better-supabase 0.7.1 → 0.9.0

package/dist/testing/index.js

@@ -1,20 +1,26 @@
 import { t as DbException } from "../db-exception-CnWcYPxL.js";
-import { n as dbError } from "../errors-B11Duf73.js";
-import { d as temporalText } from "../temporal-BJGitm-h.js";
-import { t as temporal } from "../temporal-required-BVvW7SYJ.js";
-import { a as ok } from "../result-DzUbqgdW.js";
-import { t as BetterSupabase } from "../define-B-TVjC25.js";
-import { a as toBase64Url, r as fromBase64, t as base64ToText } from "../base64-D2gsioCY.js";
-import { t as isList } from "../guards-BnzDvFrz.js";
-import { a as resolveConfig } from "../modules-dxrVK3ID.js";
+import { n as dbError } from "../errors-8i6tSICm.js";
+import { d as temporalText } from "../temporal-CB5Fpo5d.js";
+import { t as temporal } from "../temporal-required-DqRzr7i0.js";
+import { a as ok } from "../result-BlgnMB0H.js";
+import { t as BetterSupabase } from "../define-B2ln373W.js";
+import { t as isList } from "../guards-6F2bCtQR.js";
+import { a as toBase64Url, r as fromBase64, t as base64ToText } from "../base64-BmeCBgGo.js";
+import { o as resolveConfig } from "../config-BA1K4OPk.js";
 import { ENV_VARIABLES } from "../env/index.js";
-import { n as postgresExecutor } from "../executor-De1Of3m3.js";
-import "../replicas-CwrYp5Zj.js";
-import { a as tenantCredentialRef } from "../provider-Di3sRutW.js";
-import { n as parseDbStats } from "../timing-CyTQPubY.js";
-import { t as rawError } from "../block-transport-BLr-ZgLc.js";
-import { a as isScopeName, c as templateFunctions, l as templatePlaceholders, n as TEMPLATE_PLACEHOLDERS, s as scopeProblems, u as templateProblems } from "../access-sql-B0dF-SoF.js";
+import { t as defineController } from "../controller-D6NyNrlZ.js";
+import "../replicas-BvIL4_jL.js";
+import { a as tenantCredentialRef } from "../provider-DKh2xFZb.js";
+import { n as rawError } from "../block-transport-G4t1umrR.js";
+import { t as postgresExecutor } from "../executor-D1kYY5BA.js";
+import { i as requestOf, n as checkPermission, r as defineAuthorizer } from "../authorizer-DH7DjkL3.js";
+import { n as parseDbStats } from "../timing-BMCWgpdZ.js";
+import { t as mailHeaders } from "../delivery-B1mKaOen.js";
 import { toCloudEvents } from "../events/index.js";
+import { d as money, l as isRate } from "../money-95Rff2vT.js";
+import { t as SHIPPING_LINE } from "../tax-D_kSCdWU.js";
+import { a as isScopeName, c as templateFunctions, l as templatePlaceholders, n as TEMPLATE_PLACEHOLDERS, s as scopeProblems, u as templateProblems } from "../access-sql-DUSSMaC3.js";
+import { t as buildApiModel } from "../build-Cm0T5MVG.js";
 import { timestamps } from "../plugins/timestamps/index.js";
 import { softDelete } from "../plugins/soft-delete/index.js";
 import { tenant } from "../plugins/tenant/index.js";
@@ -149,11 +155,11 @@ async function findSigningKeys(from) {
 		const supabase = join(dir, "supabase");
 		const toml = join(supabase, "config.toml");
 		if (existsSync(toml)) {
-			const configured = SIGNING_KEYS_PATH.exec(await readFile(toml, "utf8"))?.[1];
+			const configured = SIGNING_KEYS_PATH.exec(await readFile(toml, "utf-8"))?.[1];
 			const path = resolve(supabase, configured ?? "signing_keys.json");
 			if (existsSync(path)) return path;
 		}
-		if (dirname(dir) === dir) return void 0;
+		if (dirname(dir) === dir) return;
 	}
 }
 const isSigningKey = (value) => typeof value === "object" && value !== null && "kid" in value && typeof value.kid === "string" && "d" in value && typeof value.d === "string";
@@ -165,7 +171,7 @@ const isSigningKey = (value) => typeof value === "object" && value !== null && "
 async function localSigningKey(path) {
 	const file = path ?? process.env["SUPABASE_SIGNING_KEYS_PATH"] ?? await findSigningKeys(process.cwd());
 	if (!file || !existsSync(file)) throw new TypeError("No local signing key. Run `better-supabase keys`, set `signing_keys_path` in supabase/config.toml and restart the stack, or pass { alg: \"HS256\" } to sign with the local JWT secret.");
-	const keys = JSON.parse(await readFile(file, "utf8"));
+	const keys = JSON.parse(await readFile(file, "utf-8"));
 	const first = Array.isArray(keys) ? keys[0] : void 0;
 	if (!isSigningKey(first)) throw new TypeError(`${file} has no private ES256 key first.`);
 	return first;
@@ -179,7 +185,7 @@ async function signLocalJwt(claims, path) {
 /** The local CLI stack's default JWT secret. */
 const LOCAL_JWT_SECRET = "super-secret-jwt-token-with-at-least-32-characters-long";
 function env$1(...names) {
-	if (typeof process === "undefined") return void 0;
+	if (typeof process === "undefined") return;
 	for (const name of names) {
 		const value = process.env[name];
 		if (value) return value;
@@ -230,7 +236,10 @@ async function asUser(betterSupabase, claims, stack = {}) {
 		},
 		claims: full
 	};
-	const supabase = createClient(url, publishableKey, { accessToken: () => Promise.resolve(token) });
+	const supabase = createClient(url, publishableKey, {
+		accessToken: () => Promise.resolve(token),
+		...stack.fetch ? { global: { fetch: stack.fetch } } : {}
+	});
 	return {
 		token,
 		claims: full,
@@ -240,6 +249,141 @@ async function asUser(betterSupabase, claims, stack = {}) {
 	};
 }
 //#endregion
+//#region src/lite/runtime.ts
+const LITE_INSTALL = "Supabase Lite is an optional peer: install it with `pnpm add -D @supabase/lite`";
+/**
+* `@supabase/lite` is an optional peer: variable specifiers keep bundlers
+* from resolving it, and a missing install returns `undefined` so callers
+* can say how to add it.
