better-supabase 0.3.0 → 0.5.0

package/dist/support-Dk6vdmEw.js

@@ -0,0 +1,291 @@
+import { c as mapDbError, n as dbError } from "./errors-DtwXa6b8.js";
+import { t as temporal } from "./temporal-required-CAt4Dc9Z.js";
+import { i as ok, n as err, o as toDbError, t as AsyncResult } from "./result-BKiliPY7.js";
+import { t as validate } from "./standard-D7r6dMUu.js";
+import { c as supportCookie, l as supportCookieValue, s as clearSupportCookie } from "./server-Csx2sRjg.js";
+import { r as sqlIdent } from "./template-TxrGI5jR.js";
+import { n as emitKitEvent } from "./kit-events-CTFDfSwb.js";
+import { t as fromPgError } from "./executor-XycESQPH.js";
+//#region src/auth/support.ts
+/** A session from the jsonb the `support-sessions` functions return. */
+function supportSessionFromRow(row) {
+	const instant = (value) => temporal().Instant.from(value);
+	return {
+		id: row.id,
+		adminId: row.admin_id,
+		targetUserId: row.target_user_id,
+		reason: row.reason,
+		readOnly: row.read_only ?? true,
+		...row.tenant === null ? {} : { tenant: String(row.tenant) },
+		startedAt: instant(row.started_at),
+		expiresAt: instant(row.expires_at),
+		...row.ended_at === null ? {} : { endedAt: instant(row.ended_at) },
+		...row.ended_by === null ? {} : { endedBy: row.ended_by },
+		metadata: row.metadata ?? {}
+	};
+}
+/**
+* Support sessions in the `support-sessions` SQL kit module. `start` runs
+* as the admin, so the module's `is_platform()` gate applies; the reads run
+* on the admin connection.
+*/
+function sqlSupportStore(postgres, options = {}) {
+	const fn = (name) => `${sqlIdent(options.schema ?? "better_supabase")}.${sqlIdent(name)}`;
+	const as = (claims) => claims ? postgres.asUser(claims) : postgres.admin;
+	const one = async (client, text, params) => {
+		const [row] = await client.queryRaw(text, params);
+		return row?.session ?? null;
+	};
+	return {
+		apiVersion: 1,
+		name: "sql",
+		async start(input) {
+			const row = await one(postgres.asUser(input.adminClaims), `select ${fn("start_support_session")}($1, $2, $3::interval, $4, $5, $6, $7) as session`, [
+				input.targetUserId,
+				input.reason,
+				`${String(input.ttlSeconds)} seconds`,
+				input.readOnly,
+				JSON.stringify(input.metadata),
+				input.tenant ?? null,
+				input.adminId
+			]);
+			if (!row) throw new Error("start_support_session returned no session");
+			return supportSessionFromRow(row);
+		},
+		async get(sessionId, adminId, claims) {
+			const row = await one(as(claims), `select ${fn("active_support_session")}($1, $2) as session`, [sessionId, adminId]);
+			return row ? supportSessionFromRow(row) : void 0;
+		},
+		async end(sessionId, endedBy, claims) {
+			const [row] = await as(claims).queryRaw(`select ${fn("end_support_session")}($1, $2) as ended`, [sessionId, endedBy]);
+			return row?.ended === true;
+		},
+		async list(filter = {}, claims) {
+			return (await as(claims).queryRaw(`select session from ${fn("list_support_sessions")}($1, $2, $3, $4) as session`, [
+				filter.adminId ?? null,
+				filter.targetUserId ?? null,
+				filter.active ?? null,
+				filter.limit ?? 50
+			])).map((row) => supportSessionFromRow(row.session));
+		},
+		async claims(targetUserId) {
+			const [row] = await postgres.admin.queryRaw(`select ${fn("support_target_claims")}($1) as claims`, [targetUserId]);
+			return row?.claims ?? {};
+		}
+	};
+}
+/**
+* The claims a support session runs with: the target's, plus `act` naming
+* the admin, the reason and the session (the audit module records all three).
+* `role` falls back to `authenticated`; the admin's claims never leak in.
+*/
+function supportClaims(session, target) {
+	const role = target["role"];
+	return {
+		...target,
+		sub: session.targetUserId,
+		role: typeof role === "string" && role !== "" ? role : "authenticated",
+		act: {
+			sub: session.adminId,
+			reason: session.reason,
+			session_id: session.id,
+			read_only: session.readOnly
+		}
+	};
+}
+//#endregion
+//#region src/server/support.ts
+const denied = (message, code) => dbError("forbidden", message, { code });
+const invalid = (message, code) => dbError("invalid_request", message, { code });
+function storeError(cause) {
+	const raw = fromPgError(cause);
+	return raw ? mapDbError(raw) : toDbError(cause);
+}
+/**
+* Support sessions for `createServer(betterSupabase, { support })`. Apps that
+* never import it don't bundle the support code.
+*/
+function supportSessions(options) {
+	return {
+		options,
+		create: (events, claimsSchema) => createSupport(options, events, claimsSchema)
+	};
+}
+function createSupport(options, events, claimsSchema) {
+	const policy = options.policy ?? {};
+	const ttl = policy.ttl ?? 1800;
+	const maxTtl = policy.maxTtl ?? 14400;
+	const cookieName = options.cookie?.name;
+	const emit = (type, data) => {
+		emitKitEvent(events, type, data, {
+			actorId: data.adminId,
+			...data.sessionId ? { subject: `support_sessions/${data.sessionId}` } : {}
+		});
+	};
+	const targetClaims = async (store, targetUserId) => {
+		if (options.claims) return options.claims(targetUserId);
+		if (store.claims) return store.claims(targetUserId);
+		return { role: "authenticated" };
+	};
+	const checkPolicy = (admin, request, reason, seconds) => {
+		if (admin.claims["act"] !== void 0) return denied("An impersonated session cannot start a support session", "SUPPORT_NESTED");
+		if (request.targetUserId === admin.user.id) return invalid("An admin cannot start a support session as themselves", "SUPPORT_SELF");
