better-supabase 0.4.0 → 0.5.1

package/dist/support-wHnK6zp-.js

@@ -0,0 +1,293 @@
+import { c as mapDbError, n as dbError } from "./errors-DtwXa6b8.js";
+import { t as temporal } from "./temporal-required-CAt4Dc9Z.js";
+import { i as ok, n as err, o as toDbError, t as AsyncResult } from "./result-BKiliPY7.js";
+import { t as validate } from "./standard-D7r6dMUu.js";
+import { c as supportCookie, l as supportCookieValue, s as clearSupportCookie } from "./server-B1mZ7CgQ.js";
+import { r as sqlIdent } from "./template-TxrGI5jR.js";
+import { n as emitKitEvent } from "./kit-events-CTFDfSwb.js";
+import { t as fromPgError } from "./executor-XycESQPH.js";
+//#region src/auth/support.ts
+/** A session from the jsonb the `support-sessions` functions return. */
+function supportSessionFromRow(row) {
+	const instant = (value) => temporal().Instant.from(value);
+	return {
+		id: row.id,
+		adminId: row.admin_id,
+		targetUserId: row.target_user_id,
+		reason: row.reason,
+		readOnly: row.read_only ?? true,
+		...row.tenant === null ? {} : { tenant: String(row.tenant) },
+		startedAt: instant(row.started_at),
+		expiresAt: instant(row.expires_at),
+		...row.ended_at === null ? {} : { endedAt: instant(row.ended_at) },
+		...row.ended_by === null ? {} : { endedBy: row.ended_by },
+		metadata: row.metadata ?? {}
+	};
+}
+/**
+* Support sessions in the `support-sessions` SQL kit module. `start` runs
+* as the admin, so the module's `is_platform()` gate applies; the reads run
+* on the admin connection.
+*/
+function sqlSupportStore(postgres, options = {}) {
+	const fn = (name) => `${sqlIdent(options.schema ?? "better_supabase")}.${sqlIdent(name)}`;
+	const as = (claims) => claims ? postgres.asUser(claims) : postgres.admin;
+	const one = async (client, text, params) => {
+		const [row] = await client.queryRaw(text, params);
+		return row?.session ?? null;
+	};
+	return {
+		apiVersion: 1,
+		name: "sql",
+		async start(input) {
+			const row = await one(postgres.asUser(input.adminClaims), `select ${fn("start_support_session")}($1, $2, $3::interval, $4, $5, $6, $7) as session`, [
+				input.targetUserId,
+				input.reason,
+				`${String(input.ttlSeconds)} seconds`,
+				input.readOnly,
+				JSON.stringify(input.metadata),
+				input.tenant ?? null,
+				input.adminId
+			]);
+			if (!row) throw new Error("start_support_session returned no session");
+			return supportSessionFromRow(row);
+		},
+		async get(sessionId, adminId, claims) {
+			const row = await one(as(claims), `select ${fn("active_support_session")}($1, $2) as session`, [sessionId, adminId]);
+			return row ? supportSessionFromRow(row) : void 0;
+		},
+		async end(sessionId, endedBy, claims) {
+			const [row] = await as(claims).queryRaw(`select ${fn("end_support_session")}($1, $2) as ended`, [sessionId, endedBy]);
+			return row?.ended === true;
+		},
+		async list(filter = {}, claims) {
+			return (await as(claims).queryRaw(`select session from ${fn("list_support_sessions")}($1, $2, $3, $4) as session`, [
+				filter.adminId ?? null,
+				filter.targetUserId ?? null,
+				filter.active ?? null,
+				filter.limit ?? 50
+			])).map((row) => supportSessionFromRow(row.session));
+		},
+		async claims(targetUserId) {
+			const [row] = await postgres.admin.queryRaw(`select ${fn("support_target_claims")}($1) as claims`, [targetUserId]);
+			return row?.claims ?? {};
+		}
+	};
+}
+/**
+* The claims a support session runs with: the target's, plus `act` naming
+* the admin, the reason and the session (the audit module records all three),
+* marked `kind: "support"` so `actorOf` never reads it as an OAuth client.
