better-supabase 0.5.1 → 0.6.1

package/dist/testing/index.js

@@ -1,14 +1,24 @@
-import { n as dbError } from "../errors-DtwXa6b8.js";
-import { i as temporalText } from "../temporal-CVlIV2DZ.js";
-import { t as temporal } from "../temporal-required-CAt4Dc9Z.js";
-import { i as ok } from "../result-BKiliPY7.js";
-import { t as BetterSupabase } from "../define-cNKzqwL_.js";
+import { t as DbException } from "../db-exception-CnWcYPxL.js";
+import { n as dbError } from "../errors-B11Duf73.js";
+import { d as temporalText } from "../temporal-BJGitm-h.js";
+import { t as temporal } from "../temporal-required-BVvW7SYJ.js";
+import { a as ok } from "../result-DzUbqgdW.js";
+import { t as BetterSupabase } from "../define-B-TVjC25.js";
 import { a as toBase64Url, r as fromBase64, t as base64ToText } from "../base64-D2gsioCY.js";
-import { a as resolveConfig } from "../kits-CGLLrNPd.js";
 import { t as isList } from "../guards-BnzDvFrz.js";
+import { a as resolveConfig } from "../modules-dxrVK3ID.js";
 import { ENV_VARIABLES } from "../env/index.js";
-import { n as postgresExecutor } from "../executor-XycESQPH.js";
+import { n as postgresExecutor } from "../executor-De1Of3m3.js";
+import "../replicas-CwrYp5Zj.js";
+import { a as tenantCredentialRef } from "../provider-Di3sRutW.js";
+import { n as parseDbStats } from "../timing-CyTQPubY.js";
+import { t as rawError } from "../block-transport-BLr-ZgLc.js";
+import { a as isScopeName, c as templateFunctions, l as templatePlaceholders, n as TEMPLATE_PLACEHOLDERS, s as scopeProblems, u as templateProblems } from "../access-sql-B0dF-SoF.js";
 import { toCloudEvents } from "../events/index.js";
+import { timestamps } from "../plugins/timestamps/index.js";
+import { softDelete } from "../plugins/soft-delete/index.js";
+import { tenant } from "../plugins/tenant/index.js";
+import { actor } from "../plugins/actor/index.js";
 import { createClient } from "@supabase/supabase-js";
 import { existsSync } from "node:fs";
 import { readFile } from "node:fs/promises";
@@ -235,6 +245,11 @@ function isPrefetch(response) {
 	const headers = response.request().headers();
 	return headers["next-router-prefetch"] !== void 0 || headers["purpose"] === "prefetch" || (headers["sec-purpose"]?.includes("prefetch") ?? false);
 }
+function sleep$1(ms) {
+	return new Promise((done) => {
+		setTimeout(done, ms);
+	});
+}
 function settle(promise, ms) {
 	let timer;
 	return Promise.race([promise, new Promise((done) => {
@@ -243,32 +258,74 @@ function settle(promise, ms) {
 		clearTimeout(timer);
 	});
 }
-/**
-* Measures every document and RSC navigation response during `during` and
-* fails when one render makes more database calls or waves than allowed.
-* Needs `createNext(betterSupabase, { debug })` and `bs.debugRoute()` in the app.
-*/
-async function expectDbBudget(page, expectation) {
+function expectResponseBudget(response, expectation) {
+	const header = expectation.header ?? "x-bs-db-calls";
+	const stats = parseDbStats(response.headers.get(header));
+	if (!stats) throw new Error(`expectDbBudget: the response has no ${header} header. Add withDbStats() to the entries.`);
+	if (expectation.maxCalls !== void 0 && stats.calls > expectation.maxCalls || expectation.maxWaves !== void 0 && stats.waves > expectation.maxWaves) throw new Error(`expectDbBudget: ${stats.calls} calls in ${stats.waves} waves, over the budget of ${expectation.maxCalls ?? "∞"} calls and ${expectation.maxWaves ?? "∞"} waves`);
+	return stats;
+}
+function expectDbBudget(target, expectation) {
+	if (target instanceof Response) return expectResponseBudget(target, expectation);
+	return expectPageBudget(target, expectation);
+}
+async function expectPageBudget(page, expectation) {
 	const seen = [];
+	let lastSeen = 0;
 	const listener = (response) => {
 		const headers = response.headers();
 		const id = headers["x-bs-request-id"];
 		const stats = headers["x-bs-stats"];
 		if (!id || !stats || !expectation.prefetches && isPrefetch(response)) return;
+		lastSeen = Date.now();
 		seen.push({
 			response,
 			id,
 			url: new URL(stats, response.url()).href
 		});
 	};
+	const settleMs = expectation.settleMs ?? 500;
+	const timeoutMs = expectation.timeoutMs ?? 1e4;
+	/** Waits until no response has arrived for `settleMs`, at most `timeoutMs`. */
+	const quiet = async () => {
+		const start = Date.now();
+		lastSeen = Math.max(lastSeen, start);
+		for (;;) {
+			const left = lastSeen + settleMs - Date.now();
+			if (left <= 0 || Date.now() - start >= timeoutMs) return;
+			await sleep$1(left);
+		}
+	};
+	const failed = /* @__PURE__ */ new WeakSet();
+	const aborts = /* @__PURE__ */ new Map();
+	const onFailed = (request) => {
+		failed.add(request);
+		aborts.get(request)?.();
+	};
+	const ended = (response) => {
+		const request = response.request();
+		if (failed.has(request)) return Promise.resolve();
+		return Promise.race([response.finished(), new Promise((done) => {
+			aborts.set(request, done);
+		})]);
+	};
 	page.on("response", listener);
+	page.on("requestfailed", onFailed);
 	try {
-		await (expectation.during ? expectation.during() : page.reload());
+		try {
+			await (expectation.during ? expectation.during() : page.reload());
+			await quiet();
+		} finally {
+			page.off("response", listener);
+		}
+		if (seen.length === 0) {
+			if (expectation.requireRequest === false) return [];
+			throw new Error("expectDbBudget: no response carried x-bs-request-id. Enable createNext(betterSupabase, { debug: { enabled: true } }) and run the proxy.");
+		}
+		await Promise.all(seen.map(({ response }) => settle(ended(response), timeoutMs)));
 	} finally {
-		page.off("response", listener);
+		page.off("requestfailed", onFailed);
 	}
-	if (seen.length === 0) throw new Error("expectDbBudget: no response carried x-bs-request-id. Enable createNext(betterSupabase, { debug: { enabled: true } }) and run the proxy.");
-	await Promise.all(seen.map(({ response }) => settle(response.finished(), expectation.timeoutMs ?? 1e4)));
 	const renders = [];
 	for (const { response, id, url } of seen) {
 		const reply = await page.request.get(url);
@@ -287,6 +344,60 @@ async function expectDbBudget(page, expectation) {
 	return renders;
 }
 //#endregion
+//#region src/testing/instant.ts
+/**
+* `@next/playwright` is an optional peer: loading it on demand keeps it out
+* of apps that never call `expectInstant`, and a missing install returns
+* `undefined` so the caller can say how to add it.
