better-supabase 0.7.0 → 0.8.0

package/dist/testing/index.js

@@ -1,20 +1,22 @@
 import { t as DbException } from "../db-exception-CnWcYPxL.js";
-import { n as dbError } from "../errors-B11Duf73.js";
+import { n as dbError } from "../errors-2M6CKMP4.js";
 import { d as temporalText } from "../temporal-BJGitm-h.js";
-import { t as temporal } from "../temporal-required-BVvW7SYJ.js";
-import { a as ok } from "../result-DzUbqgdW.js";
-import { t as BetterSupabase } from "../define-B-TVjC25.js";
+import { t as temporal } from "../temporal-required-BtynQtM-.js";
+import { a as ok } from "../result-DEqHCMKP.js";
+import { t as BetterSupabase } from "../define-CFQcvM20.js";
+import { t as isList } from "../guards-6F2bCtQR.js";
 import { a as toBase64Url, r as fromBase64, t as base64ToText } from "../base64-D2gsioCY.js";
-import { t as isList } from "../guards-BnzDvFrz.js";
-import { a as resolveConfig } from "../modules-dxrVK3ID.js";
+import { o as resolveConfig } from "../config-DlKvtt95.js";
 import { ENV_VARIABLES } from "../env/index.js";
-import { n as postgresExecutor } from "../executor-De1Of3m3.js";
+import { n as postgresExecutor } from "../executor-B_Hfobee.js";
 import "../replicas-CwrYp5Zj.js";
-import { a as tenantCredentialRef } from "../provider-Di3sRutW.js";
+import { a as tenantCredentialRef } from "../provider-DxRTex4x.js";
+import { i as requestOf, n as checkPermission, r as defineAuthorizer } from "../authorizer-ayxUDXXP.js";
 import { n as parseDbStats } from "../timing-CyTQPubY.js";
-import { t as rawError } from "../block-transport-BLr-ZgLc.js";
-import { a as isScopeName, c as templateFunctions, l as templatePlaceholders, n as TEMPLATE_PLACEHOLDERS, s as scopeProblems, u as templateProblems } from "../access-sql-B0dF-SoF.js";
+import { n as rawError } from "../block-transport-bAKh-dGc.js";
+import { a as isScopeName, c as templateFunctions, l as templatePlaceholders, n as TEMPLATE_PLACEHOLDERS, s as scopeProblems, u as templateProblems } from "../access-sql-CrSbK1q-.js";
 import { toCloudEvents } from "../events/index.js";
+import { t as buildApiModel } from "../build-hPwk3_X5.js";
 import { timestamps } from "../plugins/timestamps/index.js";
 import { softDelete } from "../plugins/soft-delete/index.js";
 import { tenant } from "../plugins/tenant/index.js";
@@ -230,7 +232,10 @@ async function asUser(betterSupabase, claims, stack = {}) {
 		},
 		claims: full
 	};
-	const supabase = createClient(url, publishableKey, { accessToken: () => Promise.resolve(token) });
+	const supabase = createClient(url, publishableKey, {
+		accessToken: () => Promise.resolve(token),
+		...stack.fetch ? { global: { fetch: stack.fetch } } : {}
+	});
 	return {
 		token,
 		claims: full,
@@ -240,6 +245,141 @@ async function asUser(betterSupabase, claims, stack = {}) {
 	};
 }
 //#endregion
+//#region src/lite/runtime.ts
+const LITE_INSTALL = "Supabase Lite is an optional peer: install it with `pnpm add -D @supabase/lite`";
+/**
+* `@supabase/lite` is an optional peer: variable specifiers keep bundlers
+* from resolving it, and a missing install returns `undefined` so callers
+* can say how to add it.
+*/
+async function loadLite() {
+	const root = "@supabase/lite";
+	const pglite = "@supabase/lite/pglite";
+	const sqlite = "@supabase/lite/sqlite";
+	try {
+		const [{ App }, pg, sq] = await Promise.all([
+			import(root),
+			import(pglite),
+			import(sqlite)
+		]);
+		return {
+			App,
+			createPgliteConnection: () => pg.createPgliteConnection(),
+			createSqliteConnection: (url) => sq.createConnection({ url })
+		};
+	} catch {
+		return;
+	}
+}
+/** Applies migrations, then declarative schemas, with Lite's migrator. */
+async function migrateLite(connection, sql) {
+	const ddl = sql.filter((part) => part.trim() !== "").join("\n;\n");
+	if (ddl !== "") await connection.createMigrator(ddl).migrate();
+}
+/** Runs seed SQL: as is on PGlite, translated to SQLite on `sqlite-postgres`. */
+async function seedLite(target, sql) {
+	if (sql.trim() === "") return;
+	if (target.driver === "pglite") {
+		await target.connection.driver.exec(sql);
+		return;
+	}
+	const { connection } = target;
+	const translated = await connection.translateDdl(sql);
+	const statements = typeof translated === "string" ? translated : typeof translated === "object" && translated !== null && "ddl" in translated && typeof translated.ddl === "string" ? translated.ddl : "";
+	if (statements !== "") await connection.transaction([statements]);
+}
+//#endregion
+//#region src/testing/lite.ts
+const LITE_URL = "http://localhost:54321";
+function randomToken(bytes) {
+	return toBase64Url(crypto.getRandomValues(new Uint8Array(bytes)));
+}
+function list(value) {
+	if (value === void 0) return [];
+	return typeof value === "string" ? [value] : [...value];
+}
+/**
+* Supabase Lite in this process, for tests without Docker: an in-memory
+* database with your schema, Auth with fresh API keys, and supabase-js
+* clients whose requests go straight to Lite's `fetch` handler (no port).
+*
+* ```ts
+* await using stack = await liteStack({ schemas: [await readFile("supabase/schemas/notes.sql", "utf8")] });
+* const alice = await stack.asUser(betterSupabase, { sub: aliceId });
+* expect(await alice.db.notes.count().orThrow()).toBe(1);
+* ```
+*/
+async function liteStack(options = {}) {
+	const lite = await loadLite();
+	if (!lite) throw new Error(`liteStack() needs @supabase/lite. ${LITE_INSTALL}`);
+	const driver = options.driver ?? "sqlite-postgres";
+	const jwtSecret = options.jwtSecret ?? randomToken(32);
+	const publishableKey = `sb_publishable_${randomToken(16)}`;
+	const secretKey = `sb_secret_${randomToken(16)}`;
+	let target;
+	if (driver === "pglite") target = {
+		driver,
+		connection: await lite.createPgliteConnection()
+	};
+	else target = {
+		driver,
+		connection: await lite.createSqliteConnection(":memory:")
+	};
+	const { connection } = target;
+	try {
+		const app = new lite.App({
+			connection,
+			auth: {
+				enabled: true,
+				jwt_secret: jwtSecret,
+				publishable_key: publishableKey,
+				secret_key: secretKey
+			}
+		});
+		await app.init();
+		await migrateLite(connection, [...options.migrations ?? [], ...options.schemas ?? []]);
+		for (const seed of list(options.seed)) await seedLite(target, seed);
+		const fetch = (input, init) => app.fetch(new Request(input, init));
+		const stateless = {
+			auth: {
+				persistSession: false,
+				autoRefreshToken: false
+			},
+			global: { fetch }
+		};
+		const close = () => connection.close();
+		return {
+			url: LITE_URL,
+			publishableKey,
+			secretKey,
+			jwtSecret,
+			fetch,
+			env: {
+				url: LITE_URL,
+				publishableKey,
+				secretKey,
+				secretKeys: { default: secretKey },
+				jwksUrl: new URL(`${LITE_URL}/auth/v1/.well-known/jwks.json`),
+				jwtSecret
+			},
+			supabase: createClient(LITE_URL, publishableKey, stateless),
+			admin: createClient(LITE_URL, secretKey, stateless),
+			asUser: (betterSupabase, claims) => asUser(betterSupabase, claims, {
+				url: LITE_URL,
+				publishableKey,
+				alg: "HS256",
+				jwtSecret,
+				fetch
+			}),
+			close,
+			[Symbol.asyncDispose]: close
+		};
+	} catch (error) {
+		await connection.close();
+		throw error;
+	}
+}
+//#endregion
 //#region src/testing/budget.ts
 function isPrefetch(response) {
 	const headers = response.request().headers();
@@ -449,905 +589,932 @@ function deepFreeze(value) {
 }
 const frozenCopy = (value) => deepFreeze(structuredClone(value));
 const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
-const recorder = (ops) => ({
-	name: "recorder",
-	execute: (op) => {
-		ops.push(op);
-		return Promise.resolve(ok({
-			rows: [],
-			count: 0
-		}));
-	}
-});
-/** The operation `run` sends to the executor, built by `betterSupabase` without touching a database. */
-async function captureOp(betterSupabase, run) {
-	const ops = [];
-	await run(betterSupabase.connect(recorder(ops)));
-	const [op] = ops;
-	if (!op) throw new Error("the repository call did not reach the executor");
-	return op;
+//#endregion
+//#region src/testing/isolation.ts
+const scalar = (value) => typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+function keyOf(table, row) {
+	return Object.fromEntries(table.primaryKey.map((column) => [column, row[column]]));
 }
-function tableKey(betterSupabase, table) {
-	const key = table ?? Object.keys(betterSupabase.meta.tables)[0];
-	if (!key || !(key in betterSupabase.meta.tables)) throw new TypeError(`better-supabase: unknown table "${String(key)}"`);
-	return key;
+async function rowsOf(outcome) {
+	const result = await outcome;
+	if (!result.ok) throw new Error(result.error.message);
+	return Array.isArray(result.data) ? result.data : [result.data];
+}
+function env(names) {
+	if (typeof process === "undefined") return void 0;
+	for (const name of names) {
+		const value = process.env[name];
+		if (value) return value;
+	}
 }
-const hasName = (subject) => ["has a name", () => {
-	expect(typeof subject.name === "string" && subject.name.length > 0, "name must be a non-empty string");
-}];
 /**
-* Proves an `Executor` meets the contract: rows keyed by the selection's
-* aliases, counts, `aborted` errors, failures returned as `Result`s rather
-* than thrown, and (with `create`) a write round trip and a `deleteMany`
-* that `maxAffected` refuses without deleting anything.
+* Checks row-level security between two tenants against a running stack: for
+* each table, a user of one tenant must not select, insert, update or delete
+* the other tenant's rows. Runs without `betterSupabase`'s plugins, so the `tenant()`
+* plugin can't hide a missing policy. Throws a `ConformanceError` naming each
+* table and command that leaks; removes every row it created.