+* `role` falls back to `authenticated`; the admin's claims never leak in.
+*/
+function supportClaims(session, target) {
+	const role = target["role"];
+	return {
+		...target,
+		sub: session.targetUserId,
+		role: typeof role === "string" && role !== "" ? role : "authenticated",
+		act: {
+			kind: "support",
+			sub: session.adminId,
+			reason: session.reason,
+			session_id: session.id,
+			read_only: session.readOnly
+		}
+	};
+}
+//#endregion
+//#region src/server/support.ts
+const denied = (message, code) => dbError("forbidden", message, { code });
+const invalid = (message, code) => dbError("invalid_request", message, { code });
+function storeError(cause) {
+	const raw = fromPgError(cause);
+	return raw ? mapDbError(raw) : toDbError(cause);
+}
+/**
+* Support sessions for `createServer(betterSupabase, { support })`. Apps that
+* never import it don't bundle the support code.
+*/
+function supportSessions(options) {
+	return {
+		options,
+		create: (events, claimsSchema) => createSupport(options, events, claimsSchema)
+	};
+}
+function createSupport(options, events, claimsSchema) {
+	const policy = options.policy ?? {};
+	const ttl = policy.ttl ?? 1800;
+	const maxTtl = policy.maxTtl ?? 14400;
+	const cookieName = options.cookie?.name;
+	const emit = (type, data) => {
+		emitKitEvent(events, type, data, {
+			actorId: data.adminId,
+			...data.sessionId ? { subject: `support_sessions/${data.sessionId}` } : {}
+		});
+	};
+	const targetClaims = async (store, targetUserId) => {
+		if (options.claims) return options.claims(targetUserId);
+		if (store.claims) return store.claims(targetUserId);
+		return { role: "authenticated" };
+	};
+	const checkPolicy = (admin, request, reason, seconds) => {
+		if (admin.claims["act"] !== void 0) return denied("An impersonated session cannot start a support session", "SUPPORT_NESTED");
+		if (request.targetUserId === admin.user.id) return invalid("An admin cannot start a support session as themselves", "SUPPORT_SELF");
+		if ((policy.requireReason ?? true) && reason === "") return invalid("A reason is required", "SUPPORT_REASON_REQUIRED");
+		if (!Number.isFinite(seconds) || seconds <= 0 || seconds > maxTtl) return invalid(`ttl must be between 1 and ${String(maxTtl)} seconds`, "SUPPORT_TTL");
+	};
+	const authorized = async (input) => {
+		if (!options.authorize) return true;
+		try {
+			return await options.authorize(input);
+		} catch {
+			return false;
+		}
+	};
+	return {
+		start(admin, request) {
+			return AsyncResult.from(async () => {
+				if (admin.kind !== "user") return err(dbError("unauthorized", "Sign in to start a support session"));
+				const reason = request.reason?.trim() ?? "";
+				const seconds = request.ttl ?? ttl;
+				const readOnly = policy.readOnly === "default" ? request.readOnly ?? true : true;
+				const deny = (error, denial) => {
+					emit("support.denied", {
+						adminId: admin.user.id,
+						targetUserId: request.targetUserId,
+						...reason ? { reason } : {},
+						denial
+					});
+					return err(error);
+				};
+				const violation = checkPolicy(admin, request, reason, seconds);
+				if (violation) return deny(violation, "policy");
+				const input = {
+					admin,
+					targetUserId: request.targetUserId,
+					reason,
+					readOnly,
+					...request.tenant === void 0 ? {} : { tenant: request.tenant },
+					metadata: request.metadata ?? {}
+				};
+				if (!await authorized(input)) return deny(denied("Not allowed to start a support session", "SUPPORT_FORBIDDEN"), "authorize");
+				let session;
+				try {
+					session = await options.store.start({
+						adminId: admin.user.id,
+						adminClaims: admin.claims,
+						targetUserId: request.targetUserId,
+						reason,
+						ttlSeconds: seconds,
+						readOnly,
+						...request.tenant === void 0 ? {} : { tenant: request.tenant },
+						metadata: request.metadata ?? {}
+					});
+				} catch (cause) {
+					const error = storeError(cause);
+					return deny(error, error.code === "42501" ? "permission" : "store");
+				}
+				emit("support.started", {
+					sessionId: session.id,
+					adminId: session.adminId,