+*/
+async function loadInstant() {
+	const specifier = "@next/playwright";
+	try {
+		return (await import(specifier)).instant;
+	} catch {
+		return;
+	}
+}
+async function assertUnderLock(expectation) {
+	const timeout = expectation.timeoutMs ?? 5e3;
+	for (const locator of expectation.visible) try {
+		await locator.waitFor({
+			state: "visible",
+			timeout
+		});
+	} catch (error) {
+		throw new Error(`expectInstant: ${String(locator)} was not visible under the instant() lock. It is not in the prefetched UI.`, { cause: error });
+	}
+	for (const locator of expectation.absent ?? []) {
+		const count = await locator.count();
+		if (count > 0) throw new Error(`expectInstant: ${String(locator)} matched ${count} elements under the instant() lock. It should stream in after the navigation.`);
+	}
+}
+/**
+* Runs `during` inside `@next/playwright`'s `instant()`, checks what the
+* prefetched UI shows while the lock holds, and with `maxCalls` or
+* `maxWaves` checks the navigation's database budget like `expectDbBudget`.
+* Needs a `next build` with the testing API exposed.
+*/
+async function expectInstant(page, expectation) {
+	const instant = await loadInstant();
+	if (!instant) throw new Error("expectInstant: install @next/playwright as a dev dependency (pnpm add -D @next/playwright).");
+	const run = () => instant(page, async () => {
+		await expectation.during();
+		await assertUnderLock(expectation);
+	}, expectation.baseURL === void 0 ? void 0 : { baseURL: expectation.baseURL });
+	if (expectation.maxCalls === void 0 && expectation.maxWaves === void 0) {
+		await run();
+		return [];
+	}
+	return expectDbBudget(page, {
+		during: run,
+		...expectation.settleMs === void 0 ? {} : { settleMs: expectation.settleMs },
+		...expectation.maxCalls === void 0 ? {} : { maxCalls: expectation.maxCalls },
+		...expectation.maxWaves === void 0 ? {} : { maxWaves: expectation.maxWaves }
+	});
+}
+//#endregion
 //#region src/testing/conformance.ts
 /** Thrown by a conformance kit when any check fails. Lists every failure, not just the first. */
 var ConformanceError = class extends Error {
@@ -367,7 +478,8 @@ const hasName = (subject) => ["has a name", () => {
 /**
 * Proves an `Executor` meets the contract: rows keyed by the selection's
 * aliases, counts, `aborted` errors, failures returned as `Result`s rather
-* than thrown, and (with `create`) a write round trip.
+* than thrown, and (with `create`) a write round trip and a `deleteMany`
+* that `maxAffected` refuses without deleting anything.
 *
 * ```ts
 * it('conforms', () => testExecutor(myExecutor, { betterSupabase, table: 'tags', create: { name: 'x' } }));
@@ -475,6 +587,32 @@ function testExecutor(executor, options) {
 			expect(removed.ok, `delete failed: ${JSON.stringify(removed.error)}`);
 			const again = await repository["findFirst"]({ where: { [primary]: row[primary] } });
 			expect(again.ok && again.data === null, "the deleted row is still readable");
+		}],
+		create && ["refuses a write past maxAffected and writes nothing", async () => {
+			const repository = betterSupabase.connect(executor)[table];
+			const [primary] = betterSupabase.meta.tables[table].primaryKey;
+			expect(primary, "write checks need a table with a primary key");
+			const created = await repository["create"](create);
+			expect(created.ok, `create failed: ${JSON.stringify(created.error)}`);
+			const id = created.data[primary];
+			try {
+				const refused = await repository["deleteMany"]({
+					where: { [primary]: id },
+					maxAffected: 0
+				});
+				expect(!refused.ok, "deleteMany past maxAffected must fail");
+				const kind = refused.error?.kind;
+				expect(kind === "max_affected", `expected kind "max_affected", got "${String(kind)}"`);
+				const kept = await repository["findFirst"]({ where: { [primary]: id } });
+				expect(kept.ok && kept.data !== null, "a refused deleteMany must not delete the row");
+				const allowed = await repository["deleteMany"]({
+					where: { [primary]: id },
+					maxAffected: 1
+				});
+				expect(allowed.ok, `deleteMany within maxAffected failed: ${JSON.stringify(allowed.error)}`);
+			} finally {
+				await repository["delete"](id);
+			}
 		}]
 	]);
 }
@@ -496,7 +634,7 @@ function testCacheAdapter(adapter, options = {}) {
 			table,
 			tables: [table],
 			ids: ["1", "a,b"],
-			tenant: "org_1"
+			tenant: "organization_1"
 		})],
 		["accepts repeated and concurrent calls", async () => {
 			await invalidate({
@@ -534,7 +672,7 @@ function testEventSink(sink, options = {}) {
 			id: "2",
 			name: "Globex"
 		}],
-		context: { tenant: "org_1" }
+		context: { tenant: "organization_1" }
 	}, { source: "/better-supabase/conformance" });
 	return conform("EventSink", [
 		["accepts an empty batch", () => sink.send(deepFreeze([]))],
@@ -610,6 +748,19 @@ function testQueueBackend(backend, options) {
 			expect(await backend.fail(second, "boom", 0) === "dead", "fail at max_attempts must return dead");
 			expect(await claimOne() === void 0, "a dead message must not be claimed again");
 		}],
+		backend.stats && backend.listDead && ["counts and lists dead letters", async () => {
+			expect(((await backend.stats?.(queue))?.dead ?? 0) >= 1, "stats must count the dead letter");
+			const [dead] = await backend.listDead?.(queue, 10, void 0) ?? [];
+			expect(dead, "listDead must return the dead letter");
+			expect(same(dead.message?.payload, { n: 3 }), "listDead must return the newest dead letter first");
+			if (backend.retryDead) {
+				expect(await backend.retryDead(queue, [Number(dead.id)], 10) === 1, "retryDead must enqueue the dead letter again");
+				const job = await claimOne();
+				expect(job, "the retried job must be claimable");
+				expect(same(job.payload, { n: 3 }), "the retried job must keep its payload");
+				await backend.complete(job);
+			}
+		}],
 		(options.dedupe ?? backend.leases) && ["returns the first id for a repeated dedupe key", async () => {
 			expect(await backend.send(queue, { n: 4 }, 0, 3, "same") === await backend.send(queue, { n: 4 }, 0, 3, "same"), "a waiting dedupe key must return its id");
 			const job = await claimOne();
@@ -722,65 +873,11 @@ function testAuthResolver(resolver, options) {
 		}]
 	]);
 }
-function relativeImport(from, to) {
-	const fromParts = from.split("/").slice(0, -1);
-	const toParts = to.split("/");
-	let common = 0;
-	while (common < fromParts.length && fromParts[common] === toParts[common]) common += 1;
-	const path = [...Array.from({ length: fromParts.length - common }, () => ".."), ...toParts.slice(common)].join("/");
-	return path.startsWith(".") ? path : `./${path}`;
-}
-const EMPTY_INTROSPECTION = {
-	version: 1,
-	schemas: [],
-	tables: [],
-	foreignTables: [],
-	views: [],
-	materializedViews: [],
-	columns: [],
-	primaryKeys: [],
-	relationships: [],
-	functions: [],
-	types: []
-};
-/** Proves a `Generator` writes relative, unique paths, is deterministic and doesn't mutate its input. */
-function testGenerator(generator, options) {
-	const config = options.config ?? resolveConfig({}, "/project");
-	const input = () => ({
-		meta: frozenCopy(options.meta),
-		introspection: frozenCopy(options.introspection ?? EMPTY_INTROSPECTION),
-		extras: frozenCopy(options.extras ?? {
-			tables: [],
-			buckets: [],
-			realtime: []
-		}),
-		config,
-		output: `${config.root}/${config.output}`,
-		importPath: (from, to) => relativeImport(from, to)
-	});
-	return conform(`Generator "${generator.name}"`, [
-		hasName(generator),
-		["writes files inside the project", async () => {
-			const files = await generator.generate(input());
-			expect(isList(files), "generate() must return an array");
-			for (const file of files) {
-				expect(typeof file.path === "string" && typeof file.contents === "string", "files need a path and contents");
-				expect(!file.path.startsWith("/") && !/^[A-Za-z]:/.test(file.path), `${file.path} must be relative`);
-				expect(!file.path.split(/[\\/]/).includes(".."), `${file.path} must stay inside the project`);
-			}
-			const paths = files.map((file) => file.path);
-			expect(new Set(paths).size === paths.length, "paths must be unique");
-		}],
-		["is deterministic and does not mutate its input", async () => {
-			const first = await generator.generate(input());
-			const second = await generator.generate(input());
-			expect(same(first, second), "two runs on the same input differ");
-		}]
-	]);
-}
 /**
-* Proves a `Plugin` targets API v1, installs cleanly, keeps `transformQuery`
-* and `beforeMutation` pure and deterministic, and keeps executors'
+* Proves a `Plugin` targets API v1, installs cleanly on its own and next to
+* the first-party plugins in either order, adds repository methods without
+* replacing base ones, keeps `context`, `transformQuery` and
+* `beforeMutation` pure and deterministic, and keeps executors'
 * results intact when it wraps them.