+		if ((policy.requireReason ?? true) && reason === "") return invalid("A reason is required", "SUPPORT_REASON_REQUIRED");
+		if (!Number.isFinite(seconds) || seconds <= 0 || seconds > maxTtl) return invalid(`ttl must be between 1 and ${String(maxTtl)} seconds`, "SUPPORT_TTL");
+	};
+	const authorized = async (input) => {
+		if (!options.authorize) return true;
+		try {
+			return await options.authorize(input);
+		} catch {
+			return false;
+		}
+	};
+	return {
+		start(admin, request) {
+			return AsyncResult.from(async () => {
+				if (admin.kind !== "user") return err(dbError("unauthorized", "Sign in to start a support session"));
+				const reason = request.reason?.trim() ?? "";
+				const seconds = request.ttl ?? ttl;
+				const readOnly = policy.readOnly === "default" ? request.readOnly ?? true : true;
+				const deny = (error, denial) => {
+					emit("support.denied", {
+						adminId: admin.user.id,
+						targetUserId: request.targetUserId,
+						...reason ? { reason } : {},
+						denial
+					});
+					return err(error);
+				};
+				const violation = checkPolicy(admin, request, reason, seconds);
+				if (violation) return deny(violation, "policy");
+				const input = {
+					admin,
+					targetUserId: request.targetUserId,
+					reason,
+					readOnly,
+					...request.tenant === void 0 ? {} : { tenant: request.tenant },
+					metadata: request.metadata ?? {}
+				};
+				if (!await authorized(input)) return deny(denied("Not allowed to start a support session", "SUPPORT_FORBIDDEN"), "authorize");
+				let session;
+				try {
+					session = await options.store.start({
+						adminId: admin.user.id,
+						adminClaims: admin.claims,
+						targetUserId: request.targetUserId,
+						reason,
+						ttlSeconds: seconds,
+						readOnly,
+						...request.tenant === void 0 ? {} : { tenant: request.tenant },
+						metadata: request.metadata ?? {}
+					});
+				} catch (cause) {
+					const error = storeError(cause);
+					return deny(error, error.code === "42501" ? "permission" : "store");
+				}
+				emit("support.started", {
+					sessionId: session.id,
+					adminId: session.adminId,
+					targetUserId: session.targetUserId,
+					reason: session.reason,
+					readOnly: session.readOnly,
+					expiresAt: session.expiresAt
+				});
+				return ok({
+					session,
+					cookie: supportCookie(session, options.cookie)
+				});
+			});
+		},
+		stop(admin, sessionId) {
+			return AsyncResult.from(async () => {
+				const cookie = clearSupportCookie(options.cookie);
+				if (admin.kind !== "user") return err(dbError("unauthorized", "Sign in to stop a support session"));
+				try {
+					const session = await options.store.get(sessionId, admin.user.id, admin.claims);
+					if (!session) return ok({
+						ended: false,
+						cookie
+					});
+					const ended = await options.store.end(sessionId, "admin", admin.claims);
+					if (ended) emit("support.ended", {
+						sessionId,
+						adminId: session.adminId,
+						targetUserId: session.targetUserId,
+						endedBy: "admin"
+					});
+					return ok({
+						ended,
+						cookie
+					});
+				} catch (cause) {
+					return err(storeError(cause));
+				}
+			});
+		},
+		revoke(caller, sessionId) {
+			return AsyncResult.from(async () => {
+				if (caller.kind !== "user") return err(dbError("unauthorized", "Sign in to revoke a support session"));
+				try {
+					return ok(await options.store.end(sessionId, "revoked", caller.claims));
+				} catch (cause) {
+					return err(storeError(cause));
+				}
+			});
+		},
+		async current(request, auth) {
+			if (auth.kind !== "user") return;
+			if (auth.claims["act"] !== void 0) return;
+			const id = supportCookieValue(request.headers.get("cookie"), cookieName);
+			if (!id) return;
+			let session;
+			let claims;
+			try {
+				session = await options.store.get(id, auth.user.id, auth.claims);
+				if (!session || session.expiresAt.epochMilliseconds <= Date.now()) return;
+				if (policy.readOnly !== "default" && !session.readOnly) session = {
+					...session,
+					readOnly: true
+				};
+				claims = supportClaims(session, await targetClaims(options.store, session.targetUserId));
+			} catch (cause) {
+				events.logger.warn("Could not load the support session", { cause });
+				return;
+			}
+			if (claimsSchema) {
+				const checked = await validate(claimsSchema, claims, "claims");
+				if (!checked.ok) {
+					events.logger.warn("The support target's claims fail the claims schema", { sessionId: session.id });
+					return;
+				}
+				if (typeof checked.data === "object" && checked.data !== null) claims = {
+					...claims,
+					...checked.data
+				};
+			}
+			return {
+				session,
+				admin: {
+					id: auth.user.id,
+					...auth.user.email ? { email: auth.user.email } : {}
+				},
+				claims
+			};
+		},
+		list(caller, filter) {
+			return AsyncResult.from(async () => {
+				if (caller.kind !== "user") return err(dbError("unauthorized", "Sign in to list support sessions"));
+				try {
+					return ok(await options.store.list(filter, caller.claims));
+				} catch (cause) {
+					return err(storeError(cause));
+				}
+			});
+		},
+		sessionIdOf: (request) => supportCookieValue(request.headers.get("cookie"), cookieName),
+		clearCookie: () => clearSupportCookie(options.cookie)
+	};
+}
+//#endregion
+export { sqlSupportStore as n, supportClaims as r, supportSessions as t };