+					targetUserId: session.targetUserId,
+					reason: session.reason,
+					readOnly: session.readOnly,
+					expiresAt: session.expiresAt
+				});
+				return ok({
+					session,
+					cookie: supportCookie(session, options.cookie)
+				});
+			});
+		},
+		stop(admin, sessionId) {
+			return AsyncResult.from(async () => {
+				const cookie = clearSupportCookie(options.cookie);
+				if (admin.kind !== "user") return err(dbError("unauthorized", "Sign in to stop a support session"));
+				try {
+					const session = await options.store.get(sessionId, admin.user.id, admin.claims);
+					if (!session) return ok({
+						ended: false,
+						cookie
+					});
+					const ended = await options.store.end(sessionId, "admin", admin.claims);
+					if (ended) emit("support.ended", {
+						sessionId,
+						adminId: session.adminId,
+						targetUserId: session.targetUserId,
+						endedBy: "admin"
+					});
+					return ok({
+						ended,
+						cookie
+					});
+				} catch (cause) {
+					return err(storeError(cause));
+				}
+			});
+		},
+		revoke(caller, sessionId) {
+			return AsyncResult.from(async () => {
+				if (caller.kind !== "user") return err(dbError("unauthorized", "Sign in to revoke a support session"));
+				try {
+					return ok(await options.store.end(sessionId, "revoked", caller.claims));
+				} catch (cause) {
+					return err(storeError(cause));
+				}
+			});
+		},
+		async current(request, auth) {
+			if (auth.kind !== "user") return;
+			if (auth.claims["act"] !== void 0) return;
+			const id = supportCookieValue(request.headers.get("cookie"), cookieName);
+			if (!id) return;
+			let session;
+			let claims;
+			try {
+				session = await options.store.get(id, auth.user.id, auth.claims);
+				if (!session || session.expiresAt.epochMilliseconds <= Date.now()) return;
+				if (policy.readOnly !== "default" && !session.readOnly) session = {
+					...session,
+					readOnly: true
+				};
+				claims = supportClaims(session, await targetClaims(options.store, session.targetUserId));
+			} catch (cause) {
+				events.logger.warn("Could not load the support session", { cause });
+				return;
+			}
+			if (claimsSchema) {
+				const checked = await validate(claimsSchema, claims, "claims");
+				if (!checked.ok) {
+					events.logger.warn("The support target's claims fail the claims schema", { sessionId: session.id });
+					return;
+				}
+				if (typeof checked.data === "object" && checked.data !== null) claims = {
+					...claims,
+					...checked.data
+				};
+			}
+			return {
+				session,
+				admin: {
+					id: auth.user.id,
+					...auth.user.email ? { email: auth.user.email } : {}
+				},
+				claims
+			};
+		},
+		list(caller, filter) {
+			return AsyncResult.from(async () => {
+				if (caller.kind !== "user") return err(dbError("unauthorized", "Sign in to list support sessions"));
+				try {
+					return ok(await options.store.list(filter, caller.claims));
+				} catch (cause) {
+					return err(storeError(cause));
+				}
+			});
+		},
+		sessionIdOf: (request) => supportCookieValue(request.headers.get("cookie"), cookieName),
+		clearCookie: () => clearSupportCookie(options.cookie)
+	};
+}
+//#endregion
+export { sqlSupportStore as n, supportClaims as r, supportSessions as t };

package/dist/{permdock-sql-C4KFzLc9.js → template-TxrGI5jR.js}

@@ -1,4 +1,4 @@
-import { n as dbError, t as DbException } from "./errors-L0xK41y_.js";
+import { n as dbError, t as DbException } from "./errors-DtwXa6b8.js";
 //#region src/core/template.ts
 const PLACEHOLDER = /\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
 function parseSegment(segment) {
@@ -90,33 +90,4 @@ function slug(value) {
 	return value.replaceAll(/[^A-Za-z0-9]+/g, "_").replaceAll(/^_|_$/g, "").toLowerCase();
 }
 //#endregion
-//#region src/core/permdock-sql.ts
-const SCOPE = /^[a-z_][a-z0-9_]*$/;
-/** PermDock splits a key with row conditions into `key#1`, `key#2`, ...: those need its own policies. */
-const SPLIT_KEY = /#\d+$/;
-/**
-* The SQL condition for one PermDock permission key. `id` is the text
-* expression holding the scope id; it is compared as text, so a malformed
-* path never raises a cast error.