 *
 * ```ts
-* it('conforms', () => testExecutor(myExecutor, { betterSupabase, table: 'tags', create: { name: 'x' } }));
+* await expectTenantIsolation(betterSupabase, {
+*   tenants: [
+*     { id: ACME, claims: { sub: alice, tenant_id: ACME } },
+*     { id: GLOBEX, claims: { sub: bob, tenant_id: GLOBEX } },
+*   ],
+*   tables: {
+*     tags: {
+*       row: (tenant, n) => ({ organizationId: tenant.id, name: `iso-${n}` }),
+*       update: { name: 'changed' },
+*     },
+*   },
+* });
 * ```
 */
-function testExecutor(executor, options) {
-	const { betterSupabase } = options;
-	const table = tableKey(betterSupabase, options.table);
-	const context = { errorMappers: [] };
-	const read = () => captureOp(betterSupabase, (db) => db[table]["findMany"]({ limit: 2 }));
-	const create = options.create;
-	return conform(`Executor "${executor.name}"`, [
-		hasName(executor),
-		["reads rows keyed by the selection aliases", async () => {
-			const op = await read();
-			const result = await executor.execute(op, context);
-			expect(result.ok, `select failed: ${result.ok ? "" : result.error.message}`);
-			expect(isList(result.data.rows), "rows must be an array");
-			expect(result.data.rows.length <= 2, `limit 2 returned ${result.data.rows.length} rows`);
-			expect(result.data.count === null || typeof result.data.count === "number", "count must be a number or null");
-			if (op.kind !== "select") return;
-			const aliases = new Set(op.selection.columns.map((column) => column.alias));
-			for (const row of result.data.rows) {
-				const extra = Object.keys(row).filter((key) => !aliases.has(key));
-				expect(extra.length === 0, `rows must use selection aliases; got ${extra.join(", ")}`);
-			}
-		}],
-		["counts rows", async () => {
-			const op = await captureOp(betterSupabase, (db) => db[table]["count"]());
-			const result = await executor.execute(op, context);
-			expect(result.ok, `count failed: ${result.ok ? "" : result.error.message}`);
-			expect(typeof result.data.count === "number" && result.data.count >= 0, "count must be a number");
-		}],
-		["returns an aborted error for an aborted signal", async () => {
-			const controller = new AbortController();
-			controller.abort();
-			const result = await executor.execute(await read(), {
-				...context,
-				signal: controller.signal
-			});
-			expect(!result.ok, "an aborted request must fail");
-			expect(result.error.kind === "aborted", `expected kind "aborted", got "${result.error.kind}"`);
-		}],
-		["returns failures as results instead of throwing", async () => {
-			const op = await read();
-			const missing = {
-				...op,
-				table: {
-					...op.table,
-					name: "__better_supabase_missing__"
-				}
-			};
-			const result = await executor.execute(missing, context);
-			expect(!result.ok, "a missing table must fail");
-			expect(typeof result.error.kind === "string" && typeof result.error.message === "string", "errors must be DbErrors");
-		}],
-		executor.rpc && ["returns rpc failures as results", async () => {
-			expect(!(await executor.rpc("__better_supabase_missing__", {}, {
-				...context,
-				schema: "public"
-			})).ok, "calling a missing function must fail");
-		}],
-		executor.functionSources && ["reads from SelectOp.source instead of the table", async () => {
-			const op = await read();
-			if (op.kind !== "select") return;
-			expect(!(await executor.execute({
-				...op,
-				source: {
-					schema: op.table.schema,
-					name: "__better_supabase_missing__",
-					args: {}
-				}
-			}, context)).ok, "a missing source function must fail; reading the table ignores source");
-		}],
-		executor.batch && ["batch returns one result per operation, in order", async () => {
-			const rows = await read();
-			const count = await captureOp(betterSupabase, (db) => db[table]["count"]());
-			const missing = {
-				...rows,
-				table: {
-					...rows.table,
-					name: "__better_supabase_missing__"
-				}
-			};
-			const results = await executor.batch([
-				rows,
-				count,
-				missing
-			], context);
-			expect(results.length === 3, `expected 3 results, got ${results.length}`);
-			const [first, second, third] = results;
-			expect(first?.ok === true && Array.isArray(first.data.rows), "the first operation must return rows");
-			expect(second?.ok === true && typeof second.data.count === "number", "the second operation must return a count");
-			expect(third?.ok === false, "a failing operation must fail on its own, as a result");
-		}],
-		create && ["round-trips a write", async () => {
-			const repository = betterSupabase.connect(executor)[table];
-			const created = await repository["create"](create);
-			expect(created.ok, `create failed: ${JSON.stringify(created.error)}`);
-			const row = created.data;
-			for (const [key, value] of Object.entries(create)) expect(same(row[key], value), `created row has ${key} = ${JSON.stringify(row[key])}`);
-			const [primary] = betterSupabase.meta.tables[table].primaryKey;
-			expect(primary, "write checks need a table with a primary key");
-			const removed = await repository["delete"](row[primary]);
-			expect(removed.ok, `delete failed: ${JSON.stringify(removed.error)}`);
-			const again = await repository["findFirst"]({ where: { [primary]: row[primary] } });
-			expect(again.ok && again.data === null, "the deleted row is still readable");
-		}],
-		create && ["refuses a write past maxAffected and writes nothing", async () => {
-			const repository = betterSupabase.connect(executor)[table];
-			const [primary] = betterSupabase.meta.tables[table].primaryKey;
-			expect(primary, "write checks need a table with a primary key");
-			const created = await repository["create"](create);
-			expect(created.ok, `create failed: ${JSON.stringify(created.error)}`);
-			const id = created.data[primary];
-			try {
-				const refused = await repository["deleteMany"]({
-					where: { [primary]: id },
-					maxAffected: 0
-				});
-				expect(!refused.ok, "deleteMany past maxAffected must fail");
-				const kind = refused.error?.kind;
-				expect(kind === "max_affected", `expected kind "max_affected", got "${String(kind)}"`);
-				const kept = await repository["findFirst"]({ where: { [primary]: id } });
-				expect(kept.ok && kept.data !== null, "a refused deleteMany must not delete the row");
-				const allowed = await repository["deleteMany"]({
-					where: { [primary]: id },
-					maxAffected: 1
-				});
-				expect(allowed.ok, `deleteMany within maxAffected failed: ${JSON.stringify(allowed.error)}`);
-			} finally {
-				await repository["delete"](id);
+async function expectTenantIsolation(betterSupabase, options) {
+	const stack = options.stack ?? {};
+	const bare = new BetterSupabase(betterSupabase.schema);
+	const url = stack.url ?? env(ENV_VARIABLES.url) ?? "http://127.0.0.1:54321";
+	const secretKey = stack.secretKey ?? env(ENV_VARIABLES.secretKey);
+	if (!secretKey) throw new TypeError("expectTenantIsolation needs stack.secretKey or $SUPABASE_SECRET_KEY to seed rows.");
+	const admin = bare.connect(createClient(url, secretKey, { auth: {
+		persistSession: false,
+		autoRefreshToken: false
+	} }));
+	await options.seed?.();
+	const tenants = options.tenants;
+	const users = await Promise.all(tenants.map(async (tenant) => (await asUser(bare, tenant.claims, stack)).db));
+	const label = (tenant) => tenant.name ?? tenant.id;
+	const cleanup = [];
+	const reads = [];
+	const deletes = [];
+	try {
+		for (const [key, spec] of Object.entries(options.tables)) {
+			const table = bare.meta.tables[key];
+			if (!table || table.primaryKey.length === 0) throw new TypeError(`expectTenantIsolation: "${key}" is not a table with a primary key`);
+			const seeded = [];
+			for (const tenant of tenants) {
+				const [row] = await rowsOf(admin[key].create(spec.row(tenant, 0)));
+				const where = keyOf(table, row);
+				cleanup.push(() => admin[key].deleteMany({ where }));
+				seeded.push(row);
 			}
-		}]
-	]);
-}
-/**
-* Proves a `CacheAdapter` accepts table and row targets, repeated and
-* concurrent calls, and never mutates its input.
-*/
-function testCacheAdapter(adapter, options = {}) {
-	const table = options.table ?? "customers";
-	const invalidate = (target) => Promise.resolve(adapter.invalidate(deepFreeze(target)));
-	return conform(`CacheAdapter "${adapter.name}"`, [
-		hasName(adapter),
-		["invalidates a table", () => invalidate({
-			table,
-			tables: [table],
-			ids: []
-		})],
-		["invalidates rows of a tenant", () => invalidate({
-			table,
-			tables: [table],
-			ids: ["1", "a,b"],
-			tenant: "organization_1"
-		})],
-		["accepts repeated and concurrent calls", async () => {
-			await invalidate({
-				table,
-				tables: [table],
-				ids: ["1"]
-			});
-			await Promise.all(Array.from({ length: 10 }, (_, index) => invalidate({
-				table,
-				tables: [table],
-				ids: [String(index)]
-			})));
-		}],
-		["accepts tables it has never seen", () => invalidate({
-			table: "__better_supabase_unknown__",
-			tables: ["__better_supabase_unknown__"],
-			ids: []
-		})],
-		["invalidates tables reached through foreign keys", () => invalidate({
-			table,
-			tables: [table, `${table}_children`],
-			ids: ["1"]
-		})]
-	]);
-}
-/** Proves an `EventSink` accepts empty and full batches without mutating them, and delivers them when readable. */
-function testEventSink(sink, options = {}) {
-	const events = toCloudEvents({
-		table: "customers",
-		kind: "insert",
-		rows: [{
-			id: "1",
-			name: "Acme"
-		}, {
-			id: "2",
-			name: "Globex"
-		}],
-		context: { tenant: "organization_1" }
-	}, { source: "/better-supabase/conformance" });
-	return conform("EventSink", [
-		["accepts an empty batch", () => sink.send(deepFreeze([]))],
-		["accepts a batch without mutating it", () => sink.send(frozenCopy(events))],
-		options.received && ["delivers every event", async () => {
-			const ids = new Set((await options.received()).map((event) => event.id));
-			const missing = events.filter((event) => !ids.has(event.id));
-			expect(missing.length === 0, `${missing.length} of ${events.length} events were not delivered`);
-		}]
-	]);
-}
-function claimedJob(queue, row) {
-	const instant = temporal().Instant.fromEpochMilliseconds(0);
-	return {
-		id: Number(row.id),
-		queue,
-		payload: row.message?.payload,
-		attempts: row.attempts,
-		maxAttempts: row.message?.max_attempts ?? 5,
-		enqueuedAt: instant,
-		visibleUntil: instant,
-		lastError: row.message?.last_error ?? null,
-		context: {}
-	};
-}
-/**
-* Proves a `QueueBackend` round-trips payloads, hides claimed messages for
-* their lease, counts attempts, retries and dead-letters on `fail`, and
-* (when it has `leases`) rejects a stale attempt and extends a lease. It
-* writes to `options.queue` on the backend's real store.
-*/
-function testQueueBackend(backend, options) {
-	const { queue } = options;
-	const claimOne = async () => {
-		const [row] = await backend.read(queue, 30, 1);
-		return row && claimedJob(queue, row);
-	};
-	return conform(`QueueBackend "${backend.name}"`, [
-		hasName(backend),
-		["has apiVersion 1", () => {
-			const version = backend.apiVersion;
-			expect(version === 1, "apiVersion must be 1");
-		}],
-		["round-trips a payload and leases it", async () => {
-			const id = await backend.send(queue, { n: 1 }, 0, 3, void 0);
-			expect(Number.isFinite(id), "send must return a numeric id");
-			const job = await claimOne();
-			expect(job?.id === id, "read must return the sent message");
-			expect(same(job.payload, { n: 1 }), "the payload must round-trip");
-			expect(job.attempts === 1, "the first claim must be attempt 1");
-			expect(job.maxAttempts === 3, "max_attempts must round-trip");
-			expect(await claimOne() === void 0, "a leased message must stay hidden from other reads");
-			expect(await backend.complete(job), "complete must return true");
-		}],
-		backend.leases && ["rejects a stale attempt and extends a lease", async () => {
-			await backend.send(queue, { n: 2 }, 0, 3, void 0);
-			const job = await claimOne();
-			expect(job, "read must return the sent message");
-			expect(!await backend.complete({
-				...job,
-				attempts: job.attempts + 1
-			}), "complete with another attempt must return false");
-			expect(await backend.extend(job, 60), "extend must return true");
-			expect(await backend.complete(job), "complete must return true");
-		}],
-		["retries, then dead-letters at max attempts", async () => {
-			await backend.send(queue, { n: 3 }, 0, 2, void 0);
-			const first = await claimOne();
-			expect(first, "read must return the sent message");
-			expect(await backend.fail(first, "boom", 0) === "queued", "fail before max_attempts must return queued");
-			const second = await claimOne();
-			expect(second?.attempts === 2, "a retried message must be attempt 2");
-			expect(await backend.fail(second, "boom", 0) === "dead", "fail at max_attempts must return dead");
-			expect(await claimOne() === void 0, "a dead message must not be claimed again");
-		}],
-		backend.stats && backend.listDead && ["counts and lists dead letters", async () => {
-			expect(((await backend.stats?.(queue))?.dead ?? 0) >= 1, "stats must count the dead letter");
-			const [dead] = await backend.listDead?.(queue, 10, void 0) ?? [];
-			expect(dead, "listDead must return the dead letter");
-			expect(same(dead.message?.payload, { n: 3 }), "listDead must return the newest dead letter first");
-			if (backend.retryDead) {
-				expect(await backend.retryDead(queue, [Number(dead.id)], 10) === 1, "retryDead must enqueue the dead letter again");
-				const job = await claimOne();
-				expect(job, "the retried job must be claimable");
-				expect(same(job.payload, { n: 3 }), "the retried job must keep its payload");
-				await backend.complete(job);
+			for (const [self, other] of [[0, 1], [1, 0]]) {
+				const user = users[self][key];
+				const who = label(tenants[self]);
+				const whose = `${label(tenants[other])}'s`;
+				const own = keyOf(table, seeded[self]);
+				const target = keyOf(table, seeded[other]);
+				const current = async () => (await rowsOf(admin[key].findMany({ where: target })))[0];
+				reads.push([`${key}: ${who} reads its own row`, async () => {
+					expect((await rowsOf(user.findMany({ where: own }))).length === 1, `${who} can't read its own row, so the other checks prove nothing; check its claims and memberships`);
+				}], [`${key}: ${who} can't select ${whose} rows`, async () => {
+					expect((await rowsOf(user.findMany({ where: target }))).length === 0, `select returned ${whose} row`);
+				}], [`${key}: ${who} can't insert ${whose} rows`, async () => {
+					const row = spec.row(tenants[other], 1);
+					const result = await user.create(row, { returning: false });
+					if (result.ok) {
+						const where = Object.fromEntries(Object.entries(row).filter(([, value]) => scalar(value)));
+						cleanup.push(() => admin[key].deleteMany({ where }));
+					}
+					expect(!result.ok, `insert of a row for ${whose} tenant succeeded`);
+					expect(result.error.kind === "forbidden", `insert failed with ${result.error.kind} (${result.error.message}), not an RLS error; check the row factory`);
+				}], [`${key}: ${who} can't update ${whose} rows`, async () => {
+					const before = await current();
+					const patch = spec.update;
+					expect(Object.entries(patch).some(([column, value]) => before?.[column] !== value), "update must change the row to detect a leak");
+					await user.updateMany({
+						where: target,
+						data: patch,
+						returning: false
+					});
+					const after = await current();
+					expect(Object.entries(patch).every(([column]) => after?.[column] === before?.[column]), `update changed ${whose} row`);
+				}]);
+				deletes.push([`${key}: ${who} can't delete ${whose} rows`, async () => {
+					await user.deleteMany({ where: target });
+					expect(await current() !== void 0, `delete removed ${whose} row`);
+				}]);
 			}
-		}],
-		(options.dedupe ?? backend.leases) && ["returns the first id for a repeated dedupe key", async () => {
-			expect(await backend.send(queue, { n: 4 }, 0, 3, "same") === await backend.send(queue, { n: 4 }, 0, 3, "same"), "a waiting dedupe key must return its id");
-			const job = await claimOne();
-			expect(job, "read must return the sent message");
-			await backend.complete(job);
-		}]
-	]);
+		}
+		return await conform("Tenant isolation", [...reads, ...deletes]);
+	} finally {
+		for (const remove of cleanup.reverse()) await remove();
+	}
 }
+//#endregion
+//#region src/testing/claims-fixtures.ts
+const base = {
+	sub: "6f1c2c1e-5d0a-4d9e-9a51-6b1f0e7c2a10",
+	aud: "authenticated",
+	role: "authenticated",
+	iss: "https://project.supabase.co/auth/v1",
+	aal: "aal1",
+	session_id: "b7a8f9c0-1111-4222-8333-944455556666",
+	is_anonymous: false
+};
+const admin = "9a8b7c6d-5e4f-4a3b-8c2d-1e0f9a8b7c6d";
+const supportSessionId = "4e5f6a7b-8c9d-4e0f-9a1b-2c3d4e5f6a7b";
+const client = "5f0e4d3c-2b1a-4098-8776-655443322110";
+const chain = {
+	sub: "agent-runner",
+	act: { sub: "mcp-client-42" }
+};
 /**
-* Proves a `SupportSessionStore` starts sessions with the input it was
-* given, shows a running session only to its admin, ends the admin's
-* previous session on start, ends a session once, and lists sessions.