 */
 function testPlugin(plugin, options) {
@@ -804,6 +901,41 @@ function testPlugin(plugin, options) {
 			const db = betterSupabase.use(plugin).connect(recorder([]), context);
 			for (const key of Object.keys(betterSupabase.meta.tables)) expect(db[key], `db.${key} is missing`);
 		}],
+		["declares a known hook order", () => {
+			const enforce = plugin.enforce;
+			expect(enforce === void 0 || enforce === "first" || enforce === "pre" || enforce === "post", `enforce is ${String(enforce)}; use "first", "pre", "post" or leave it out`);
+		}],
+		["installs next to the first-party plugins in either order", () => {
+			const others = [
+				timestamps(),
+				softDelete(),
+				tenant(),
+				actor()
+			].filter((other) => other.name !== plugin.name);
+			let before = betterSupabase;
+			for (const other of others) before = before.use(other);
+			let after = betterSupabase.use(plugin);
+			for (const other of others) after = after.use(other);
+			for (const installed of [before.use(plugin), after]) {
+				const db = installed.connect(recorder([]), context);
+				for (const key of Object.keys(betterSupabase.meta.tables)) expect(db[key], `db.${key} is missing`);
+			}
+		}],
+		plugin.repository && ["repository adds functions and keeps the base methods", () => {
+			const db = betterSupabase.connect(recorder([]), context);
+			for (const [key, table] of Object.entries(betterSupabase.meta.tables)) {
+				const base = db[key];
+				const added = plugin.repository({
+					table,
+					base
+				});
+				if (added === void 0) continue;
+				for (const [name, method] of Object.entries(added)) {
+					expect(typeof method === "function", `${key}.${name} is not a function`);
+					expect(!(name in base), `${key}.${name} replaces a base method`);
+				}
+			}
+		}],
 		plugin.transformQuery && ["transformQuery is pure and deterministic", async () => {
 			const op = await captureOp(betterSupabase, (db) => db[table]["findMany"]({ limit: 1 }));
 			const first = plugin.transformQuery(frozenCopy(op), hook(op));
@@ -848,6 +980,13 @@ function testPlugin(plugin, options) {
 			const result = await wrapped.execute(op, { errorMappers: [] });
 			expect(result.ok && same(result.data, data), "the wrapped executor changed the result");
 		}],
+		plugin.context && ["context is pure and deterministic", () => {
+			const args = { schema: betterSupabase.meta };
+			const first = plugin.context(frozenCopy(context), args);
+			const second = plugin.context(frozenCopy(context), args);
+			expect(typeof first === "object" && first !== null, "must return a context object");
+			expect(same(first, second), "two calls with the same input differ");
+		}],
 		plugin.mapError && ["mapError returns a DbError or undefined", () => {
 			const fallback = dbError("unexpected", "internal error");
 			const mapped = plugin.mapError({
@@ -1211,6 +1350,471 @@ function defineSeed(betterSupabase, fixtures) {
 	};
 }
 //#endregion
+//#region src/testing/adapter.ts
+const MODULE_SERVER = {
+	env: {
+		url: "http://127.0.0.1:54321",
+		publishableKey: "sb_publishable_kit",
+		jwksUrl: new URL("http://127.0.0.1:54321/auth/v1/.well-known/jwks.json")
+	},
+	readUrl: "http://127.0.0.1:54329",
+	prefetchJwks: false,
+	exposeErrors: false
+};
+/**
+* Proves a framework adapter refuses callers its guard rejects, answers
+* `DbError`s with their status, hides unexpected errors, applies the
+* context's cookies and hands pending event sends to `waitUntil`, the way
+* `handle()` from `better-supabase/server` does.
+*/
+function testAdapter(name, options) {
+	const { events } = options.betterSupabase;
+	const call = async (run, allow = ["anon"], waitUntil = () => void 0) => options.serve(MODULE_SERVER, run, {
+		allow,
+		waitUntil
+	})(new Request("http://127.0.0.1/module"));
+	const errorStatus = (expected) => options.errorsInBody ? 200 : expected;
+	return conform(`Adapter "${name}"`, [
+		["refuses a caller the guard rejects", async () => {
+			let ran = false;
+			const response = await call(() => {
+				ran = true;
+			}, ["user"]);
+			expect(response.status === 401, `expected 401 for an anonymous caller, got ${response.status}`);
+			expect(!ran, "the handler ran for a refused caller");
+		}],
+		["runs the handler for an allowed caller", async () => {
+			const response = await call(() => ({ module: "ran" }));
+			expect(response.status === 200, `expected 200, got ${response.status}`);
+			const body = await response.text();
+			expect(body.includes("ran"), `the handler's data is missing: ${body}`);
+		}],
+		["answers a DbError with its status", async () => {
+			const response = await call(() => {
+				throw new DbException(dbError("not_found", "module: no such row"));
+			});
+			expect(response.status === errorStatus(404), `expected ${errorStatus(404)}, got ${response.status}`);
+			const body = await response.text();
+			expect(body.includes("module: no such row"), `the error message is missing: ${body}`);
+		}],
+		["hides the message of an unexpected error", async () => {
+			const response = await call(() => {
+				throw new Error("module-internal-detail");
+			});
+			expect(response.status === errorStatus(500), `expected ${errorStatus(500)}, got ${response.status}`);
+			expect(!(await response.text()).includes("module-internal-detail"), "the response leaks the error message");
+		}],
+		options.cookies !== false && ["applies the context's cookies", async () => {
+			let replica = false;
+			const response = await call((ctx) => {
+				replica = ctx.replica !== void 0;
+				ctx.replica?.pin();
+				return { pinned: true };
+			});
+			expect(replica, "ctx.replica is unset: pass `server` to the adapter");
+			expect(response.headers.getSetCookie().some((cookie) => cookie.startsWith(`bs-primary-until=`)), `a write must send bs-primary-until; apply ctx.apply() or ctx.cookies()`);
+		}],
+		["hands pending event sends to waitUntil", async () => {
+			const { promise: send, resolve } = Promise.withResolvers();
+			const waited = [];
+			await call(() => {
+				events.track(send);
+				return { sent: true };
+			}, ["anon"], (promise) => {
+				waited.push(promise);
+			});
+			resolve();
+			expect(waited.length > 0, "waitUntil was not called while an event send was pending");
+			await Promise.all(waited);
+		}]
+	]);
+}
+//#endregion
+//#region src/testing/transport-middleware.ts
+const REQUEST = {
+	schema: "better_supabase",
+	fn: "list_my_organizations",
+	args: {
+		organization: "organization_1",
+		filters: { status: "open" }
+	}
+};
+/**
+* Proves a `BlockTransportMiddleware` meets the contract: it declares API 1
+* and a name, calls `next` at most once per call, leaves the request it got
+* unchanged, resolves when `next` does, and rejects with the database error
+* `next` rejected with, so blocks still map it to a `DbError`.
