymentProvider(provider, options = {}) {
 			expect(refund.amount.amount === part.amount, `refunded ${String(refund.amount.amount)}`);
 			expect(refund.status === "succeeded" || refund.status === "pending", `refund status is ${refund.status}`);
 			const tooMuch = await provider.refund(payment.id, { amount });
-			expect(kindOf$2(tooMuch) === "invalid_input", `refunding more than is left gave ${kindOf$2(tooMuch)}`);
+			expect(kindOf$3(tooMuch) === "invalid_input", `refunding more than is left gave ${kindOf$3(tooMuch)}`);
 		}],
 		provider.cancel !== void 0 && ["cancels a payment that was not captured", async () => {
 			const created = await provider.createPayment({
@@ -1593,20 +1777,20 @@ function testPaymentProvider(provider, options = {}) {
 				expect(event.paymentId === payment.id, `an event names payment ${event.paymentId}`);
 			}
 			const refused = await provider.parseWebhook(tampered);
-			expect(kindOf$2(refused) === "unauthorized", `a tampered delivery gave ${kindOf$2(refused)}`);
+			expect(kindOf$3(refused) === "unauthorized", `a tampered delivery gave ${kindOf$3(refused)}`);
 		}]
 	]);
 }
 //#endregion
 //#region src/testing/kits/tax-provider.ts
-const kindOf$1 = (result) => result.ok ? "ok" : result.error.kind;
+const kindOf$2 = (result) => result.ok ? "ok" : result.error.kind;
 const sum = (values) => values.reduce((total, value) => total + value.amount, 0n);
 /**
-* Runs the `TaxProvider` contract against `provider`: the API version,
-* refused carts, a quote with one line per cart line in order and a total
-* that adds up, inclusive prices, shipping, exempt customers, commit, and
-* full and partial reversals with their limits. Every commit carries a
-* fresh reference, so the kit runs against a test account without cleanup.
+* Runs the `TaxProvider` contract against `provider`: the API version, refused
+* carts, a quote with one line per cart line in order and a total that adds up,
+* inclusive prices, shipping, exempt customers, commit, and full and partial
+* reversals with their limits. Every commit carries a fresh reference, so the
+* kit runs against a test account without cleanup.
 */
 function testTaxProvider(provider, options) {
 	const currency = options.currency ?? "EUR";
@@ -1651,12 +1835,12 @@ function testTaxProvider(provider, options) {
 				id: "a",
 				amount: money(100n, other)
 			}] }));
-			expect(kindOf$1(mixed) === "invalid_input", `mixed currencies gave ${kindOf$1(mixed)}`);
+			expect(kindOf$2(mixed) === "invalid_input", `mixed currencies gave ${kindOf$2(mixed)}`);
 			const nowhere = await provider.quote(cart({ address: {
 				...address,
 				country: ""
 			} }));
-			expect(kindOf$1(nowhere) === "invalid_input", `no country gave ${kindOf$1(nowhere)}`);
+			expect(kindOf$2(nowhere) === "invalid_input", `no country gave ${kindOf$2(nowhere)}`);
 		}],
 		["quotes one line per cart line, in order, with a total that adds up", async () => {
 			const quote = await provider.quote(cart()).orThrow();
@@ -1722,7 +1906,7 @@ function testTaxProvider(provider, options) {
 					amount: money(sold.taxable.amount + 1n, currency)
 				}]
 			});
-			expect(kindOf$1(tooMuch) === "invalid_input", `reversing more than was sold gave ${kindOf$1(tooMuch)}`);
+			expect(kindOf$2(tooMuch) === "invalid_input", `reversing more than was sold gave ${kindOf$2(tooMuch)}`);
 			const unknown = await provider.reverse({
 				transaction: sale,
 				reference: reference(),
@@ -1731,7 +1915,135 @@ function testTaxProvider(provider, options) {
 					lineId: "conformance-unknown"
 				}]
 			});
-			expect(kindOf$1(unknown) === "invalid_input", `an unknown line gave ${kindOf$1(unknown)}`);
+			expect(kindOf$2(unknown) === "invalid_input", `an unknown line gave ${kindOf$2(unknown)}`);
+		}]
+	]);
+}
+//#endregion
+//#region src/testing/kits/shipment-carrier.ts
+const kindOf$1 = (result) => result.ok ? "ok" : result.error.kind;
+const formats = LABEL_FORMATS;
+const statuses = TRACKING_STATUSES;
+function eventsValid(events, where, ordered) {
+	for (const [index, event] of events.entries()) {
+		expect(event.id.length > 0, `${where}: event ${index} has no id`);
+		expect(statuses.includes(event.status), `${where}: event ${event.id} has status "${event.status}"`);
+		const previous = events[index - 1];
+		expect(!ordered || previous === void 0 || previous.occurredAt.epochNanoseconds <= event.occurredAt.epochNanoseconds, `${where}: events are not oldest first`);
+	}
+}
+/**
+* Runs the `ShipmentCarrier` contract against `carrier`: the API version,
+* refused requests, rates, a label with idempotent retries, tracking, voiding
+* the label and, with `webhook`, signed and forged tracking webhooks. Run it
+* against a carrier's test account: it buys one label and voids it.
