better-supabase 0.5.0 → 0.6.0

package/dist/testing/index.d.ts

@@ -1,17 +1,29 @@
-import { P as TableKey, _ as Insert, j as SchemaMeta, n as AnyFunctions, r as AnyModels, z as Update } from "../types-Dnf_wRDz.js";
-import { r as Executor } from "../executor-BunPOO-k.js";
-import { P as DbStats, l as CacheAdapter, t as BetterSupabase, y as Db } from "../define-Bp_BZa5h.js";
-import { g as RequestContext, n as AnyPlugin } from "../plugin-o144f322.js";
-import { b as ResolvedConfig, d as Generator, f as GeneratorInput } from "../config-T_ejwyd3.js";
-import { t as SqlClient } from "../executor-Cghdstwu.js";
-import { t as BetterPostgres } from "../pool-C9voM4Kw.js";
-import { n as AuthResolver } from "../resolve-C15TJq77.js";
-import { o as SupportSessionStore } from "../support-DT-OhSxD.js";
-import { r as EventSink, t as CloudEvent } from "../index-DOESKG27.js";
-import { p as QueueBackend } from "../queue-BYUCjr59.js";
-import { t as NotificationChannel } from "../channel-FQW-CnGR.js";
-import { c as WebhookSecretStore, i as WebhookSigner, m as WebhookTransport } from "../signers-Cc6r98SW.js";
+import { H as Update, L as TableKey, P as SchemaMeta, a as AnyModels, i as AnyFunctions, x as Insert } from "../types-6BdhkmZe.js";
+import { r as Executor } from "../executor-DvsBbNBS.js";
+import { t as SqlClient } from "../executor-DbvExCFC.js";
+import { m as RequestContext, n as AnyPlugin } from "../plugin-FGY8UhYm.js";
+import { n as AuthResolver } from "../resolve-KW8nCeL6.js";
+import { a as CredentialSubject, i as CredentialRef, r as CredentialProvider } from "../provider-BH5UWZJ6.js";
+import { k as QueueBackend } from "../queue-CLJurhdy.js";
+import { n as Embedder } from "../knowledge-BXBbT0Tr.js";
+import { o as StreamStore } from "../store-CGjgWu5n.js";
+import { B as DbStats, b as Db, t as BetterSupabase, u as CacheAdapter } from "../define-CJJkkr1-.js";
+import { r as EventSink, t as CloudEvent } from "../cloud-event-C1JCc1bH.js";
+import { t as BetterPostgres } from "../pool-CAu2nLrL.js";
+import { R as SupportSessionStore, i as ServerContext, o as ServerOptions } from "../server-CeVeeXwz.js";
+import { s as Impersonator } from "../mfa-Daak8ukG.js";
+import { n as SessionActor, r as SessionDelegation } from "../actor-CQTlc1Hh.js";
+import { r as GuardOptions } from "../respond-DoBijysA.js";
+import { i as AuthorizationProvider } from "../authorization-BFCqamMs.js";
+import { i as AiTaskRun, o as AiTaskRunner, t as AiTask } from "../ai-tasks-Cd1HMFvB.js";
+import { D as ResolvedConfig, _ as GeneratorInput, h as Generator, v as GeneratorModel } from "../config-D44Y7PAv.js";
+import { a as BlockTransportMiddleware } from "../block-hooks-plbZ0AbJ.js";
+import { t as NotificationChannel } from "../channel-_2Mx1Oyu.js";
+import { c as WebhookSecretStore, i as WebhookSigner, m as WebhookTransport } from "../signers-4y62_VIi.js";
+import { T as WorkflowGraph, i as BuilderStarter, r as BuilderStartCall, s as GraphCompiler } from "../types-BI-0Sl2v.js";
+import { t as EveDocumentBackend } from "../eve-gT2Fpjut.js";
 import { SupabaseClient } from "@supabase/supabase-js";
+import { Message, StateAdapter } from "chat";
 import { webcrypto } from "node:crypto";
 //#region src/testing/jwt.d.ts
 interface TestJwtClaims {
@@ -111,19 +123,24 @@ interface TestUser<M extends AnyModels, F extends AnyFunctions, E> {
 export declare function asUser<M extends AnyModels, D, F extends AnyFunctions, E>(betterSupabase: BetterSupabase<M, D, F, E>, claims: TestJwtClaims, stack?: LocalStack): Promise<TestUser<M, F, E>>;
 //#endregion
 //#region src/testing/budget.d.ts
+/** The part of a Playwright `Request` the budget check reads. */
+interface BudgetRequest {
+  headers(): Record<string, string>;
+}
 /** The part of a Playwright `Response` the budget check reads. */
 interface BudgetResponse {
   url(): string;
   headers(): Record<string, string>;
+  /** Never settles when the browser aborts the stream, so `requestfailed` ends the wait too. */