+*/
+async function loadLite() {
+	const root = "@supabase/lite";
+	const pglite = "@supabase/lite/pglite";
+	const sqlite = "@supabase/lite/sqlite";
+	try {
+		const [{ App }, pg, sq] = await Promise.all([
+			import(root),
+			import(pglite),
+			import(sqlite)
+		]);
+		return {
+			App,
+			createPgliteConnection: () => pg.createPgliteConnection(),
+			createSqliteConnection: (url) => sq.createConnection({ url })
+		};
+	} catch {
+		return;
+	}
+}
+/** Applies migrations, then declarative schemas, with Lite's migrator. */
+async function migrateLite(connection, sql) {
+	const ddl = sql.filter((part) => part.trim() !== "").join("\n;\n");
+	if (ddl !== "") await connection.createMigrator(ddl).migrate();
+}
+/** Runs seed SQL: as is on PGlite, translated to SQLite on `sqlite-postgres`. */
+async function seedLite(target, sql) {
+	if (sql.trim() === "") return;
+	if (target.driver === "pglite") {
+		await target.connection.driver.exec(sql);
+		return;
+	}
+	const { connection } = target;
+	const translated = await connection.translateDdl(sql);
+	const statements = typeof translated === "string" ? translated : typeof translated === "object" && translated !== null && "ddl" in translated && typeof translated.ddl === "string" ? translated.ddl : "";
+	if (statements !== "") await connection.transaction([statements]);
+}
+//#endregion
+//#region src/testing/lite.ts
+const LITE_URL = "http://localhost:54321";
+function randomToken(bytes) {
+	return toBase64Url(crypto.getRandomValues(new Uint8Array(bytes)));
+}
+function list(value) {
+	if (value === void 0) return [];
+	return typeof value === "string" ? [value] : [...value];
+}
+/**
+* Supabase Lite in this process, for tests without Docker: an in-memory
+* database with your schema, Auth with fresh API keys, and supabase-js
+* clients whose requests go straight to Lite's `fetch` handler (no port).
+*
+* ```ts
+* await using stack = await liteStack({ schemas: [await readFile("supabase/schemas/notes.sql", "utf8")] });
+* const alice = await stack.asUser(betterSupabase, { sub: aliceId });
+* expect(await alice.db.notes.count().orThrow()).toBe(1);
+* ```
+*/
+async function liteStack(options = {}) {
+	const lite = await loadLite();
+	if (!lite) throw new Error(`liteStack() needs @supabase/lite. ${LITE_INSTALL}`);
+	const driver = options.driver ?? "sqlite-postgres";
+	const jwtSecret = options.jwtSecret ?? randomToken(32);
+	const publishableKey = `sb_publishable_${randomToken(16)}`;
+	const secretKey = `sb_secret_${randomToken(16)}`;
+	let target;
+	if (driver === "pglite") target = {
+		driver,
+		connection: await lite.createPgliteConnection()
+	};
+	else target = {
+		driver,
+		connection: await lite.createSqliteConnection(":memory:")
+	};
+	const { connection } = target;
+	try {
+		const app = new lite.App({
+			connection,
+			auth: {
+				enabled: true,
+				jwt_secret: jwtSecret,
+				publishable_key: publishableKey,
+				secret_key: secretKey
+			}
+		});
+		await app.init();
+		await migrateLite(connection, [...options.migrations ?? [], ...options.schemas ?? []]);
+		for (const seed of list(options.seed)) await seedLite(target, seed);
+		const fetch = (input, init) => app.fetch(new Request(input, init));
+		const stateless = {
+			auth: {
+				persistSession: false,
+				autoRefreshToken: false
+			},
+			global: { fetch }
+		};
+		const close = () => connection.close();
+		return {
+			url: LITE_URL,
+			publishableKey,
+			secretKey,
+			jwtSecret,
+			fetch,
+			env: {
+				url: LITE_URL,
+				publishableKey,
+				secretKey,
+				secretKeys: { default: secretKey },
+				jwksUrl: new URL(`${LITE_URL}/auth/v1/.well-known/jwks.json`),
+				jwtSecret
+			},
+			supabase: createClient(LITE_URL, publishableKey, stateless),
+			admin: createClient(LITE_URL, secretKey, stateless),
+			asUser: (betterSupabase, claims) => asUser(betterSupabase, claims, {
+				url: LITE_URL,
+				publishableKey,
+				alg: "HS256",
+				jwtSecret,
+				fetch
+			}),
+			close,
+			[Symbol.asyncDispose]: close
+		};
+	} catch (error) {
+		await connection.close();
+		throw error;
+	}
+}
+//#endregion
 //#region src/testing/budget.ts
 function isPrefetch(response) {
 	const headers = response.request().headers();
@@ -449,395 +593,684 @@ function deepFreeze(value) {
 }
 const frozenCopy = (value) => deepFreeze(structuredClone(value));
 const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
-const recorder = (ops) => ({
-	name: "recorder",
-	execute: (op) => {
-		ops.push(op);
-		return Promise.resolve(ok({
-			rows: [],
-			count: 0
-		}));
-	}
-});
-/** The operation `run` sends to the executor, built by `betterSupabase` without touching a database. */
-async function captureOp(betterSupabase, run) {
-	const ops = [];
-	await run(betterSupabase.connect(recorder(ops)));
-	const [op] = ops;
-	if (!op) throw new Error("the repository call did not reach the executor");
-	return op;
+//#endregion
+//#region src/testing/isolation.ts
+const scalar = (value) => typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+function keyOf(table, row) {
+	return Object.fromEntries(table.primaryKey.map((column) => [column, row[column]]));
 }
-function tableKey(betterSupabase, table) {
-	const key = table ?? Object.keys(betterSupabase.meta.tables)[0];
-	if (!key || !(key in betterSupabase.meta.tables)) throw new TypeError(`better-supabase: unknown table "${String(key)}"`);
-	return key;
+async function rowsOf(outcome) {
+	const result = await outcome;
+	if (!result.ok) throw new Error(result.error.message);
+	return Array.isArray(result.data) ? result.data : [result.data];
+}
+function env(names) {
+	if (typeof process === "undefined") return;
+	for (const name of names) {
+		const value = process.env[name];
+		if (value) return value;
+	}
 }
-const hasName = (subject) => ["has a name", () => {
-	expect(typeof subject.name === "string" && subject.name.length > 0, "name must be a non-empty string");
-}];
 /**
-* Proves an `Executor` meets the contract: rows keyed by the selection's
-* aliases, counts, `aborted` errors, failures returned as `Result`s rather
-* than thrown, and (with `create`) a write round trip and a `deleteMany`
-* that `maxAffected` refuses without deleting anything.
+* Checks row-level security between two tenants against a running stack: for
+* each table, a user of one tenant must not select, insert, update or delete
+* the other tenant's rows. Runs without `betterSupabase`'s plugins, so the `tenant()`
+* plugin can't hide a missing policy. Throws a `ConformanceError` naming each
+* table and command that leaks; removes every row it created.