+*/
+function testShipmentCarrier(carrier, options) {
+	const request = {
+		from: options.from,
+		to: options.to,
+		parcels: [{
+			weightGrams: 1200,
+			lengthMm: 300,
+			widthMm: 200,
+			heightMm: 100
+		}],
+		...options.currency === void 0 ? {} : { currency: options.currency }
+	};
+	const reference = `conformance-${crypto.randomUUID()}`;
+	const key = `conformance-${crypto.randomUUID()}`;
+	let label;
+	const bought = async () => {
+		label ??= await carrier.createLabel({
+			...request,
+			service: options.service,
+			reference
+		}, { idempotencyKey: key }).orThrow();
+		return label;
+	};
+	return conform(`ShipmentCarrier "${carrier.name}"`, [
+		["has apiVersion 1 and a name", () => {
+			const version = carrier.apiVersion;
+			expect(version === 1, `apiVersion is ${String(version)}`);
+			expect(carrier.name.length > 0, "name is empty");
+		}],
+		["refuses a request without packages or with a bad country", async () => {
+			const empty = await carrier.rates({
+				...request,
+				parcels: []
+			});
+			expect(kindOf$1(empty) === "invalid_input", `no packages gave ${kindOf$1(empty)}`);
+			const nowhere = await carrier.rates({
+				...request,
+				to: {
+					...request.to,
+					country: ""
+				}
+			});
+			expect(kindOf$1(nowhere) === "invalid_input", `no country gave ${kindOf$1(nowhere)}`);
+		}],
+		["quotes the service in the asked currency", async () => {
+			const rates = await carrier.rates(request).orThrow();
+			expect(rates.some((rate) => rate.service === options.service), `no rate for the "${options.service}" service`);
+			for (const rate of rates) {
+				expect(rate.carrier === carrier.name, `rate carrier is "${rate.carrier}"`);
+				expect(isMoney(rate.amount) && rate.amount.amount >= 0n, `the ${rate.service} rate is not a Money of zero or more`);
+				expect(options.currency === void 0 || rate.amount.currency === options.currency, `the ${rate.service} rate is in ${rate.amount.currency}`);
+			}
+		}],
+		["refuses an unknown service", async () => {
+			const unknown = await carrier.createLabel({
+				...request,
+				service: `conformance-${crypto.randomUUID()}`,
+				reference
+			});
+			expect(kindOf$1(unknown) === "invalid_input", `an unknown service gave ${kindOf$1(unknown)}`);
+		}],
+		["buys a label with a tracking number, a cost and a known format", async () => {
+			const found = await bought();
+			expect(found.labelId.length > 0, "labelId is empty");
+			expect(found.trackingNumber.length > 0, "trackingNumber is empty");
+			expect(isMoney(found.cost), "cost is not a Money");
+			expect(formats.includes(found.format), `format is "${found.format}"`);
+			for (const url of [found.labelUrl, found.trackingUrl]) expect(url === void 0 || url.startsWith("https://"), `${String(url)} is not an https URL`);
+		}],
+		["returns the same label for the same idempotency key", async () => {
+			const first = await bought();
+			expect((await carrier.createLabel({
+				...request,
+				service: options.service,
+				reference
+			}, { idempotencyKey: key }).orThrow()).labelId === first.labelId, "a retry with the same key bought another label");
+		}],
+		["tracks the label, oldest event first", async () => {
+			const found = await bought();
+			eventsValid(await carrier.track(found.trackingNumber).orThrow(), "track", true);
+		}],
+		["answers not_found for an unknown tracking number", async () => {
+			const unknown = await carrier.track(`conformance-${crypto.randomUUID()}`);
+			expect(kindOf$1(unknown) === "not_found", `an unknown tracking number gave ${kindOf$1(unknown)}`);
+		}],
+		["voids the label", async () => {
+			const found = await bought();
+			expect((await carrier.cancel({
+				labelId: found.labelId,
+				trackingNumber: found.trackingNumber
+			}).orThrow()).cancelled, "cancel did not report cancelled");
+		}],
+		["reads signed tracking webhooks and refuses forged ones", async () => {
+			const { webhook } = options;
+			if (webhook === void 0 || carrier.parseWebhook === void 0) {
+				expect(webhook === void 0 && carrier.parseWebhook === void 0, webhook === void 0 ? "the carrier has parseWebhook; pass webhook to test it" : "webhook was passed but the carrier has no parseWebhook");