-* It writes sessions to the store; they are all ended when it returns.
+* `supportSession` and `supportSessionReadOnly` are what `supportClaims`
+* mints (`act.kind: "support"`), `impersonation` what `actingAs` mints
+* (`act.kind: "impersonation"`), `oauthClient` a Supabase OAuth server token
+* and `agentChain` an RFC 8693 chain without `kind`.
 */
-function testSupportSessionStore(store, options) {
-	const { admin } = options;
-	const [first, second] = options.targets;
-	const start = (targetUserId) => store.start({
-		adminId: admin.id,
-		adminClaims: admin.claims,
-		targetUserId,
-		reason: "conformance",
-		ttlSeconds: 600,
-		readOnly: true,
-		metadata: { ticket: "T-1" }
-	});
-	return conform(`SupportSessionStore "${store.name}"`, [
-		hasName(store),
-		["has apiVersion 1", () => {
-			const version = store.apiVersion;
-			expect(version === 1, "apiVersion must be 1");
-		}],
-		["starts a session with its input and shows it to its admin only", async () => {
-			const session = await start(first);
-			try {
-				expect(session.id.length > 0, "start must return an id");
-				expect(session.adminId === admin.id, "adminId must round-trip");
-				expect(session.targetUserId === first, "targetUserId must round-trip");
-				expect(session.reason === "conformance", "reason must round-trip");
-				expect(session.readOnly, "readOnly must round-trip");
-				expect(same(session.metadata, { ticket: "T-1" }), "metadata must round-trip");
-				const seconds = (session.expiresAt.epochMilliseconds - session.startedAt.epochMilliseconds) / 1e3;
-				expect(Math.abs(seconds - 600) < 5, "expiresAt must be ttlSeconds after startedAt");
-				expect((await store.get(session.id, admin.id))?.id === session.id, "get must return the running session");
-				expect(await store.get(session.id, first) === void 0, "get must hide a session from anyone but its admin");
-			} finally {
-				await store.end(session.id, "admin");
+const supabaseClaimFixtures = {
+	supportSession: {
+		claims: {
+			...base,
+			act: {
+				kind: "support",
+				sub: admin,
+				reason: "ticket 42",
+				session_id: supportSessionId,
+				read_only: false
 			}
-		}],
-		["ends the admin's previous session on start", async () => {
-			const older = await start(first);
-			const newer = await start(second);
-			try {
-				expect(await store.get(older.id, admin.id) === void 0, "starting a session must end the admin's previous one");
-				expect((await store.get(newer.id, admin.id))?.id === newer.id, "the new session must be running");
-			} finally {
-				await store.end(newer.id, "admin");
+		},
+		expect: {
+			actor: {
+				kind: "support",
+				id: admin,
+				sessionId: supportSessionId,
+				readOnly: false,
+				reason: "ticket 42"
+			},
+			impersonator: {
+				kind: "support",
+				id: admin,
+				sessionId: supportSessionId,
+				readOnly: false,
+				reason: "ticket 42"
 			}
-		}],
-		["ends a session once and lists it", async () => {
-			const session = await start(first);
-			expect(await store.end(session.id, "admin"), "end must return true");
-			expect(!await store.end(session.id, "admin"), "ending an ended session must return false");
-			expect(await store.get(session.id, admin.id) === void 0, "get must not return an ended session");
-			const entry = (await store.list({
-				adminId: admin.id,
-				active: false
-			})).find((item) => item.id === session.id);
-			expect(entry, "list must include the ended session");
-			expect(entry.endedAt !== void 0, "an ended session has endedAt");
-			expect((await store.list({
-				adminId: admin.id,
-				active: true
-			})).every((item) => item.id !== session.id), "list({ active: true }) must leave out ended sessions");
-		}]
-	]);
+		}
+	},
+	supportSessionReadOnly: {
+		claims: {
+			...base,
+			act: {
+				kind: "support",
+				sub: admin,
+				reason: "ticket 42",
+				session_id: supportSessionId,
+				read_only: true
+			}
+		},
+		expect: {
+			actor: {
+				kind: "support",
+				id: admin,
+				sessionId: supportSessionId,
+				readOnly: true,
+				reason: "ticket 42"
+			},
+			impersonator: {
+				kind: "support",
+				id: admin,
+				sessionId: supportSessionId,
+				readOnly: true,
+				reason: "ticket 42"
+			}
+		}
+	},
+	impersonation: {
+		claims: {
+			...base,
+			act: {
+				kind: "impersonation",
+				sub: admin,
+				reason: "ticket 42"
+			}
+		},
+		expect: {
+			actor: {
+				kind: "impersonation",
+				id: admin,
+				reason: "ticket 42"
+			},
+			impersonator: {
+				kind: "impersonation",
+				id: admin,
+				reason: "ticket 42"
+			}
+		}
+	},
+	oauthClient: {
+		claims: {
+			...base,
+			client_id: client,
+			scope: "openid email posts:read"
+		},
+		expect: {
+			actor: {
+				kind: "oauth-client",
+				id: client
+			},
+			delegation: { scopes: [
+				"openid",
+				"email",
+				"posts:read"
+			] }
+		}
+	},
+	agentChain: {
+		claims: {
+			...base,
+			scope: "posts:read",
+			act: chain
+		},
+		expect: {
+			actor: {
+				kind: "oauth-client",
+				id: "agent-runner",
+				chain
+			},
+			delegation: {
+				scopes: ["posts:read"],
+				chain
+			}
+		}
+	}
+};
+//#endregion
+//#region src/testing/seed.ts
+const SEED = Symbol.for("better-supabase.seed");
+function isSeed(value) {
+	return typeof value === "object" && value !== null && SEED in value;
 }
-async function resolveSafely(resolver, request) {
-	try {
-		return await resolver.resolve(request);
-	} catch (cause) {
-		throw new Violation(`resolve() threw: ${cause instanceof Error ? cause.message : String(cause)}`);
+const quote = (text) => `'${text.replaceAll("'", "''")}'`;
+function arrayLiteral(values) {
+	return `{${values.map((value) => {
+		if (value === null) return "NULL";
+		if (Array.isArray(value)) return arrayLiteral(value);
+		return `"${(temporalText(value) ?? String(value)).replaceAll(/[\\"]/g, "\\$&")}"`;
+	}).join(",")}}`;
+}
+function literal(value, column, where) {
+	if (value === null) return "null";
+	if (column.json) return quote(JSON.stringify(value));
+	if (Array.isArray(value)) return quote(arrayLiteral(value));
+	const temporalValue = temporalText(value);
+	if (temporalValue !== void 0) return quote(temporalValue);
+	const kind = typeof value;
+	switch (kind) {
+		case "string": return quote(value);
+		case "boolean":
+		case "bigint": return String(value);
+		case "number":
+			if (!Number.isFinite(value)) throw new TypeError(`${where}: ${String(value)} is not a finite number`);
+			return String(value);
+		case "object":
+		case "function":
+		case "symbol":
+		case "undefined": throw new TypeError(`${where}: unsupported value of type ${kind}`);
+		default: throw new TypeError(`${where}: unsupported value of type ${String(kind)}`);
 	}
 }
-/**
-* Proves an `AuthResolver` passes on requests it doesn't understand, fails
-* closed (`invalid`, never anon) on bad credentials, and never throws.
-*/
-function testAuthResolver(resolver, options) {
-	return conform(`AuthResolver "${resolver.name}"`, [
-		hasName(resolver),
-		["passes on requests without its credentials", async () => {
-			const state = await resolveSafely(resolver, options.unrelated ?? new Request("https://example.com/"));
-			expect(state === void 0, `expected undefined, got kind "${state?.kind}"`);
-		}],
-		["fails closed on invalid credentials", async () => {
-			expect(options.invalid.length > 0, "pass at least one invalid request");
-			for (const request of options.invalid) {
-				const state = await resolveSafely(resolver, request);
-				expect(state?.kind === "invalid", `expected kind "invalid", got "${state?.kind ?? "undefined"}"`);
-				expect(typeof state.error.kind === "string", "invalid states carry a DbError");
-			}
-		}],
-		options.valid && ["resolves valid credentials", async () => {
-			for (const { request, userId } of options.valid) {
-				const state = await resolveSafely(resolver, request);
-				expect(state?.kind === "user" || state?.kind === "service", `expected a user or service, got "${state?.kind}"`);
-				if (userId !== void 0) expect(state.kind === "user" && state.user.id === userId, `expected user ${userId}`);
-			}
-		}]
-	]);
+const ident = (name) => `"${name.replaceAll("\"", "\"\"")}"`;
+/** Parents first (by forward relations), otherwise in the order given. */
+function order(meta, keys) {
+	const sorted = [];
+	const visiting = /* @__PURE__ */ new Set();
+	const visit = (key) => {
+		if (sorted.includes(key) || visiting.has(key)) return;
+		visiting.add(key);
+		for (const relation of Object.values(meta.tables[key]?.relations ?? {})) if (relation.direction === "forward" && relation.table !== key && keys.includes(relation.table)) visit(relation.table);
+		visiting.delete(key);
+		sorted.push(key);
+	};
+	for (const key of keys) visit(key);
+	return sorted;
+}
+function statement(table, rows) {
+	const entries = Object.entries(rows);
+	if (entries.length === 0) return void 0;
+	const columns = [];
+	for (const [, row] of entries) for (const [key, value] of Object.entries(row)) {
+		if (value === void 0 || columns.includes(key)) continue;
+		const column = table.columns[key];
+		if (!column) throw new TypeError(`seed ${table.key}: unknown column "${key}"`);
+		if (column.generated) throw new TypeError(`seed ${table.key}: "${key}" is a generated column`);
+		columns.push(key);
+	}
+	const values = entries.map(([name, row]) => {
+		return `  (${columns.map((key) => row[key] === void 0 ? "default" : literal(row[key], table.columns[key], `seed ${table.key}.${name}.${key}`)).join(", ")})`;
+	});
+	return `insert into ${`${ident(table.schema)}.${ident(table.name)}`} (${columns.map((key) => ident(table.columns[key].db)).join(", ")}) values\n${values.join(",\n")}\non conflict do nothing;`;
 }
 /**
-* Proves a `Plugin` targets API v1, installs cleanly on its own and next to
-* the first-party plugins in either order, adds repository methods without
-* replacing base ones, keeps `context`, `transformQuery` and
-* `beforeMutation` pure and deterministic, and keeps executors'
-* results intact when it wraps them.