 *
 * ```ts
-* it('conforms', () => testExecutor(myExecutor, { betterSupabase, table: 'tags', create: { name: 'x' } }));
+* await expectTenantIsolation(betterSupabase, {
+*   tenants: [
+*     { id: ACME, claims: { sub: alice, tenant_id: ACME } },
+*     { id: GLOBEX, claims: { sub: bob, tenant_id: GLOBEX } },
+*   ],
+*   tables: {
+*     tags: {
+*       row: (tenant, n) => ({ organizationId: tenant.id, name: `iso-${n}` }),
+*       update: { name: 'changed' },
+*     },
+*   },
+* });
 * ```
 */
-function testExecutor(executor, options) {
-	const { betterSupabase } = options;
-	const table = tableKey(betterSupabase, options.table);
-	const context = { errorMappers: [] };
-	const read = () => captureOp(betterSupabase, (db) => db[table]["findMany"]({ limit: 2 }));
-	const create = options.create;
-	return conform(`Executor "${executor.name}"`, [
-		hasName(executor),
-		["reads rows keyed by the selection aliases", async () => {
-			const op = await read();
-			const result = await executor.execute(op, context);
-			expect(result.ok, `select failed: ${result.ok ? "" : result.error.message}`);
-			expect(isList(result.data.rows), "rows must be an array");
-			expect(result.data.rows.length <= 2, `limit 2 returned ${result.data.rows.length} rows`);
-			expect(result.data.count === null || typeof result.data.count === "number", "count must be a number or null");
-			if (op.kind !== "select") return;
-			const aliases = new Set(op.selection.columns.map((column) => column.alias));
-			for (const row of result.data.rows) {
-				const extra = Object.keys(row).filter((key) => !aliases.has(key));
-				expect(extra.length === 0, `rows must use selection aliases; got ${extra.join(", ")}`);
-			}
-		}],
-		["counts rows", async () => {
-			const op = await captureOp(betterSupabase, (db) => db[table]["count"]());
-			const result = await executor.execute(op, context);
-			expect(result.ok, `count failed: ${result.ok ? "" : result.error.message}`);
-			expect(typeof result.data.count === "number" && result.data.count >= 0, "count must be a number");
-		}],
-		["returns an aborted error for an aborted signal", async () => {
-			const controller = new AbortController();
-			controller.abort();
-			const result = await executor.execute(await read(), {
-				...context,
-				signal: controller.signal
-			});
-			expect(!result.ok, "an aborted request must fail");
-			expect(result.error.kind === "aborted", `expected kind "aborted", got "${result.error.kind}"`);
-		}],
-		["returns failures as results instead of throwing", async () => {
-			const op = await read();
-			const missing = {
-				...op,
-				table: {
-					...op.table,
-					name: "__better_supabase_missing__"
-				}
-			};
-			const result = await executor.execute(missing, context);
-			expect(!result.ok, "a missing table must fail");
-			expect(typeof result.error.kind === "string" && typeof result.error.message === "string", "errors must be DbErrors");
-		}],
-		executor.rpc && ["returns rpc failures as results", async () => {
-			expect(!(await executor.rpc("__better_supabase_missing__", {}, {
-				...context,
-				schema: "public"
-			})).ok, "calling a missing function must fail");
-		}],
-		executor.functionSources && ["reads from SelectOp.source instead of the table", async () => {
-			const op = await read();
-			if (op.kind !== "select") return;
-			expect(!(await executor.execute({
-				...op,
-				source: {
-					schema: op.table.schema,
-					name: "__better_supabase_missing__",
-					args: {}
-				}
-			}, context)).ok, "a missing source function must fail; reading the table ignores source");
-		}],
-		executor.batch && ["batch returns one result per operation, in order", async () => {
-			const rows = await read();
-			const count = await captureOp(betterSupabase, (db) => db[table]["count"]());
-			const missing = {
-				...rows,
-				table: {
-					...rows.table,
-					name: "__better_supabase_missing__"
-				}
-			};
-			const results = await executor.batch([
-				rows,
-				count,
-				missing
-			], context);
-			expect(results.length === 3, `expected 3 results, got ${results.length}`);
-			const [first, second, third] = results;
-			expect(first?.ok === true && Array.isArray(first.data.rows), "the first operation must return rows");
-			expect(second?.ok === true && typeof second.data.count === "number", "the second operation must return a count");
-			expect(third?.ok === false, "a failing operation must fail on its own, as a result");
-		}],
-		create && ["round-trips a write", async () => {
-			const repository = betterSupabase.connect(executor)[table];
-			const created = await repository["create"](create);
-			expect(created.ok, `create failed: ${JSON.stringify(created.error)}`);
-			const row = created.data;
-			for (const [key, value] of Object.entries(create)) expect(same(row[key], value), `created row has ${key} = ${JSON.stringify(row[key])}`);
-			const [primary] = betterSupabase.meta.tables[table].primaryKey;
-			expect(primary, "write checks need a table with a primary key");
-			const removed = await repository["delete"](row[primary]);
-			expect(removed.ok, `delete failed: ${JSON.stringify(removed.error)}`);
-			const again = await repository["findFirst"]({ where: { [primary]: row[primary] } });
-			expect(again.ok && again.data === null, "the deleted row is still readable");
-		}],
-		create && ["refuses a write past maxAffected and writes nothing", async () => {
-			const repository = betterSupabase.connect(executor)[table];
-			const [primary] = betterSupabase.meta.tables[table].primaryKey;
-			expect(primary, "write checks need a table with a primary key");
-			const created = await repository["create"](create);
-			expect(created.ok, `create failed: ${JSON.stringify(created.error)}`);
-			const id = created.data[primary];
-			try {
-				const refused = await repository["deleteMany"]({
-					where: { [primary]: id },
-					maxAffected: 0
-				});
-				expect(!refused.ok, "deleteMany past maxAffected must fail");
-				const kind = refused.error?.kind;
-				expect(kind === "max_affected", `expected kind "max_affected", got "${String(kind)}"`);
-				const kept = await repository["findFirst"]({ where: { [primary]: id } });
-				expect(kept.ok && kept.data !== null, "a refused deleteMany must not delete the row");
-				const allowed = await repository["deleteMany"]({
-					where: { [primary]: id },
-					maxAffected: 1
-				});
-				expect(allowed.ok, `deleteMany within maxAffected failed: ${JSON.stringify(allowed.error)}`);
-			} finally {
-				await repository["delete"](id);
+async function expectTenantIsolation(betterSupabase, options) {
+	const stack = options.stack ?? {};
+	const bare = new BetterSupabase(betterSupabase.schema);
+	const url = stack.url ?? env(ENV_VARIABLES.url) ?? "http://127.0.0.1:54321";
+	const secretKey = stack.secretKey ?? env(ENV_VARIABLES.secretKey);
+	if (!secretKey) throw new TypeError("expectTenantIsolation needs stack.secretKey or $SUPABASE_SECRET_KEY to seed rows.");
+	const admin = bare.connect(createClient(url, secretKey, { auth: {
+		persistSession: false,
+		autoRefreshToken: false
+	} }));
+	await options.seed?.();
+	const tenants = options.tenants;
+	const users = await Promise.all(tenants.map(async (tenant) => (await asUser(bare, tenant.claims, stack)).db));
+	const label = (tenant) => tenant.name ?? tenant.id;
+	const cleanup = [];
+	const reads = [];
+	const deletes = [];
+	try {
+		for (const [key, spec] of Object.entries(options.tables)) {
+			const table = bare.meta.tables[key];
+			if (!table || table.primaryKey.length === 0) throw new TypeError(`expectTenantIsolation: "${key}" is not a table with a primary key`);
+			const seeded = [];
+			for (const tenant of tenants) {
+				const [row] = await rowsOf(admin[key].create(spec.row(tenant, 0)));
+				const where = keyOf(table, row);
+				cleanup.push(() => admin[key].deleteMany({ where }));
+				seeded.push(row);
 			}
-		}]
-	]);
-}
-/**
-* Proves a `CacheAdapter` accepts table and row targets, repeated and
-* concurrent calls, and never mutates its input.