package/dist/support-view-Da5peKFg.d.ts

@@ -0,0 +1,17 @@
+import { t as AuthSession } from "./view-BEf0diC5.js";
+//#region src/auth/support-view.d.ts
+/** A running support session as the target's view shows it, for a banner. */
+interface SupportView {
+  readonly sessionId: string;
+  /** The admin viewing the app. */
+  readonly adminId: string;
+  readonly targetUserId: string;
+  readonly reason?: string;
+  readonly readOnly: boolean;
+  /** Seconds since epoch. */
+  readonly expiresAt: number | null;
+}
+/** The support session behind `session`, or `undefined` outside one. */
+declare function supportOf(session: AuthSession): SupportView | undefined;
+//#endregion
+export { supportOf as n, SupportView as t };

package/dist/support-view-g4YLBeqX.js

@@ -0,0 +1,18 @@
+//#region src/auth/support-view.ts
+/** The support session behind `session`, or `undefined` outside one. */
+function supportOf(session) {
+	if (session.kind !== "user") return;
+	const { impersonator } = session;
+	const sessionId = impersonator?.sessionId;
+	if (!impersonator || !sessionId) return;
+	return {
+		sessionId,
+		adminId: impersonator.id,
+		targetUserId: session.user.id,
+		...impersonator.reason ? { reason: impersonator.reason } : {},
+		readOnly: impersonator.readOnly ?? true,
+		expiresAt: session.expiresAt
+	};
+}
+//#endregion
+export { supportOf as t };