   finished(): Promise<unknown>;
-  request(): {
-    headers(): Record<string, string>;
-  };
+  request(): BudgetRequest;
 }
 /** The part of a Playwright `Page` the budget check uses. */
 interface BudgetPage {
   on(event: "response", listener: (response: BudgetResponse) => void): unknown;
+  on(event: "requestfailed", listener: (request: BudgetRequest) => void): unknown;
   off(event: "response", listener: (response: BudgetResponse) => void): unknown;
+  off(event: "requestfailed", listener: (request: BudgetRequest) => void): unknown;
   reload(): Promise<unknown>;
   readonly request: {
     get(url: string): Promise<{
@@ -142,12 +159,39 @@ interface DbBudgetExpectation {
   readonly prefetches?: boolean;
   /** How long to wait for a streamed response to finish. Defaults to 10 seconds. */
   readonly timeoutMs?: number;
+  /**
+   * How long to keep listening once `during` resolves and no new response
+   * arrives, for renders it started that answer later (the dynamic render
+   * after an `instant()` lock releases). Defaults to 500 ms.
+   */
+  readonly settleMs?: number;
+  /**
+   * When no document or RSC response carries `x-bs-request-id`, throw
+   * (the default) or return `[]`. Cache-only navigations never hit the
+   * proxy, so they have no request id.
+   */
+  readonly requireRequest?: boolean;
 }
 interface MeasuredRender {
   readonly url: string;
   readonly requestId: string;
   readonly stats: DbStats;
 }
+/** What `expectDbBudget` measures on a plain fetch `Response`. */
+interface ResponseBudgetExpectation {
+  readonly maxCalls?: number;
+  readonly maxWaves?: number;
+  /** The header `withDbStats` wrote. Defaults to `x-bs-db-calls`. */
+  readonly header?: string;
+}
+/** The calls, waves and time one response's request made. */
+type ResponseDbStats = Pick<DbStats, "calls" | "waves" | "ms">;
+/**
+ * Reads the `withDbStats()` header of a fetch `Response` from any adapter
+ * (Hono, SvelteKit, oRPC, an edge function) and fails when its request made
+ * more database calls or waves than allowed.
+ */
+export declare function expectDbBudget(response: Response, expectation: ResponseBudgetExpectation): ResponseDbStats;
 /**
  * Measures every document and RSC navigation response during `during` and
  * fails when one render makes more database calls or waves than allowed.
@@ -155,6 +199,67 @@ interface MeasuredRender {
  */
 export declare function expectDbBudget(page: BudgetPage, expectation: DbBudgetExpectation): Promise<readonly MeasuredRender[]>;
 //#endregion
+//#region src/testing/instant.d.ts
+/** The part of a Playwright `BrowserContext` that `instant()` uses. */
+interface InstantBrowserContext {
+  addCookies(cookies: {
+    name: string;
+    value: string;
+    url?: string;
+    domain?: string;
+    path?: string;
+    expires?: number;
+  }[]): Promise<void>;
+  cookies(): Promise<{
+    name: string;
+    value: string;
+    domain: string;
+    path: string;
+  }[]>;
+}
+/** The part of a Playwright `Page` that `expectInstant` uses. */
+interface InstantPage extends BudgetPage {
+  url(): string;
+  context(): InstantBrowserContext;
+}
+/** The part of a Playwright `Locator` that `expectInstant` checks. */
+interface InstantLocator {
+  waitFor(options: {
+    state: "visible";
+    timeout?: number;
+  }): Promise<void>;
+  count(): Promise<number>;
+}
+interface InstantExpectation {
+  /** The navigation to hold, such as a click on a `<Link>`. */
+  readonly during: () => Promise<unknown>;
+  /** Locators that must be visible while the lock holds. */
+  readonly visible: readonly InstantLocator[];
+  /** Locators that must not exist while the lock holds. */
+  readonly absent?: readonly InstantLocator[];
+  /**
+   * Fails when one render of the navigation makes more database calls, or
+   * when no render reached the proxy (a navigation the client cache served
+   * has nothing to measure: drop the budget for it).