+				return;
+			}
+			const updates = await carrier.parseWebhook(await webhook.valid()).orThrow();
+			expect(updates.length > 0, "a valid webhook gave no updates");
+			for (const update of updates) {
+				expect(update.trackingNumber.length > 0, "an update has no tracking number");
+				eventsValid(update.events, update.trackingNumber, false);
+			}
+			const forged = await carrier.parseWebhook(await webhook.forged());
+			expect(kindOf$1(forged) === "unauthorized", `a forged webhook gave ${kindOf$1(forged)}`);
 		}]
 	]);
 }
@@ -1740,8 +2052,8 @@ function testTaxProvider(provider, options) {
 /**
 * Proves an `IncomingDestination` accepts a delivery once per endpoint and
 * message id: a repeat reports the first id as a duplicate, while another
-* message id or another endpoint is new.
-* It delivers four messages with random endpoint ids; the destination keeps them.
+* message id or another endpoint is new. It delivers four messages with random
+* endpoint ids; the destination keeps them.
 */
 function testIncomingDestination(destination, options) {
 	const endpoint = crypto.randomUUID();
@@ -1782,11 +2094,11 @@ function testIncomingDestination(destination, options) {
 //#endregion
 //#region src/testing/kits/plugin.ts
 /**
-* Proves a `Plugin` targets API v1, installs cleanly on its own and next to
-* the first-party plugins in either order, adds repository methods without
-* replacing base ones, keeps `context`, `transformQuery` and
-* `beforeMutation` pure and deterministic, and keeps executors'
-* results intact when it wraps them.
+* Proves a `Plugin` targets API v1, installs cleanly on its own and next to the
+* first-party plugins in either order, adds repository methods without
+* replacing base ones, keeps `context`, `transformQuery` and `beforeMutation`
+* pure and deterministic, and keeps executors' results intact when it wraps
+* them.
 */
 function testPlugin(plugin, options) {
 	const { betterSupabase } = options;
@@ -1923,9 +2235,9 @@ function claimedJob(queue, row) {
 }
 /**
 * Proves a `QueueBackend` round-trips payloads, hides claimed messages for
-* their lease, counts attempts, retries and dead-letters on `fail`, and
-* (when it has `leases`) rejects a stale attempt and extends a lease. It
-* writes to `options.queue` on the backend's real store.
+* their lease, counts attempts, retries and dead-letters on `fail`, and (when
+* it has `leases`) rejects a stale attempt and extends a lease. It writes to
+* `options.queue` on the backend's real store.
 */
 function testQueueBackend(backend, options) {
 	const { queue } = options;
@@ -2005,11 +2317,11 @@ function testQueueBackend(backend, options) {
 //#endregion
 //#region src/testing/kits/support-session-store.ts
 /**
-* Proves a `SupportSessionStore` starts sessions with the input it was
-* given, shows a running session only to its admin, ends the admin's
-* previous session on start, ends a session once, lists sessions and, with
-* `expire`, leaves running sessions alone.
-* It writes sessions to the store; they are all ended when it returns.
+* Proves a `SupportSessionStore` starts sessions with the input it was given,
+* shows a running session only to its admin, ends the admin's previous session
+* on start, ends a session once, lists sessions and, with `expire`, leaves
+* running sessions alone. It writes sessions to the store; they are all ended
+* when it returns.
 */
 function testSupportSessionStore(store, options) {
 	const { admin } = options;
@@ -2207,9 +2519,9 @@ const MODULE_SERVER = {
 };
 /**
 * Proves a framework adapter refuses callers its guard rejects, answers
-* `DbError`s with their status, hides unexpected errors, applies the
-* context's cookies and hands pending event sends to `waitUntil`, the way
-* `handle()` from `better-supabase/server` does.
+* `DbError`s with their status, hides unexpected errors, applies the context's
+* cookies and hands pending event sends to `waitUntil`, the way `handle()` from
+* `better-supabase/server` does.