-*/
-function testCacheAdapter(adapter, options = {}) {
-	const table = options.table ?? "customers";
-	const invalidate = (target) => Promise.resolve(adapter.invalidate(deepFreeze(target)));
-	return conform(`CacheAdapter "${adapter.name}"`, [
-		hasName(adapter),
-		["invalidates a table", () => invalidate({
-			table,
-			tables: [table],
-			ids: []
-		})],
-		["invalidates rows of a tenant", () => invalidate({
-			table,
-			tables: [table],
-			ids: ["1", "a,b"],
-			tenant: "organization_1"
-		})],
-		["accepts repeated and concurrent calls", async () => {
-			await invalidate({
-				table,
-				tables: [table],
-				ids: ["1"]
-			});
-			await Promise.all(Array.from({ length: 10 }, (_, index) => invalidate({
-				table,
-				tables: [table],
-				ids: [String(index)]
-			})));
-		}],
-		["accepts tables it has never seen", () => invalidate({
-			table: "__better_supabase_unknown__",
-			tables: ["__better_supabase_unknown__"],
-			ids: []
-		})],
-		["invalidates tables reached through foreign keys", () => invalidate({
-			table,
-			tables: [table, `${table}_children`],
-			ids: ["1"]
-		})]
-	]);
+			for (const [self, other] of [[0, 1], [1, 0]]) {
+				const user = users[self][key];
+				const who = label(tenants[self]);
+				const whose = `${label(tenants[other])}'s`;
+				const own = keyOf(table, seeded[self]);
+				const target = keyOf(table, seeded[other]);
+				const current = async () => (await rowsOf(admin[key].findMany({ where: target })))[0];
+				reads.push([`${key}: ${who} reads its own row`, async () => {
+					expect((await rowsOf(user.findMany({ where: own }))).length === 1, `${who} can't read its own row, so the other checks prove nothing; check its claims and memberships`);
+				}], [`${key}: ${who} can't select ${whose} rows`, async () => {
+					expect((await rowsOf(user.findMany({ where: target }))).length === 0, `select returned ${whose} row`);
+				}], [`${key}: ${who} can't insert ${whose} rows`, async () => {
+					const row = spec.row(tenants[other], 1);
+					const result = await user.create(row, { returning: false });
+					if (result.ok) {
+						const where = Object.fromEntries(Object.entries(row).filter(([, value]) => scalar(value)));
+						cleanup.push(() => admin[key].deleteMany({ where }));
+					}
+					expect(!result.ok, `insert of a row for ${whose} tenant succeeded`);
+					expect(result.error.kind === "forbidden", `insert failed with ${result.error.kind} (${result.error.message}), not an RLS error; check the row factory`);
+				}], [`${key}: ${who} can't update ${whose} rows`, async () => {
+					const before = await current();
+					const patch = spec.update;
+					expect(Object.entries(patch).some(([column, value]) => before?.[column] !== value), "update must change the row to detect a leak");
+					await user.updateMany({
+						where: target,
+						data: patch,
+						returning: false
+					});
+					const after = await current();
+					expect(Object.entries(patch).every(([column]) => after?.[column] === before?.[column]), `update changed ${whose} row`);
+				}]);
+				deletes.push([`${key}: ${who} can't delete ${whose} rows`, async () => {
+					await user.deleteMany({ where: target });
+					expect(await current() !== void 0, `delete removed ${whose} row`);
+				}]);
+			}
+		}
+		return await conform("Tenant isolation", [...reads, ...deletes]);
+	} finally {
+		for (const remove of cleanup.reverse()) await remove();
+	}
 }
-/** Proves an `EventSink` accepts empty and full batches without mutating them, and delivers them when readable. */
-function testEventSink(sink, options = {}) {
-	const events = toCloudEvents({
-		table: "customers",
-		kind: "insert",
-		rows: [{
-			id: "1",
-			name: "Acme"
-		}, {
-			id: "2",
-			name: "Globex"
-		}],
-		context: { tenant: "organization_1" }
-	}, { source: "/better-supabase/conformance" });
-	return conform("EventSink", [
-		["accepts an empty batch", () => sink.send(deepFreeze([]))],
-		["accepts a batch without mutating it", () => sink.send(frozenCopy(events))],
-		options.received && ["delivers every event", async () => {
-			const ids = new Set((await options.received()).map((event) => event.id));
-			const missing = events.filter((event) => !ids.has(event.id));
-			expect(missing.length === 0, `${missing.length} of ${events.length} events were not delivered`);
-		}]
-	]);
+//#endregion
+//#region src/testing/claims-fixtures.ts
+const base = {
+	sub: "6f1c2c1e-5d0a-4d9e-9a51-6b1f0e7c2a10",
+	aud: "authenticated",
+	role: "authenticated",
+	iss: "https://project.supabase.co/auth/v1",
+	aal: "aal1",
+	session_id: "b7a8f9c0-1111-4222-8333-944455556666",
+	is_anonymous: false
+};
+const admin = "9a8b7c6d-5e4f-4a3b-8c2d-1e0f9a8b7c6d";
+const supportSessionId = "4e5f6a7b-8c9d-4e0f-9a1b-2c3d4e5f6a7b";
+const client = "5f0e4d3c-2b1a-4098-8776-655443322110";
+const chain = {
+	sub: "agent-runner",
+	act: { sub: "mcp-client-42" }
+};
+const agentAct = {
+	kind: "agent",
+	sub: "agent-7",
+	tools: ["search_knowledge"],
+	act: chain
+};
+const agentActReadOnly = {
+	kind: "agent",
+	sub: "agent-7",
+	tools: ["search_knowledge"],
+	read_only: true,
+	act: chain
+};
+/**
+* `supportSession` and `supportSessionReadOnly` are what `supportClaims`
+* mints (`act.kind: "support"`), `impersonation` what `actingAs` mints
+* (`act.kind: "impersonation"`), `oauthClient` a Supabase OAuth server
+* token (its identity scopes `openid` and `email` are left out of the
+* delegation), `agentChain` an RFC 8693 chain without `kind`, and
+* `agentRun` and `agentRunReadOnly` what `agentClaims` mints over that
+* chain (`act.kind: "agent"`, with `readOnly: true` for the second).