+* Typed fixtures shared by `supabase/seeds` and your tests. Rows use app
+* casing and Insert types; `better-supabase seed` renders them to SQL.
+*
+* ```ts
+* export const seed = defineSeed(betterSupabase, {
+*   organizations: { acme: { id: ACME, name: 'Acme' } },
+*   customers: { first: { organizationId: ACME, name: 'First customer' } },
+* });
+* ```
 */
-function testPlugin(plugin, options) {
-	const { betterSupabase } = options;
-	const table = tableKey(betterSupabase, options.table);
-	const context = options.context ?? {};
-	const hook = (op) => ({
-		table: op.table,
-		schema: betterSupabase.meta,
-		context,
-		options: {},
-		now: () => temporal().Instant.fromEpochMilliseconds(0)
-	});
-	const create = options.create;
-	return conform(`Plugin "${plugin.name}"`, [
-		hasName(plugin),
-		["targets plugin API v1", () => {
-			expect(plugin.apiVersion === 1, `apiVersion is ${String(plugin.apiVersion)}`);
-		}],
-		["installs and builds repositories", () => {
-			const db = betterSupabase.use(plugin).connect(recorder([]), context);
-			for (const key of Object.keys(betterSupabase.meta.tables)) expect(db[key], `db.${key} is missing`);
-		}],
-		["declares a known hook order", () => {
-			const enforce = plugin.enforce;
-			expect(enforce === void 0 || enforce === "first" || enforce === "pre" || enforce === "post", `enforce is ${String(enforce)}; use "first", "pre", "post" or leave it out`);
-		}],
-		["installs next to the first-party plugins in either order", () => {
-			const others = [
-				timestamps(),
-				softDelete(),
-				tenant(),
-				actor()
-			].filter((other) => other.name !== plugin.name);
-			let before = betterSupabase;
-			for (const other of others) before = before.use(other);
-			let after = betterSupabase.use(plugin);
-			for (const other of others) after = after.use(other);
-			for (const installed of [before.use(plugin), after]) {
-				const db = installed.connect(recorder([]), context);
-				for (const key of Object.keys(betterSupabase.meta.tables)) expect(db[key], `db.${key} is missing`);
-			}
-		}],
-		plugin.repository && ["repository adds functions and keeps the base methods", () => {
-			const db = betterSupabase.connect(recorder([]), context);
-			for (const [key, table] of Object.entries(betterSupabase.meta.tables)) {
-				const base = db[key];
-				const added = plugin.repository({
-					table,
-					base
-				});
-				if (added === void 0) continue;
-				for (const [name, method] of Object.entries(added)) {
-					expect(typeof method === "function", `${key}.${name} is not a function`);
-					expect(!(name in base), `${key}.${name} replaces a base method`);
-				}
-			}
-		}],
-		plugin.transformQuery && ["transformQuery is pure and deterministic", async () => {
-			const op = await captureOp(betterSupabase, (db) => db[table]["findMany"]({ limit: 1 }));
-			const first = plugin.transformQuery(frozenCopy(op), hook(op));
-			const second = plugin.transformQuery(frozenCopy(op), hook(op));
-			expect(typeof first === "object" && first !== null && first.kind === op.kind, "must return an operation of the same kind");
-			expect(same(first, second), "two calls with the same input differ");
-		}],
-		plugin.beforeMutation && create && ["beforeMutation is pure and deterministic", async () => {
-			const op = await captureOp(betterSupabase, (db) => db[table]["create"](create));
-			if (op.kind === "select") throw new Violation("create did not produce a mutation");
-			const first = await plugin.beforeMutation(frozenCopy(op), hook(op));
-			const second = await plugin.beforeMutation(frozenCopy(op), hook(op));
-			expect(first.kind === op.kind, "must return a mutation of the same kind");
-			expect(same(first, second), "two calls with the same input differ");
-		}],
-		plugin.afterMutation && create && ["afterMutation cannot change the result", async () => {
-			const row = {
-				marker: "conformance",
-				nested: { kept: true }
-			};
-			const result = await betterSupabase.use(plugin).connect({
-				name: "rows",
-				execute: () => Promise.resolve(ok({
-					rows: [structuredClone(row)],
-					count: 1
-				}))
-			}, context)[table]["create"](create);
-			expect(result.ok, "create failed");
-			expect(same(result.data, row), "afterMutation changed the returned row");
-		}],
-		plugin.wrapExecutor && ["wrapExecutor keeps results intact", async () => {
-			const op = await captureOp(betterSupabase, (db) => db[table]["findMany"]({ limit: 1 }));
-			const data = {
-				rows: [{ marker: "conformance" }],
-				count: 1
-			};
-			const wrapped = plugin.wrapExecutor({
-				name: "inner",
-				execute: () => Promise.resolve(ok(data))
-			});
-			expect(typeof wrapped.name === "string", "the wrapped executor needs a name");
-			const result = await wrapped.execute(op, { errorMappers: [] });
-			expect(result.ok && same(result.data, data), "the wrapped executor changed the result");
-		}],
-		plugin.context && ["context is pure and deterministic", () => {
-			const args = { schema: betterSupabase.meta };
-			const first = plugin.context(frozenCopy(context), args);
-			const second = plugin.context(frozenCopy(context), args);
-			expect(typeof first === "object" && first !== null, "must return a context object");
-			expect(same(first, second), "two calls with the same input differ");
-		}],
-		plugin.mapError && ["mapError returns a DbError or undefined", () => {
-			const fallback = dbError("unexpected", "internal error");
-			const mapped = plugin.mapError({
-				code: "XX000",
-				message: "internal error"
-			}, fallback);
-			expect(mapped === void 0 || typeof mapped === "object" && typeof mapped.kind === "string", "must return a DbError or undefined");
-		}]
-	]);
+function defineSeed(betterSupabase, fixtures) {
+	const meta = betterSupabase.meta;
+	const statements = () => {
+		const keys = Object.keys(fixtures).filter((key) => fixtures[key] !== void 0);
+		for (const key of keys) {
+			const table = meta.tables[key];
+			if (!table) throw new TypeError(`seed: unknown table "${key}"`);
+			if (table.kind === "view") throw new TypeError(`seed: "${key}" is a view`);
+		}
+		return order(meta, keys).flatMap((key) => {
+			const sql = statement(meta.tables[key], fixtures[key]);
+			return sql ? [sql] : [];
+		});
+	};
+	return {
+		[SEED]: true,
+		rows: fixtures,
+		statements,
+		sql: () => statements().join("\n\n"),
+		async insert(sql) {
+			for (const text of statements()) await sql.queryRaw(text);
+		}
+	};
 }
 //#endregion
-//#region src/testing/isolation.ts
-const scalar = (value) => typeof value === "string" || typeof value === "number" || typeof value === "boolean";
-function keyOf(table, row) {
-	return Object.fromEntries(table.primaryKey.map((column) => [column, row[column]]));
-}
-async function rowsOf(outcome) {
-	const result = await outcome;
-	if (!result.ok) throw new Error(result.error.message);
-	return Array.isArray(result.data) ? result.data : [result.data];
-}
-function env(names) {
-	if (typeof process === "undefined") return void 0;
-	for (const name of names) {
-		const value = process.env[name];
-		if (value) return value;
+//#region src/testing/kits/executor.ts
+const recorder = (ops) => ({
+	name: "recorder",
+	execute: (op) => {
+		ops.push(op);
+		return Promise.resolve(ok({
+			rows: [],
+			count: 0
+		}));
 	}
+});
+/** The operation `run` sends to the executor, built by `betterSupabase` without touching a database. */
+async function captureOp(betterSupabase, run) {
+	const ops = [];
+	await run(betterSupabase.connect(recorder(ops)));
+	const [op] = ops;
+	if (!op) throw new Error("the repository call did not reach the executor");
+	return op;
 }
+function tableKey(betterSupabase, table) {
+	const key = table ?? Object.keys(betterSupabase.meta.tables)[0];
+	if (!key || !(key in betterSupabase.meta.tables)) throw new TypeError(`better-supabase: unknown table "${String(key)}"`);
+	return key;
+}
+const hasName = (subject) => ["has a name", () => {
+	expect(typeof subject.name === "string" && subject.name.length > 0, "name must be a non-empty string");
+}];
 /**
-* Checks row-level security between two tenants against a running stack: for
-* each table, a user of one tenant must not select, insert, update or delete
-* the other tenant's rows. Runs without `betterSupabase`'s plugins, so the `tenant()`
-* plugin can't hide a missing policy. Throws a `ConformanceError` naming each
-* table and command that leaks; removes every row it created.
+* Proves an `Executor` meets the contract: rows keyed by the selection's
+* aliases, counts, `aborted` errors, failures returned as `Result`s rather
+* than thrown, and (with `create`) a write round trip and a `deleteMany`
+* that `maxAffected` refuses without deleting anything.