 */
 function testAdapter(name, options) {
 	const { events } = options.betterSupabase;
@@ -2284,13 +2596,14 @@ const REQUEST = {
 	}
 };
 /**
-* Proves a `BlockTransportMiddleware` meets the contract: it declares API 1
-* and a name, calls `next` at most once per call, leaves the request it got
+* Proves a `BlockTransportMiddleware` meets the contract: it declares API 1 and
+* a name, calls `next` at most once per call, leaves the request it got
 * unchanged, resolves when `next` does, and rejects with the database error
 * `next` rejected with, so blocks still map it to a `DbError`.
 *
 * ```ts
-* it('conforms', () => testBlockTransportMiddleware(statementTimeout('5s')));
+* it("conforms", () =>
+*   testBlockTransportMiddleware(statementTimeout("5s")));
 * ```
 */
 function testBlockTransportMiddleware(middleware) {
@@ -2348,11 +2661,11 @@ function expectRow(where, row) {
 	expect(row.status === void 0 === (row.active === void 0), `${where} needs status and active together`);
 }
 /**
-* Proves an `AuthorizationProvider` targets API v1, is plain JSON, names
-* valid scopes with a tenant scope that has an id type, writes templates
-* that are safe to inline and use the placeholders they need, lists every
-* function its templates call in `requires`, and keeps its token hook,
-* suspension rows, role sources and deciding columns well formed.
+* Proves an `AuthorizationProvider` targets API v1, is plain JSON, names valid
+* scopes with a tenant scope that has an id type, writes templates that are
+* safe to inline and use the placeholders they need, lists every function its
+* templates call in `requires`, and keeps its token hook, suspension rows, role
+* sources and deciding columns well formed.
 */
 function testAuthorizationProvider(provider) {
 	const scopes = new Set(provider.scopes.map((scope) => scope.name));
@@ -2458,12 +2771,12 @@ function testAuthorizationProvider(provider) {
 //#region src/testing/authorization-hooks.ts
 /**
 * Proves `AuthorizationHooks` target API v1 and fail closed for strangers:
-* fan-out returns only subscribers it was given, an identity nobody linked
-* and a forged ticket resolve to `null`, a requester never approves their
-* own request, an unknown publisher can neither publish nor run, an
-* unlinked chat author gets nothing, an admin with no claims cannot start
-* a support session and never approves their own, and a delegated token
-* with no scopes maps to no permissions.
+* fan-out returns only subscribers it was given, an identity nobody linked and
+* a forged ticket resolve to `null`, a requester never approves their own
+* request, an unknown publisher can neither publish nor run, an unlinked chat
+* author gets nothing, an admin with no claims cannot start a support session
+* and never approves their own, and a delegated token with no scopes maps to no
+* permissions.
 */
 function testAuthorizationHooks(hooks) {
 	const stranger = crypto.randomUUID();
@@ -2595,10 +2908,10 @@ function testAuthorizationHooks(hooks) {
 //#region src/testing/delivery-transport.ts
 const KEY = "00000000-0000-4000-8000-00000000d0f0";
 /**
-* Runs the `DeliveryTransport` contract against `transport`: API version 1,
-* the `email` channel, a provider name, and one frozen sample message it
-* sends without mutating, with the delivery id as its idempotency key.
-* Throws a `ConformanceError` listing every failed check.
+* Runs the `DeliveryTransport` contract against `transport`: API version 1, the
+* `email` channel, a provider name, and one frozen sample message it sends
+* without mutating, with the delivery id as its idempotency key. Throws a
+* `ConformanceError` listing every failed check.
 */
 function testDeliveryTransport(transport, options = {}) {
 	const message = deepFreeze({
@@ -2670,12 +2983,12 @@ const FORGED = {
 };
 /**
 * Proves an `Authorizer` targets API v1, keys every permission to the same
-* string each time (and after a JSON round trip, so references are plain
-* JSON), answers every request with a known outcome without mutating it,
-* keeps the request order in `evaluations`, decides from the subject rather
-* than the input (forged roles, claims and memberships in the resource
-* properties or the context never turn a denial into a grant), never grants an unknown permission, and grants
-* `options.granted` through `checkPermission`.
+* string each time (and after a JSON round trip, so references are plain JSON),
+* answers every request with a known outcome without mutating it, keeps the
+* request order in `evaluations`, decides from the subject rather than the
+* input (forged roles, claims and memberships in the resource properties or the
+* context never turn a denial into a grant), never grants an unknown
+* permission, and grants `options.granted` through `checkPermission`.