+*/
+const supabaseClaimFixtures = {
+	supportSession: {
+		claims: {
+			...base,
+			act: {
+				kind: "support",
+				sub: admin,
+				reason: "ticket 42",
+				session_id: supportSessionId,
+				read_only: false
+			}
+		},
+		expect: {
+			actor: {
+				kind: "support",
+				id: admin,
+				sessionId: supportSessionId,
+				readOnly: false,
+				reason: "ticket 42"
+			},
+			impersonator: {
+				kind: "support",
+				id: admin,
+				sessionId: supportSessionId,
+				readOnly: false,
+				reason: "ticket 42"
+			}
+		}
+	},
+	supportSessionReadOnly: {
+		claims: {
+			...base,
+			act: {
+				kind: "support",
+				sub: admin,
+				reason: "ticket 42",
+				session_id: supportSessionId,
+				read_only: true
+			}
+		},
+		expect: {
+			actor: {
+				kind: "support",
+				id: admin,
+				sessionId: supportSessionId,
+				readOnly: true,
+				reason: "ticket 42"
+			},
+			impersonator: {
+				kind: "support",
+				id: admin,
+				sessionId: supportSessionId,
+				readOnly: true,
+				reason: "ticket 42"
+			}
+		}
+	},
+	impersonation: {
+		claims: {
+			...base,
+			act: {
+				kind: "impersonation",
+				sub: admin,
+				reason: "ticket 42"
+			}
+		},
+		expect: {
+			actor: {
+				kind: "impersonation",
+				id: admin,
+				reason: "ticket 42"
+			},
+			impersonator: {
+				kind: "impersonation",
+				id: admin,
+				reason: "ticket 42"
+			}
+		}
+	},
+	oauthClient: {
+		claims: {
+			...base,
+			client_id: client,
+			scope: "openid email posts:read"
+		},
+		expect: {
+			actor: {
+				kind: "oauth-client",
+				id: client
+			},
+			delegation: { scopes: ["posts:read"] }
+		}
+	},
+	agentChain: {
+		claims: {
+			...base,
+			scope: "posts:read",
+			act: chain
+		},
+		expect: {
+			actor: {
+				kind: "oauth-client",
+				id: "agent-runner",
+				chain
+			},
+			delegation: {
+				scopes: ["posts:read"],
+				chain
+			}
+		}
+	},
+	agentRun: {
+		claims: {
+			...base,
+			scope: "posts:read",
+			act: agentAct
+		},
+		expect: {
+			actor: {
+				kind: "agent",
+				id: "agent-7",
+				tools: ["search_knowledge"],
+				readOnly: false,
+				chain: agentAct
+			},
+			delegation: {
+				scopes: ["posts:read"],
+				chain: agentAct
+			}
+		}
+	},
+	agentRunReadOnly: {
+		claims: {
+			...base,
+			scope: "posts:read",
+			act: agentActReadOnly
+		},
+		expect: {
+			actor: {
+				kind: "agent",
+				id: "agent-7",
+				tools: ["search_knowledge"],
+				readOnly: true,
+				chain: agentActReadOnly
+			},
+			delegation: {
+				scopes: ["posts:read"],
+				chain: agentActReadOnly
+			}
+		}
+	}
+};
+const refused = {
+	kind: "invalid",
+	reason: "actor",
+	code: "ACTOR_INVALID"
+};
+/**
+* `legacySupportSession` is a 0.5.0 support token: `session_id` without
+* `kind`. better-supabase refuses it instead of reading it as a support
+* session; mint a new one with `supportClaims`. The others are malformed
+* levels: a support or agent `read_only` that is not a boolean, an agent
+* with a `session_id`, an empty tool name or `tools` that is not a list, a
+* `kind` better-supabase does not know, and a nested level without `sub`.
+*/
+const supabaseInvalidClaimFixtures = {
+	legacySupportSession: {
+		claims: {
+			...base,
+			act: {
+				sub: admin,
+				session_id: supportSessionId,
+				reason: "ticket 42"
+			}
+		},
+		expect: refused
+	},
+	supportReadOnlyNotBoolean: {
+		claims: {
+			...base,
+			act: {
+				kind: "support",
+				sub: admin,
+				session_id: supportSessionId,
+				read_only: "false"
+			}
+		},
+		expect: refused
+	},
+	agentWithSessionId: {
+		claims: {
+			...base,
+			act: {
+				kind: "agent",
+				sub: "agent-7",
+				session_id: supportSessionId
+			}
+		},
+		expect: refused
+	},
+	agentEmptyToolName: {
+		claims: {
+			...base,
+			act: {
+				kind: "agent",
+				sub: "agent-7",
+				tools: ["search_knowledge", ""]
+			}
+		},
+		expect: refused
+	},
+	agentToolsNotArray: {
+		claims: {
+			...base,
+			act: {
+				kind: "agent",
+				sub: "agent-7",
+				tools: "search_knowledge"
+			}
+		},
+		expect: refused
+	},
+	agentReadOnlyNotBoolean: {
+		claims: {
+			...base,
+			act: {
+				kind: "agent",
+				sub: "agent-7",
+				read_only: "true"
+			}
+		},
+		expect: refused
+	},
+	unknownKind: {
+		claims: {
+			...base,
+			act: {
+				kind: "delegate",
+				sub: "agent-7"
+			}
+		},
+		expect: refused
+	},
+	levelWithoutSub: {
+		claims: {
+			...base,
+			act: {
+				kind: "agent",
+				sub: "agent-7",
+				act: { client_id: client }
+			}
+		},
+		expect: refused
+	}
+};
+//#endregion
+//#region src/testing/seed.ts
+const SEED = Symbol.for("better-supabase.seed");
+function isSeed(value) {
+	return typeof value === "object" && value !== null && SEED in value;
 }
-function claimedJob(queue, row) {
-	const instant = temporal().Instant.fromEpochMilliseconds(0);
+const quote = (text) => `'${text.replaceAll("'", "''")}'`;
+function arrayLiteral(values) {
+	return `{${values.map((value) => {
+		if (value === null) return "NULL";
+		if (Array.isArray(value)) return arrayLiteral(value);
+		return `"${(temporalText(value) ?? String(value)).replaceAll(/[\\"]/g, "\\$&")}"`;
+	}).join(",")}}`;
+}
+function literal(value, column, where) {
+	if (value === null) return "null";
+	if (column.json) return quote(JSON.stringify(value));
+	if (Array.isArray(value)) return quote(arrayLiteral(value));
+	const temporalValue = temporalText(value);
+	if (temporalValue !== void 0) return quote(temporalValue);
+	const kind = typeof value;
+	switch (kind) {
+		case "string": return quote(value);
+		case "boolean":
+		case "bigint": return String(value);
+		case "number":
+			if (!Number.isFinite(value)) throw new TypeError(`${where}: ${String(value)} is not a finite number`);
+			return String(value);
+		case "object":
+		case "function":
+		case "symbol":
+		case "undefined": throw new TypeError(`${where}: unsupported value of type ${kind}`);
+		default: throw new TypeError(`${where}: unsupported value of type ${String(kind)}`);
+	}
+}
+const ident = (name) => `"${name.replaceAll("\"", "\"\"")}"`;
+/** Parents first (by forward relations), otherwise in the order given. */
+function order(meta, keys) {
+	const sorted = [];
+	const visiting = /* @__PURE__ */ new Set();
+	const visit = (key) => {
+		if (sorted.includes(key) || visiting.has(key)) return;
+		visiting.add(key);
+		for (const relation of Object.values(meta.tables[key]?.relations ?? {})) if (relation.direction === "forward" && relation.table !== key && keys.includes(relation.table)) visit(relation.table);
+		visiting.delete(key);
+		sorted.push(key);
+	};
+	for (const key of keys) visit(key);
+	return sorted;
+}
+function statement(table, rows) {
+	const entries = Object.entries(rows);
+	if (entries.length === 0) return;
+	const columns = [];
+	for (const [, row] of entries) for (const [key, value] of Object.entries(row)) {
+		if (value === void 0 || columns.includes(key)) continue;
+		const column = table.columns[key];
+		if (!column) throw new TypeError(`seed ${table.key}: unknown column "${key}"`);
+		if (column.generated) throw new TypeError(`seed ${table.key}: "${key}" is a generated column`);
+		columns.push(key);
+	}
+	const values = entries.map(([name, row]) => {
+		return `  (${columns.map((key) => row[key] === void 0 ? "default" : literal(row[key], table.columns[key], `seed ${table.key}.${name}.${key}`)).join(", ")})`;
+	});
+	return `insert into ${`${ident(table.schema)}.${ident(table.name)}`} (${columns.map((key) => ident(table.columns[key].db)).join(", ")}) values\n${values.join(",\n")}\non conflict do nothing;`;
+}
+/**
+* Typed fixtures shared by `supabase/seeds` and your tests. Rows use app
+* casing and Insert types; `better-supabase seed` renders them to SQL.
