better-supabase 0.2.0 → 0.4.0

package/dist/testing/index.d.ts

@@ -1,13 +1,14 @@
-import { d as Generator, f as GeneratorInput, y as ResolvedConfig } from "../index-DOsjFvMf.js";
-import { A as SchemaMeta, N as TableKey, R as Update, _ as Insert, n as AnyModels, t as AnyFunctions } from "../types-C83v5SQz.js";
-import { r as Executor } from "../executor-CGdNQ27g.js";
-import { P as DbStats, l as CacheAdapter, t as BetterSupabase, y as Db } from "../define-e3zI4_4g.js";
-import { h as RequestContext, n as AnyPlugin } from "../plugin-C4TR9J0Z.js";
-import { t as SqlClient } from "../executor-BYXQ9AGn.js";
-import { t as Postgres } from "../pool-R2m_DkXi.js";
-import { n as AuthResolver } from "../resolve-CjHILk2w.js";
-import { r as EventSink, t as CloudEvent } from "../index-Ciu5Xlml.js";
+import { A as SchemaMeta, N as TableKey, R as Update, g as Insert, n as AnyModels, t as AnyFunctions } from "../types-DONv9SHN.js";
+import { r as Executor } from "../executor-B5IoUxLE.js";
+import { P as DbStats, l as CacheAdapter, t as BetterSupabase, y as Db } from "../define-CRS2MRV3.js";
+import { h as RequestContext, n as AnyPlugin } from "../plugin-bNhvJwRh.js";
+import { b as ResolvedConfig, d as Generator, f as GeneratorInput } from "../config-C1CYcm6o.js";
+import { t as SqlClient } from "../executor-CZ7ImRiD.js";
+import { t as BetterPostgres } from "../pool-DFwEQwmN.js";
+import { n as AuthResolver } from "../resolve-BAqQcwMW.js";
+import { r as EventSink, t as CloudEvent } from "../index-D5IfUIDh.js";
 import { SupabaseClient } from "@supabase/supabase-js";
+import { webcrypto } from "node:crypto";
 //#region src/testing/jwt.d.ts
 interface TestJwtClaims {
   readonly sub: string;
@@ -24,19 +25,19 @@ interface TestJwtClaims {
 export declare function signTestJwt(secret: string, claims: TestJwtClaims): Promise<string>;
 /**
  * Accepts `signTestJwt` tokens as users, for API servers tested against the
- * local stack: `createServer(sb, { auth: { resolvers: [localAuth(secret)] } })`.
+ * local stack: `createServer(betterSupabase, { auth: { resolvers: [localAuth(secret)] } })`.
  * Tokens that are not HS256-signed with `secret` fall through. Test-only.
  */
 export declare function localAuth(secret: string): AuthResolver;
 interface TestSigner {
   /** Public JWKS; pass as `jwks` to `resolveAuth` / `createServer({ auth: { jwks } })`. */
   readonly jwks: {
-    readonly keys: readonly JsonWebKey[];
+    readonly keys: readonly webcrypto.JsonWebKey[];
   };
   sign(claims: TestJwtClaims): Promise<string>;
 }
 /** A private ES256 JWK, as `better-supabase keys` writes to `supabase/signing_keys.json`. */
-interface SigningJwk extends JsonWebKey {
+interface SigningJwk extends webcrypto.JsonWebKey {
   readonly kid: string;
 }
 /**
@@ -80,7 +81,7 @@ interface LocalStack {
   /** Service-role key for `expectTenantIsolation`; defaults to `$SUPABASE_SECRET_KEY`. */
   readonly secretKey?: string;
   /** Enables `sql`: the same user over direct Postgres. */
-  readonly postgres?: Postgres;
+  readonly postgres?: BetterPostgres;
 }
 interface TestUser<M extends AnyModels, F extends AnyFunctions, E> {
   readonly token: string;
@@ -99,11 +100,11 @@ interface TestUser<M extends AnyModels, F extends AnyFunctions, E> {
  * still uses the shared JWT secret.
  *
  * ```ts
- * const alice = await asUser(sb, { sub: aliceId, tenant_id: acme });
+ * const alice = await asUser(betterSupabase, { sub: aliceId, tenant_id: acme });
  * expect(await alice.db.customers.count().orThrow()).toBe(3);
  * ```
  */
-export declare function asUser<M extends AnyModels, D, F extends AnyFunctions, E>(sb: BetterSupabase<M, D, F, E>, claims: TestJwtClaims, stack?: LocalStack): Promise<TestUser<M, F, E>>;
+export declare function asUser<M extends AnyModels, D, F extends AnyFunctions, E>(betterSupabase: BetterSupabase<M, D, F, E>, claims: TestJwtClaims, stack?: LocalStack): Promise<TestUser<M, F, E>>;
 //#endregion
 //#region src/testing/budget.d.ts
 /** The part of a Playwright `Response` the budget check reads. */
@@ -146,7 +147,7 @@ interface MeasuredRender {
 /**
  * Measures every document and RSC navigation response during `during` and
  * fails when one render makes more database calls or waves than allowed.