package/dist/{tables-Dhha3BXM.js → tables-Cb-3_VWc.js}

@@ -42,6 +42,20 @@ function visitCondition(condition, tables) {
 * followed through chains of cascades.
 */
 function invalidationTargets(meta, table) {
+	let byTable = targetsByMeta.get(meta);
+	if (!byTable) {
+		byTable = /* @__PURE__ */ new Map();
+		targetsByMeta.set(meta, byTable);
+	}
+	let targets = byTable.get(table);
+	if (!targets) {
+		targets = Object.freeze(computeTargets(meta, table));
+		byTable.set(table, targets);
+	}
+	return targets;
+}
+const targetsByMeta = /* @__PURE__ */ new WeakMap();
+function computeTargets(meta, table) {
 	const targets = /* @__PURE__ */ new Set([table]);
 	const queue = [table];
 	for (let key = queue.shift(); key !== void 0; key = queue.shift()) {

package/dist/{permdock-sql-Bta_G0v-.js → template-TxrGI5jR.js}

@@ -1,4 +1,4 @@
-import { n as dbError, t as DbException } from "./errors-Bl3rkOzo.js";
+import { n as dbError, t as DbException } from "./errors-DtwXa6b8.js";
 //#region src/core/template.ts
 const PLACEHOLDER = /\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
 function parseSegment(segment) {
@@ -90,33 +90,4 @@ function slug(value) {
 	return value.replaceAll(/[^A-Za-z0-9]+/g, "_").replaceAll(/^_|_$/g, "").toLowerCase();
 }
 //#endregion
-//#region src/core/permdock-sql.ts
-const SCOPE = /^[a-z_][a-z0-9_]*$/;
-/** PermDock splits a key with row conditions into `key#1`, `key#2`, ...: those need its own policies. */
-const SPLIT_KEY = /#\d+$/;
-/**
-* The SQL condition for one PermDock permission key. `id` is the text
-* expression holding the scope id; it is compared as text, so a malformed
-* path never raises a cast error.
-*
-* The helpers check role and scope, not a permission's row conditions, so
-* the condition is only correct for permissions whose grants have none
-* beyond the scope. `#n` keys are refused, and so are keys the catalog marks
-* with `rowConditions: true` when one is passed.
-*/
-function permdockCheck(where, target, key, id, catalog) {
-	if (key === "") throw new TypeError(`${where}: a PermDock permission key is empty`);
-	if (SPLIT_KEY.test(key)) throw new TypeError(`${where}: "${key}" is one part of a permission PermDock splits by row condition. Use PermDock's generated policies for it.`);
-	if (catalog?.permissions.some((permission) => permission.key === key && permission.rowConditions === true)) throw new TypeError(`${where}: "${key}" has row conditions in PermDock's catalog (rowConditions: true), which the SQL helpers don't check. Use PermDock's generated policies for it.`);
-	const schema = sqlIdent(target.schema ?? "public");
-	if (target.scope === "global") return `(select ${schema}.permdock_has(${sqlString(key)}))`;
-	if (!SCOPE.test(target.scope)) throw new TypeError(`${where}: invalid PermDock scope "${target.scope}"`);
-	if (id === void 0) throw new TypeError(`${where}: scope "${target.scope}" needs a segment`);
-	return `${id} in (select t.id::text from ${schema}.${sqlIdent(`permitted_${target.scope}_ids`)}(${sqlString(key)}) as t(id))`;
-}
-/** The keys a bucket or topic PermDock policy names. */
-function permdockKeys(policy) {
-	return Object.values(policy.permdock).filter((key) => typeof key === "string");
-}
-//#endregion
-export { sqlIdent as a, slug as i, permdockKeys as n, sqlString as o, parseTemplate as r, permdockCheck as t };
+export { sqlString as i, slug as n, sqlIdent as r, parseTemplate as t };