 *
 * ```ts
-* await expectTenantIsolation(betterSupabase, {
-*   tenants: [
-*     { id: ACME, claims: { sub: alice, tenant_id: ACME } },
-*     { id: GLOBEX, claims: { sub: bob, tenant_id: GLOBEX } },
-*   ],
-*   tables: {
-*     tags: {
-*       row: (tenant, n) => ({ organizationId: tenant.id, name: `iso-${n}` }),
-*       update: { name: 'changed' },
-*     },
-*   },
-* });
+* it('conforms', () => testExecutor(myExecutor, { betterSupabase, table: 'tags', create: { name: 'x' } }));
 * ```
 */
-async function expectTenantIsolation(betterSupabase, options) {
-	const stack = options.stack ?? {};
-	const bare = new BetterSupabase(betterSupabase.schema);
-	const url = stack.url ?? env(ENV_VARIABLES.url) ?? "http://127.0.0.1:54321";
-	const secretKey = stack.secretKey ?? env(ENV_VARIABLES.secretKey);
-	if (!secretKey) throw new TypeError("expectTenantIsolation needs stack.secretKey or $SUPABASE_SECRET_KEY to seed rows.");
-	const admin = bare.connect(createClient(url, secretKey, { auth: {
-		persistSession: false,
-		autoRefreshToken: false
-	} }));
-	await options.seed?.();
-	const tenants = options.tenants;
-	const users = await Promise.all(tenants.map(async (tenant) => (await asUser(bare, tenant.claims, stack)).db));
-	const label = (tenant) => tenant.name ?? tenant.id;
-	const cleanup = [];
-	const reads = [];
-	const deletes = [];
-	try {
-		for (const [key, spec] of Object.entries(options.tables)) {
-			const table = bare.meta.tables[key];
-			if (!table || table.primaryKey.length === 0) throw new TypeError(`expectTenantIsolation: "${key}" is not a table with a primary key`);
-			const seeded = [];
-			for (const tenant of tenants) {
-				const [row] = await rowsOf(admin[key].create(spec.row(tenant, 0)));
-				const where = keyOf(table, row);
-				cleanup.push(() => admin[key].deleteMany({ where }));
-				seeded.push(row);
+function testExecutor(executor, options) {
+	const { betterSupabase } = options;
+	const table = tableKey(betterSupabase, options.table);
+	const context = { errorMappers: [] };
+	const read = () => captureOp(betterSupabase, (db) => db[table]["findMany"]({ limit: 2 }));
+	const create = options.create;
+	return conform(`Executor "${executor.name}"`, [
+		hasName(executor),
+		["reads rows keyed by the selection aliases", async () => {
+			const op = await read();
+			const result = await executor.execute(op, context);
+			expect(result.ok, `select failed: ${result.ok ? "" : result.error.message}`);
+			expect(isList(result.data.rows), "rows must be an array");
+			expect(result.data.rows.length <= 2, `limit 2 returned ${result.data.rows.length} rows`);
+			expect(result.data.count === null || typeof result.data.count === "number", "count must be a number or null");
+			if (op.kind !== "select") return;
+			const aliases = new Set(op.selection.columns.map((column) => column.alias));
+			for (const row of result.data.rows) {
+				const extra = Object.keys(row).filter((key) => !aliases.has(key));
+				expect(extra.length === 0, `rows must use selection aliases; got ${extra.join(", ")}`);
 			}
-			for (const [self, other] of [[0, 1], [1, 0]]) {
-				const user = users[self][key];
-				const who = label(tenants[self]);
-				const whose = `${label(tenants[other])}'s`;
-				const own = keyOf(table, seeded[self]);
-				const target = keyOf(table, seeded[other]);
-				const current = async () => (await rowsOf(admin[key].findMany({ where: target })))[0];
-				reads.push([`${key}: ${who} reads its own row`, async () => {
-					expect((await rowsOf(user.findMany({ where: own }))).length === 1, `${who} can't read its own row, so the other checks prove nothing; check its claims and memberships`);
-				}], [`${key}: ${who} can't select ${whose} rows`, async () => {
-					expect((await rowsOf(user.findMany({ where: target }))).length === 0, `select returned ${whose} row`);
-				}], [`${key}: ${who} can't insert ${whose} rows`, async () => {
-					const row = spec.row(tenants[other], 1);
-					const result = await user.create(row, { returning: false });
-					if (result.ok) {
-						const where = Object.fromEntries(Object.entries(row).filter(([, value]) => scalar(value)));
-						cleanup.push(() => admin[key].deleteMany({ where }));
-					}
-					expect(!result.ok, `insert of a row for ${whose} tenant succeeded`);
-					expect(result.error.kind === "forbidden", `insert failed with ${result.error.kind} (${result.error.message}), not an RLS error; check the row factory`);
-				}], [`${key}: ${who} can't update ${whose} rows`, async () => {
-					const before = await current();
-					const patch = spec.update;
-					expect(Object.entries(patch).some(([column, value]) => before?.[column] !== value), "update must change the row to detect a leak");
-					await user.updateMany({
-						where: target,
-						data: patch,
-						returning: false
-					});
-					const after = await current();
-					expect(Object.entries(patch).every(([column]) => after?.[column] === before?.[column]), `update changed ${whose} row`);
-				}]);
-				deletes.push([`${key}: ${who} can't delete ${whose} rows`, async () => {
-					await user.deleteMany({ where: target });
-					expect(await current() !== void 0, `delete removed ${whose} row`);
-				}]);
+		}],
+		["counts rows", async () => {
+			const op = await captureOp(betterSupabase, (db) => db[table]["count"]());
+			const result = await executor.execute(op, context);
+			expect(result.ok, `count failed: ${result.ok ? "" : result.error.message}`);
+			expect(typeof result.data.count === "number" && result.data.count >= 0, "count must be a number");
+		}],
+		["returns an aborted error for an aborted signal", async () => {
+			const controller = new AbortController();
+			controller.abort();
+			const result = await executor.execute(await read(), {
+				...context,
+				signal: controller.signal
+			});
+			expect(!result.ok, "an aborted request must fail");
+			expect(result.error.kind === "aborted", `expected kind "aborted", got "${result.error.kind}"`);
+		}],
+		["returns failures as results instead of throwing", async () => {
+			const op = await read();
+			const missing = {
+				...op,
+				table: {
+					...op.table,
+					name: "__better_supabase_missing__"
+				}
+			};
+			const result = await executor.execute(missing, context);
+			expect(!result.ok, "a missing table must fail");
+			expect(typeof result.error.kind === "string" && typeof result.error.message === "string", "errors must be DbErrors");
+		}],
+		executor.rpc && ["returns rpc failures as results", async () => {
+			expect(!(await executor.rpc("__better_supabase_missing__", {}, {
+				...context,
+				schema: "public"
+			})).ok, "calling a missing function must fail");
+		}],
+		executor.functionSources && ["reads from SelectOp.source instead of the table", async () => {
+			const op = await read();
+			if (op.kind !== "select") return;
+			expect(!(await executor.execute({
+				...op,
+				source: {
+					schema: op.table.schema,
+					name: "__better_supabase_missing__",
+					args: {}
+				}
+			}, context)).ok, "a missing source function must fail; reading the table ignores source");
+		}],
+		executor.batch && ["batch returns one result per operation, in order", async () => {
+			const rows = await read();
+			const count = await captureOp(betterSupabase, (db) => db[table]["count"]());
+			const missing = {
+				...rows,
+				table: {
+					...rows.table,
+					name: "__better_supabase_missing__"
+				}
+			};
+			const results = await executor.batch([
+				rows,
+				count,
+				missing
+			], context);
+			expect(results.length === 3, `expected 3 results, got ${results.length}`);
+			const [first, second, third] = results;
+			expect(first?.ok === true && Array.isArray(first.data.rows), "the first operation must return rows");
+			expect(second?.ok === true && typeof second.data.count === "number", "the second operation must return a count");
+			expect(third?.ok === false, "a failing operation must fail on its own, as a result");
+		}],
+		create && ["round-trips a write", async () => {
+			const repository = betterSupabase.connect(executor)[table];
+			const created = await repository["create"](create);
+			expect(created.ok, `create failed: ${JSON.stringify(created.error)}`);
+			const row = created.data;
+			for (const [key, value] of Object.entries(create)) expect(same(row[key], value), `created row has ${key} = ${JSON.stringify(row[key])}`);
+			const [primary] = betterSupabase.meta.tables[table].primaryKey;
+			expect(primary, "write checks need a table with a primary key");
+			const removed = await repository["delete"](row[primary]);
+			expect(removed.ok, `delete failed: ${JSON.stringify(removed.error)}`);
+			const again = await repository["findFirst"]({ where: { [primary]: row[primary] } });
+			expect(again.ok && again.data === null, "the deleted row is still readable");
+		}],
+		create && ["refuses a write past maxAffected and writes nothing", async () => {
+			const repository = betterSupabase.connect(executor)[table];
+			const [primary] = betterSupabase.meta.tables[table].primaryKey;
+			expect(primary, "write checks need a table with a primary key");
+			const created = await repository["create"](create);
+			expect(created.ok, `create failed: ${JSON.stringify(created.error)}`);
+			const id = created.data[primary];
+			try {
+				const refused = await repository["deleteMany"]({
+					where: { [primary]: id },
+					maxAffected: 0
+				});
+				expect(!refused.ok, "deleteMany past maxAffected must fail");
+				const kind = refused.error?.kind;
+				expect(kind === "max_affected", `expected kind "max_affected", got "${String(kind)}"`);
+				const kept = await repository["findFirst"]({ where: { [primary]: id } });
+				expect(kept.ok && kept.data !== null, "a refused deleteMany must not delete the row");
+				const allowed = await repository["deleteMany"]({
+					where: { [primary]: id },
+					maxAffected: 1
+				});
+				expect(allowed.ok, `deleteMany within maxAffected failed: ${JSON.stringify(allowed.error)}`);
+			} finally {
+				await repository["delete"](id);
 			}
-		}
-		return await conform("Tenant isolation", [...reads, ...deletes]);
-	} finally {
-		for (const remove of cleanup.reverse()) await remove();
-	}
+		}]
+	]);
 }
 //#endregion
-//#region src/testing/claims-fixtures.ts
-const base = {
-	sub: "6f1c2c1e-5d0a-4d9e-9a51-6b1f0e7c2a10",
-	aud: "authenticated",
-	role: "authenticated",
-	iss: "https://project.supabase.co/auth/v1",
-	aal: "aal1",
-	session_id: "b7a8f9c0-1111-4222-8333-944455556666",
-	is_anonymous: false
-};
-const admin = "9a8b7c6d-5e4f-4a3b-8c2d-1e0f9a8b7c6d";
-const supportSessionId = "4e5f6a7b-8c9d-4e0f-9a1b-2c3d4e5f6a7b";
-const client = "5f0e4d3c-2b1a-4098-8776-655443322110";
-const chain = {
-	sub: "agent-runner",
-	act: { sub: "mcp-client-42" }
-};
+//#region src/testing/kits/auth-resolver.ts
+async function resolveSafely(resolver, request) {
+	try {
+		return await resolver.resolve(request);
+	} catch (cause) {
+		throw new Violation(`resolve() threw: ${cause instanceof Error ? cause.message : String(cause)}`);
+	}
+}
 /**
-* `supportSession` and `supportSessionReadOnly` are what `supportClaims`
-* mints (`act.kind: "support"`), `impersonation` what `actingAs` mints
-* (`act.kind: "impersonation"`), `oauthClient` a Supabase OAuth server token
-* and `agentChain` an RFC 8693 chain without `kind`.
+* Proves an `AuthResolver` passes on requests it doesn't understand, fails
+* closed (`invalid`, never anon) on bad credentials, and never throws.
 */
-const supabaseClaimFixtures = {
-	supportSession: {
-		claims: {
-			...base,
-			act: {
-				kind: "support",
-				sub: admin,
-				reason: "ticket 42",
-				session_id: supportSessionId,
-				read_only: false
-			}
-		},
-		expect: {
-			actor: {
-				kind: "support",
-				id: admin,
-				sessionId: supportSessionId,
-				readOnly: false,
-				reason: "ticket 42"
-			},
-			impersonator: {
-				kind: "support",
-				id: admin,
-				sessionId: supportSessionId,
-				readOnly: false,
-				reason: "ticket 42"
-			}
-		}
-	},
-	supportSessionReadOnly: {
-		claims: {
-			...base,
-			act: {
-				kind: "support",
-				sub: admin,
-				reason: "ticket 42",
-				session_id: supportSessionId,
-				read_only: true
-			}
-		},
-		expect: {
-			actor: {
-				kind: "support",
-				id: admin,
-				sessionId: supportSessionId,
-				readOnly: true,
-				reason: "ticket 42"
-			},
-			impersonator: {
-				kind: "support",
-				id: admin,
-				sessionId: supportSessionId,
-				readOnly: true,
-				reason: "ticket 42"
-			}
-		}
-	},
-	impersonation: {
-		claims: {
-			...base,
-			act: {
-				kind: "impersonation",
-				sub: admin,
-				reason: "ticket 42"
+function testAuthResolver(resolver, options) {
+	return conform(`AuthResolver "${resolver.name}"`, [
+		hasName(resolver),
+		["passes on requests without its credentials", async () => {
+			const state = await resolveSafely(resolver, options.unrelated ?? new Request("https://example.com/"));
+			expect(state === void 0, `expected undefined, got kind "${state?.kind}"`);
+		}],
+		["fails closed on invalid credentials", async () => {
+			expect(options.invalid.length > 0, "pass at least one invalid request");
+			for (const request of options.invalid) {
+				const state = await resolveSafely(resolver, request);
+				expect(state?.kind === "invalid", `expected kind "invalid", got "${state?.kind ?? "undefined"}"`);
+				expect(typeof state.error.kind === "string", "invalid states carry a DbError");
 			}
-		},
-		expect: {
-			actor: {
-				kind: "impersonation",
-				id: admin,
-				reason: "ticket 42"
-			},
-			impersonator: {
-				kind: "impersonation",
-				id: admin,
-				reason: "ticket 42"
+		}],
+		options.valid && ["resolves valid credentials", async () => {
+			for (const { request, userId } of options.valid) {
+				const state = await resolveSafely(resolver, request);
+				expect(state?.kind === "user" || state?.kind === "service", `expected a user or service, got "${state?.kind}"`);
+				if (userId !== void 0) expect(state.kind === "user" && state.user.id === userId, `expected user ${userId}`);
 			}
-		}
-	},
-	oauthClient: {
-		claims: {
-			...base,
-			client_id: client,
-			scope: "openid email posts:read"
-		},
-		expect: {
-			actor: {
-				kind: "oauth-client",
-				id: client
-			},
-			delegation: { scopes: [
-				"openid",
-				"email",
-				"posts:read"
-			] }
-		}
-	},
-	agentChain: {
-		claims: {
-			...base,
-			scope: "posts:read",
-			act: chain
-		},
-		expect: {
-			actor: {
-				kind: "oauth-client",
-				id: "agent-runner",
-				chain
-			},
-			delegation: {
-				scopes: ["posts:read"],
-				chain
-			}
-		}
-	}
-};
-//#endregion
-//#region src/testing/seed.ts
-const SEED = Symbol.for("better-supabase.seed");
-function isSeed(value) {
-	return typeof value === "object" && value !== null && SEED in value;
-}
-const quote = (text) => `'${text.replaceAll("'", "''")}'`;
-function arrayLiteral(values) {
-	return `{${values.map((value) => {
-		if (value === null) return "NULL";
-		if (Array.isArray(value)) return arrayLiteral(value);
-		return `"${(temporalText(value) ?? String(value)).replaceAll(/[\\"]/g, "\\$&")}"`;
-	}).join(",")}}`;
+		}]
+	]);
 }
-function literal(value, column, where) {
-	if (value === null) return "null";
-	if (column.json) return quote(JSON.stringify(value));
-	if (Array.isArray(value)) return quote(arrayLiteral(value));
-	const temporalValue = temporalText(value);
-	if (temporalValue !== void 0) return quote(temporalValue);
-	const kind = typeof value;
-	switch (kind) {
-		case "string": return quote(value);
-		case "boolean":
-		case "bigint": return String(value);
-		case "number":
-			if (!Number.isFinite(value)) throw new TypeError(`${where}: ${String(value)} is not a finite number`);
-			return String(value);
-		case "object":
-		case "function":
-		case "symbol":
-		case "undefined": throw new TypeError(`${where}: unsupported value of type ${kind}`);
-		default: throw new TypeError(`${where}: unsupported value of type ${String(kind)}`);
-	}
+//#endregion
+//#region src/testing/kits/cache-adapter.ts
+/**
+* Proves a `CacheAdapter` accepts table and row targets, repeated and
+* concurrent calls, and never mutates its input.