+*
+* ```ts
+* export const seed = defineSeed(betterSupabase, {
+*   organizations: { acme: { id: ACME, name: 'Acme' } },
+*   customers: { first: { organizationId: ACME, name: 'First customer' } },
+* });
+* ```
+*/
+function defineSeed(betterSupabase, fixtures) {
+	const meta = betterSupabase.meta;
+	const statements = () => {
+		const keys = Object.keys(fixtures).filter((key) => fixtures[key] !== void 0);
+		for (const key of keys) {
+			const table = meta.tables[key];
+			if (!table) throw new TypeError(`seed: unknown table "${key}"`);
+			if (table.kind === "view") throw new TypeError(`seed: "${key}" is a view`);
+		}
+		return order(meta, keys).flatMap((key) => {
+			const sql = statement(meta.tables[key], fixtures[key]);
+			return sql ? [sql] : [];
+		});
+	};
 	return {
-		id: Number(row.id),
-		queue,
-		payload: row.message?.payload,
-		attempts: row.attempts,
-		maxAttempts: row.message?.max_attempts ?? 5,
-		enqueuedAt: instant,
-		visibleUntil: instant,
-		lastError: row.message?.last_error ?? null,
-		context: {}
+		[SEED]: true,
+		rows: fixtures,
+		statements,
+		sql: () => statements().join("\n\n"),
+		async insert(sql) {
+			for (const text of statements()) await sql.queryRaw(text);
+		}
 	};
 }
+//#endregion
+//#region src/testing/kits/executor.ts
+const recorder = (ops) => ({
+	name: "recorder",
+	execute: (op) => {
+		ops.push(op);
+		return Promise.resolve(ok({
+			rows: [],
+			count: 0
+		}));
+	}
+});
+/** The operation `run` sends to the executor, built by `betterSupabase` without touching a database. */
+async function captureOp(betterSupabase, run) {
+	const ops = [];
+	await run(betterSupabase.connect(recorder(ops)));
+	const [op] = ops;
+	if (!op) throw new Error("the repository call did not reach the executor");
+	return op;
+}
+function tableKey(betterSupabase, table) {
+	const key = table ?? Object.keys(betterSupabase.meta.tables)[0];
+	if (!key || !(key in betterSupabase.meta.tables)) throw new TypeError(`better-supabase: unknown table "${String(key)}"`);
+	return key;
+}
+const hasName = (subject) => ["has a name", () => {
+	expect(typeof subject.name === "string" && subject.name.length > 0, "name must be a non-empty string");
+}];
 /**
-* Proves a `QueueBackend` round-trips payloads, hides claimed messages for
-* their lease, counts attempts, retries and dead-letters on `fail`, and
-* (when it has `leases`) rejects a stale attempt and extends a lease. It
-* writes to `options.queue` on the backend's real store.
+* Proves an `Executor` meets the contract: rows keyed by the selection's
+* aliases, counts, `aborted` errors, failures returned as `Result`s rather
+* than thrown, and (with `create`) a write round trip and a `deleteMany`
+* that `maxAffected` refuses without deleting anything.