-*
-* The helpers check role and scope, not a permission's row conditions, so
-* the condition is only correct for permissions whose grants have none
-* beyond the scope. `#n` keys are refused, and so are keys the catalog marks
-* with `rowConditions: true` when one is passed.
-*/
-function permdockCheck(where, target, key, id, catalog) {
-	if (key === "") throw new TypeError(`${where}: a PermDock permission key is empty`);
-	if (SPLIT_KEY.test(key)) throw new TypeError(`${where}: "${key}" is one part of a permission PermDock splits by row condition. Use PermDock's generated policies for it.`);
-	if (catalog?.permissions.some((permission) => permission.key === key && permission.rowConditions === true)) throw new TypeError(`${where}: "${key}" has row conditions in PermDock's catalog (rowConditions: true), which the SQL helpers don't check. Use PermDock's generated policies for it.`);
-	const schema = sqlIdent(target.schema ?? "public");
-	if (target.scope === "global") return `(select ${schema}.permdock_has(${sqlString(key)}))`;
-	if (!SCOPE.test(target.scope)) throw new TypeError(`${where}: invalid PermDock scope "${target.scope}"`);
-	if (id === void 0) throw new TypeError(`${where}: scope "${target.scope}" needs a segment`);
-	return `${id} in (select t.id::text from ${schema}.${sqlIdent(`permitted_${target.scope}_ids`)}(${sqlString(key)}) as t(id))`;
-}
-/** The keys a bucket or topic PermDock policy names. */
-function permdockKeys(policy) {
-	return Object.values(policy.permdock).filter((key) => typeof key === "string");
-}
-//#endregion
-export { sqlIdent as a, slug as i, permdockKeys as n, sqlString as o, parseTemplate as r, permdockCheck as t };
+export { sqlString as i, slug as n, sqlIdent as r, parseTemplate as t };

package/dist/{temporal-BwshQk0W.js → temporal-CVlIV2DZ.js}

@@ -12,16 +12,29 @@ function nowInstant() {
 	if (namespace === void 0) throw new TypeError(TEMPORAL_MISSING);
 	return namespace.Now.instant();
 }
+const ISO_TAGS = /* @__PURE__ */ new Set([
+	"Temporal.Instant",
+	"Temporal.PlainDateTime",
+	"Temporal.PlainDate",
+	"Temporal.PlainTime"
+]);
 /**
 * The text Postgres reads back for a Temporal value: ISO 8601, with a
 * `ZonedDateTime` sent as its instant because Postgres rejects the
 * `[Region/City]` annotation. `undefined` for anything else.
+*
+* Values are recognized by `Symbol.toStringTag`, not `instanceof`, so values
+* from another realm or a second copy of the polyfill still encode.