+*
+* ```ts
+* it('conforms', () => testBlockTransportMiddleware(statementTimeout('5s')));
+* ```
+*/
+function testBlockTransportMiddleware(middleware) {
+	return conform(`BlockTransportMiddleware "${middleware.name}"`, [
+		hasName(middleware),
+		["declares apiVersion 1", () => {
+			const version = middleware.apiVersion;
+			expect(version === 1, "apiVersion must be 1");
+		}],
+		["calls next at most once and resolves with a value", async () => {
+			let calls = 0;
+			await middleware.call(frozenCopy(REQUEST), (request) => {
+				calls += 1;
+				expect(typeof request.fn === "string" && typeof request.schema === "string", "next got a request without a schema and function");
+				return Promise.resolve([{ id: "organization_1" }]);
+			});
+			expect(calls <= 1, `next was called ${String(calls)} times`);
+		}],
+		["keeps the database error next rejects with", async () => {
+			const denied = Object.assign(/* @__PURE__ */ new Error("permission denied"), {
+				code: "42501",
+				hint: "ORGANIZATION_FORBIDDEN"
+			});
+			let rejected;
+			try {
+				await middleware.call(frozenCopy(REQUEST), () => Promise.reject(denied));
+			} catch (cause) {
+				rejected = cause;
+			}
+			expect(rejected !== void 0, "resolved although next rejected");
+			const raw = rawError(rejected);
+			expect(raw?.code === "42501" && raw.hint === "ORGANIZATION_FORBIDDEN", "the rejection lost the database error's code or hint");
+		}]
+	]);
+}
+//#endregion
+//#region src/testing/authorization-provider.ts
+function isPlainJson(value) {
+	if (value === null || typeof value === "string" || typeof value === "boolean") return true;
+	if (typeof value === "number") return Number.isFinite(value);
+	if (Array.isArray(value)) return value.every(isPlainJson);
+	if (typeof value !== "object") return false;
+	const prototype = Object.getPrototypeOf(value);
+	return (prototype === Object.prototype || prototype === null) && Object.values(value).every((entry) => entry === void 0 || isPlainJson(entry));
+}
+const QUALIFIED = /^[a-z_][\w$]*\.[a-z_][\w${}]*$/i;
+const TABLE = /^[a-z_][\w$]*\.[a-z_][\w$]*$/i;
+const COLUMN = /^[a-z_][\w$]*\.[a-z_][\w$]*\.[a-z_][\w$]*$/i;
+const IDENTIFIER = /^[a-z_][\w$]*$/i;
+function expectRow(where, row) {
+	expect(TABLE.test(row.table), `${where}.table "${row.table}" is not schema.table`);
+	expect(IDENTIFIER.test(row.id), `${where}.id "${row.id}" is not a column`);
+	expect(row.disabledAt !== void 0 || row.status !== void 0, `${where} sets neither disabledAt nor status`);
+	for (const column of [row.disabledAt, row.status]) if (column !== void 0) expect(IDENTIFIER.test(column), `${where} column "${column}" is not a column`);
+	expect(row.status === void 0 === (row.active === void 0), `${where} needs status and active together`);
+}
+/**
+* Proves an `AuthorizationProvider` targets API v1, is plain JSON, names
+* valid scopes with a tenant scope that has an id type, writes templates
+* that are safe to inline and use the placeholders they need, lists every
+* function its templates call in `requires`, and keeps its token hook,
+* suspension rows, role sources and deciding columns well formed.
+*/
+function testAuthorizationProvider(provider) {
+	const scopes = new Set(provider.scopes.map((scope) => scope.name));
+	const templates = Object.entries(provider.functions).filter((entry) => typeof entry[1] === "string");
+	const calls = templates.some(([, template]) => (template.includes("{scope}") ? [...scopes] : [void 0]).some((scope) => templateFunctions(template, scope).length > 0));
+	return conform(`AuthorizationProvider "${provider.name}"`, [
+		hasName(provider),
+		["targets authorization API v1", () => {
+			expect(provider.apiVersion === 1, `apiVersion is ${String(provider.apiVersion)}`);
+		}],
+		["is plain JSON", () => {
+			expect(isPlainJson(provider), "it doesn't survive a JSON round trip");
+		}],
+		["names valid, unique scopes", () => {
+			expect(scopes.size > 0, "scopes is empty");
+			expect(scopes.size === provider.scopes.length, "a scope name repeats");
+			for (const scope of provider.scopes) expect(isScopeName(scope.name), `scope "${scope.name}" is not lower snake case`);
+			const problems = scopeProblems(provider);
+			expect(problems.length === 0, problems.join("; "));
+		}],
+		["templates use only their placeholders", () => {
+			for (const [name, template] of templates) {
+				const allowed = TEMPLATE_PLACEHOLDERS[name];
+				expect(allowed, `functions.${name} is not a known template`);
+				for (const placeholder of templatePlaceholders(template)) expect(allowed.includes(placeholder), `functions.${name} uses {${placeholder}}; it takes ${allowed.map((key) => `{${key}}`).join(", ")}`);
+				const needed = allowed.filter((key) => key === "permission" || key === "user" || key === "tenant" || key === "role" || key === "scope" && scopes.size > 1 && name.startsWith("idsWith"));
+				for (const key of needed) expect(template.includes(`{${key}}`), key === "scope" ? `functions.${name} doesn't use {scope}, so it answers the same for every scope` : `functions.${name} doesn't use {${key}}`);
+			}
+		}],
+		["templates are safe to inline", () => {
+			for (const [name, template] of templates) {
+				const problems = templateProblems(template);
+				expect(problems.length === 0, `functions.${name} ${problems.join(", ")}`);
+			}
+		}],
+		["requires every function the templates call", () => {
+			expect(!calls || provider.requires !== void 0, "the templates call functions, but requires is unset");
+			const required = new Set((provider.requires ?? []).map((entry) => entry.function));
+			for (const entry of provider.requires ?? []) expect(QUALIFIED.test(entry.function), `requires "${entry.function}" is not schema.name`);
+			for (const [name, template] of templates) for (const scope of template.includes("{scope}") ? scopes : [void 0]) for (const fn of templateFunctions(template, scope)) expect(required.has(fn), `functions.${name} calls ${fn}, which requires doesn't list`);
+		}],
+		provider.permissions && ["lists each permission once, at known scopes", () => {
+			const keys = /* @__PURE__ */ new Set();
+			for (const permission of provider.permissions) {
+				expect(permission.key !== "", "a permission key is empty");
+				expect(!keys.has(permission.key), `permission "${permission.key}" repeats`);
+				keys.add(permission.key);
+				for (const scope of permission.scopes ?? []) expect(scopes.has(scope), `permission "${permission.key}" names unknown scope "${scope}"`);
+			}
+		}],
+		provider.memberships && ["memberships name known scopes", () => {
+			for (const membership of provider.memberships) {
+				expect(TABLE.test(membership.table), `membership table "${membership.table}" is not schema.table`);
+				if ("value" in membership.scope) expect(scopes.has(membership.scope.value), `${membership.table} names unknown scope "${membership.scope.value}"`);
+			}
+		}],
+		provider.suspension && ["suspension rows name a table, an id and a state column", () => {
+			const { user, tenant } = provider.suspension;
+			if (user) expectRow("suspension.user", user);
+			if (tenant) expectRow("suspension.tenant", tenant);