+*
+* ```ts
+* it('conforms', () => testExecutor(myExecutor, { betterSupabase, table: 'tags', create: { name: 'x' } }));
+* ```
 */
-function testQueueBackend(backend, options) {
-	const { queue } = options;
-	const claimOne = async () => {
-		const [row] = await backend.read(queue, 30, 1);
-		return row && claimedJob(queue, row);
-	};
-	return conform(`QueueBackend "${backend.name}"`, [
-		hasName(backend),
-		["has apiVersion 1", () => {
-			const version = backend.apiVersion;
-			expect(version === 1, "apiVersion must be 1");
+function testExecutor(executor, options) {
+	const { betterSupabase } = options;
+	const table = tableKey(betterSupabase, options.table);
+	const context = { errorMappers: [] };
+	const read = () => captureOp(betterSupabase, (db) => db[table]["findMany"]({ limit: 2 }));
+	const create = options.create;
+	return conform(`Executor "${executor.name}"`, [
+		hasName(executor),
+		["reads rows keyed by the selection aliases", async () => {
+			const op = await read();
+			const result = await executor.execute(op, context);
+			expect(result.ok, `select failed: ${result.ok ? "" : result.error.message}`);
+			expect(isList(result.data.rows), "rows must be an array");
+			expect(result.data.rows.length <= 2, `limit 2 returned ${result.data.rows.length} rows`);
+			expect(result.data.count === null || typeof result.data.count === "number", "count must be a number or null");
+			if (op.kind !== "select") return;
+			const aliases = new Set(op.selection.columns.map((column) => column.alias));
+			for (const row of result.data.rows) {
+				const extra = Object.keys(row).filter((key) => !aliases.has(key));
+				expect(extra.length === 0, `rows must use selection aliases; got ${extra.join(", ")}`);
+			}
 		}],
-		["round-trips a payload and leases it", async () => {
-			const id = await backend.send(queue, { n: 1 }, 0, 3, void 0);
-			expect(Number.isFinite(id), "send must return a numeric id");
-			const job = await claimOne();
-			expect(job?.id === id, "read must return the sent message");
-			expect(same(job.payload, { n: 1 }), "the payload must round-trip");
-			expect(job.attempts === 1, "the first claim must be attempt 1");
-			expect(job.maxAttempts === 3, "max_attempts must round-trip");
-			expect(await claimOne() === void 0, "a leased message must stay hidden from other reads");
-			expect(await backend.complete(job), "complete must return true");
+		["counts rows", async () => {
+			const op = await captureOp(betterSupabase, (db) => db[table]["count"]());
+			const result = await executor.execute(op, context);
+			expect(result.ok, `count failed: ${result.ok ? "" : result.error.message}`);
+			expect(typeof result.data.count === "number" && result.data.count >= 0, "count must be a number");
 		}],
-		backend.leases && ["rejects a stale attempt and extends a lease", async () => {
-			await backend.send(queue, { n: 2 }, 0, 3, void 0);
-			const job = await claimOne();
-			expect(job, "read must return the sent message");
-			expect(!await backend.complete({
-				...job,
-				attempts: job.attempts + 1
-			}), "complete with another attempt must return false");
-			expect(await backend.extend(job, 60), "extend must return true");
-			expect(await backend.complete(job), "complete must return true");
+		["returns an aborted error for an aborted signal", async () => {
+			const controller = new AbortController();
+			controller.abort();
+			const result = await executor.execute(await read(), {
+				...context,
+				signal: controller.signal
+			});
+			expect(!result.ok, "an aborted request must fail");
+			expect(result.error.kind === "aborted", `expected kind "aborted", got "${result.error.kind}"`);
 		}],
-		["retries, then dead-letters at max attempts", async () => {
-			await backend.send(queue, { n: 3 }, 0, 2, void 0);
-			const first = await claimOne();
-			expect(first, "read must return the sent message");
-			expect(await backend.fail(first, "boom", 0) === "queued", "fail before max_attempts must return queued");
-			const second = await claimOne();
-			expect(second?.attempts === 2, "a retried message must be attempt 2");
-			expect(await backend.fail(second, "boom", 0) === "dead", "fail at max_attempts must return dead");
-			expect(await claimOne() === void 0, "a dead message must not be claimed again");
+		["returns failures as results instead of throwing", async () => {
+			const op = await read();
+			const missing = {
+				...op,
+				table: {
+					...op.table,
+					name: "__better_supabase_missing__"
+				}
+			};
+			const result = await executor.execute(missing, context);
+			expect(!result.ok, "a missing table must fail");
+			expect(typeof result.error.kind === "string" && typeof result.error.message === "string", "errors must be DbErrors");
 		}],
-		backend.stats && backend.listDead && ["counts and lists dead letters", async () => {
-			expect(((await backend.stats?.(queue))?.dead ?? 0) >= 1, "stats must count the dead letter");
-			const [dead] = await backend.listDead?.(queue, 10, void 0) ?? [];
-			expect(dead, "listDead must return the dead letter");
-			expect(same(dead.message?.payload, { n: 3 }), "listDead must return the newest dead letter first");
-			if (backend.retryDead) {
-				expect(await backend.retryDead(queue, [Number(dead.id)], 10) === 1, "retryDead must enqueue the dead letter again");
-				const job = await claimOne();
-				expect(job, "the retried job must be claimable");
-				expect(same(job.payload, { n: 3 }), "the retried job must keep its payload");
-				await backend.complete(job);
-			}
+		executor.rpc && ["returns rpc failures as results", async () => {
+			expect(!(await executor.rpc("__better_supabase_missing__", {}, {
+				...context,
+				schema: "public"
+			})).ok, "calling a missing function must fail");
 		}],
-		(options.dedupe ?? backend.leases) && ["returns the first id for a repeated dedupe key", async () => {
-			expect(await backend.send(queue, { n: 4 }, 0, 3, "same") === await backend.send(queue, { n: 4 }, 0, 3, "same"), "a waiting dedupe key must return its id");
-			const job = await claimOne();
-			expect(job, "read must return the sent message");
-			await backend.complete(job);
-		}]
-	]);
-}
-/**
-* Proves a `SupportSessionStore` starts sessions with the input it was
-* given, shows a running session only to its admin, ends the admin's
-* previous session on start, ends a session once, and lists sessions.
-* It writes sessions to the store; they are all ended when it returns.
-*/
-function testSupportSessionStore(store, options) {
-	const { admin } = options;
-	const [first, second] = options.targets;
-	const start = (targetUserId) => store.start({
-		adminId: admin.id,
-		adminClaims: admin.claims,
-		targetUserId,
-		reason: "conformance",
-		ttlSeconds: 600,
-		readOnly: true,
-		metadata: { ticket: "T-1" }
-	});
-	return conform(`SupportSessionStore "${store.name}"`, [
-		hasName(store),
-		["has apiVersion 1", () => {
-			const version = store.apiVersion;
-			expect(version === 1, "apiVersion must be 1");
+		executor.functionSources && ["reads from SelectOp.source instead of the table", async () => {
+			const op = await read();
+			if (op.kind !== "select") return;
+			expect(!(await executor.execute({
+				...op,
+				source: {
+					schema: op.table.schema,
+					name: "__better_supabase_missing__",
+					args: {}
+				}
+			}, context)).ok, "a missing source function must fail; reading the table ignores source");
 		}],
-		["starts a session with its input and shows it to its admin only", async () => {
-			const session = await start(first);
-			try {
-				expect(session.id.length > 0, "start must return an id");
-				expect(session.adminId === admin.id, "adminId must round-trip");
-				expect(session.targetUserId === first, "targetUserId must round-trip");
-				expect(session.reason === "conformance", "reason must round-trip");
-				expect(session.readOnly, "readOnly must round-trip");
-				expect(same(session.metadata, { ticket: "T-1" }), "metadata must round-trip");
-				const seconds = (session.expiresAt.epochMilliseconds - session.startedAt.epochMilliseconds) / 1e3;