- * Needs `createNext(sb, { debug })` and `next.debugRoute()` in the app.
+ * Needs `createNext(betterSupabase, { debug })` and `bs.debugRoute()` in the app.
  */
 export declare function expectDbBudget(page: BudgetPage, expectation: DbBudgetExpectation): Promise<readonly MeasuredRender[]>;
 //#endregion
@@ -169,7 +170,7 @@ export declare class ConformanceError extends Error {
 type AnySupabase = BetterSupabase<any, any, any, any>;
 interface TestExecutorOptions {
   /** A definition whose schema matches the executor's database. Install no plugins. */
-  readonly sb: AnySupabase;
+  readonly betterSupabase: AnySupabase;
   /** App key of a table with rows the executor can read. Defaults to the first table. */
   readonly table?: string;
   /** A row to insert and delete again, to check writes. Skips write checks when omitted. */
@@ -181,7 +182,7 @@ interface TestExecutorOptions {
  * than thrown, and (with `create`) a write round trip.
  *
  * ```ts
- * it('conforms', () => testExecutor(myExecutor, { sb, table: 'tags', create: { name: 'x' } }));
+ * it('conforms', () => testExecutor(myExecutor, { betterSupabase, table: 'tags', create: { name: 'x' } }));
  * ```
  */
 export declare function testExecutor(executor: Executor, options: TestExecutorOptions): Promise<ConformanceReport>;
@@ -226,7 +227,7 @@ interface TestGeneratorOptions {
 export declare function testGenerator(generator: Generator, options: TestGeneratorOptions): Promise<ConformanceReport>;
 interface TestPluginOptions {
   /** The definition without this plugin. */
-  readonly sb: AnySupabase;
+  readonly betterSupabase: AnySupabase;
   /** Table to exercise. Defaults to the first table. */
   readonly table?: string;
   /** Context the plugin needs, such as `{ tenant }` for `tenant()`. */
@@ -271,12 +272,12 @@ interface TenantIsolationOptions<M extends AnyModels> {
 /**
  * Checks row-level security between two tenants against a running stack: for
  * each table, a user of one tenant must not select, insert, update or delete
- * the other tenant's rows. Runs without `sb`'s plugins, so the `tenant()`
+ * the other tenant's rows. Runs without `betterSupabase`'s plugins, so the `tenant()`
  * plugin can't hide a missing policy. Throws a `ConformanceError` naming each
  * table and command that leaks; removes every row it created.
  *
  * ```ts
- * await expectTenantIsolation(sb, {
+ * await expectTenantIsolation(betterSupabase, {
  *   tenants: [
  *     { id: ACME, claims: { sub: alice, tenant_id: ACME } },
  *     { id: GLOBEX, claims: { sub: bob, tenant_id: GLOBEX } },
@@ -290,7 +291,7 @@ interface TenantIsolationOptions<M extends AnyModels> {
  * });
  * ```
  */
-export declare function expectTenantIsolation<M extends AnyModels, D, F extends AnyFunctions, E>(sb: BetterSupabase<M, D, F, E>, options: TenantIsolationOptions<M>): Promise<ConformanceReport>;
+export declare function expectTenantIsolation<M extends AnyModels, D, F extends AnyFunctions, E>(betterSupabase: BetterSupabase<M, D, F, E>, options: TenantIsolationOptions<M>): Promise<ConformanceReport>;
 //#endregion
 //#region src/testing/seed.d.ts
 /** Named rows per table, in app casing: `{ customers: { acme: { ... } } }`. */
@@ -314,12 +315,12 @@ export declare function isSeed(value: unknown): value is Seed<unknown>;
  * casing and Insert types; `better-supabase seed` renders them to SQL.