 */
 function temporalText(value) {
-	const namespace = optionalTemporal();
-	if (namespace === void 0) return void 0;
-	if (value instanceof namespace.ZonedDateTime) return value.toInstant().toString();
-	if (value instanceof namespace.Instant || value instanceof namespace.PlainDateTime || value instanceof namespace.PlainDate || value instanceof namespace.PlainTime) return value.toString();
+	if (typeof value !== "object" || value === null) return void 0;
+	if (!(Symbol.toStringTag in value)) return void 0;
+	const tag = value[Symbol.toStringTag];
+	if (ISO_TAGS.has(tag)) return String(value);
+	return tag === "Temporal.ZonedDateTime" && isZoned(value) ? String(value.toInstant()) : void 0;
+}
+function isZoned(value) {
+	return "toInstant" in value && typeof value.toInstant === "function";
 }
 //#endregion
 export { temporalText as i, nowInstant as n, optionalTemporal as r, TEMPORAL_MISSING as t };

package/dist/{temporal-required-CBNHT6ni.js → temporal-required-CAt4Dc9Z.js}

@@ -1,5 +1,5 @@
-import { n as dbError, t as DbException } from "./errors-L0xK41y_.js";
-import { r as optionalTemporal, t as TEMPORAL_MISSING } from "./temporal-BwshQk0W.js";
+import { n as dbError, t as DbException } from "./errors-DtwXa6b8.js";
+import { r as optionalTemporal, t as TEMPORAL_MISSING } from "./temporal-CVlIV2DZ.js";
 //#region src/core/temporal-required.ts
 /** The error for a runtime without Temporal, naming the polyfill to load. */
 function temporalMissing() {

package/dist/testing/index.d.ts

@@ -1,12 +1,17 @@
-import { A as SchemaMeta, N as TableKey, R as Update, g as Insert, n as AnyModels, t as AnyFunctions } from "../types-DONv9SHN.js";
-import { r as Executor } from "../executor-B5IoUxLE.js";
-import { P as DbStats, l as CacheAdapter, t as BetterSupabase, y as Db } from "../define-CRS2MRV3.js";
-import { h as RequestContext, n as AnyPlugin } from "../plugin-bNhvJwRh.js";
-import { b as ResolvedConfig, d as Generator, f as GeneratorInput } from "../config-C1CYcm6o.js";
-import { t as SqlClient } from "../executor-CZ7ImRiD.js";
-import { t as BetterPostgres } from "../pool-DFwEQwmN.js";
-import { n as AuthResolver } from "../resolve-BAqQcwMW.js";
-import { r as EventSink, t as CloudEvent } from "../index-D5IfUIDh.js";
+import { P as TableKey, _ as Insert, j as SchemaMeta, n as AnyFunctions, r as AnyModels, z as Update } from "../types-Dnf_wRDz.js";
+import { r as Executor } from "../executor-BunPOO-k.js";
+import { P as DbStats, l as CacheAdapter, t as BetterSupabase, y as Db } from "../define-Bp_BZa5h.js";
+import { g as RequestContext, n as AnyPlugin } from "../plugin-o144f322.js";
+import { b as ResolvedConfig, d as Generator, f as GeneratorInput } from "../config-Bv7gvfzC.js";
+import { t as SqlClient } from "../executor-Cghdstwu.js";
+import { t as BetterPostgres } from "../pool-C9voM4Kw.js";
+import { a as AuthResolver, n as Impersonator } from "../impersonation-BmePsuxz.js";
+import { o as SupportSessionStore } from "../support-CEPwlw2G.js";
+import { r as EventSink, t as CloudEvent } from "../index-DOESKG27.js";
+import { p as QueueBackend } from "../queue-BYUCjr59.js";
+import { n as SessionActor, r as SessionDelegation } from "../actor-DaJjqD5R.js";
+import { t as NotificationChannel } from "../channel-FQW-CnGR.js";
+import { c as WebhookSecretStore, i as WebhookSigner, m as WebhookTransport } from "../signers-Cc6r98SW.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { webcrypto } from "node:crypto";
 //#region src/testing/jwt.d.ts
@@ -199,6 +204,35 @@ interface TestEventSinkOptions {
 }
 /** Proves an `EventSink` accepts empty and full batches without mutating them, and delivers them when readable. */
 export declare function testEventSink(sink: EventSink, options?: TestEventSinkOptions): Promise<ConformanceReport>;
+interface TestQueueBackendOptions {
+  /** A queue the kit may fill and drain; use a fresh name per run. */
+  readonly queue: string;
+  /** Check that a repeated dedupe key returns the first id. Defaults to `backend.leases`. */
+  readonly dedupe?: boolean;
+}
+/**
+ * Proves a `QueueBackend` round-trips payloads, hides claimed messages for
+ * their lease, counts attempts, retries and dead-letters on `fail`, and
+ * (when it has `leases`) rejects a stale attempt and extends a lease. It
+ * writes to `options.queue` on the backend's real store.