package/dist/{temporal-BwshQk0W.js → temporal-CVlIV2DZ.js}

@@ -12,16 +12,29 @@ function nowInstant() {
 	if (namespace === void 0) throw new TypeError(TEMPORAL_MISSING);
 	return namespace.Now.instant();
 }
+const ISO_TAGS = /* @__PURE__ */ new Set([
+	"Temporal.Instant",
+	"Temporal.PlainDateTime",
+	"Temporal.PlainDate",
+	"Temporal.PlainTime"
+]);
 /**
 * The text Postgres reads back for a Temporal value: ISO 8601, with a
 * `ZonedDateTime` sent as its instant because Postgres rejects the
 * `[Region/City]` annotation. `undefined` for anything else.
+*
+* Values are recognized by `Symbol.toStringTag`, not `instanceof`, so values
+* from another realm or a second copy of the polyfill still encode.
 */
 function temporalText(value) {
-	const namespace = optionalTemporal();
-	if (namespace === void 0) return void 0;
-	if (value instanceof namespace.ZonedDateTime) return value.toInstant().toString();
-	if (value instanceof namespace.Instant || value instanceof namespace.PlainDateTime || value instanceof namespace.PlainDate || value instanceof namespace.PlainTime) return value.toString();
+	if (typeof value !== "object" || value === null) return void 0;
+	if (!(Symbol.toStringTag in value)) return void 0;
+	const tag = value[Symbol.toStringTag];
+	if (ISO_TAGS.has(tag)) return String(value);
+	return tag === "Temporal.ZonedDateTime" && isZoned(value) ? String(value.toInstant()) : void 0;
+}
+function isZoned(value) {
+	return "toInstant" in value && typeof value.toInstant === "function";
 }
 //#endregion
 export { temporalText as i, nowInstant as n, optionalTemporal as r, TEMPORAL_MISSING as t };

package/dist/{temporal-required-CMxeSVPo.js → temporal-required-CAt4Dc9Z.js}

@@ -1,5 +1,5 @@
-import { n as dbError, t as DbException } from "./errors-Bl3rkOzo.js";
-import { r as optionalTemporal, t as TEMPORAL_MISSING } from "./temporal-BwshQk0W.js";
+import { n as dbError, t as DbException } from "./errors-DtwXa6b8.js";
+import { r as optionalTemporal, t as TEMPORAL_MISSING } from "./temporal-CVlIV2DZ.js";
 //#region src/core/temporal-required.ts
 /** The error for a runtime without Temporal, naming the polyfill to load. */
 function temporalMissing() {