  *
  * ```ts
- * export const seed = defineSeed(sb, {
+ * export const seed = defineSeed(betterSupabase, {
  *   organizations: { acme: { id: ACME, name: 'Acme' } },
  *   customers: { first: { organizationId: ACME, name: 'First customer' } },
  * });
  * ```
  */
-export declare function defineSeed<M extends AnyModels, D, F extends AnyFunctions, E, const S extends SeedFixtures<M>>(sb: BetterSupabase<M, D, F, E>, fixtures: S & ExactSeed<M, S>): Seed<S>;
+export declare function defineSeed<M extends AnyModels, D, F extends AnyFunctions, E, const S extends SeedFixtures<M>>(betterSupabase: BetterSupabase<M, D, F, E>, fixtures: S & ExactSeed<M, S>): Seed<S>;
 //#endregion
 export type { BudgetPage, BudgetResponse, ConformanceCheck, ConformanceReport, DbBudgetExpectation, ExactSeed, IsolationTable, IsolationTables, IsolationTenant, LocalStack, MeasuredRender, Seed, SeedFixtures, SigningJwk, TenantIsolationOptions, TestAuthResolverOptions, TestEventSinkOptions, TestExecutorOptions, TestGeneratorOptions, TestJwtClaims, TestPluginOptions, TestSigner, TestUser };

package/dist/testing/index.js

@@ -1,24 +1,20 @@
-import { n as dbError } from "../errors-Bl3rkOzo.js";
-import { i as ok } from "../result-DWXatkd6.js";
-import { t as BetterSupabase } from "../define-BXMYD9AY.js";
+import { n as dbError } from "../errors-L0xK41y_.js";
+import { i as temporalText } from "../temporal-BwshQk0W.js";
+import { t as temporal } from "../temporal-required-CBNHT6ni.js";
+import { i as ok } from "../result-Bj6yt33D.js";
+import { t as BetterSupabase } from "../define-Bh0AqTik.js";
+import { a as toBase64Url, r as fromBase64, t as base64ToText } from "../base64-D2gsioCY.js";
+import { r as resolveConfig } from "../config-BpxDfnbg.js";
 import { t as isList } from "../guards-BnzDvFrz.js";
-import { r as resolveConfig } from "../config-ClDXmVtY.js";
-import { t as ENV_VARIABLES } from "../env-BEToab0I.js";
-import { n as postgresExecutor } from "../executor-DeppvirK.js";
-import { o as toCloudEvents } from "../events-BuzTgn2D.js";
-import { n as isSeed, t as defineSeed } from "../seed-CzecODcJ.js";
+import { ENV_VARIABLES } from "../env/index.js";
+import { n as postgresExecutor } from "../executor-CVt6dD0B.js";
+import { toCloudEvents } from "../events/index.js";
 import { createClient } from "@supabase/supabase-js";
 import { existsSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 //#region src/testing/jwt.ts
-const encoder = new TextEncoder();
-function base64url(input) {
-	const bytes = typeof input === "string" ? encoder.encode(input) : input;
-	let binary = "";
-	for (const byte of bytes) binary += String.fromCharCode(byte);
-	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
-}
+const encoder = /* @__PURE__ */ new TextEncoder();
 /**
 * Signs an HS256 access token the local Supabase stack accepts. Test-only:
 * production tokens come from Supabase Auth.
@@ -34,25 +30,21 @@ async function signTestJwt(secret, claims) {
 		exp: now + expiresIn,
 		...rest
 	};
-	const header = base64url(JSON.stringify({
+	const header = toBase64Url(JSON.stringify({
 		alg: "HS256",
 		typ: "JWT"
 	}));
-	const body = base64url(JSON.stringify(payload));
+	const body = toBase64Url(JSON.stringify(payload));
 	const key = await crypto.subtle.importKey("raw", encoder.encode(secret), {
 		name: "HMAC",
 		hash: "SHA-256"
 	}, false, ["sign"]);
 	const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(`${header}.${body}`));
-	return `${header}.${body}.${base64url(new Uint8Array(signature))}`;
-}
-function base64urlDecode(input) {
-	const binary = atob(input.replaceAll("-", "+").replaceAll("_", "/"));
-	return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+	return `${header}.${body}.${toBase64Url(new Uint8Array(signature))}`;
 }
 /**
 * Accepts `signTestJwt` tokens as users, for API servers tested against the
-* local stack: `createServer(sb, { auth: { resolvers: [localAuth(secret)] } })`.
+* local stack: `createServer(betterSupabase, { auth: { resolvers: [localAuth(secret)] } })`.
 * Tokens that are not HS256-signed with `secret` fall through. Test-only.