+*/
+function testCacheAdapter(adapter, options = {}) {
+	const table = options.table ?? "customers";
+	const invalidate = (target) => Promise.resolve(adapter.invalidate(deepFreeze(target)));
+	return conform(`CacheAdapter "${adapter.name}"`, [
+		hasName(adapter),
+		["invalidates a table", () => invalidate({
+			table,
+			tables: [table],
+			ids: []
+		})],
+		["invalidates rows of a tenant", () => invalidate({
+			table,
+			tables: [table],
+			ids: ["1", "a,b"],
+			tenant: "organization_1"
+		})],
+		["accepts repeated and concurrent calls", async () => {
+			await invalidate({
+				table,
+				tables: [table],
+				ids: ["1"]
+			});
+			await Promise.all(Array.from({ length: 10 }, (_, index) => invalidate({
+				table,
+				tables: [table],
+				ids: [String(index)]
+			})));
+		}],
+		["accepts tables it has never seen", () => invalidate({
+			table: "__better_supabase_unknown__",
+			tables: ["__better_supabase_unknown__"],
+			ids: []
+		})],
+		["invalidates tables reached through foreign keys", () => invalidate({
+			table,
+			tables: [table, `${table}_children`],
+			ids: ["1"]
+		})]
+	]);
 }
-const ident = (name) => `"${name.replaceAll("\"", "\"\"")}"`;
-/** Parents first (by forward relations), otherwise in the order given. */
-function order(meta, keys) {
-	const sorted = [];
-	const visiting = /* @__PURE__ */ new Set();
-	const visit = (key) => {
-		if (sorted.includes(key) || visiting.has(key)) return;
-		visiting.add(key);
-		for (const relation of Object.values(meta.tables[key]?.relations ?? {})) if (relation.direction === "forward" && relation.table !== key && keys.includes(relation.table)) visit(relation.table);
-		visiting.delete(key);
-		sorted.push(key);
-	};
-	for (const key of keys) visit(key);
-	return sorted;
+//#endregion
+//#region src/testing/kits/event-sink.ts
+/** Proves an `EventSink` accepts empty and full batches without mutating them, and delivers them when readable. */
+function testEventSink(sink, options = {}) {
+	const events = toCloudEvents({
+		table: "customers",
+		kind: "insert",
+		rows: [{
+			id: "1",
+			name: "Acme"
+		}, {
+			id: "2",
+			name: "Globex"
+		}],
+		context: { tenant: "organization_1" }
+	}, { source: "/better-supabase/conformance" });
+	return conform("EventSink", [
+		["accepts an empty batch", () => sink.send(deepFreeze([]))],
+		["accepts a batch without mutating it", () => sink.send(frozenCopy(events))],
+		options.received && ["delivers every event", async () => {
+			const ids = new Set((await options.received()).map((event) => event.id));
+			const missing = events.filter((event) => !ids.has(event.id));
+			expect(missing.length === 0, `${missing.length} of ${events.length} events were not delivered`);
+		}]
+	]);
 }
-function statement(table, rows) {
-	const entries = Object.entries(rows);
-	if (entries.length === 0) return void 0;
-	const columns = [];
-	for (const [, row] of entries) for (const [key, value] of Object.entries(row)) {
-		if (value === void 0 || columns.includes(key)) continue;
-		const column = table.columns[key];
-		if (!column) throw new TypeError(`seed ${table.key}: unknown column "${key}"`);
-		if (column.generated) throw new TypeError(`seed ${table.key}: "${key}" is a generated column`);
-		columns.push(key);
-	}
-	const values = entries.map(([name, row]) => {
-		return `  (${columns.map((key) => row[key] === void 0 ? "default" : literal(row[key], table.columns[key], `seed ${table.key}.${name}.${key}`)).join(", ")})`;
+//#endregion
+//#region src/testing/kits/plugin.ts
+/**
+* Proves a `Plugin` targets API v1, installs cleanly on its own and next to
+* the first-party plugins in either order, adds repository methods without
+* replacing base ones, keeps `context`, `transformQuery` and
+* `beforeMutation` pure and deterministic, and keeps executors'
+* results intact when it wraps them.
+*/
+function testPlugin(plugin, options) {
+	const { betterSupabase } = options;
+	const table = tableKey(betterSupabase, options.table);
+	const context = options.context ?? {};
+	const hook = (op) => ({
+		table: op.table,
+		schema: betterSupabase.meta,
+		context,
+		options: {},
+		now: () => temporal().Instant.fromEpochMilliseconds(0)
 	});
-	return `insert into ${`${ident(table.schema)}.${ident(table.name)}`} (${columns.map((key) => ident(table.columns[key].db)).join(", ")}) values\n${values.join(",\n")}\non conflict do nothing;`;
+	const create = options.create;
+	return conform(`Plugin "${plugin.name}"`, [
+		hasName(plugin),
+		["targets plugin API v1", () => {
+			expect(plugin.apiVersion === 1, `apiVersion is ${String(plugin.apiVersion)}`);
+		}],
+		["installs and builds repositories", () => {
+			const db = betterSupabase.use(plugin).connect(recorder([]), context);
+			for (const key of Object.keys(betterSupabase.meta.tables)) expect(db[key], `db.${key} is missing`);
+		}],
+		["declares a known hook order", () => {
+			const enforce = plugin.enforce;
+			expect(enforce === void 0 || enforce === "first" || enforce === "pre" || enforce === "post", `enforce is ${String(enforce)}; use "first", "pre", "post" or leave it out`);
+		}],
+		["installs next to the first-party plugins in either order", () => {
+			const others = [
+				timestamps(),
+				softDelete(),
+				tenant(),
+				actor()
+			].filter((other) => other.name !== plugin.name);
+			let before = betterSupabase;
+			for (const other of others) before = before.use(other);
+			let after = betterSupabase.use(plugin);
+			for (const other of others) after = after.use(other);
+			for (const installed of [before.use(plugin), after]) {
+				const db = installed.connect(recorder([]), context);
+				for (const key of Object.keys(betterSupabase.meta.tables)) expect(db[key], `db.${key} is missing`);
+			}
+		}],
+		plugin.repository && ["repository adds functions and keeps the base methods", () => {
+			const db = betterSupabase.connect(recorder([]), context);
+			for (const [key, table] of Object.entries(betterSupabase.meta.tables)) {
+				const base = db[key];
+				const added = plugin.repository({
+					table,
+					base
+				});
+				if (added === void 0) continue;
+				for (const [name, method] of Object.entries(added)) {
+					expect(typeof method === "function", `${key}.${name} is not a function`);
+					expect(!(name in base), `${key}.${name} replaces a base method`);
+				}
+			}
+		}],
+		plugin.transformQuery && ["transformQuery is pure and deterministic", async () => {
+			const op = await captureOp(betterSupabase, (db) => db[table]["findMany"]({ limit: 1 }));
+			const first = plugin.transformQuery(frozenCopy(op), hook(op));
+			const second = plugin.transformQuery(frozenCopy(op), hook(op));
+			expect(typeof first === "object" && first !== null && first.kind === op.kind, "must return an operation of the same kind");
+			expect(same(first, second), "two calls with the same input differ");
+		}],
+		plugin.beforeMutation && create && ["beforeMutation is pure and deterministic", async () => {
+			const op = await captureOp(betterSupabase, (db) => db[table]["create"](create));
+			if (op.kind === "select") throw new Violation("create did not produce a mutation");
+			const first = await plugin.beforeMutation(frozenCopy(op), hook(op));
+			const second = await plugin.beforeMutation(frozenCopy(op), hook(op));
+			expect(first.kind === op.kind, "must return a mutation of the same kind");
+			expect(same(first, second), "two calls with the same input differ");
+		}],
+		plugin.afterMutation && create && ["afterMutation cannot change the result", async () => {
+			const row = {
+				marker: "conformance",
+				nested: { kept: true }
+			};
+			const result = await betterSupabase.use(plugin).connect({
+				name: "rows",
+				execute: () => Promise.resolve(ok({
+					rows: [structuredClone(row)],
+					count: 1
+				}))
+			}, context)[table]["create"](create);
+			expect(result.ok, "create failed");
+			expect(same(result.data, row), "afterMutation changed the returned row");
+		}],
+		plugin.wrapExecutor && ["wrapExecutor keeps results intact", async () => {
+			const op = await captureOp(betterSupabase, (db) => db[table]["findMany"]({ limit: 1 }));
+			const data = {
+				rows: [{ marker: "conformance" }],
+				count: 1
+			};
+			const wrapped = plugin.wrapExecutor({
+				name: "inner",
+				execute: () => Promise.resolve(ok(data))
+			});
+			expect(typeof wrapped.name === "string", "the wrapped executor needs a name");
+			const result = await wrapped.execute(op, { errorMappers: [] });
+			expect(result.ok && same(result.data, data), "the wrapped executor changed the result");
+		}],
+		plugin.context && ["context is pure and deterministic", () => {
+			const args = { schema: betterSupabase.meta };
+			const first = plugin.context(frozenCopy(context), args);
+			const second = plugin.context(frozenCopy(context), args);
+			expect(typeof first === "object" && first !== null, "must return a context object");
+			expect(same(first, second), "two calls with the same input differ");
+		}],
+		plugin.mapError && ["mapError returns a DbError or undefined", () => {
+			const fallback = dbError("unexpected", "internal error");
+			const mapped = plugin.mapError({
+				code: "XX000",
+				message: "internal error"
+			}, fallback);
+			expect(mapped === void 0 || typeof mapped === "object" && typeof mapped.kind === "string", "must return a DbError or undefined");
+		}]
+	]);
+}
+//#endregion
+//#region src/testing/kits/queue-backend.ts
+function claimedJob(queue, row) {
+	const instant = temporal().Instant.fromEpochMilliseconds(0);
+	return {
+		id: Number(row.id),
+		queue,
+		payload: row.message?.payload,
+		attempts: row.attempts,
+		maxAttempts: row.message?.max_attempts ?? 5,
+		enqueuedAt: instant,
+		visibleUntil: instant,
+		lastError: row.message?.last_error ?? null,
+		context: {}
+	};
 }
 /**
-* Typed fixtures shared by `supabase/seeds` and your tests. Rows use app
-* casing and Insert types; `better-supabase seed` renders them to SQL.
-*
-* ```ts
-* export const seed = defineSeed(betterSupabase, {
-*   organizations: { acme: { id: ACME, name: 'Acme' } },
-*   customers: { first: { organizationId: ACME, name: 'First customer' } },
-* });
-* ```
+* Proves a `QueueBackend` round-trips payloads, hides claimed messages for
+* their lease, counts attempts, retries and dead-letters on `fail`, and
+* (when it has `leases`) rejects a stale attempt and extends a lease. It
+* writes to `options.queue` on the backend's real store.