package/dist/testing/index.d.ts

@@ -1,13 +1,16 @@
-import { A as SchemaMeta, N as TableKey, R as Update, g as Insert, n as AnyModels, t as AnyFunctions } from "../types-DONv9SHN.js";
-import { r as Executor } from "../executor-DynmIWhq.js";
-import { P as DbStats, l as CacheAdapter, t as BetterSupabase, y as Db } from "../define-DUbydmJa.js";
-import { h as RequestContext, n as AnyPlugin } from "../plugin-DVRB8qNE.js";
-import { b as ResolvedConfig, d as Generator, f as GeneratorInput } from "../config-C1CYcm6o.js";
-import "../index-Cf-D2jk1.js";
-import { t as SqlClient } from "../executor-B26lgbHD.js";
-import { r as Postgres } from "../pool-B9qsLyFR.js";
-import { n as AuthResolver } from "../resolve-BRciX2jK.js";
-import { r as EventSink, t as CloudEvent } from "../index-GV77NpRP.js";
+import { P as TableKey, _ as Insert, j as SchemaMeta, n as AnyFunctions, r as AnyModels, z as Update } from "../types-Dnf_wRDz.js";
+import { r as Executor } from "../executor-BunPOO-k.js";
+import { P as DbStats, l as CacheAdapter, t as BetterSupabase, y as Db } from "../define-Bp_BZa5h.js";
+import { g as RequestContext, n as AnyPlugin } from "../plugin-o144f322.js";
+import { b as ResolvedConfig, d as Generator, f as GeneratorInput } from "../config-T_ejwyd3.js";
+import { t as SqlClient } from "../executor-Cghdstwu.js";
+import { t as BetterPostgres } from "../pool-C9voM4Kw.js";
+import { n as AuthResolver } from "../resolve-C15TJq77.js";
+import { o as SupportSessionStore } from "../support-DT-OhSxD.js";
+import { r as EventSink, t as CloudEvent } from "../index-DOESKG27.js";
+import { p as QueueBackend } from "../queue-BYUCjr59.js";
+import { t as NotificationChannel } from "../channel-FQW-CnGR.js";
+import { c as WebhookSecretStore, i as WebhookSigner, m as WebhookTransport } from "../signers-Cc6r98SW.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { webcrypto } from "node:crypto";
 //#region src/testing/jwt.d.ts
@@ -26,7 +29,7 @@ interface TestJwtClaims {
 export declare function signTestJwt(secret: string, claims: TestJwtClaims): Promise<string>;
 /**
  * Accepts `signTestJwt` tokens as users, for API servers tested against the
- * local stack: `createServer(sb, { auth: { resolvers: [localAuth(secret)] } })`.
+ * local stack: `createServer(betterSupabase, { auth: { resolvers: [localAuth(secret)] } })`.
  * Tokens that are not HS256-signed with `secret` fall through. Test-only.
  */
 export declare function localAuth(secret: string): AuthResolver;
@@ -82,7 +85,7 @@ interface LocalStack {
   /** Service-role key for `expectTenantIsolation`; defaults to `$SUPABASE_SECRET_KEY`. */
   readonly secretKey?: string;
   /** Enables `sql`: the same user over direct Postgres. */
-  readonly postgres?: Postgres;
+  readonly postgres?: BetterPostgres;
 }
 interface TestUser<M extends AnyModels, F extends AnyFunctions, E> {
   readonly token: string;
@@ -101,11 +104,11 @@ interface TestUser<M extends AnyModels, F extends AnyFunctions, E> {
  * still uses the shared JWT secret.
  *
  * ```ts
- * const alice = await asUser(sb, { sub: aliceId, tenant_id: acme });
+ * const alice = await asUser(betterSupabase, { sub: aliceId, tenant_id: acme });
  * expect(await alice.db.customers.count().orThrow()).toBe(3);
  * ```
  */
-export declare function asUser<M extends AnyModels, D, F extends AnyFunctions, E>(sb: BetterSupabase<M, D, F, E>, claims: TestJwtClaims, stack?: LocalStack): Promise<TestUser<M, F, E>>;
+export declare function asUser<M extends AnyModels, D, F extends AnyFunctions, E>(betterSupabase: BetterSupabase<M, D, F, E>, claims: TestJwtClaims, stack?: LocalStack): Promise<TestUser<M, F, E>>;
 //#endregion
 //#region src/testing/budget.d.ts
 /** The part of a Playwright `Response` the budget check reads. */
@@ -148,7 +151,7 @@ interface MeasuredRender {
 /**
  * Measures every document and RSC navigation response during `during` and
  * fails when one render makes more database calls or waves than allowed.
- * Needs `createNext(sb, { debug })` and `next.debugRoute()` in the app.
+ * Needs `createNext(betterSupabase, { debug })` and `bs.debugRoute()` in the app.
  */
 export declare function expectDbBudget(page: BudgetPage, expectation: DbBudgetExpectation): Promise<readonly MeasuredRender[]>;
 //#endregion
@@ -171,7 +174,7 @@ export declare class ConformanceError extends Error {
 type AnySupabase = BetterSupabase<any, any, any, any>;
 interface TestExecutorOptions {
   /** A definition whose schema matches the executor's database. Install no plugins. */