 */
 function localAuth(secret) {
@@ -65,9 +57,9 @@ function localAuth(secret) {
 		async resolve(request) {
 			const token = /^Bearer (.+)$/i.exec(request.headers.get("authorization") ?? "")?.[1];
 			const [header, body, signature] = token?.split(".") ?? [];
-			if (!token || !header || !body || !signature) return void 0;
-			if (!await crypto.subtle.verify("HMAC", await key, base64urlDecode(signature), encoder.encode(`${header}.${body}`)).catch(() => false)) return void 0;
-			const claims = JSON.parse(new TextDecoder().decode(base64urlDecode(body)));
+			if (!token || !header || !body || !signature) return;
+			if (!await crypto.subtle.verify("HMAC", await key, fromBase64(signature), encoder.encode(`${header}.${body}`)).catch(() => false)) return;
+			const claims = JSON.parse(base64ToText(body));
 			if (typeof claims.exp === "number" && claims.exp * 1e3 < Date.now()) return {
 				kind: "invalid",
 				error: dbError("unauthorized", "The token has expired")
@@ -98,17 +90,17 @@ async function signEs256(key, kid, claims) {
 		exp: now + expiresIn,
 		...rest
 	};
-	const header = base64url(JSON.stringify({
+	const header = toBase64Url(JSON.stringify({
 		alg: "ES256",
 		typ: "JWT",
 		kid
 	}));
-	const body = base64url(JSON.stringify(payload));
+	const body = toBase64Url(JSON.stringify(payload));
 	const signature = await crypto.subtle.sign({
 		name: "ECDSA",
 		hash: "SHA-256"
 	}, key, encoder.encode(`${header}.${body}`));
-	return `${header}.${body}.${base64url(new Uint8Array(signature))}`;
+	return `${header}.${body}.${toBase64Url(new Uint8Array(signature))}`;
 }
 /**
 * Signs an ES256 access token with a private JWK, the way the local stack
@@ -206,11 +198,11 @@ async function signFor(stack, url, claims) {
 * still uses the shared JWT secret.
 *
 * ```ts
-* const alice = await asUser(sb, { sub: aliceId, tenant_id: acme });
+* const alice = await asUser(betterSupabase, { sub: aliceId, tenant_id: acme });
 * expect(await alice.db.customers.count().orThrow()).toBe(3);
 * ```
 */
-async function asUser(sb, claims, stack = {}) {
+async function asUser(betterSupabase, claims, stack = {}) {
 	const url = stack.url ?? env$1(...ENV_VARIABLES.url) ?? "http://127.0.0.1:54321";
 	const publishableKey = stack.publishableKey ?? env$1(...ENV_VARIABLES.publishableKey, "SUPABASE_ANON_KEY");
 	if (!publishableKey) throw new TypeError("asUser needs publishableKey or $SUPABASE_PUBLISHABLE_KEY. Run `better-supabase env` to write it to .env.local.");
@@ -233,8 +225,8 @@ async function asUser(sb, claims, stack = {}) {
 		token,
 		claims: full,
 		supabase,
-		db: sb.connect(supabase, context),
-		sql: stack.postgres ? sb.connect(postgresExecutor(stack.postgres.asUser(full)), context) : void 0
+		db: betterSupabase.connect(supabase, context),
+		sql: stack.postgres ? betterSupabase.connect(postgresExecutor(stack.postgres.asUser(full)), context) : void 0
 	};
 }
 //#endregion
@@ -247,12 +239,14 @@ function settle(promise, ms) {
 	let timer;
 	return Promise.race([promise, new Promise((done) => {
 		timer = setTimeout(done, ms);
-	})]).finally(() => clearTimeout(timer));
+	})]).finally(() => {
+		clearTimeout(timer);
+	});
 }
 /**
 * Measures every document and RSC navigation response during `during` and
 * fails when one render makes more database calls or waves than allowed.
-* Needs `createNext(sb, { debug })` and `next.debugRoute()` in the app.
+* Needs `createNext(betterSupabase, { debug })` and `bs.debugRoute()` in the app.