+		}],
+		provider.roleSources && ["role sources name schema.table and columns", () => {
+			for (const source of provider.roleSources) {
+				expect(TABLE.test(source.table), `roleSources table "${source.table}" is not schema.table`);
+				expect(TABLE.test(source.role.through.table), `roleSources ${source.table} reads roles from "${source.role.through.table}", which is not schema.table`);
+				for (const column of [
+					source.role.column,
+					source.role.through.id,
+					source.role.through.column
+				]) expect(IDENTIFIER.test(column), `roleSources ${source.table} names "${column}", which is not a column`);
+			}
+		}],
+		provider.decidingColumns && ["deciding columns are schema.table.column", () => {
+			for (const column of provider.decidingColumns) expect(COLUMN.test(column), `decidingColumns "${column}" is not schema.table.column`);
+		}],
+		provider.tokenHook && ["names its token hook and the claims it writes", () => {
+			const hook = provider.tokenHook;
+			expect(QUALIFIED.test(hook.function), `tokenHook.function "${hook.function}" is not schema.name`);
+			expect(hook.ownedClaims.length > 0, "tokenHook.ownedClaims is empty");
+			const owned = new Set(hook.ownedClaims);
+			const written = new Set(owned);
+			for (const claim of hook.registeredClaims ?? []) {
+				expect(QUALIFIED.test(claim.function), `tokenHook claim "${claim.name}" calls "${claim.function}", which is not schema.name`);
+				expect(!owned.has(claim.name), `tokenHook registers "${claim.name}", which ownedClaims also lists: a claim the hook owns has no second writer`);
+				written.add(claim.name);
+			}
+			if (hook.budget !== void 0) {
+				expect(Number.isInteger(hook.budget.bytes) && hook.budget.bytes > 0, "tokenHook.budget.bytes must be a positive integer");
+				for (const claim of hook.budget.claims) expect(written.has(claim), `tokenHook.budget counts "${claim}", which neither ownedClaims nor registeredClaims lists`);
+			}
+		}]
+	]);
+}
+//#endregion
+//#region src/testing/generator.ts
+function relativeImport(from, to) {
+	const fromParts = from.split("/").slice(0, -1);
+	const toParts = to.split("/");
+	let common = 0;
+	while (common < fromParts.length && fromParts[common] === toParts[common]) common += 1;
+	const path = [...Array.from({ length: fromParts.length - common }, () => ".."), ...toParts.slice(common)].join("/");
+	return path.startsWith(".") ? path : `./${path}`;
+}
+/** A `GeneratorModel` from schema metadata, for generators tested without a database. */
+function modelFromMeta(meta) {
+	return {
+		tables: Object.values(meta.tables).map((table) => ({
+			key: table.key,
+			schema: table.schema,
+			name: table.name,
+			casing: meta.casing,
+			columns: Object.entries(table.columns).map(([app, column]) => ({
+				app,
+				db: column.db,
+				tsType: column.enum ? column.enum.map((value) => JSON.stringify(value)).join(" | ") : "unknown",
+				nullable: column.nullable,
+				optional: column.nullable || column.hasDefault || column.generated === true,
+				readonly: column.generated === true,
+				values: column.enum,
+				json: column.json === true
+			}))
+		})),
+		enums: Object.entries(meta.enums).map(([name, values]) => ({
+			schema: "public",
+			name,
+			values
+		}))
+	};
+}
+const EMPTY_INTROSPECTION = {
+	version: 1,
+	schemas: [],
+	tables: [],
+	foreignTables: [],
+	views: [],
+	materializedViews: [],
+	columns: [],
+	primaryKeys: [],
+	relationships: [],
+	functions: [],
+	types: []
+};
+/** Proves a `Generator` writes relative, unique paths, is deterministic and doesn't mutate its input. */
+function testGenerator(generator, options) {
+	const config = options.config ?? resolveConfig({}, "/project");
+	const input = () => ({
+		meta: frozenCopy(options.meta),
+		introspection: frozenCopy(options.introspection ?? EMPTY_INTROSPECTION),
+		extras: frozenCopy(options.extras ?? {
+			tables: [],
+			buckets: [],
+			realtime: []
+		}),
+		config,
+		output: `${config.root}/${config.output}`,
+		importPath: (from, to) => relativeImport(from, to),
+		model: frozenCopy(options.model ?? modelFromMeta(options.meta))
+	});
+	return conform(`Generator "${generator.name}"`, [
+		hasName(generator),
+		["targets generator API 1", () => {
+			const version = generator.apiVersion;
+			expect(version === void 0 || version === 1, `apiVersion is ${String(version)}; this better-supabase supports 1`);
+		}],
+		["writes files inside the project", async () => {
+			const files = await generator.generate(input());
+			expect(isList(files), "generate() must return an array");
+			for (const file of files) {
+				expect(typeof file.path === "string" && typeof file.contents === "string", "files need a path and contents");
+				expect(!file.path.startsWith("/") && !/^[A-Za-z]:/.test(file.path), `${file.path} must be relative`);
+				expect(!file.path.split(/[\\/]/).includes(".."), `${file.path} must stay inside the project`);
+			}
+			const paths = files.map((file) => file.path);
+			expect(new Set(paths).size === paths.length, "paths must be unique");
+		}],
+		["is deterministic and does not mutate its input", async () => {
+			const first = await generator.generate(input());
+			const second = await generator.generate(input());
+			expect(same(first, second), "two runs on the same input differ");
+		}]
+	]);
+}
+//#endregion
+//#region src/testing/injectables.ts
+const hasApiVersion = (subject) => ["has apiVersion 1", () => {
+	const version = subject.apiVersion;
+	expect(version === 1, `apiVersion is ${String(version)}, not 1`);
+}];
+const rejects = async (run) => {
+	try {
+		await run();
+		return false;
+	} catch {
+		return true;
+	}
+};
+/**
+* Proves an `Embedder` for the knowledge and memory blocks names its model,
+* embeds an empty list to nothing, and returns one finite vector per value,
+* all of the same length on every call. It calls the real model.
+*/
+function testEmbedder(embedder, options = {}) {
+	const values = options.values ?? ["The first text.", "A second text."];
+	return conform(`Embedder "${embedder.model}"`, [
+		hasApiVersion(embedder),
+		["names its model", () => {
+			expect(typeof embedder.model === "string" && embedder.model !== "", "model must be a non-empty string");
+		}],
+		["embeds nothing to nothing", async () => {
+			const vectors = await embedder.embed([]);
+			expect(vectors.length === 0, `got ${vectors.length} vectors`);
+		}],
+		["returns one finite vector per value, of one length", async () => {
+			const first = await embedder.embed(values);
+			expect(first.length === values.length, `got ${first.length} vectors for ${values.length} values`);
+			const size = first[0]?.length ?? 0;
+			expect(size > 0, "vectors must not be empty");
+			expect(first.every((vector) => vector.length === size && vector.every(Number.isFinite)), "vectors must share one length and hold finite numbers");
+			const [again] = await embedder.embed(values.slice(0, 1));
+			expect(again?.length === size, "a second call changed the length");
+		}]
+	]);
+}
+/**
+* Proves an `AiTaskRunner` resolves with nothing or a chat id and stops when
+* its signal is already aborted. It runs `options.task` for real.