-  readonly sb: AnySupabase;
+  readonly betterSupabase: AnySupabase;
   /** App key of a table with rows the executor can read. Defaults to the first table. */
   readonly table?: string;
   /** A row to insert and delete again, to check writes. Skips write checks when omitted. */
@@ -183,7 +186,7 @@ interface TestExecutorOptions {
  * than thrown, and (with `create`) a write round trip.
  *
  * ```ts
- * it('conforms', () => testExecutor(myExecutor, { sb, table: 'tags', create: { name: 'x' } }));
+ * it('conforms', () => testExecutor(myExecutor, { betterSupabase, table: 'tags', create: { name: 'x' } }));
  * ```
  */
 export declare function testExecutor(executor: Executor, options: TestExecutorOptions): Promise<ConformanceReport>;
@@ -200,6 +203,35 @@ interface TestEventSinkOptions {
 }
 /** Proves an `EventSink` accepts empty and full batches without mutating them, and delivers them when readable. */
 export declare function testEventSink(sink: EventSink, options?: TestEventSinkOptions): Promise<ConformanceReport>;
+interface TestQueueBackendOptions {
+  /** A queue the kit may fill and drain; use a fresh name per run. */
+  readonly queue: string;
+  /** Check that a repeated dedupe key returns the first id. Defaults to `backend.leases`. */
+  readonly dedupe?: boolean;
+}
+/**
+ * Proves a `QueueBackend` round-trips payloads, hides claimed messages for
+ * their lease, counts attempts, retries and dead-letters on `fail`, and
+ * (when it has `leases`) rejects a stale attempt and extends a lease. It
+ * writes to `options.queue` on the backend's real store.
+ */
+export declare function testQueueBackend(backend: QueueBackend, options: TestQueueBackendOptions): Promise<ConformanceReport>;
+interface TestSupportSessionStoreOptions {
+  /** A user who may start support sessions in the store. */
+  readonly admin: {
+    readonly id: string;
+    readonly claims: Readonly<Record<string, unknown>>;
+  };
+  /** Two other users the admin may view the app as. */
+  readonly targets: readonly [string, string];
+}
+/**
+ * Proves a `SupportSessionStore` starts sessions with the input it was
+ * given, shows a running session only to its admin, ends the admin's
+ * previous session on start, ends a session once, and lists sessions.
+ * It writes sessions to the store; they are all ended when it returns.
+ */
+export declare function testSupportSessionStore(store: SupportSessionStore, options: TestSupportSessionStoreOptions): Promise<ConformanceReport>;
 interface TestAuthResolverOptions {
   /** Requests with credentials this resolver owns but that must not verify. */
   readonly invalid: readonly Request[];
@@ -228,7 +260,7 @@ interface TestGeneratorOptions {
 export declare function testGenerator(generator: Generator, options: TestGeneratorOptions): Promise<ConformanceReport>;
 interface TestPluginOptions {
   /** The definition without this plugin. */
-  readonly sb: AnySupabase;
+  readonly betterSupabase: AnySupabase;
   /** Table to exercise. Defaults to the first table. */
   readonly table?: string;
   /** Context the plugin needs, such as `{ tenant }` for `tenant()`. */
@@ -273,12 +305,12 @@ interface TenantIsolationOptions<M extends AnyModels> {
 /**
  * Checks row-level security between two tenants against a running stack: for
  * each table, a user of one tenant must not select, insert, update or delete
- * the other tenant's rows. Runs without `sb`'s plugins, so the `tenant()`
+ * the other tenant's rows. Runs without `betterSupabase`'s plugins, so the `tenant()`
  * plugin can't hide a missing policy. Throws a `ConformanceError` naming each
  * table and command that leaks; removes every row it created.
  *
  * ```ts
- * await expectTenantIsolation(sb, {
+ * await expectTenantIsolation(betterSupabase, {
  *   tenants: [
  *     { id: ACME, claims: { sub: alice, tenant_id: ACME } },
  *     { id: GLOBEX, claims: { sub: bob, tenant_id: GLOBEX } },
@@ -292,7 +324,7 @@ interface TenantIsolationOptions<M extends AnyModels> {
  * });
  * ```
  */
-export declare function expectTenantIsolation<M extends AnyModels, D, F extends AnyFunctions, E>(sb: BetterSupabase<M, D, F, E>, options: TenantIsolationOptions<M>): Promise<ConformanceReport>;
+export declare function expectTenantIsolation<M extends AnyModels, D, F extends AnyFunctions, E>(betterSupabase: BetterSupabase<M, D, F, E>, options: TenantIsolationOptions<M>): Promise<ConformanceReport>;
 //#endregion
 //#region src/testing/seed.d.ts