 */
 async function expectDbBudget(page, expectation) {
 	const seen = [];
@@ -273,12 +267,12 @@ async function expectDbBudget(page, expectation) {
 	} finally {
 		page.off("response", listener);
 	}
-	if (seen.length === 0) throw new Error("expectDbBudget: no response carried x-bs-request-id. Enable createNext(sb, { debug: { enabled: true } }) and run the proxy.");
+	if (seen.length === 0) throw new Error("expectDbBudget: no response carried x-bs-request-id. Enable createNext(betterSupabase, { debug: { enabled: true } }) and run the proxy.");
 	await Promise.all(seen.map(({ response }) => settle(response.finished(), expectation.timeoutMs ?? 1e4)));
 	const renders = [];
 	for (const { response, id, url } of seen) {
 		const reply = await page.request.get(url);
-		if (!reply.ok()) throw new Error(`expectDbBudget: ${url} answered ${reply.status()}. Mount next.debugRoute() at that path.`);
+		if (!reply.ok()) throw new Error(`expectDbBudget: ${url} answered ${reply.status()}. Mount bs.debugRoute() at that path.`);
 		renders.push({
 			url: response.url(),
 			requestId: id,
@@ -354,34 +348,36 @@ const recorder = (ops) => ({
 		}));
 	}
 });
-/** The operation `run` sends to the executor, built by `sb` without touching a database. */
-async function captureOp(sb, run) {
+/** The operation `run` sends to the executor, built by `betterSupabase` without touching a database. */
+async function captureOp(betterSupabase, run) {
 	const ops = [];
-	await run(sb.connect(recorder(ops)));
+	await run(betterSupabase.connect(recorder(ops)));
 	const [op] = ops;
 	if (!op) throw new Error("the repository call did not reach the executor");
 	return op;
 }
-function tableKey(sb, table) {
-	const key = table ?? Object.keys(sb.meta.tables)[0];
-	if (!key || !(key in sb.meta.tables)) throw new TypeError(`better-supabase: unknown table "${String(key)}"`);
+function tableKey(betterSupabase, table) {
+	const key = table ?? Object.keys(betterSupabase.meta.tables)[0];
+	if (!key || !(key in betterSupabase.meta.tables)) throw new TypeError(`better-supabase: unknown table "${String(key)}"`);
 	return key;
 }
-const hasName = (subject) => ["has a name", () => expect(typeof subject.name === "string" && subject.name.length > 0, "name must be a non-empty string")];
+const hasName = (subject) => ["has a name", () => {
+	expect(typeof subject.name === "string" && subject.name.length > 0, "name must be a non-empty string");
+}];
 /**
 * Proves an `Executor` meets the contract: rows keyed by the selection's
 * aliases, counts, `aborted` errors, failures returned as `Result`s rather
 * than thrown, and (with `create`) a write round trip.
 *
 * ```ts
-* it('conforms', () => testExecutor(myExecutor, { sb, table: 'tags', create: { name: 'x' } }));
+* it('conforms', () => testExecutor(myExecutor, { betterSupabase, table: 'tags', create: { name: 'x' } }));
 * ```
 */
 function testExecutor(executor, options) {
-	const { sb } = options;
-	const table = tableKey(sb, options.table);
+	const { betterSupabase } = options;
+	const table = tableKey(betterSupabase, options.table);
 	const context = { errorMappers: [] };
-	const read = () => captureOp(sb, (db) => db[table]["findMany"]({ limit: 2 }));
+	const read = () => captureOp(betterSupabase, (db) => db[table]["findMany"]({ limit: 2 }));
 	const create = options.create;
 	return conform(`Executor "${executor.name}"`, [
 		hasName(executor),
@@ -400,7 +396,7 @@ function testExecutor(executor, options) {
 			}
 		}],
 		["counts rows", async () => {
-			const op = await captureOp(sb, (db) => db[table]["count"]());
+			const op = await captureOp(betterSupabase, (db) => db[table]["count"]());
 			const result = await executor.execute(op, context);
 			expect(result.ok, `count failed: ${result.ok ? "" : result.error.message}`);
 			expect(typeof result.data.count === "number" && result.data.count >= 0, "count must be a number");
@@ -448,7 +444,7 @@ function testExecutor(executor, options) {
 		}],
 		executor.batch && ["batch returns one result per operation, in order", async () => {
 			const rows = await read();
-			const count = await captureOp(sb, (db) => db[table]["count"]());
+			const count = await captureOp(betterSupabase, (db) => db[table]["count"]());
 			const missing = {
 				...rows,
 				table: {
@@ -468,12 +464,12 @@ function testExecutor(executor, options) {
 			expect(third?.ok === false, "a failing operation must fail on its own, as a result");
 		}],
 		create && ["round-trips a write", async () => {
-			const repository = sb.connect(executor)[table];
+			const repository = betterSupabase.connect(executor)[table];
 			const created = await repository["create"](create);
 			expect(created.ok, `create failed: ${JSON.stringify(created.error)}`);
 			const row = created.data;
 			for (const [key, value] of Object.entries(create)) expect(same(row[key], value), `created row has ${key} = ${JSON.stringify(row[key])}`);
-			const [primary] = sb.meta.tables[table].primaryKey;
+			const [primary] = betterSupabase.meta.tables[table].primaryKey;
 			expect(primary, "write checks need a table with a primary key");
 			const removed = await repository["delete"](row[primary]);
 			expect(removed.ok, `delete failed: ${JSON.stringify(removed.error)}`);
@@ -647,33 +643,35 @@ function testGenerator(generator, options) {
 * results intact when it wraps them.