 */
 function testAuthorizer(authorizer, options) {
 	const { subject, context } = requestOf(void 0);
@@ -2759,9 +3072,9 @@ function testAuthorizer(authorizer, options) {
 	]);
 }
 /**
-* An in-memory `Authorizer` for tests and examples: permissions come from
-* the subject's `role` and id only, never from the request's resource or
-* context, and it ignores `subject.properties.claims`.
+* An in-memory `Authorizer` for tests and examples: permissions come from the
+* subject's `role` and id only, never from the request's resource or context,
+* and it ignores `subject.properties.claims`.
 */
 function staticAuthorizer(options) {
 	const approvals = new Set(options.approvals);
@@ -2920,12 +3233,11 @@ function diagnosticProblem(diagnostic) {
 }
 /**
 * Proves a `DocumentFormat` targets API v1, lists versions with pins and a
-* known status, defaults to a version it lists that is not a preview, and,
-* for every version: lowers the model without mutating it (also when the
-* model is frozen), renders the same document twice, renders plain JSON or
-* text, reports diagnostics with a kebab-case code, a severity and a
-* message, finds no error in its own output with `lint`, and names a bare,
-* stable file.
+* known status, defaults to a version it lists that is not a preview, and, for
+* every version: lowers the model without mutating it (also when the model is
+* frozen), renders the same document twice, renders plain JSON or text, reports
+* diagnostics with a kebab-case code, a severity and a message, finds no error
+* in its own output with `lint`, and names a bare, stable file.
 */
 function testDocumentFormat(format, options = {}) {
 	const subject = format;
@@ -3024,7 +3336,10 @@ function relativeImport(from, to) {
 	const path = [...Array.from({ length: fromParts.length - common }, () => ".."), ...toParts.slice(common)].join("/");
 	return path.startsWith(".") ? path : `./${path}`;
 }
-/** A `GeneratorModel` from schema metadata, for generators tested without a database. */
+/**
+* A `GeneratorModel` from schema metadata, for generators tested without a
+* database.
+*/
 function modelFromMeta(meta) {
 	return {
 		tables: Object.values(meta.tables).map((table) => ({
@@ -3047,7 +3362,24 @@ function modelFromMeta(meta) {
 			schema: "public",
 			name,
 			values
-		}))
+		})),
+		functions: Object.entries(meta.functions).flatMap(([key, fn]) => (fn.overloads ?? [fn]).map((signature) => ({
+			key,
+			schema: fn.schema,
+			args: signature.args.map((arg) => {
+				const values = meta.enums[arg.type];
+				return {
+					name: arg.name,
+					tsType: values === void 0 ? "unknown" : values.map((value) => JSON.stringify(value)).join(" | "),
+					optional: arg.optional === true,
+					values
+				};
+			}),
+			returns: "unknown",
+			returnsSet: signature.returnsSet,
+			volatility: signature.volatility
+		}))),
+		blocks: []
 	};
 }
 const EMPTY_INTROSPECTION = {
@@ -3063,7 +3395,10 @@ const EMPTY_INTROSPECTION = {
 	functions: [],
 	types: []
 };
-/** Proves a `Generator` writes relative, unique paths, is deterministic and doesn't mutate its input. */
+/**
+* Proves a `Generator` writes relative, unique paths, is deterministic and
+* doesn't mutate its input.
+*/
 function testGenerator(generator, options) {
 	const config = options.config ?? resolveConfig({}, "/project");
 	const input = () => ({
@@ -3119,8 +3454,8 @@ const rejects = async (run) => {
 };
 /**
 * Proves an `Embedder` for the knowledge and memory blocks names its model,
-* embeds an empty list to nothing, and returns one finite vector per value,
-* all of the same length on every call. It calls the real model.
+* embeds an empty list to nothing, and returns one finite vector per value, all
+* of the same length on every call. It calls the real model.
 */
 function testEmbedder(embedder, options = {}) {
 	const values = options.values ?? ["The first text.", "A second text."];
@@ -3186,8 +3521,8 @@ function testGraphCompiler(compile, options) {
 	]);
 }
 /**
-* Proves a `BuilderStarter` returns a run id and returns the same id when
-* the same idempotency key starts again. It starts real runs.
+* Proves a `BuilderStarter` returns a run id and returns the same id when the
+* same idempotency key starts again. It starts real runs.