+   */
+  readonly maxCalls?: number;
+  /** Fails when one render of the navigation makes more sequential waves. */
+  readonly maxWaves?: number;
+  /** How long to wait for the render that streams in after the lock releases. Defaults to 500 ms. */
+  readonly settleMs?: number;
+  /** Scopes the lock on a page that has not loaded yet. */
+  readonly baseURL?: string;
+  /** How long each `visible` locator may take. Defaults to 5 seconds. */
+  readonly timeoutMs?: number;
+}
+/**
+ * Runs `during` inside `@next/playwright`'s `instant()`, checks what the
+ * prefetched UI shows while the lock holds, and with `maxCalls` or
+ * `maxWaves` checks the navigation's database budget like `expectDbBudget`.
+ * Needs a `next build` with the testing API exposed.
+ */
+export declare function expectInstant(page: InstantPage, expectation: InstantExpectation): Promise<readonly MeasuredRender[]>;
+//#endregion
 //#region src/testing/conformance.d.ts
 interface ConformanceCheck {
   readonly name: string;
@@ -171,10 +276,10 @@ export declare class ConformanceError extends Error {
   readonly report: ConformanceReport;
   constructor(report: ConformanceReport);
 }
-type AnySupabase = BetterSupabase<any, any, any, any>;
+type AnySupabase$1 = BetterSupabase<any, any, any, any>;
 interface TestExecutorOptions {
   /** A definition whose schema matches the executor's database. Install no plugins. */
-  readonly betterSupabase: AnySupabase;
+  readonly betterSupabase: AnySupabase$1;
   /** App key of a table with rows the executor can read. Defaults to the first table. */
   readonly table?: string;
   /** A row to insert and delete again, to check writes. Skips write checks when omitted. */
@@ -183,7 +288,8 @@ interface TestExecutorOptions {
 /**
  * Proves an `Executor` meets the contract: rows keyed by the selection's
  * aliases, counts, `aborted` errors, failures returned as `Result`s rather
- * than thrown, and (with `create`) a write round trip.
+ * than thrown, and (with `create`) a write round trip and a `deleteMany`
+ * that `maxAffected` refuses without deleting anything.
  *
  * ```ts
  * it('conforms', () => testExecutor(myExecutor, { betterSupabase, table: 'tags', create: { name: 'x' } }));
@@ -248,19 +354,9 @@ interface TestAuthResolverOptions {
  * closed (`invalid`, never anon) on bad credentials, and never throws.