 */
 function testPlugin(plugin, options) {
-	const { sb } = options;
-	const table = tableKey(sb, options.table);
+	const { betterSupabase } = options;
+	const table = tableKey(betterSupabase, options.table);
 	const context = options.context ?? {};
 	const hook = (op) => ({
 		table: op.table,
-		schema: sb.meta,
+		schema: betterSupabase.meta,
 		context,
 		options: {},
-		now: () => /* @__PURE__ */ new Date(0)
+		now: () => temporal().Instant.fromEpochMilliseconds(0)
 	});
 	const create = options.create;
 	return conform(`Plugin "${plugin.name}"`, [
 		hasName(plugin),
-		["targets plugin API v1", () => expect(plugin.apiVersion === 1, `apiVersion is ${String(plugin.apiVersion)}`)],
+		["targets plugin API v1", () => {
+			expect(plugin.apiVersion === 1, `apiVersion is ${String(plugin.apiVersion)}`);
+		}],
 		["installs and builds repositories", () => {
-			const db = sb.use(plugin).connect(recorder([]), context);
-			for (const key of Object.keys(sb.meta.tables)) expect(db[key], `db.${key} is missing`);
+			const db = betterSupabase.use(plugin).connect(recorder([]), context);
+			for (const key of Object.keys(betterSupabase.meta.tables)) expect(db[key], `db.${key} is missing`);
 		}],
 		plugin.transformQuery && ["transformQuery is pure and deterministic", async () => {
-			const op = await captureOp(sb, (db) => db[table]["findMany"]({ limit: 1 }));
+			const op = await captureOp(betterSupabase, (db) => db[table]["findMany"]({ limit: 1 }));
 			const first = plugin.transformQuery(frozenCopy(op), hook(op));
 			const second = plugin.transformQuery(frozenCopy(op), hook(op));
 			expect(typeof first === "object" && first !== null && first.kind === op.kind, "must return an operation of the same kind");
 			expect(same(first, second), "two calls with the same input differ");
 		}],
 		plugin.beforeMutation && create && ["beforeMutation is pure and deterministic", async () => {
-			const op = await captureOp(sb, (db) => db[table]["create"](create));
+			const op = await captureOp(betterSupabase, (db) => db[table]["create"](create));
 			if (op.kind === "select") throw new Violation("create did not produce a mutation");
 			const first = await plugin.beforeMutation(frozenCopy(op), hook(op));
 			const second = await plugin.beforeMutation(frozenCopy(op), hook(op));
@@ -681,7 +679,7 @@ function testPlugin(plugin, options) {
 			expect(same(first, second), "two calls with the same input differ");
 		}],
 		plugin.wrapExecutor && ["wrapExecutor keeps results intact", async () => {
-			const op = await captureOp(sb, (db) => db[table]["findMany"]({ limit: 1 }));
+			const op = await captureOp(betterSupabase, (db) => db[table]["findMany"]({ limit: 1 }));
 			const data = {
 				rows: [{ marker: "conformance" }],
 				count: 1
@@ -725,12 +723,12 @@ function env(names) {
 /**
 * Checks row-level security between two tenants against a running stack: for
 * each table, a user of one tenant must not select, insert, update or delete
-* the other tenant's rows. Runs without `sb`'s plugins, so the `tenant()`
+* the other tenant's rows. Runs without `betterSupabase`'s plugins, so the `tenant()`
 * plugin can't hide a missing policy. Throws a `ConformanceError` naming each
 * table and command that leaks; removes every row it created.
 *
 * ```ts
-* await expectTenantIsolation(sb, {
+* await expectTenantIsolation(betterSupabase, {
 *   tenants: [
 *     { id: ACME, claims: { sub: alice, tenant_id: ACME } },
 *     { id: GLOBEX, claims: { sub: bob, tenant_id: GLOBEX } },
@@ -744,9 +742,9 @@ function env(names) {
 * });
 * ```
 */
-async function expectTenantIsolation(sb, options) {
+async function expectTenantIsolation(betterSupabase, options) {
 	const stack = options.stack ?? {};
-	const bare = new BetterSupabase(sb.schema);
+	const bare = new BetterSupabase(betterSupabase.schema);
 	const url = stack.url ?? env(ENV_VARIABLES.url) ?? "http://127.0.0.1:54321";
 	const secretKey = stack.secretKey ?? env(ENV_VARIABLES.secretKey);
 	if (!secretKey) throw new TypeError("expectTenantIsolation needs stack.secretKey or $SUPABASE_SECRET_KEY to seed rows.");
@@ -816,4 +814,105 @@ async function expectTenantIsolation(sb, options) {
 	}
 }
 //#endregion
+//#region src/testing/seed.ts
+const SEED = Symbol.for("better-supabase.seed");
+function isSeed(value) {
+	return typeof value === "object" && value !== null && SEED in value;
+}
+const quote = (text) => `'${text.replaceAll("'", "''")}'`;
+function arrayLiteral(values) {
+	return `{${values.map((value) => {
+		if (value === null) return "NULL";