 */
 function testBuilderStarter(start, options) {
 	const { call } = options;
@@ -3226,6 +3561,87 @@ function testEveDocumentBackend(backend, options = {}) {
 		expect((await backend.read({ key }))?.content === "two", "a refused write changed the document");
 	}]]);
 }
+const FAKE_RECORDING = {
+	file: {
+		id: "recording",
+		filename: "call.webm",
+		mediaType: "audio/webm"
+	},
+	url: "https://example.com/call.webm",
+	read: () => Promise.resolve(/* @__PURE__ */ new Uint8Array())
+};
+/**
+* Proves a `Transcriber` for the engagements block names its model, returns
+* speaker turns in order with `startMs` at most `endMs` and text on each, and
+* rejects once its signal is aborted. Pass a real recording in `input` to call
+* the real provider.
+*/
+function testTranscriber(transcriber, options = {}) {
+	const input = options.input ?? FAKE_RECORDING;
+	return conform(`Transcriber "${transcriber.model}"`, [
+		hasApiVersion(transcriber),
+		["names its model", () => {
+			expect(typeof transcriber.model === "string" && transcriber.model !== "", "model must be a non-empty string");
+		}],
+		["returns ordered speaker turns", async () => {
+			const { segments } = await transcriber.transcribe(input);
+			let last = 0;
+			for (const segment of segments) {
+				expect(typeof segment.text === "string", "every segment needs its text");
+				expect(Number.isFinite(segment.startMs) && Number.isFinite(segment.endMs) && segment.startMs <= segment.endMs, `segment ${segment.startMs}-${segment.endMs} must start before it ends`);
+				expect(segment.startMs >= last, "segments must be ordered by startMs");
+				last = segment.startMs;
+			}
+		}],
+		["rejects once aborted", async () => {
+			expect(await rejects(() => transcriber.transcribe(input, { signal: AbortSignal.abort() })), "transcribe must reject when its signal is aborted");
+		}]
+	]);
+}
+const FAKE_CALL = {
+	engagement: {
+		id: "engagement",
+		kind: "call",
+		title: "Intro call"
+	},
+	transcript: [{
+		recordingId: "recording",
+		position: 1,
+		speaker: "Speaker 1",
+		startMs: 0,
+		endMs: 4e3,
+		text: "Can you send the proposal by Friday?"
+	}, {
+		recordingId: "recording",
+		position: 2,
+		speaker: "Speaker 2",
+		startMs: 4e3,
+		endMs: 7e3,
+		text: "Yes, I will send it on Thursday."
+	}]
+};
+/**
+* Proves a `NoteTaker` for the engagements block names its model, returns a
+* non-empty summary with well-formed action items, and rejects once its signal
+* is aborted. It calls the real model.
+*/
+function testNoteTaker(noteTaker, options = {}) {
+	const input = options.input ?? FAKE_CALL;
+	return conform(`NoteTaker "${noteTaker.model}"`, [
+		hasApiVersion(noteTaker),
+		["names its model", () => {
+			expect(typeof noteTaker.model === "string" && noteTaker.model !== "", "model must be a non-empty string");
+		}],
+		["writes a summary and action items", async () => {
+			const notes = await noteTaker.summarize(input);
+			expect(typeof notes.summary === "string" && notes.summary.trim() !== "", "summary must be a non-empty string");
+			expect((notes.actionItems ?? []).every((item) => typeof item.text === "string" && item.text !== ""), "every action item needs its text");
+		}],
+		["rejects once aborted", async () => {
+			expect(await rejects(() => noteTaker.summarize(input, { signal: AbortSignal.abort() })), "summarize must reject when its signal is aborted");
+		}]
+	]);
+}
 //#endregion
 //#region src/testing/notification-channel.ts
 const STATUSES = /* @__PURE__ */ new Set(["sent", "skipped"]);
@@ -3261,9 +3677,9 @@ function sample(channel, email) {
 	});
 }
 /**
-* Runs the `NotificationChannel` contract against `channel`: the API version,
-* a name, and one frozen sample message it must send without mutating.
-* Throws a `ConformanceError` listing every failed check.
+* Runs the `NotificationChannel` contract against `channel`: the API version, a
+* name, and one frozen sample message it must send without mutating. Throws a
+* `ConformanceError` listing every failed check.
 */
 function testNotificationChannel(channel, options = {}) {
 	const message = sample(channel.name, options.email ?? null);
@@ -3287,6 +3703,45 @@ function testNotificationChannel(channel, options = {}) {
 	]);
 }
 //#endregion
+//#region src/testing/section.ts
+const callable = (value) => typeof value === "function";
+/**
+* Runs the `defineSection` contract against `section`: the API version, a read
+* permission, the event patterns, a `load` that settles, and a `count` keyed by
+* `subjectKey` with a whole number per record. Throws a `ConformanceError`
+* listing every failed check.