 /** Named rows per table, in app casing: `{ customers: { acme: { ... } } }`. */
@@ -316,12 +348,69 @@ export declare function isSeed(value: unknown): value is Seed<unknown>;
  * casing and Insert types; `better-supabase seed` renders them to SQL.
  *
  * ```ts
- * export const seed = defineSeed(sb, {
+ * export const seed = defineSeed(betterSupabase, {
  *   organizations: { acme: { id: ACME, name: 'Acme' } },
  *   customers: { first: { organizationId: ACME, name: 'First customer' } },
  * });
  * ```
  */
-export declare function defineSeed<M extends AnyModels, D, F extends AnyFunctions, E, const S extends SeedFixtures<M>>(sb: BetterSupabase<M, D, F, E>, fixtures: S & ExactSeed<M, S>): Seed<S>;
+export declare function defineSeed<M extends AnyModels, D, F extends AnyFunctions, E, const S extends SeedFixtures<M>>(betterSupabase: BetterSupabase<M, D, F, E>, fixtures: S & ExactSeed<M, S>): Seed<S>;
+//#endregion
+//#region src/testing/notification-channel.d.ts
+interface TestNotificationChannelOptions {
+  /** The recipient's email in the sample message. Defaults to `null`. */
+  readonly email?: string | null;
+  /**
+   * The delivery ids the provider received, read after the kit sends. When
+   * given, the kit checks that the sample message arrived.
+   */
+  readonly received?: () => Promise<readonly string[]>;
+}
+/**
+ * Runs the `NotificationChannel` contract against `channel`: the API version,
+ * a name, and one frozen sample message it must send without mutating.
+ * Throws a `ConformanceError` listing every failed check.
+ */
+export declare function testNotificationChannel(channel: NotificationChannel, options?: TestNotificationChannelOptions): Promise<ConformanceReport>;
+//#endregion
+//#region src/testing/webhooks.d.ts
+interface TestWebhookSignerOptions {
+  /**
+   * The receiver's check, e.g. `verifyWebhook`. When given, the kit checks
+   * that the signed sample verifies with its secret.
+   */
+  readonly verify?: (request: {
+    readonly headers: Readonly<Record<string, string>>;
+    readonly body: string;
+  }, secret: string) => Promise<boolean>;
+}
+/**
+ * Runs the `WebhookSigner` contract against `signer`: the API version, a
+ * name, string headers that depend on the body and are stable for the same
+ * input, and, with `verify`, a signature the receiver accepts.
+ */
+export declare function testWebhookSigner(signer: WebhookSigner, options?: TestWebhookSignerOptions): Promise<ConformanceReport>;
+interface TestWebhookTransportOptions {
+  /** A receiver the transport may POST the sample to, e.g. a local server. */
+  readonly url: string;
+  /** The bodies the receiver got, read after the kit sends. */
+  readonly received?: () => Promise<readonly string[]>;
+}
+/**
+ * Runs the `WebhookTransport` contract against `transport`: the API version,
+ * a name, and one POST to `options.url` that returns an HTTP status and a
+ * string body.
+ */
+export declare function testWebhookTransport(transport: WebhookTransport, options: TestWebhookTransportOptions): Promise<ConformanceReport>;
+interface TestWebhookSecretStoreOptions {
+  /** An endpoint the store may read and, when it can rotate, rotate. */
+  readonly endpointId: string;
+}
+/**
+ * Runs the `WebhookSecretStore` contract against `store`: the API version, a
+ * list of strings, and, when it can rotate, a new secret listed first while
+ * the previous one keeps signing.
+ */
+export declare function testWebhookSecretStore(store: WebhookSecretStore, options: TestWebhookSecretStoreOptions): Promise<ConformanceReport>;
 //#endregion
-export type { BudgetPage, BudgetResponse, ConformanceCheck, ConformanceReport, DbBudgetExpectation, ExactSeed, IsolationTable, IsolationTables, IsolationTenant, LocalStack, MeasuredRender, Seed, SeedFixtures, SigningJwk, TenantIsolationOptions, TestAuthResolverOptions, TestEventSinkOptions, TestExecutorOptions, TestGeneratorOptions, TestJwtClaims, TestPluginOptions, TestSigner, TestUser };
+export type { BudgetPage, BudgetResponse, ConformanceCheck, ConformanceReport, DbBudgetExpectation, ExactSeed, IsolationTable, IsolationTables, IsolationTenant, LocalStack, MeasuredRender, Seed, SeedFixtures, SigningJwk, TenantIsolationOptions, TestAuthResolverOptions, TestEventSinkOptions, TestExecutorOptions, TestGeneratorOptions, TestJwtClaims, TestNotificationChannelOptions, TestPluginOptions, TestQueueBackendOptions, TestSigner, TestSupportSessionStoreOptions, TestUser, TestWebhookSecretStoreOptions, TestWebhookSignerOptions, TestWebhookTransportOptions };