+		if (Array.isArray(value)) return arrayLiteral(value);
+		return `"${(temporalText(value) ?? String(value)).replaceAll(/[\\"]/g, "\\$&")}"`;
+	}).join(",")}}`;
+}
+function literal(value, column, where) {
+	if (value === null) return "null";
+	if (column.json) return quote(JSON.stringify(value));
+	if (Array.isArray(value)) return quote(arrayLiteral(value));
+	const temporalValue = temporalText(value);
+	if (temporalValue !== void 0) return quote(temporalValue);
+	const kind = typeof value;
+	switch (kind) {
+		case "string": return quote(value);
+		case "boolean":
+		case "bigint": return String(value);
+		case "number":
+			if (!Number.isFinite(value)) throw new TypeError(`${where}: ${String(value)} is not a finite number`);
+			return String(value);
+		case "object":
+		case "function":
+		case "symbol":
+		case "undefined": throw new TypeError(`${where}: unsupported value of type ${kind}`);
+		default: throw new TypeError(`${where}: unsupported value of type ${String(kind)}`);
+	}
+}
+const ident = (name) => `"${name.replaceAll("\"", "\"\"")}"`;
+/** Parents first (by forward relations), otherwise in the order given. */
+function order(meta, keys) {
+	const sorted = [];
+	const visiting = /* @__PURE__ */ new Set();
+	const visit = (key) => {
+		if (sorted.includes(key) || visiting.has(key)) return;
+		visiting.add(key);
+		for (const relation of Object.values(meta.tables[key]?.relations ?? {})) if (relation.direction === "forward" && relation.table !== key && keys.includes(relation.table)) visit(relation.table);
+		visiting.delete(key);
+		sorted.push(key);
+	};
+	for (const key of keys) visit(key);
+	return sorted;
+}
+function statement(table, rows) {
+	const entries = Object.entries(rows);
+	if (entries.length === 0) return void 0;
+	const columns = [];
+	for (const [, row] of entries) for (const [key, value] of Object.entries(row)) {
+		if (value === void 0 || columns.includes(key)) continue;
+		const column = table.columns[key];
+		if (!column) throw new TypeError(`seed ${table.key}: unknown column "${key}"`);
+		if (column.generated) throw new TypeError(`seed ${table.key}: "${key}" is a generated column`);
+		columns.push(key);
+	}
+	const values = entries.map(([name, row]) => {
+		return `  (${columns.map((key) => row[key] === void 0 ? "default" : literal(row[key], table.columns[key], `seed ${table.key}.${name}.${key}`)).join(", ")})`;
+	});
+	return `insert into ${`${ident(table.schema)}.${ident(table.name)}`} (${columns.map((key) => ident(table.columns[key].db)).join(", ")}) values\n${values.join(",\n")}\non conflict do nothing;`;
+}
+/**
+* Typed fixtures shared by `supabase/seeds` and your tests. Rows use app
+* casing and Insert types; `better-supabase seed` renders them to SQL.
+*
+* ```ts
+* export const seed = defineSeed(betterSupabase, {
+*   organizations: { acme: { id: ACME, name: 'Acme' } },
+*   customers: { first: { organizationId: ACME, name: 'First customer' } },
+* });
+* ```
+*/
+function defineSeed(betterSupabase, fixtures) {
+	const meta = betterSupabase.meta;
+	const statements = () => {
+		const keys = Object.keys(fixtures).filter((key) => fixtures[key] !== void 0);
+		for (const key of keys) {
+			const table = meta.tables[key];
+			if (!table) throw new TypeError(`seed: unknown table "${key}"`);
+			if (table.kind === "view") throw new TypeError(`seed: "${key}" is a view`);
+		}
+		return order(meta, keys).flatMap((key) => {
+			const sql = statement(meta.tables[key], fixtures[key]);
+			return sql ? [sql] : [];
+		});
+	};
+	return {
+		[SEED]: true,
+		rows: fixtures,
+		statements,
+		sql: () => statements().join("\n\n"),
+		async insert(sql) {
+			for (const text of statements()) await sql.queryRaw(text);
+		}
+	};
+}
+//#endregion
 export { ConformanceError, LOCAL_JWT_SECRET, asUser, createTestSigner, defineSeed, expectDbBudget, expectTenantIsolation, isSeed, localAuth, localSigningKey, signLocalJwt, signTestJwt, signTestJwtWithKey, testAuthResolver, testCacheAdapter, testEventSink, testExecutor, testGenerator, testPlugin };

package/dist/{types-C83v5SQz.d.ts → types-DONv9SHN.d.ts}

@@ -1,3 +1,4 @@
+/// <reference lib="esnext.temporal" />
 //#region src/schema/types.d.ts
 type Casing = "snake" | "camel";
 /** Runtime metadata for one column. Keyed by the app (cased) column name. */
@@ -27,10 +28,12 @@ interface ColumnMeta {
   readonly storage?: string;
 }
 /**
- * Runtime representation for a column: `date` decodes timestamps to `Date`,
- * `bigint` and `string` read the exact text of `int8`/`numeric` values.