+*/
+function testAiTaskRunner(runner, options) {
+	const { task, run } = options;
+	return conform("AiTaskRunner", [
+		hasApiVersion(runner),
+		["resolves with nothing or a chat id", async () => {
+			const result = await runner(task, run, new AbortController().signal);
+			expect(result === void 0 || typeof result === "object" && result !== null && (!("chatId" in result) || result.chatId === void 0 || typeof result.chatId === "string"), "must resolve with undefined or { chatId?: string }");
+		}],
+		["stops on an aborted signal", async () => {
+			expect(await rejects(() => runner(task, run, AbortSignal.abort())), "resolved although the signal was aborted");
+		}]
+	]);
+}
+/**
+* Proves a `GraphCompiler` returns a JSON value (stored with the published
+* version), compiles the same graph to the same value and leaves the graph
+* unchanged.
+*/
+function testGraphCompiler(compile, options) {
+	const { graph } = options;
+	return conform("GraphCompiler", [
+		hasApiVersion(compile),
+		["returns a JSON value", async () => {
+			const compiled = await compile(graph);
+			if (compiled === void 0) return;
+			const json = JSON.stringify(compiled);
+			expect(same(JSON.parse(json), compiled), "the compiled form must survive a JSON round trip");
+		}],
+		["compiles one graph to one value, without changing it", async () => {
+			const before = structuredClone(graph);
+			const first = await compile(graph);
+			const second = await compile(graph);
+			expect(same(first, second), "two compiles of one graph differ");
+			expect(same(graph, before), "compile changed the graph");
+		}]
+	]);
+}
+/**
+* Proves a `BuilderStarter` returns a run id and returns the same id when
+* the same idempotency key starts again. It starts real runs.
+*/
+function testBuilderStarter(start, options) {
+	const { call } = options;
+	return conform("BuilderStarter", [hasApiVersion(start), ["returns one run id per idempotency key", async () => {
+		const first = await start(call);
+		expect(typeof first === "string" && first !== "", "must resolve with a non-empty run id");
+		expect(await start(call) === first, "a repeated idempotency key started a new run");
+	}]]);
+}
+/**
+* Proves an `EveDocumentBackend` reads a missing document as `null`, creates
+* one with `expectedVersion: null`, refuses a stale version and moves the
+* version on every write. It writes `options.key` on the real store.
+*/
+function testEveDocumentBackend(backend, options = {}) {
+	const key = options.key ?? `conformance/${crypto.randomUUID()}`;
+	return conform("EveDocumentBackend", [hasApiVersion(backend), ["creates, reads and updates a document by version", async () => {
+		expect(await backend.read({ key }) === null, "a missing document must read as null");
+		const created = await backend.write({
+			key,
+			content: "one",
+			expectedVersion: null
+		});
+		const read = await backend.read({ key });
+		expect(read?.content === "one" && read.version === created.version, "read must return the written content and version");
+		expect((await backend.write({
+			key,
+			content: "two",
+			expectedVersion: created.version
+		})).version !== created.version, "a write must change the version");
+		expect(await rejects(() => backend.write({
+			key,
+			content: "three",
+			expectedVersion: created.version
+		})), "a write with a stale version must throw");
+		expect((await backend.read({ key }))?.content === "two", "a refused write changed the document");
+	}]]);
+}
+//#endregion
 //#region src/testing/notification-channel.ts
 const STATUSES = /* @__PURE__ */ new Set(["sent", "skipped"]);
 function sample(channel, email) {
@@ -1383,4 +1987,367 @@ function testWebhookSecretStore(store, options) {
 	]);
 }
 //#endregion
-export { ConformanceError, LOCAL_JWT_SECRET, asUser, createTestSigner, defineSeed, expectDbBudget, expectTenantIsolation, isSeed, localAuth, localSigningKey, signLocalJwt, signTestJwt, signTestJwtWithKey, supabaseClaimFixtures, testAuthResolver, testCacheAdapter, testEventSink, testExecutor, testGenerator, testNotificationChannel, testPlugin, testQueueBackend, testSupportSessionStore, testWebhookSecretStore, testWebhookSigner, testWebhookTransport };
+//#region src/testing/chat-state.ts
+const sleep = (ms) => new Promise((resolve) => {
+	setTimeout(resolve, ms);
+});
+/**
+* Runs the Chat SDK `StateAdapter` contract against `state`: subscriptions,
+* one lock holder at a time with token-checked release and extension, lock
+* and cache TTLs, `setIfNotExists`, list trimming, and a per-thread queue
+* that keeps the newest entries, reports its depth and drops expired ones.
+*/
+function testChatState(state, options) {
+	const fresh = options.id ?? (() => `conformance-${crypto.randomUUID()}`);
+	const ttl = options.ttlMs ?? 300;
+	const entry = (thread, text, expiresIn = 6e4) => ({
+		enqueuedAt: Date.now(),
+		expiresAt: Date.now() + expiresIn,
+		message: options.message(`${thread}-${text}`, text)
+	});
+	return conform("StateAdapter", [
+		["subscribes and unsubscribes a thread", async () => {
+			const thread = fresh();
+			expect(!await state.isSubscribed(thread), "new thread is subscribed");
+			await state.subscribe(thread);
+			await state.subscribe(thread);
+			expect(await state.isSubscribed(thread), "subscribe did not stick");
+			await state.unsubscribe(thread);
+			expect(!await state.isSubscribed(thread), "unsubscribe did not stick");
+		}],
+		["gives the lock to one holder at a time", async () => {
+			const thread = fresh();
+			const [a, b] = await Promise.all([state.acquireLock(thread, 1e4), state.acquireLock(thread, 1e4)]);
+			expect(a === null !== (b === null), "both or neither got the lock");
+			const held = a ?? b;
+			expect(held !== null, "no lock");
+			expect(held.threadId === thread, "lock names another thread");
+			expect(held.expiresAt > Date.now(), "lock is already expired");
+			await state.releaseLock({
+				...held,
+				token: "not-the-token"
+			});
+			expect(await state.acquireLock(thread, 1e4) === null, "a wrong token released the lock");
+			expect(await state.extendLock(held, 2e4), "extendLock failed");
+			await state.releaseLock(held);
+			expect(await state.acquireLock(thread, 1e4) !== null, "released lock was not free");
+			await state.forceReleaseLock(thread);
+			expect(await state.acquireLock(thread, 1e4) !== null, "forceReleaseLock left the lock held");
+		}],
+		["lets an expired lock go", async () => {
+			const thread = fresh();
+			const lock = await state.acquireLock(thread, ttl);
+			expect(lock !== null, "no lock");
+			await sleep(ttl + 100);
+			expect(!await state.extendLock(lock, 1e4), "extended an expired lock");
+			expect(await state.acquireLock(thread, 1e4) !== null, "expired lock is still held");
+		}],
+		["stores values with a TTL", async () => {
+			const key = fresh();
+			expect(await state.get(key) === null, "missing key is not null");
+			await state.set(key, {
+				n: 1,
+				list: ["a"]
+			});
+			const stored = await state.get(key);
+			expect(stored?.n === 1 && stored.list[0] === "a", "value changed");
+			await state.set(key, "text");
+			expect(await state.get(key) === "text", "a string value changed");
+			await state.delete(key);
+			expect(await state.get(key) === null, "delete left the value");
+			await state.set(key, 1, ttl);
+			await sleep(ttl + 100);
+			expect(await state.get(key) === null, "value outlived its TTL");
+		}],
+		["sets a key only when it is missing", async () => {
+			const key = fresh();
+			expect(await state.setIfNotExists(key, "first"), "first set failed");
+			expect(!await state.setIfNotExists(key, "second"), "second set won");