 */
-function defineSeed(betterSupabase, fixtures) {
-	const meta = betterSupabase.meta;
-	const statements = () => {
-		const keys = Object.keys(fixtures).filter((key) => fixtures[key] !== void 0);
-		for (const key of keys) {
-			const table = meta.tables[key];
-			if (!table) throw new TypeError(`seed: unknown table "${key}"`);
-			if (table.kind === "view") throw new TypeError(`seed: "${key}" is a view`);
-		}
-		return order(meta, keys).flatMap((key) => {
-			const sql = statement(meta.tables[key], fixtures[key]);
-			return sql ? [sql] : [];
-		});
-	};
-	return {
-		[SEED]: true,
-		rows: fixtures,
-		statements,
-		sql: () => statements().join("\n\n"),
-		async insert(sql) {
-			for (const text of statements()) await sql.queryRaw(text);
-		}
+function testQueueBackend(backend, options) {
+	const { queue } = options;
+	const claimOne = async () => {
+		const [row] = await backend.read(queue, 30, 1);
+		return row && claimedJob(queue, row);
 	};
+	return conform(`QueueBackend "${backend.name}"`, [
+		hasName(backend),
+		["has apiVersion 1", () => {
+			const version = backend.apiVersion;
+			expect(version === 1, "apiVersion must be 1");
+		}],
+		["round-trips a payload and leases it", async () => {
+			const id = await backend.send(queue, { n: 1 }, 0, 3, void 0);
+			expect(Number.isFinite(id), "send must return a numeric id");
+			const job = await claimOne();
+			expect(job?.id === id, "read must return the sent message");
+			expect(same(job.payload, { n: 1 }), "the payload must round-trip");
+			expect(job.attempts === 1, "the first claim must be attempt 1");
+			expect(job.maxAttempts === 3, "max_attempts must round-trip");
+			expect(await claimOne() === void 0, "a leased message must stay hidden from other reads");
+			expect(await backend.complete(job), "complete must return true");
+		}],
+		backend.leases && ["rejects a stale attempt and extends a lease", async () => {
+			await backend.send(queue, { n: 2 }, 0, 3, void 0);
+			const job = await claimOne();
+			expect(job, "read must return the sent message");
+			expect(!await backend.complete({
+				...job,
+				attempts: job.attempts + 1
+			}), "complete with another attempt must return false");
+			expect(await backend.extend(job, 60), "extend must return true");
+			expect(await backend.complete(job), "complete must return true");
+		}],
+		["retries, then dead-letters at max attempts", async () => {
+			await backend.send(queue, { n: 3 }, 0, 2, void 0);
+			const first = await claimOne();
+			expect(first, "read must return the sent message");
+			expect(await backend.fail(first, "boom", 0) === "queued", "fail before max_attempts must return queued");
+			const second = await claimOne();
+			expect(second?.attempts === 2, "a retried message must be attempt 2");
+			expect(await backend.fail(second, "boom", 0) === "dead", "fail at max_attempts must return dead");
+			expect(await claimOne() === void 0, "a dead message must not be claimed again");
+		}],
+		backend.stats && backend.listDead && ["counts and lists dead letters", async () => {
+			expect(((await backend.stats?.(queue))?.dead ?? 0) >= 1, "stats must count the dead letter");
+			const [dead] = await backend.listDead?.(queue, 10, void 0) ?? [];
+			expect(dead, "listDead must return the dead letter");
+			expect(same(dead.message?.payload, { n: 3 }), "listDead must return the newest dead letter first");
+			if (backend.retryDead) {
+				expect(await backend.retryDead(queue, [Number(dead.id)], 10) === 1, "retryDead must enqueue the dead letter again");
+				const job = await claimOne();
+				expect(job, "the retried job must be claimable");
+				expect(same(job.payload, { n: 3 }), "the retried job must keep its payload");
+				await backend.complete(job);
+			}
+		}],
+		(options.dedupe ?? backend.leases) && ["returns the first id for a repeated dedupe key", async () => {
+			expect(await backend.send(queue, { n: 4 }, 0, 3, "same") === await backend.send(queue, { n: 4 }, 0, 3, "same"), "a waiting dedupe key must return its id");
+			const job = await claimOne();
+			expect(job, "read must return the sent message");
+			await backend.complete(job);
+		}]
+	]);
+}
+//#endregion
+//#region src/testing/kits/support-session-store.ts
+/**
+* Proves a `SupportSessionStore` starts sessions with the input it was
+* given, shows a running session only to its admin, ends the admin's
+* previous session on start, ends a session once, lists sessions and, with
+* `expire`, leaves running sessions alone.
+* It writes sessions to the store; they are all ended when it returns.
+*/
+function testSupportSessionStore(store, options) {
+	const { admin } = options;
+	const [first, second] = options.targets;
+	const start = (targetUserId) => store.start({
+		adminId: admin.id,
+		adminClaims: admin.claims,
+		targetUserId,
+		reason: "conformance",
+		ttlSeconds: 600,
+		readOnly: true,
+		metadata: { ticket: "T-1" }
+	});
+	return conform(`SupportSessionStore "${store.name}"`, [
+		hasName(store),
+		["has apiVersion 1", () => {
+			const version = store.apiVersion;
+			expect(version === 1, "apiVersion must be 1");
+		}],
+		["starts a session with its input and shows it to its admin only", async () => {
+			const session = await start(first);
+			try {
+				expect(session.id.length > 0, "start must return an id");
+				expect(session.adminId === admin.id, "adminId must round-trip");
+				expect(session.targetUserId === first, "targetUserId must round-trip");
+				expect(session.reason === "conformance", "reason must round-trip");
+				expect(session.readOnly, "readOnly must round-trip");
+				expect(same(session.metadata, { ticket: "T-1" }), "metadata must round-trip");
+				const seconds = (session.expiresAt.epochMilliseconds - session.startedAt.epochMilliseconds) / 1e3;
+				expect(Math.abs(seconds - 600) < 5, "expiresAt must be ttlSeconds after startedAt");
+				expect((await store.get(session.id, admin.id))?.id === session.id, "get must return the running session");
+				expect(await store.get(session.id, first) === void 0, "get must hide a session from anyone but its admin");
+			} finally {
+				await store.end(session.id, "admin");
+			}
+		}],
+		["ends the admin's previous session on start", async () => {
+			const older = await start(first);
+			const newer = await start(second);
+			try {
+				expect(await store.get(older.id, admin.id) === void 0, "starting a session must end the admin's previous one");
+				expect((await store.get(newer.id, admin.id))?.id === newer.id, "the new session must be running");
+			} finally {
+				await store.end(newer.id, "admin");
+			}
+		}],
+		["ends a session once and lists it", async () => {
+			const session = await start(first);
+			expect(await store.end(session.id, "admin"), "end must return true");
+			expect(!await store.end(session.id, "admin"), "ending an ended session must return false");
+			expect(await store.get(session.id, admin.id) === void 0, "get must not return an ended session");
+			const entry = (await store.list({
+				adminId: admin.id,
+				active: false
+			})).find((item) => item.id === session.id);
+			expect(entry, "list must include the ended session");
+			expect(entry.endedAt !== void 0, "an ended session has endedAt");
+			expect((await store.list({
+				adminId: admin.id,
+				active: true
+			})).every((item) => item.id !== session.id), "list({ active: true }) must leave out ended sessions");
+		}],
+		["expires only sessions past their expiry, when it has expire", async () => {
+			if (!store.expire) return;
+			const session = await start(first);
+			try {
+				const expired = await store.expire();
+				expect(expired.every((item) => item.id !== session.id), "expire must leave a running session alone");
+				expect(expired.every((item) => item.endedBy === "expired"), "expire must end sessions with endedBy expired");
+				expect((await store.get(session.id, admin.id))?.id === session.id, "the running session must still be running after expire");
+			} finally {
+				await store.end(session.id, "admin");
+			}
+		}]
+	]);
 }
 //#endregion
 //#region src/testing/adapter.ts
@@ -1484,13 +1651,13 @@ function testBlockTransportMiddleware(middleware) {
 }
 //#endregion
 //#region src/testing/authorization-provider.ts
-function isPlainJson(value) {
+function isPlainJson$1(value) {
 	if (value === null || typeof value === "string" || typeof value === "boolean") return true;
 	if (typeof value === "number") return Number.isFinite(value);
-	if (Array.isArray(value)) return value.every(isPlainJson);
+	if (Array.isArray(value)) return value.every(isPlainJson$1);
 	if (typeof value !== "object") return false;
 	const prototype = Object.getPrototypeOf(value);
-	return (prototype === Object.prototype || prototype === null) && Object.values(value).every((entry) => entry === void 0 || isPlainJson(entry));
+	return (prototype === Object.prototype || prototype === null) && Object.values(value).every((entry) => entry === void 0 || isPlainJson$1(entry));
 }
 const QUALIFIED = /^[a-z_][\w$]*\.[a-z_][\w${}]*$/i;
 const TABLE = /^[a-z_][\w$]*\.[a-z_][\w$]*$/i;
@@ -1520,7 +1687,7 @@ function testAuthorizationProvider(provider) {
 			expect(provider.apiVersion === 1, `apiVersion is ${String(provider.apiVersion)}`);
 		}],
 		["is plain JSON", () => {
-			expect(isPlainJson(provider), "it doesn't survive a JSON round trip");
+			expect(isPlainJson$1(provider), "it doesn't survive a JSON round trip");
 		}],
 		["names valid, unique scopes", () => {
 			expect(scopes.size > 0, "scopes is empty");
@@ -1603,6 +1770,387 @@ function testAuthorizationProvider(provider) {
 	]);
 }
 //#endregion
+//#region src/testing/authorizer.ts
+const OUTCOMES = /* @__PURE__ */ new Set([
+	"granted",
+	"denied",
+	"approval-required"
+]);
+const isOutcome = (value) => typeof value === "object" && value !== null && "outcome" in value && typeof value.outcome === "string" && OUTCOMES.has(value.outcome);
+/** Input that claims a privileged caller; the subject must decide, never this. */
+const FORGED = {
+	subject: {
+		type: "service",
+		id: "service"
+	},
+	actor: {
+		id: "service",
+		kind: "service",
+		role: "service_role"
+	},
+	role: "service_role",
+	user_id: "00000000-0000-4000-8000-000000000000",
+	memberships: [{
+		tenant: "conformance",
+		role: "owner"
+	}],
+	claims: {
+		role: "service_role",
+		user_role: "admin",
+		roles: ["admin"],
+		memberships: [{
+			tenant: "conformance",
+			role: "owner"
+		}]
+	}
+};
+/**
+* Proves an `Authorizer` targets API v1, keys every permission to the same
+* string each time (and after a JSON round trip, so references are plain
+* JSON), answers every request with a known outcome without mutating it,
+* keeps the request order in `evaluations`, decides from the subject rather
+* than the input (forged roles, claims and memberships in the resource
+* properties or the context never turn a denial into a grant), never grants an unknown permission, and grants
+* `options.granted` through `checkPermission`.
+*/
+function testAuthorizer(authorizer, options) {
+	const { subject, context } = requestOf(void 0);
+	const requestFor = (action, id, properties) => ({
+		subject,
+		action,
+		resource: {
+			type: "conformance",
+			id,
+			...properties ? { properties } : {}
+		},
+		context
+	});
+	const requests = options.permissions.flatMap((permission) => [
+		"a",
+		"b",
+		"c"
+	].map((id) => requestFor(permission, id)));
+	return conform(`Authorizer "${authorizer.name}"`, [
+		hasName(authorizer),
+		["targets API v1", () => {
+			const version = authorizer.apiVersion;
+			expect(version === 1, `apiVersion is ${String(version)}`);
+			expect(options.permissions.length > 0, "options.permissions lists no permission to check");
+		}],
+		["keys every permission stably, as plain JSON", () => {
+			for (const permission of options.permissions) {
+				const key = authorizer.key(permission);
+				expect(typeof key === "string" && key.length > 0, "key() must return a non-empty string");
+				expect(authorizer.key(permission) === key, `key() gave two keys for ${key}`);
+				const copy = JSON.parse(JSON.stringify(permission));
+				expect(same(copy, permission) && authorizer.key(copy) === key, `the reference for ${key} is not plain JSON`);
+			}
+		}],
+		["answers every request with a known outcome, without mutating it", async () => {
+			for (const request of requests) {
+				const outcome = await authorizer.evaluate(frozenCopy(request));
+				expect(isOutcome(outcome), `evaluate() gave no known outcome for ${authorizer.key(request.action)}`);
+			}
+		}],
+		authorizer.evaluations !== void 0 && ["keeps the request order in evaluations", async () => {
+			const evaluations = authorizer.evaluations.bind(authorizer);
+			const single = await Promise.all(requests.map((request) => Promise.resolve(authorizer.evaluate(request))));
+			const batch = await evaluations(frozenCopy(requests));
+			expect(batch.length === requests.length, `evaluations() gave ${batch.length} outcomes for ${requests.length} requests`);
+			expect(same(batch.map((outcome) => outcome.outcome), single.map((outcome) => outcome.outcome)), "evaluations() disagrees with evaluate() for the same requests");
+			const reversed = await evaluations(frozenCopy(requests.toReversed()));
+			expect(same(reversed.toReversed().map((outcome) => outcome.outcome), batch.map((outcome) => outcome.outcome)), "evaluations() does not keep the request order");
+		}],
+		["decides from the subject, never from the input", async () => {
+			for (const permission of options.permissions) {
+				const plain = await authorizer.evaluate(requestFor(permission, "a"));
+				const forgedResource = await authorizer.evaluate(requestFor(permission, "a", FORGED));
+				const forgedContext = await authorizer.evaluate({
+					...requestFor(permission, "a"),
+					context: {
+						...context,
+						...FORGED
+					}
+				});
+				for (const forged of [forgedResource, forgedContext]) expect(forged.outcome !== "granted" || plain.outcome === "granted", `input claiming a service caller was granted ${authorizer.key(permission)}`);
+			}
+		}],
+		options.unknown !== void 0 && ["never grants an unknown permission", async () => {
+			expect(!(await checkPermission({
+				authorizer,
+				permission: options.unknown,
+				resource: { type: "conformance" },
+				context: options.granted?.context
+			})).ok, "an unknown permission was granted");
+		}],
+		options.granted !== void 0 && ["grants the granted permission through checkPermission", async () => {
+			const checked = await checkPermission({
+				authorizer,
+				permission: options.granted.permission,
+				resource: { type: "conformance" },
+				context: options.granted.context
+			});
+			expect(checked.ok, checked.ok ? "" : `the permission was refused: ${checked.error.message}`);
+		}]
+	]);
+}
+/**
+* An in-memory `Authorizer` for tests and examples: permissions come from
+* the subject's `role` and id only, never from the request's resource or
+* context, and it ignores `subject.properties.claims`.