+*/
+function testSection(name, section, options) {
+	const subjects = options.subjects ?? [options.subject];
+	const load = section.load;
+	const count = section.count;
+	return conform(`Section "${name}"`, [
+		["has apiVersion 1", () => {
+			const version = section.apiVersion;
+			expect(version === 1, "apiVersion must be 1");
+		}],
+		["names a read permission", () => {
+			expect(typeof section.permissions.read === "string" && section.permissions.read.length > 0, "permissions.read must be a non-empty action name");
+		}],
+		["lists event types", () => {
+			expect(section.events.every((event) => typeof event === "string" && event.length > 0), "events must be non-empty strings");
+		}],
+		["loads a record", async () => {
+			expect(callable(section.load), "load must be a function");
+			expect((await load(options.client, options.subject, void 0)).ok, "load must succeed for a record the client holds");
+		}],
+		count !== void 0 && ["counts records by subject key", async () => {
+			const result = await count(options.client, subjects);
+			expect(result.ok, "count must succeed");
+			const wanted = new Set(subjects.map((subject) => subjectKey(subject)));
+			for (const [key, value] of Object.entries(result.data)) {
+				expect(wanted.has(key), `count returned "${key}", not a type:id key asked for`);
+				expect(Number.isInteger(value) && value >= 0, `count for "${key}" must be a whole number`);
+			}
+		}]
+	]);
+}
+//#endregion
 //#region src/testing/webhooks.ts
 const SECRET = "whsec_MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLaSw";
 function signInput(body, timestamp) {
@@ -3301,9 +3756,9 @@ function isHeaders(value) {
 	return typeof value === "object" && value !== null && Object.values(value).every((entry) => typeof entry === "string");
 }
 /**
-* Runs the `WebhookSigner` contract against `signer`: the API version, a
-* name, string headers that depend on the body and are stable for the same
-* input, and, with `verify`, a signature the receiver accepts.
+* Runs the `WebhookSigner` contract against `signer`: the API version, a name,
+* string headers that depend on the body and are stable for the same input,
+* and, with `verify`, a signature the receiver accepts.
 */
 function testWebhookSigner(signer, options = {}) {
 	const body = JSON.stringify({
@@ -3341,9 +3796,9 @@ function testWebhookSigner(signer, options = {}) {
 	]);
 }
 /**
-* Runs the `WebhookTransport` contract against `transport`: the API version,
-* a name, and one POST to `options.url` that returns an HTTP status and a
-* string body.
+* Runs the `WebhookTransport` contract against `transport`: the API version, a
+* name, and one POST to `options.url` that returns an HTTP status and a string
+* body.
 */
 function testWebhookTransport(transport, options) {
 	const body = JSON.stringify({
@@ -3375,8 +3830,8 @@ function testWebhookTransport(transport, options) {
 }
 /**
 * Runs the `WebhookSecretStore` contract against `store`: the API version, a
-* list of strings, and, when it can rotate, a new secret listed first while
-* the previous one keeps signing.
+* list of strings, and, when it can rotate, a new secret listed first while the
+* previous one keeps signing.
 */
 function testWebhookSecretStore(store, options) {
 	return conform("WebhookSecretStore", [
@@ -3405,10 +3860,10 @@ const sleep = (ms) => new Promise((resolve) => {
 	setTimeout(resolve, ms);
 });
 /**
-* Runs the Chat SDK `StateAdapter` contract against `state`: subscriptions,
-* one lock holder at a time with token-checked release and extension, lock
-* and cache TTLs, `setIfNotExists`, list trimming, and a per-thread queue
-* that keeps the newest entries, reports its depth and drops expired ones.
+* Runs the Chat SDK `StateAdapter` contract against `state`: subscriptions, one
+* lock holder at a time with token-checked release and extension, lock and
+* cache TTLs, `setIfNotExists`, list trimming, and a per-thread queue that
+* keeps the newest entries, reports its depth and drops expired ones.
 */
 function testChatState(state, options) {
 	const fresh = options.id ?? (() => `conformance-${crypto.randomUUID()}`);
@@ -3545,10 +4000,10 @@ async function collect(stream, timeoutMs) {
 }
 const hintOf = (result) => result.ok ? void 0 : result.error.hint;
 /**
-* Runs the `StreamStore` contract against `store`: the API version, open
-* once, idempotent appends that refuse gaps, reads from any index that end
-* when the stream closes, a live read that sees later appends, cancel seen by
-* the writer, a closed stream that refuses appends, and a missing stream.