+			expect(await state.get(key) === "first", "value was replaced");
+			const short = fresh();
+			await state.setIfNotExists(short, "old", ttl);
+			await sleep(ttl + 100);
+			expect(await state.setIfNotExists(short, "new"), "an expired key blocked the set");
+		}],
+		["appends to a list and keeps the newest maxLength", async () => {
+			const key = fresh();
+			for (const value of [
+				"a",
+				"b",
+				"c",
+				"d"
+			]) await state.appendToList(key, value, { maxLength: 3 });
+			const list = await state.getList(key);
+			expect(list.join() === "b,c,d", `list is ${list.join()}`);
+			expect((await state.getList(fresh())).length === 0, "missing list is not empty");
+		}],
+		["queues per thread, keeps the newest maxSize and reports the depth", async () => {
+			const thread = fresh();
+			expect(await state.queueDepth(thread) === 0, "new queue is not empty");
+			expect(await state.dequeue(thread) === null, "empty queue dequeued");
+			let depth = 0;
+			for (const text of [
+				"one",
+				"two",
+				"three"
+			]) depth = await state.enqueue(thread, entry(thread, text), 2);
+			expect(depth === 2, `depth after three with maxSize 2 is ${String(depth)}`);
+			expect(await state.queueDepth(thread) === 2, "queueDepth disagrees");
+			const first = await state.dequeue(thread);
+			expect(first?.message.text === "two", "dequeue did not return the oldest kept entry");
+			expect(first.message.id === `${thread}-two`, "message id changed");
+			expect(await state.queueDepth(thread) === 1, "dequeue did not remove it");
+			expect(await state.queueDepth(fresh()) === 0, "another thread shares the queue");
+		}],
+		["drops expired queue entries", async () => {
+			const thread = fresh();
+			await state.enqueue(thread, entry(thread, "stale", ttl), 10);
+			await sleep(ttl + 100);
+			expect(await state.queueDepth(thread) === 0, "an expired entry counts");
+			expect(await state.dequeue(thread) === null, "an expired entry dequeued");
+		}]
+	]);
+}
+//#endregion
+//#region src/testing/streams.ts
+async function collect(stream, timeoutMs) {
+	const chunks = [];
+	const reader = stream.getReader();
+	let timer;
+	const timeout = new Promise((_, reject) => {
+		timer = setTimeout(() => {
+			reject(/* @__PURE__ */ new Error(`read did not end within ${String(timeoutMs)} ms`));
+		}, timeoutMs);
+	});
+	try {
+		for (;;) {
+			const { done, value } = await Promise.race([reader.read(), timeout]);
+			if (done) return chunks;
+			chunks.push(value);
+		}
+	} finally {
+		clearTimeout(timer);
+		await reader.cancel().catch(() => void 0);
+	}
+}
+const hintOf = (result) => result.ok ? void 0 : result.error.hint;
+/**
+* Runs the `StreamStore` contract against `store`: the API version, open
+* once, idempotent appends that refuse gaps, reads from any index that end
+* when the stream closes, a live read that sees later appends, cancel seen by
+* the writer, a closed stream that refuses appends, and a missing stream.
+*/
+function testStreamStore(store, options = {}) {
+	const fresh = options.id ?? (() => `conformance-${crypto.randomUUID()}`);
+	const timeoutMs = options.timeoutMs ?? 5e3;
+	return conform(`StreamStore "${store.name}"`, [
+		["has apiVersion 1 and a name", () => {
+			const version = store.apiVersion;
+			expect(version === 1, `apiVersion is ${String(version)}`);
+			expect(store.name.length > 0, "name is empty");
+		}],
+		["opens a stream once", async () => {
+			const id = fresh();
+			expect(await store.open(id).orThrow(), "first open was not new");
+			expect(!await store.open(id).orThrow(), "second open was new");
+		}],
+		["appends idempotently and refuses a gap", async () => {
+			const id = fresh();
+			await store.open(id).orThrow();
+			const first = await store.append(id, 0, ["a", "b"]).orThrow();
+			expect(first.next === 2, `next after two chunks is ${String(first.next)}`);
+			const retried = await store.append(id, 0, [
+				"a",
+				"b",
+				"c"
+			]).orThrow();
+			expect(retried.next === 3, `next after a retried batch is ${String(retried.next)}`);
+			const gap = await store.append(id, 5, ["x"]);
+			expect(hintOf(gap) === "STREAM_GAP", `a gap gave ${JSON.stringify(gap)}`);
+			await store.close(id).orThrow();
+			const chunks = await collect(store.read(id), timeoutMs);
+			expect(chunks.join("") === "abc", `read ${JSON.stringify(chunks)} after a retried batch`);
+		}],
+		["reads from an index and ends once closed", async () => {
+			const id = fresh();
+			await store.open(id).orThrow();
+			await store.append(id, 0, [
+				"0",
+				"1",
+				"2",
+				"3"
+			]).orThrow();
+			expect(await store.close(id).orThrow(), "close returned false");
+			expect(!await store.close(id).orThrow(), "a second close returned true");
+			const tail = await collect(store.read(id, 2), timeoutMs);
+			expect(tail.join(",") === "2,3", `read from 2 gave ${JSON.stringify(tail)}`);
+			const status = await store.status(id).orThrow();
+			expect(status?.next === 4 && status.closed && !status.cancelled, `status is ${JSON.stringify(status)}`);
+		}],
+		["a live read sees later appends", async () => {
+			const id = fresh();
+			await store.open(id).orThrow();
+			const reading = collect(store.read(id), timeoutMs);
+			await store.append(id, 0, ["x"]).orThrow();
+			await store.append(id, 1, ["y"]).orThrow();
+			await store.close(id).orThrow();
+			const chunks = await reading;
+			expect(chunks.join("") === "xy", `live read gave ${JSON.stringify(chunks)}`);
+		}],
+		["tells the writer about a cancel", async () => {
+			const id = fresh();
+			await store.open(id).orThrow();
+			expect(!await store.isCancelled(id).orThrow(), "a new stream is cancelled");
+			expect(await store.cancel(id).orThrow(), "cancel returned false");
+			expect(await store.isCancelled(id).orThrow(), "isCancelled is false after cancel");
+			expect((await store.append(id, 0, ["late"]).orThrow()).cancelled, "append did not report the cancel");
+			await store.close(id).orThrow();
+			expect(!await store.cancel(id).orThrow(), "cancel of a closed stream returned true");
+		}],
+		["refuses appends to a closed stream", async () => {
+			const id = fresh();
+			await store.open(id).orThrow();
+			await store.close(id).orThrow();
+			const closed = await store.append(id, 0, ["x"]);
+			expect(hintOf(closed) === "STREAM_CLOSED", `append gave ${JSON.stringify(closed)}`);
+		}],
+		["treats a missing stream as empty", async () => {
+			const id = fresh();
+			expect(await store.status(id).orThrow() === void 0, "status of a missing stream");
+			const chunks = await collect(store.read(id), timeoutMs);
+			expect(chunks.length === 0, `read a missing stream as ${JSON.stringify(chunks)}`);
+			const appended = await store.append(id, 0, ["x"]);
+			expect(hintOf(appended) === "STREAM_NOT_FOUND", `append gave ${JSON.stringify(appended)}`);
+		}],
+		["purges with a count", async () => {
+			const purged = await store.purge().orThrow();
+			expect(Number.isInteger(purged) && purged >= 0, `purge returned ${String(purged)}`);
+		}]
+	]);
+}
+//#endregion
+//#region src/testing/credentials.ts
+const APP = { type: "app" };
+const kindOf = (result) => result.ok ? void 0 : result.error.kind;
+/**
+* Runs the `CredentialProvider` contract against `provider`: the API version,
+* an unknown ref, a stored token with its headers, a new value seen after it
+* is stored, separate credentials per user and per tenant (`ref` with a
+* `tenant`, which `seed` must store too), revoke (per user, as the
+* organization purger revokes connector grants), and inbound checks that
+* accept a signed request and refuse a tampered one.