  */
 export declare function testAuthResolver(resolver: AuthResolver, options: TestAuthResolverOptions): Promise<ConformanceReport>;
-interface TestGeneratorOptions {
-  /** Schema metadata to generate from: `schema.meta` from your generated module. */
-  readonly meta: SchemaMeta;
-  /** Typegen metadata; defaults to an empty database. */
-  readonly introspection?: GeneratorInput["introspection"];
-  readonly extras?: GeneratorInput["extras"];
-  readonly config?: ResolvedConfig;
-}
-/** Proves a `Generator` writes relative, unique paths, is deterministic and doesn't mutate its input. */
-export declare function testGenerator(generator: Generator, options: TestGeneratorOptions): Promise<ConformanceReport>;
 interface TestPluginOptions {
   /** The definition without this plugin. */
-  readonly betterSupabase: AnySupabase;
+  readonly betterSupabase: AnySupabase$1;
   /** Table to exercise. Defaults to the first table. */
   readonly table?: string;
   /** Context the plugin needs, such as `{ tenant }` for `tenant()`. */
@@ -269,8 +365,10 @@ interface TestPluginOptions {
   readonly create?: Readonly<Record<string, unknown>>;
 }
 /**
- * Proves a `Plugin` targets API v1, installs cleanly, keeps `transformQuery`
- * and `beforeMutation` pure and deterministic, and keeps executors'
+ * Proves a `Plugin` targets API v1, installs cleanly on its own and next to
+ * the first-party plugins in either order, adds repository methods without
+ * replacing base ones, keeps `context`, `transformQuery` and
+ * `beforeMutation` pure and deterministic, and keeps executors'
  * results intact when it wraps them.
  */
 export declare function testPlugin(plugin: AnyPlugin, options: TestPluginOptions): Promise<ConformanceReport>;
@@ -326,6 +424,36 @@ interface TenantIsolationOptions<M extends AnyModels> {
  */
 export declare function expectTenantIsolation<M extends AnyModels, D, F extends AnyFunctions, E>(betterSupabase: BetterSupabase<M, D, F, E>, options: TenantIsolationOptions<M>): Promise<ConformanceReport>;
 //#endregion
+//#region src/testing/claims-fixtures.d.ts
+/**
+ * Claims of a Supabase access token where someone acts for the user, with
+ * what `toSession` reads from them: `actor`, `impersonator` and
+ * `delegation`. Plain data, so another library that reads the same `act`
+ * claim (RFC 8693) can test against the same fixtures.
+ */
+interface SupabaseClaimFixture {
+  /** Without `iat` and `exp`, so a test signer sets them. */
+  readonly claims: {
+    readonly sub: string;
+    readonly [claim: string]: unknown;
+  };
+  readonly expect: {
+    readonly actor: SessionActor;
+    /** Set for support and impersonated sessions only. */
+    readonly impersonator?: Impersonator;
+    /** Set for an `oauth-client` actor only. */
+    readonly delegation?: SessionDelegation;
+  };
+}
+type SupabaseClaimFixtureName = "supportSession" | "supportSessionReadOnly" | "impersonation" | "oauthClient" | "agentChain";
+/**
+ * `supportSession` and `supportSessionReadOnly` are what `supportClaims`
+ * mints (`act.kind: "support"`), `impersonation` what `actingAs` mints
+ * (`act.kind: "impersonation"`), `oauthClient` a Supabase OAuth server token
+ * and `agentChain` an RFC 8693 chain without `kind`.
+ */
+export declare const supabaseClaimFixtures: Readonly<Record<SupabaseClaimFixtureName, SupabaseClaimFixture>>;
+//#endregion
 //#region src/testing/seed.d.ts
 /** Named rows per table, in app casing: `{ customers: { acme: { ... } } }`. */
 type SeedFixtures<M extends AnyModels> = { readonly [K in keyof M]?: Readonly<Record<string, M[K]["Insert"]>>; };
@@ -356,13 +484,135 @@ export declare function isSeed(value: unknown): value is Seed<unknown>;
  */
 export declare function defineSeed<M extends AnyModels, D, F extends AnyFunctions, E, const S extends SeedFixtures<M>>(betterSupabase: BetterSupabase<M, D, F, E>, fixtures: S & ExactSeed<M, S>): Seed<S>;
 //#endregion
+//#region src/testing/adapter.d.ts
+type AnySupabase = BetterSupabase<any, any, any, any>;
+/** What the adapter module asks a handler to do with the caller's context. */
+type AdapterRun = (ctx: Pick<ServerContext<AnyModels, AnyFunctions, unknown>, "auth" | "replica">) => unknown;
+interface TestAdapterOptions {
+  /** The definition the adapter is built from: the module tracks event sends on its `events`. */
+  readonly betterSupabase: AnySupabase;
+  /**
+   * Builds the adapter with `server` (pass it to `createX(betterSupabase,
+   * server)`) and returns a fetch function that answers a request with
+   * `run` as the caller, behind a guard that allows `allow`. Translate the
+   * module's bare GET into what the adapter expects (a JSON-RPC `tools/call`,
+   * an oRPC call) inside the function.