+ */
+export declare function testQueueBackend(backend: QueueBackend, options: TestQueueBackendOptions): Promise<ConformanceReport>;
+interface TestSupportSessionStoreOptions {
+  /** A user who may start support sessions in the store. */
+  readonly admin: {
+    readonly id: string;
+    readonly claims: Readonly<Record<string, unknown>>;
+  };
+  /** Two other users the admin may view the app as. */
+  readonly targets: readonly [string, string];
+}
+/**
+ * Proves a `SupportSessionStore` starts sessions with the input it was
+ * given, shows a running session only to its admin, ends the admin's
+ * previous session on start, ends a session once, and lists sessions.
+ * It writes sessions to the store; they are all ended when it returns.
+ */
+export declare function testSupportSessionStore(store: SupportSessionStore, options: TestSupportSessionStoreOptions): Promise<ConformanceReport>;
 interface TestAuthResolverOptions {
   /** Requests with credentials this resolver owns but that must not verify. */
   readonly invalid: readonly Request[];
@@ -293,6 +327,37 @@ interface TenantIsolationOptions<M extends AnyModels> {
  */
 export declare function expectTenantIsolation<M extends AnyModels, D, F extends AnyFunctions, E>(betterSupabase: BetterSupabase<M, D, F, E>, options: TenantIsolationOptions<M>): Promise<ConformanceReport>;
 //#endregion
+//#region src/testing/claims-fixtures.d.ts
+/**
+ * Claims of a Supabase access token where someone acts for the user, with
+ * what `toSession` reads from them: `actor`, `impersonator` and
+ * `delegation`. Plain data in the shape of PermDock's `supabaseClaimFixtures`
+ * (`permdock/testing`), so both packages test the same `act` contract: every
+ * fixture passes PermDock's `schemas/supabase-claims-v1.json`.
+ */
+interface SupabaseClaimFixture {
+  /** Without `iat` and `exp`, so a test signer sets them. */
+  readonly claims: {
+    readonly sub: string;
+    readonly [claim: string]: unknown;
+  };
+  readonly expect: {
+    readonly actor: SessionActor;
+    /** Set for support and impersonated sessions only. */
+    readonly impersonator?: Impersonator;
+    /** Set for an `oauth-client` actor only. */
+    readonly delegation?: SessionDelegation;
+  };
+}
+type SupabaseClaimFixtureName = "supportSession" | "supportSessionReadOnly" | "impersonation" | "oauthClient" | "agentChain";
+/**
+ * `supportSession` and `supportSessionReadOnly` are what `supportClaims`
+ * mints (`act.kind: "support"`), `impersonation` what `actingAs` mints
+ * (`act.kind: "impersonation"`), `oauthClient` a Supabase OAuth server token
+ * and `agentChain` an RFC 8693 chain without `kind`.