+* Runs the `StreamStore` contract against `store`: the API version, open once,
+* idempotent appends that refuse gaps, reads from any index that end when the
+* stream closes, a live read that sees later appends, cancel seen by the
+* writer, a closed stream that refuses appends, and a missing stream.
 */
 function testStreamStore(store, options = {}) {
 	const fresh = options.id ?? (() => `conformance-${crypto.randomUUID()}`);
@@ -3644,11 +4099,11 @@ const APP = { type: "app" };
 const kindOf = (result) => result.ok ? void 0 : result.error.kind;
 /**
 * Runs the `CredentialProvider` contract against `provider`: the API version,
-* an unknown ref, a stored token with its headers, a new value seen after it
-* is stored, separate credentials per user and per tenant (`ref` with a
-* `tenant`, which `seed` must store too), revoke (per user, as the
-* organization purger revokes connector grants), and inbound checks that
-* accept a signed request and refuse a tampered one.
+* an unknown ref, a stored token with its headers, a new value seen after it is
+* stored, separate credentials per user and per tenant (`ref` with a `tenant`,
+* which `seed` must store too), revoke (per user, as the organization purger
+* revokes connector grants), and inbound checks that accept a signed request
+* and refuse a tampered one.
 */
 function testCredentialProvider(provider, options) {
 	const value = () => `token-${crypto.randomUUID()}`;
@@ -3765,9 +4220,9 @@ function testCredentialProvider(provider, options) {
 //#endregion
 //#region src/testing/act-cases.ts
 /**
-* The RFC 8693 `act` chains better-supabase accepts and refuses, as plain
-* JSON (`better-supabase/testing/act-cases.json`), so another library that
-* reads the same claims can run the same cases.
+* The RFC 8693 `act` chains better-supabase accepts and refuses, as plain JSON
+* (`better-supabase/testing/act-cases.json`), so another library that reads the
+* same claims can run the same cases.
 */
 const actCases = {
 	version: 1,
@@ -4086,4 +4541,4 @@ const actCases = {
 	]
 };
 //#endregion
-export { ConformanceError, LOCAL_JWT_SECRET, PROBE_INITIAL, actCases, asUser, createTestSigner, defineSeed, expectDbBudget, expectInstant, expectTenantIsolation, isSeed, liteStack, localAuth, localSigningKey, scopedSeed, signLocalJwt, signTestJwt, signTestJwtWithKey, staticAuthorizer, supabaseClaimFixtures, supabaseInvalidClaimFixtures, testAdapter, testAiTaskRunner, testAuthResolver, testAuthorizationHooks, testAuthorizationProvider, testAuthorizer, testBlockTransportMiddleware, testBuilderStarter, testCacheAdapter, testChatState, testControllerBinding, testCredentialProvider, testDeliveryTransport, testDocumentFormat, testEmbedder, testEveDocumentBackend, testEventSink, testExecutor, testGenerator, testGraphCompiler, testIncomingDestination, testNotificationChannel, testPaymentProvider, testPlugin, testQueueBackend, testStreamStore, testSupportSessionStore, testTaxProvider, testWebhookSecretStore, testWebhookSigner, testWebhookTransport, withRollback };
+export { ConformanceError, LOCAL_JWT_SECRET, PROBE_INITIAL, actCases, asUser, createTestSigner, defineFactory, defineSeed, defineTenantSeed, expectDbBudget, expectInstant, expectTenantIsolation, factoryPath, factoryTime, isSeed, isTenantSeed, liteStack, localAuth, localSigningKey, scopedSeed, seedTenantOnCreate, signLocalJwt, signTestJwt, signTestJwtWithKey, staticAuthorizer, supabaseClaimFixtures, supabaseInvalidClaimFixtures, testAdapter, testAiTaskRunner, testAuthResolver, testAuthorizationHooks, testAuthorizationProvider, testAuthorizer, testBlockTransportMiddleware, testBuilderStarter, testCacheAdapter, testChatState, testControllerBinding, testCredentialProvider, testDeliveryTransport, testDocumentFormat, testEmbedder, testEveDocumentBackend, testEventSink, testExecutor, testGenerator, testGraphCompiler, testIncomingDestination, testNoteTaker, testNotificationChannel, testPaymentProvider, testPlugin, testQueueBackend, testSection, testShipmentCarrier, testStreamStore, testSupportSessionStore, testTaxProvider, testTranscriber, testWebhookSecretStore, testWebhookSigner, testWebhookTransport, withClaims, withRollback };