+   */
+  readonly serve: (server: ServerOptions & {
+    readonly exposeErrors: false;
+  }, run: AdapterRun, options: {
+    readonly allow: NonNullable<GuardOptions["allow"]>;
+    readonly waitUntil: (promise: Promise<unknown>) => void;
+  }) => (request: Request) => Promise<Response>;
+  /** The adapter answers handler errors in a 200 body (MCP tool results), not with HTTP statuses. */
+  readonly errorsInBody?: boolean;
+  /** The adapter sends no cookies (bearer-only transports such as MCP). */
+  readonly cookies?: false;
+}
+/**
+ * Proves a framework adapter refuses callers its guard rejects, answers
+ * `DbError`s with their status, hides unexpected errors, applies the
+ * context's cookies and hands pending event sends to `waitUntil`, the way
+ * `handle()` from `better-supabase/server` does.
+ */
+export declare function testAdapter(name: string, options: TestAdapterOptions): Promise<ConformanceReport>;
+//#endregion
+//#region src/testing/transport-middleware.d.ts
+/**
+ * Proves a `BlockTransportMiddleware` meets the contract: it declares API 1
+ * and a name, calls `next` at most once per call, leaves the request it got
+ * unchanged, resolves when `next` does, and rejects with the database error
+ * `next` rejected with, so blocks still map it to a `DbError`.
+ *
+ * ```ts
+ * it('conforms', () => testBlockTransportMiddleware(statementTimeout('5s')));
+ * ```
+ */
+export declare function testBlockTransportMiddleware(middleware: BlockTransportMiddleware): Promise<ConformanceReport>;
+//#endregion
+//#region src/testing/authorization-provider.d.ts
+/**
+ * Proves an `AuthorizationProvider` targets API v1, is plain JSON, names
+ * valid scopes with a tenant scope that has an id type, writes templates
+ * that are safe to inline and use the placeholders they need, lists every
+ * function its templates call in `requires`, and keeps its token hook,
+ * suspension rows, role sources and deciding columns well formed.
+ */
+export declare function testAuthorizationProvider(provider: AuthorizationProvider): Promise<ConformanceReport>;
+//#endregion
+//#region src/testing/generator.d.ts
+interface TestGeneratorOptions {
+  /** Schema metadata to generate from: `schema.meta` from your generated module. */
+  readonly meta: SchemaMeta;
+  /** Typegen metadata; defaults to an empty database. */
+  readonly introspection?: GeneratorInput["introspection"];
+  readonly extras?: GeneratorInput["extras"];
+  readonly config?: ResolvedConfig;
+  /** Defaults to one built from `meta`, with `unknown` for column types it can't name. */
+  readonly model?: GeneratorModel;
+}
+/** Proves a `Generator` writes relative, unique paths, is deterministic and doesn't mutate its input. */
+export declare function testGenerator(generator: Generator, options: TestGeneratorOptions): Promise<ConformanceReport>;
+//#endregion
+//#region src/testing/injectables.d.ts
+interface TestEmbedderOptions {
+  /** The texts to embed. Defaults to two short sentences. */
+  readonly values?: readonly string[];
+}
+/**
+ * Proves an `Embedder` for the knowledge and memory blocks names its model,
+ * embeds an empty list to nothing, and returns one finite vector per value,
+ * all of the same length on every call. It calls the real model.
+ */
+export declare function testEmbedder(embedder: Embedder, options?: TestEmbedderOptions): Promise<ConformanceReport>;
+interface TestAiTaskRunnerOptions {
+  /** A task the runner can run, as the ai-tasks block passes it. */
+  readonly task: AiTask;
+  /** The claimed run for `task`. */
+  readonly run: AiTaskRun;
+}
+/**
+ * Proves an `AiTaskRunner` resolves with nothing or a chat id and stops when
+ * its signal is already aborted. It runs `options.task` for real.