+ */
+export declare const supabaseClaimFixtures: Readonly<Record<SupabaseClaimFixtureName, SupabaseClaimFixture>>;
+//#endregion
 //#region src/testing/seed.d.ts
 /** Named rows per table, in app casing: `{ customers: { acme: { ... } } }`. */
 type SeedFixtures<M extends AnyModels> = { readonly [K in keyof M]?: Readonly<Record<string, M[K]["Insert"]>>; };
@@ -323,4 +388,61 @@ export declare function isSeed(value: unknown): value is Seed<unknown>;
  */
 export declare function defineSeed<M extends AnyModels, D, F extends AnyFunctions, E, const S extends SeedFixtures<M>>(betterSupabase: BetterSupabase<M, D, F, E>, fixtures: S & ExactSeed<M, S>): Seed<S>;
 //#endregion
-export type { BudgetPage, BudgetResponse, ConformanceCheck, ConformanceReport, DbBudgetExpectation, ExactSeed, IsolationTable, IsolationTables, IsolationTenant, LocalStack, MeasuredRender, Seed, SeedFixtures, SigningJwk, TenantIsolationOptions, TestAuthResolverOptions, TestEventSinkOptions, TestExecutorOptions, TestGeneratorOptions, TestJwtClaims, TestPluginOptions, TestSigner, TestUser };
+//#region src/testing/notification-channel.d.ts
+interface TestNotificationChannelOptions {
+  /** The recipient's email in the sample message. Defaults to `null`. */
+  readonly email?: string | null;
+  /**
+   * The delivery ids the provider received, read after the kit sends. When
+   * given, the kit checks that the sample message arrived.
+   */
+  readonly received?: () => Promise<readonly string[]>;
+}
+/**
+ * Runs the `NotificationChannel` contract against `channel`: the API version,
+ * a name, and one frozen sample message it must send without mutating.
+ * Throws a `ConformanceError` listing every failed check.
+ */
+export declare function testNotificationChannel(channel: NotificationChannel, options?: TestNotificationChannelOptions): Promise<ConformanceReport>;
+//#endregion
+//#region src/testing/webhooks.d.ts
+interface TestWebhookSignerOptions {
+  /**
+   * The receiver's check, e.g. `verifyWebhook`. When given, the kit checks
+   * that the signed sample verifies with its secret.
+   */
+  readonly verify?: (request: {
+    readonly headers: Readonly<Record<string, string>>;
+    readonly body: string;
+  }, secret: string) => Promise<boolean>;
+}
+/**
+ * Runs the `WebhookSigner` contract against `signer`: the API version, a
+ * name, string headers that depend on the body and are stable for the same
+ * input, and, with `verify`, a signature the receiver accepts.
+ */
+export declare function testWebhookSigner(signer: WebhookSigner, options?: TestWebhookSignerOptions): Promise<ConformanceReport>;
+interface TestWebhookTransportOptions {
+  /** A receiver the transport may POST the sample to, e.g. a local server. */
+  readonly url: string;
+  /** The bodies the receiver got, read after the kit sends. */
+  readonly received?: () => Promise<readonly string[]>;
+}
+/**
+ * Runs the `WebhookTransport` contract against `transport`: the API version,
+ * a name, and one POST to `options.url` that returns an HTTP status and a
+ * string body.
+ */
+export declare function testWebhookTransport(transport: WebhookTransport, options: TestWebhookTransportOptions): Promise<ConformanceReport>;
+interface TestWebhookSecretStoreOptions {
+  /** An endpoint the store may read and, when it can rotate, rotate. */
+  readonly endpointId: string;
+}
+/**
+ * Runs the `WebhookSecretStore` contract against `store`: the API version, a
+ * list of strings, and, when it can rotate, a new secret listed first while
+ * the previous one keeps signing.
+ */
+export declare function testWebhookSecretStore(store: WebhookSecretStore, options: TestWebhookSecretStoreOptions): Promise<ConformanceReport>;
+//#endregion
+export type { BudgetPage, BudgetResponse, ConformanceCheck, ConformanceReport, DbBudgetExpectation, ExactSeed, IsolationTable, IsolationTables, IsolationTenant, LocalStack, MeasuredRender, Seed, SeedFixtures, SigningJwk, SupabaseClaimFixture, SupabaseClaimFixtureName, TenantIsolationOptions, TestAuthResolverOptions, TestEventSinkOptions, TestExecutorOptions, TestGeneratorOptions, TestJwtClaims, TestNotificationChannelOptions, TestPluginOptions, TestQueueBackendOptions, TestSigner, TestSupportSessionStoreOptions, TestUser, TestWebhookSecretStoreOptions, TestWebhookSignerOptions, TestWebhookTransportOptions };