+*/
+function testCredentialProvider(provider, options) {
+	const value = () => `token-${crypto.randomUUID()}`;
+	const { ref, seed, userRef, inbound } = options;
+	return conform(`CredentialProvider "${provider.name}"`, [
+		["has apiVersion 1 and a name", () => {
+			const version = provider.apiVersion;
+			expect(version === 1, `apiVersion is ${String(version)}`);
+			expect(provider.name.length > 0, "name is empty");
+		}],
+		["refuses a ref for another provider", async () => {
+			const result = await provider.getToken({ provider: "conformance-unknown" }, { subject: APP });
+			expect(kindOf(result) === "invalid_input", `got ${kindOf(result) ?? "a token"}`);
+		}],
+		["returns a stored token with headers", async () => {
+			const token = value();
+			await seed(ref, APP, token);
+			const got = await provider.getToken(ref, { subject: APP }).orThrow();
+			expect(got.token === token, "returned another token");
+			expect(Object.values(got.headers).some((header) => header.includes(token)), "no header carries the token");
+		}],
+		["sees a new value once it is stored", async () => {
+			await seed(ref, APP, value());
+			await provider.getToken(ref, { subject: APP }).orThrow();
+			const next = value();
+			await seed(ref, APP, next);
+			expect((await provider.getToken(ref, { subject: APP }).orThrow()).token === next, "returned the previous value");
+		}],
+		provider.set !== void 0 && ["stores a value through set", async () => {
+			const set = provider.set?.bind(provider);
+			expect(set !== void 0, "no set");
+			const next = value();
+			await set(ref, next, { subject: APP }).orThrow();
+			expect((await provider.getToken(ref, { subject: APP }).orThrow()).token === next, "getToken missed the value set stored");
+		}],
+		userRef !== void 0 && ["keeps a credential per user", async () => {
+			const alice = {
+				type: "user",
+				id: crypto.randomUUID()
+			};
+			const bob = {
+				type: "user",
+				id: crypto.randomUUID()
+			};
+			const [forAlice, forBob] = [value(), value()];
+			await seed(userRef, alice, forAlice);
+			await seed(userRef, bob, forBob);
+			const a = await provider.getToken(userRef, { subject: alice }).orThrow();
+			const b = await provider.getToken(userRef, { subject: bob }).orThrow();
+			expect(a.token === forAlice && b.token === forBob, "users share a credential");
+			expect(provider.capabilities(userRef).userSubjects, "capabilities do not report user subjects");
+			expect(!(await provider.getToken(userRef, { subject: APP })).ok, "the app read a per-user credential");
+		}],
+		userRef !== void 0 && ["revokes one user's credential only", async () => {
+			const alice = {
+				type: "user",
+				id: crypto.randomUUID()
+			};
+			const bob = {
+				type: "user",
+				id: crypto.randomUUID()
+			};
+			const forBob = value();
+			await seed(userRef, alice, value());
+			await seed(userRef, bob, forBob);
+			expect(await provider.revoke(userRef, { subject: alice }).orThrow(), "revoke found nothing for the user");
+			const after = await provider.getToken(userRef, { subject: alice });
+			expect(kindOf(after) === "not_found", `after revoke got ${kindOf(after) ?? "a token"}`);
+			expect((await provider.getToken(userRef, { subject: bob }).orThrow()).token === forBob, "revoking a user's credential removed another user's");
+			await provider.revoke(userRef, { subject: bob }).orThrow();
+		}],
+		["keeps a tenant's credential inside its namespace", async () => {
+			const forA = tenantCredentialRef(crypto.randomUUID(), ref);
+			const forB = tenantCredentialRef(crypto.randomUUID(), ref);
+			const [app, a, b] = [
+				value(),
+				value(),
+				value()
+			];
+			await seed(ref, APP, app);
+			await seed(forA, APP, a);
+			await seed(forB, APP, b);
+			const tokenOf = async (of) => (await provider.getToken(of, { subject: APP }).orThrow()).token;
+			expect(await tokenOf(ref) === app && await tokenOf(forA) === a && await tokenOf(forB) === b, "a tenant's ref resolved another tenant's or the app's credential");
+			expect(await provider.revoke(forA, { subject: APP }).orThrow(), "revoke found nothing in the tenant's namespace");
+			const after = await provider.getToken(forA, { subject: APP });
+			expect(kindOf(after) === "not_found", `after revoke got ${kindOf(after) ?? "a token"}`);
+			expect(await tokenOf(forB) === b && await tokenOf(ref) === app, "revoking a tenant's ref removed another tenant's or the app's credential");
+			await provider.revoke(forB, { subject: APP }).orThrow();
+		}],
+		["revokes a credential", async () => {
+			await seed(ref, APP, value());
+			expect(await provider.revoke(ref, { subject: APP }).orThrow(), "revoke found nothing");
+			const after = await provider.getToken(ref, { subject: APP });
+			expect(kindOf(after) === "not_found", `after revoke got ${kindOf(after) ?? "a token"}`);
+			expect(!await provider.revoke(ref, { subject: APP }).orThrow(), "a second revoke found a credential");
+		}],
+		inbound !== void 0 && ["verifies inbound requests", async () => {
+			const verify = provider.verifyInbound?.bind(provider);
+			expect(verify !== void 0, "no verifyInbound");
+			const secret = `whsec_${btoa(crypto.randomUUID())}`;
+			await seed(inbound.ref, APP, secret);
+			const body = JSON.stringify({ hello: "world" });
+			const signed = await inbound.sign(body, secret);
+			expect(await verify(signed, inbound.ref).orThrow(), "refused a signed request");
+			expect(!await verify(new Request(signed.url, {
+				method: "POST",
+				headers: signed.headers,
+				body: `${body} `
+			}), inbound.ref).orThrow(), "accepted a tampered request");
+		}]
+	]);
+}
+//#endregion
+export { ConformanceError, LOCAL_JWT_SECRET, asUser, createTestSigner, defineSeed, expectDbBudget, expectInstant, expectTenantIsolation, isSeed, localAuth, localSigningKey, signLocalJwt, signTestJwt, signTestJwtWithKey, supabaseClaimFixtures, testAdapter, testAiTaskRunner, testAuthResolver, testAuthorizationProvider, testBlockTransportMiddleware, testBuilderStarter, testCacheAdapter, testChatState, testCredentialProvider, testEmbedder, testEveDocumentBackend, testEventSink, testExecutor, testGenerator, testGraphCompiler, testNotificationChannel, testPlugin, testQueueBackend, testStreamStore, testSupportSessionStore, testWebhookSecretStore, testWebhookSigner, testWebhookTransport };