+ * Runtime representation for a column: `instant` decodes `timestamptz` to
+ * `Temporal.Instant`, `plainDateTime` decodes `timestamp` to
+ * `Temporal.PlainDateTime`, and `bigint` and `string` read the exact text of
+ * `int8`/`numeric` values.
  */
-type Codec = "date" | "bigint" | "string";
+type Codec = "instant" | "plainDateTime" | "bigint" | "string";
 interface RelationMeta {
   /** App key of the target table. */
   readonly table: string;
@@ -165,19 +168,19 @@ interface BucketMeta {
   readonly fileSizeLimit?: string;
   readonly allowedMimeTypes?: readonly string[];
 }
-interface RelationShape {
+interface RelationTypes {
   readonly table: string;
   readonly kind: "one" | "many";
   readonly nullable: boolean;
 }
-interface FlagsShape {
+interface ModelFlags {
   readonly softDelete?: string;
   readonly timestamps?: true;
   readonly tenant?: string;
   readonly actor?: true;
   readonly version?: string;
 }
-interface ModelShape {
+interface ModelTypes {
   readonly Row: object;
   readonly Insert: object;
   readonly Update: object;
@@ -188,17 +191,17 @@ interface ModelShape {
   readonly Checks?: string;
   /** Foreign key constraint names on this table. */
   readonly ForeignKeys?: string;
-  readonly Flags: FlagsShape;
+  readonly Flags: ModelFlags;
 }
 type AnyModels = {
-  readonly [table: string]: ModelShape;
+  readonly [table: string]: ModelTypes;
 };
-type FunctionShape = {
+type FunctionTypes = {
   readonly Args: object;
   readonly Returns: unknown;
 };
 type AnyFunctions = {
-  readonly [name: string]: FunctionShape;
+  readonly [name: string]: FunctionTypes;
 };
 /**
  * Carries the model types next to the runtime metadata. Created by
@@ -245,4 +248,4 @@ type IsUnion<T, U = T> = T extends unknown ? [U] extends [T] ? false : true : ne
 type PrimaryKeyValue<M extends AnyModels, T extends keyof M> = true extends IsUnion<PrimaryKeyColumn<M, T>> ? { readonly [K in PrimaryKeyColumn<M, T>]: Row<M, T>[K]; } : Row<M, T>[PrimaryKeyColumn<M, T>];
 type Simplify<T> = { [K in keyof T]: T[K]; } & {};
 //#endregion
-export { SchemaMeta as A, PrimaryKeyValue as C, Relations as D, RelationShape as E, UniqueConstraint as F, UniqueKeyName as I, UniqueWhere as L, TableFlags as M, TableKey as N, Row as O, TableMeta as P, Update as R, PrimaryKeyColumn as S, RelationMeta as T, Insert as _, Casing as a, PermdockBucketPolicy as b, Codec as c, Flags as d, FlagsShape as f, FunctionsOf as g, FunctionShape as h, BucketPolicyName as i, Simplify as j, Schema as k, ColumnMeta as l, FunctionMeta as m, AnyModels as n, CheckConstraint as o, ForeignKeyConstraint as p, BucketMeta as r, ClaimsMeta as s, AnyFunctions as t, DatabaseOf as u, ModelShape as v, RealtimeTableMeta as w, PermdockTopicPolicy as x, ModelsOf as y };
+export { SchemaMeta as A, PrimaryKeyValue as C, Relations as D, RelationTypes as E, UniqueConstraint as F, UniqueKeyName as I, UniqueWhere as L, TableFlags as M, TableKey as N, Row as O, TableMeta as P, Update as R, PrimaryKeyColumn as S, RelationMeta as T, ModelFlags as _, Casing as a, PermdockBucketPolicy as b, Codec as c, Flags as d, ForeignKeyConstraint as f, Insert as g, FunctionsOf as h, BucketPolicyName as i, Simplify as j, Schema as k, ColumnMeta as l, FunctionTypes as m, AnyModels as n, CheckConstraint as o, FunctionMeta as p, BucketMeta as r, ClaimsMeta as s, AnyFunctions as t, DatabaseOf as u, ModelTypes as v, RealtimeTableMeta as w, PermdockTopicPolicy as x, ModelsOf as y };

package/dist/version-Bmf7_FzM.js

@@ -0,0 +1,4 @@
+//#region src/core/version.ts
+const VERSION = "0.4.0";
+//#endregion
+export { VERSION as t };