+ */
+export declare function testAiTaskRunner(runner: AiTaskRunner, options: TestAiTaskRunnerOptions): Promise<ConformanceReport>;
+interface TestGraphCompilerOptions {
+  /** A valid graph for the compiler's engine. */
+  readonly graph: WorkflowGraph;
+}
+/**
+ * Proves a `GraphCompiler` returns a JSON value (stored with the published
+ * version), compiles the same graph to the same value and leaves the graph
+ * unchanged.
+ */
+export declare function testGraphCompiler(compile: GraphCompiler, options: TestGraphCompilerOptions): Promise<ConformanceReport>;
+interface TestBuilderStarterOptions {
+  /** A start call the engine can run. */
+  readonly call: BuilderStartCall;
+}
+/**
+ * Proves a `BuilderStarter` returns a run id and returns the same id when
+ * the same idempotency key starts again. It starts real runs.
+ */
+export declare function testBuilderStarter(start: BuilderStarter, options: TestBuilderStarterOptions): Promise<ConformanceReport>;
+interface TestEveDocumentBackendOptions {
+  /** The document key to write. Defaults to a random `conformance/` key. */
+  readonly key?: string;
+}
+/**
+ * Proves an `EveDocumentBackend` reads a missing document as `null`, creates
+ * one with `expectedVersion: null`, refuses a stale version and moves the
+ * version on every write. It writes `options.key` on the real store.
+ */
+export declare function testEveDocumentBackend(backend: EveDocumentBackend, options?: TestEveDocumentBackendOptions): Promise<ConformanceReport>;
+//#endregion
 //#region src/testing/notification-channel.d.ts
 interface TestNotificationChannelOptions {
   /** The recipient's email in the sample message. Defaults to `null`. */
   readonly email?: string | null;
   /**
-   * The delivery ids the provider received, read after the kit sends. When
-   * given, the kit checks that the sample message arrived.
+   * The delivery ids the provider received, read after the module sends. When
+   * given, the module checks that the sample message arrived.
    */
   readonly received?: () => Promise<readonly string[]>;
 }
@@ -376,7 +626,7 @@ export declare function testNotificationChannel(channel: NotificationChannel, op
 //#region src/testing/webhooks.d.ts
 interface TestWebhookSignerOptions {
   /**
-   * The receiver's check, e.g. `verifyWebhook`. When given, the kit checks
+   * The receiver's check, e.g. `verifyWebhook`. When given, the module checks
    * that the signed sample verifies with its secret.
    */
   readonly verify?: (request: {
@@ -393,7 +643,7 @@ export declare function testWebhookSigner(signer: WebhookSigner, options?: TestW
 interface TestWebhookTransportOptions {
   /** A receiver the transport may POST the sample to, e.g. a local server. */
   readonly url: string;
-  /** The bodies the receiver got, read after the kit sends. */
+  /** The bodies the receiver got, read after the module sends. */
   readonly received?: () => Promise<readonly string[]>;
 }
 /**
@@ -413,4 +663,60 @@ interface TestWebhookSecretStoreOptions {
  */
 export declare function testWebhookSecretStore(store: WebhookSecretStore, options: TestWebhookSecretStoreOptions): Promise<ConformanceReport>;
 //#endregion
-export type { BudgetPage, BudgetResponse, ConformanceCheck, ConformanceReport, DbBudgetExpectation, ExactSeed, IsolationTable, IsolationTables, IsolationTenant, LocalStack, MeasuredRender, Seed, SeedFixtures, SigningJwk, TenantIsolationOptions, TestAuthResolverOptions, TestEventSinkOptions, TestExecutorOptions, TestGeneratorOptions, TestJwtClaims, TestNotificationChannelOptions, TestPluginOptions, TestQueueBackendOptions, TestSigner, TestSupportSessionStoreOptions, TestUser, TestWebhookSecretStoreOptions, TestWebhookSignerOptions, TestWebhookTransportOptions };
+//#region src/testing/chat-state.d.ts
+interface TestChatStateOptions {
+  /** Builds a queued message, e.g. `createTestMessage(id, text)` from `@chat-adapter/tests`. */
+  readonly message: (id: string, text: string) => Message;
+  /** A fresh key or thread id per call. Defaults to `conformance-<uuid>`. */
+  readonly id?: () => string;
+  /** The TTL the expiry checks use, in milliseconds. Defaults to 300. */
+  readonly ttlMs?: number;
+}
+/**
+ * Runs the Chat SDK `StateAdapter` contract against `state`: subscriptions,
+ * one lock holder at a time with token-checked release and extension, lock
+ * and cache TTLs, `setIfNotExists`, list trimming, and a per-thread queue
+ * that keeps the newest entries, reports its depth and drops expired ones.