+*/
+function staticAuthorizer(options) {
+	const approvals = new Set(options.approvals ?? []);
+	const evaluate = (request) => {
+		const { subject, action } = request;
+		if (approvals.has(action)) return {
+			outcome: "approval-required",
+			approval: { id: `approval:${action}` }
+		};
+		const role = subject.properties?.["role"];
+		return [...options.roles?.[typeof role === "string" ? role : subject.type] ?? [], ...options.grants?.[subject.id] ?? []].includes(action) ? { outcome: "granted" } : {
+			outcome: "denied",
+			reason: `Permission ${action} is required`
+		};
+	};
+	return defineAuthorizer({
+		name: "static",
+		key: (ref) => ref,
+		evaluate,
+		evaluations: (requests) => Promise.resolve(requests.map(evaluate))
+	});
+}
+//#endregion
+//#region src/testing/document-format.ts
+const STATUSES$1 = /* @__PURE__ */ new Set([
+	"stable",
+	"legacy",
+	"preview"
+]);
+const SEVERITIES = /* @__PURE__ */ new Set([
+	"error",
+	"warning",
+	"info"
+]);
+const CODE = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+const jsonSchema = (schema) => ({ "~standard": {
+	version: 1,
+	vendor: "better-supabase-conformance",
+	validate: (value) => ({ value }),
+	jsonSchema: {
+		input: () => schema,
+		output: () => schema
+	}
+} });
+function sampleModel() {
+	const customer = {
+		type: "object",
+		required: ["id", "name"],
+		properties: {
+			id: {
+				type: "string",
+				format: "uuid"
+			},
+			name: { type: "string" },
+			note: { type: ["string", "null"] }
+		}
+	};
+	return buildApiModel({ meta: {
+		version: 1,
+		casing: "camel",
+		tables: {},
+		enums: {},
+		functions: {}
+	} }, {
+		info: {
+			title: "Conformance",
+			version: "1.0.0"
+		},
+		servers: [{
+			url: "https://api.test",
+			name: "test"
+		}],
+		tags: [{
+			name: "customers",
+			summary: "Customers"
+		}],
+		basePath: "/api",
+		routes: [
+			{
+				method: "get",
+				path: "/customers/{id}",
+				operationId: "getCustomer",
+				tags: ["customers"],
+				output: jsonSchema(customer)
+			},
+			{
+				method: "post",
+				path: "/customers",
+				operationId: "createCustomer",
+				tags: ["customers"],
+				input: jsonSchema(customer),
+				output: jsonSchema(customer),
+				status: 201
+			},
+			{
+				method: "get",
+				path: "/customers/changes",
+				operationId: "streamCustomerChanges",
+				stream: { item: jsonSchema(customer) }
+			}
+		],
+		webhooks: [{
+			id: "customer.created",
+			payload: customer,
+			standardWebhooks: true
+		}],
+		realtimeUrl: "wss://abc.supabase.co/realtime/v1/websocket",
+		messages: { customerChanged: {
+			id: "customerChanged",
+			payload: customer
+		} },
+		channels: [{
+			id: "customers",
+			address: "bs:t:public.customers",
+			protocol: "ws",
+			messages: ["customerChanged"],
+			operations: [{
+				id: "onCustomerChanged",
+				action: "receive"
+			}]
+		}],
+		workflows: [{
+			id: "createThenGet",
+			steps: [{
+				id: "create",
+				operationId: "createCustomer",
+				outputs: { id: "$response.body#/id" }
+			}, {
+				id: "get",
+				operationId: "getCustomer",
+				parameters: [{
+					name: "id",
+					in: "path",
+					value: "$steps.create.outputs.id"
+				}]
+			}]
+		}],
+		security: ["bearer"]
+	}).model;
+}
+function isPlainJson(value) {
+	if (value === null || typeof value === "string" || typeof value === "boolean") return true;
+	if (typeof value === "number") return Number.isFinite(value);
+	if (Array.isArray(value)) return value.every(isPlainJson);
+	if (typeof value !== "object") return false;
+	const prototype = Object.getPrototypeOf(value);
+	if (prototype !== Object.prototype && prototype !== null) return false;
+	return Object.values(value).every((entry) => entry !== void 0 && isPlainJson(entry));
+}
+function diagnosticProblem(diagnostic) {
+	if (typeof diagnostic.code !== "string" || !CODE.test(diagnostic.code)) return `the code ${JSON.stringify(diagnostic.code)} is not kebab-case`;
+	const severity = diagnostic.severity;
+	if (typeof severity !== "string" || !SEVERITIES.has(severity)) return `${diagnostic.code} has the severity ${String(severity)}`;
+	if (typeof diagnostic.message !== "string" || diagnostic.message === "") return `${diagnostic.code} has no message`;
+	if (diagnostic.pointer !== void 0 && !/^(?:\/|$)/.test(diagnostic.pointer)) return `${diagnostic.code} has the pointer ${diagnostic.pointer}, which is not a JSON Pointer`;
+}
+/**
+* Proves a `DocumentFormat` targets API v1, lists versions with pins and a
+* known status, defaults to a version it lists that is not a preview, and,
+* for every version: lowers the model without mutating it (also when the
+* model is frozen), renders the same document twice, renders plain JSON or
+* text, reports diagnostics with a kebab-case code, a severity and a
+* message, finds no error in its own output with `lint`, and names a bare,
+* stable file.
+*/
+function testDocumentFormat(format, options = {}) {
+	const subject = format;
+	const id = subject.id;
+	const defaultVersion = subject.defaultVersion;
+	const versions = options.versions ?? Object.keys(subject.versions);
+	let model;
+	const modelOf = () => model ??= options.model ?? sampleModel();
+	const lower = (version, input) => {
+		const diagnostics = [];
+		return {
+			document: subject.lower(input, version, { report: (diagnostic) => {
+				diagnostics.push(diagnostic);
+			} }),
+			diagnostics
+		};
+	};
+	return conform(`DocumentFormat "${String(id)}"`, [
+		["targets API v1 with an id", () => {
+			const version = subject.apiVersion;
+			expect(version === 1, `apiVersion is ${String(version)}`);
+			expect(typeof id === "string" && id.length > 0, "id must be a non-empty string");
+		}],
+		["lists versions with a pin and a known status", () => {
+			const listed = Object.entries(subject.versions);
+			expect(listed.length > 0, "versions lists no version");
+			for (const [version, entry] of listed) {
+				const status = entry.status;
+				expect(typeof entry.pin === "string" && entry.pin.length > 0, `version ${version} has no pin`);
+				expect(typeof status === "string" && STATUSES$1.has(status), `version ${version} has the status ${String(status)}`);
+			}
+			for (const version of versions) expect(Object.hasOwn(subject.versions, version), `options.versions names ${version}, which the format does not list`);
+		}],
+		["defaults to a listed version that is not a preview", () => {
+			const entry = Object.hasOwn(subject.versions, subject.defaultVersion) ? subject.versions[subject.defaultVersion] : void 0;
+			expect(entry !== void 0, `the default version ${String(defaultVersion)} is not in versions`);
+			expect(entry.status !== "preview", `the default version ${String(defaultVersion)} is a preview`);
+		}],
+		["lowers every version without mutating the model", () => {
+			const original = modelOf();
+			const before = JSON.stringify(original);
+			for (const version of versions) {
+				lower(version, original);
+				expect(JSON.stringify(original) === before, `lower(model, "${version}") changed the model`);
+				lower(version, frozenCopy(original));
+			}
+		}],
+		["renders the same document twice", () => {
+			for (const version of versions) {
+				const first = lower(version, structuredClone(modelOf()));
+				const second = lower(version, structuredClone(modelOf()));
+				expect(same(first.document, second.document), `lower(model, "${version}") is not deterministic`);
+				expect(same(first.diagnostics, second.diagnostics), `lower(model, "${version}") reports different diagnostics each time`);
+			}
+		}],
+		["renders plain JSON or text", () => {
+			for (const version of versions) {
+				const { document } = lower(version, modelOf());
+				expect(typeof document === "string" || typeof document === "object" && document !== null && isPlainJson(document), `lower(model, "${version}") returned something other than a JSON object or a string`);
+			}
+		}],
+		["reports diagnostics with a code, a severity and a message", () => {
+			for (const version of versions) {
+				const { document, diagnostics } = lower(version, modelOf());
+				const linted = subject.lint?.(document, version) ?? [];
+				for (const diagnostic of [...diagnostics, ...linted]) {
+					const problem = diagnosticProblem(diagnostic);
+					expect(problem === void 0, `${version}: ${problem ?? ""}`);
+				}
+			}
+		}],
+		subject.lint !== void 0 && ["finds no error in its own output", () => {
+			for (const version of versions) {
+				const { document, diagnostics } = lower(version, modelOf());
+				if (diagnostics.some((diagnostic) => diagnostic.severity === "error")) continue;
+				const errors = (subject.lint?.(document, version) ?? []).filter((diagnostic) => diagnostic.severity === "error");
+				expect(errors.length === 0, `lint(lower(model, "${version}")) reports ${errors.map((error) => error.code).join(", ")}`);
+			}
+		}],
+		["names a bare, stable file per version", () => {
+			for (const version of versions) {
+				const name = subject.fileName(version);
+				expect(typeof name === "string" && /^[^/\\]+\.[A-Za-z0-9]+$/.test(name), `fileName("${version}") is ${JSON.stringify(name)}, not a file name with an extension`);
+				expect(subject.fileName(version) === name, `fileName("${version}") changes between calls`);
+			}
+		}]
+	]);
+}
+//#endregion
 //#region src/testing/generator.ts
 function relativeImport(from, to) {
 	const fromParts = from.split("/").slice(0, -1);
@@ -2350,4 +2898,4 @@ function testCredentialProvider(provider, options) {
 	]);
 }
 //#endregion
-export { ConformanceError, LOCAL_JWT_SECRET, asUser, createTestSigner, defineSeed, expectDbBudget, expectInstant, expectTenantIsolation, isSeed, localAuth, localSigningKey, signLocalJwt, signTestJwt, signTestJwtWithKey, supabaseClaimFixtures, testAdapter, testAiTaskRunner, testAuthResolver, testAuthorizationProvider, testBlockTransportMiddleware, testBuilderStarter, testCacheAdapter, testChatState, testCredentialProvider, testEmbedder, testEveDocumentBackend, testEventSink, testExecutor, testGenerator, testGraphCompiler, testNotificationChannel, testPlugin, testQueueBackend, testStreamStore, testSupportSessionStore, testWebhookSecretStore, testWebhookSigner, testWebhookTransport };
+export { ConformanceError, LOCAL_JWT_SECRET, asUser, createTestSigner, defineSeed, expectDbBudget, expectInstant, expectTenantIsolation, isSeed, liteStack, localAuth, localSigningKey, signLocalJwt, signTestJwt, signTestJwtWithKey, staticAuthorizer, supabaseClaimFixtures, testAdapter, testAiTaskRunner, testAuthResolver, testAuthorizationProvider, testAuthorizer, testBlockTransportMiddleware, testBuilderStarter, testCacheAdapter, testChatState, testCredentialProvider, testDocumentFormat, testEmbedder, testEveDocumentBackend, testEventSink, testExecutor, testGenerator, testGraphCompiler, testNotificationChannel, testPlugin, testQueueBackend, testStreamStore, testSupportSessionStore, testWebhookSecretStore, testWebhookSigner, testWebhookTransport };