+ */
+export declare function testChatState(state: StateAdapter, options: TestChatStateOptions): Promise<ConformanceReport>;
+//#endregion
+//#region src/testing/streams.d.ts
+interface TestStreamStoreOptions {
+  /** A fresh stream id per call. Defaults to `conformance-<uuid>`. */
+  readonly id?: () => string;
+  /** Milliseconds a read may take before the check fails. Defaults to 5000. */
+  readonly timeoutMs?: number;
+}
+/**
+ * Runs the `StreamStore` contract against `store`: the API version, open
+ * once, idempotent appends that refuse gaps, reads from any index that end
+ * when the stream closes, a live read that sees later appends, cancel seen by
+ * the writer, a closed stream that refuses appends, and a missing stream.
+ */
+export declare function testStreamStore(store: StreamStore, options?: TestStreamStoreOptions): Promise<ConformanceReport>;
+//#endregion
+//#region src/testing/credentials.d.ts
+interface TestCredentialProviderOptions {
+  /** An app-scoped ref the kit may store into and revoke. */
+  readonly ref: CredentialRef;
+  /** Stores `value` as the credential `ref` names for `subject`. */
+  readonly seed: (ref: CredentialRef, subject: CredentialSubject, value: string) => Promise<void>;
+  /** A per-user ref, for providers that keep one credential per user. */
+  readonly userRef?: CredentialRef;
+  /** A ref with an inbound scheme and a function that signs a request with `secret`. */
+  readonly inbound?: {
+    readonly ref: CredentialRef;
+    readonly sign: (body: string, secret: string) => Promise<Request>;
+  };
+}
+/**
+ * Runs the `CredentialProvider` contract against `provider`: the API version,
+ * an unknown ref, a stored token with its headers, a new value seen after it
+ * is stored, separate credentials per user and per tenant (`ref` with a
+ * `tenant`, which `seed` must store too), revoke (per user, as the
+ * organization purger revokes connector grants), and inbound checks that
+ * accept a signed request and refuse a tampered one.
+ */
+export declare function testCredentialProvider(provider: CredentialProvider, options: TestCredentialProviderOptions): Promise<ConformanceReport>;
+//#endregion
+export type { AdapterRun, BudgetPage, BudgetRequest, BudgetResponse, ConformanceCheck, ConformanceReport, DbBudgetExpectation, ExactSeed, InstantBrowserContext, InstantExpectation, InstantLocator, InstantPage, IsolationTable, IsolationTables, IsolationTenant, LocalStack, MeasuredRender, ResponseBudgetExpectation, ResponseDbStats, Seed, SeedFixtures, SigningJwk, SupabaseClaimFixture, SupabaseClaimFixtureName, TenantIsolationOptions, TestAdapterOptions, TestAiTaskRunnerOptions, TestAuthResolverOptions, TestBuilderStarterOptions, TestChatStateOptions, TestCredentialProviderOptions, TestEmbedderOptions, TestEveDocumentBackendOptions, TestEventSinkOptions, TestExecutorOptions, TestGeneratorOptions, TestGraphCompilerOptions, TestJwtClaims, TestNotificationChannelOptions, TestPluginOptions, TestQueueBackendOptions, TestSigner, TestStreamStoreOptions, TestSupportSessionStoreOptions, TestUser, TestWebhookSecretStoreOptions, TestWebhookSignerOptions, TestWebhookTransportOptions };