-				expect(Math.abs(seconds - 600) < 5, "expiresAt must be ttlSeconds after startedAt");
-				expect((await store.get(session.id, admin.id))?.id === session.id, "get must return the running session");
-				expect(await store.get(session.id, first) === void 0, "get must hide a session from anyone but its admin");
-			} finally {
-				await store.end(session.id, "admin");
-			}
+		executor.batch && ["batch returns one result per operation, in order", async () => {
+			const rows = await read();
+			const count = await captureOp(betterSupabase, (db) => db[table]["count"]());
+			const missing = {
+				...rows,
+				table: {
+					...rows.table,
+					name: "__better_supabase_missing__"
+				}
+			};
+			const results = await executor.batch([
+				rows,
+				count,
+				missing
+			], context);
+			expect(results.length === 3, `expected 3 results, got ${results.length}`);
+			const [first, second, third] = results;
+			expect(first?.ok === true && Array.isArray(first.data.rows), "the first operation must return rows");
+			expect(second?.ok === true && typeof second.data.count === "number", "the second operation must return a count");
+			expect(third?.ok === false, "a failing operation must fail on its own, as a result");
 		}],
-		["ends the admin's previous session on start", async () => {
-			const older = await start(first);
-			const newer = await start(second);
-			try {
-				expect(await store.get(older.id, admin.id) === void 0, "starting a session must end the admin's previous one");
-				expect((await store.get(newer.id, admin.id))?.id === newer.id, "the new session must be running");
-			} finally {
-				await store.end(newer.id, "admin");
-			}
+		create && ["round-trips a write", async () => {
+			const repository = betterSupabase.connect(executor)[table];
+			const created = await repository["create"](create);
+			expect(created.ok, `create failed: ${JSON.stringify(created.error)}`);
+			const row = created.data;
+			for (const [key, value] of Object.entries(create)) expect(same(row[key], value), `created row has ${key} = ${JSON.stringify(row[key])}`);
+			const [primary] = betterSupabase.meta.tables[table].primaryKey;
+			expect(primary, "write checks need a table with a primary key");
+			const removed = await repository["delete"](row[primary]);
+			expect(removed.ok, `delete failed: ${JSON.stringify(removed.error)}`);
+			const again = await repository["findFirst"]({ where: { [primary]: row[primary] } });
+			expect(again.ok && again.data === null, "the deleted row is still readable");
 		}],
-		["ends a session once and lists it", async () => {
-			const session = await start(first);
-			expect(await store.end(session.id, "admin"), "end must return true");
-			expect(!await store.end(session.id, "admin"), "ending an ended session must return false");
-			expect(await store.get(session.id, admin.id) === void 0, "get must not return an ended session");
-			const entry = (await store.list({
-				adminId: admin.id,
-				active: false
-			})).find((item) => item.id === session.id);
-			expect(entry, "list must include the ended session");
-			expect(entry.endedAt !== void 0, "an ended session has endedAt");
-			expect((await store.list({
-				adminId: admin.id,
-				active: true
-			})).every((item) => item.id !== session.id), "list({ active: true }) must leave out ended sessions");
+		create && ["refuses a write past maxAffected and writes nothing", async () => {
+			const repository = betterSupabase.connect(executor)[table];
+			const [primary] = betterSupabase.meta.tables[table].primaryKey;
+			expect(primary, "write checks need a table with a primary key");
+			const created = await repository["create"](create);
+			expect(created.ok, `create failed: ${JSON.stringify(created.error)}`);
+			const id = created.data[primary];
+			try {
+				const refused = await repository["deleteMany"]({
+					where: { [primary]: id },
+					maxAffected: 0
+				});
+				expect(!refused.ok, "deleteMany past maxAffected must fail");
+				const kind = refused.error?.kind;
+				expect(kind === "max_affected", `expected kind "max_affected", got "${String(kind)}"`);
+				const kept = await repository["findFirst"]({ where: { [primary]: id } });
+				expect(kept.ok && kept.data !== null, "a refused deleteMany must not delete the row");
+				const allowed = await repository["deleteMany"]({
+					where: { [primary]: id },
+					maxAffected: 1
+				});
+				expect(allowed.ok, `deleteMany within maxAffected failed: ${JSON.stringify(allowed.error)}`);
+			} finally {
+				await repository["delete"](id);
+			}
 		}]
 	]);
 }
+//#endregion
+//#region src/testing/kits/auth-resolver.ts
 async function resolveSafely(resolver, request) {
 	try {
 		return await resolver.resolve(request);
@@ -873,6 +1306,393 @@ function testAuthResolver(resolver, options) {
 		}]
 	]);
 }
+//#endregion
+//#region src/testing/kits/cache-adapter.ts
+/**
+* Proves a `CacheAdapter` accepts table and row targets, repeated and
+* concurrent calls, and never mutates its input.
+*/
+function testCacheAdapter(adapter, options = {}) {
+	const table = options.table ?? "customers";
+	const invalidate = (target) => Promise.resolve(adapter.invalidate(deepFreeze(target)));
+	return conform(`CacheAdapter "${adapter.name}"`, [
+		hasName(adapter),
+		["invalidates a table", () => invalidate({
+			table,
+			tables: [table],
+			ids: []
+		})],
+		["invalidates rows of a tenant", () => invalidate({
+			table,
+			tables: [table],
+			ids: ["1", "a,b"],
+			tenant: "organization_1"
+		})],
+		["accepts repeated and concurrent calls", async () => {
+			await invalidate({
+				table,
+				tables: [table],
+				ids: ["1"]
+			});
+			await Promise.all(Array.from({ length: 10 }, (_, index) => invalidate({
+				table,
+				tables: [table],
+				ids: [String(index)]
+			})));
+		}],
+		["accepts tables it has never seen", () => invalidate({
+			table: "__better_supabase_unknown__",
+			tables: ["__better_supabase_unknown__"],
+			ids: []
+		})],
+		["invalidates tables reached through foreign keys", () => invalidate({
+			table,
+			tables: [table, `${table}_children`],
+			ids: ["1"]
+		})]
+	]);
+}
+//#endregion
+//#region src/testing/kits/event-sink.ts
+/** Proves an `EventSink` accepts empty and full batches without mutating them, and delivers them when readable. */
+function testEventSink(sink, options = {}) {
+	const events = toCloudEvents({
+		table: "customers",
+		kind: "insert",
+		rows: [{
+			id: "1",
+			name: "Acme"
+		}, {
+			id: "2",
+			name: "Globex"
+		}],
+		context: { tenant: "organization_1" }
+	}, { source: "/better-supabase/conformance" });
+	return conform("EventSink", [
+		["accepts an empty batch", () => sink.send(deepFreeze([]))],
+		["accepts a batch without mutating it", () => sink.send(frozenCopy(events))],
+		options.received && ["delivers every event", async () => {
+			const ids = new Set((await options.received()).map((event) => event.id));
+			const missing = events.filter((event) => !ids.has(event.id));
+			expect(missing.length === 0, `${missing.length} of ${events.length} events were not delivered`);
+		}]
+	]);
+}
+//#endregion
+//#region src/testing/kits/payment-provider.ts
+const kindOf$2 = (result) => result.ok ? "ok" : result.error.kind;
+const half = (value) => ({
+	amount: value.amount / 2n,
+	currency: value.currency
+});
+/**
+* Runs the `PaymentProvider` contract against `provider`: the API version,
+* refused amounts, a created payment and its fields, an idempotency key
+* that pays once, `not_found` for an unknown payment, and, with the
+* options that drive them, capture and refunds of an authorized payment
+* and webhook verification. Every call carries a fresh reference, so the
+* kit runs against a test account without cleanup.
+*/
+function testPaymentProvider(provider, options = {}) {
+	const amount = options.amount ?? money(1000n, "EUR");
+	const reference = () => `conformance-${crypto.randomUUID()}`;
+	const { authorize, webhook } = options;
+	const authorized = async () => {
+		const created = await provider.createPayment({
+			amount,
+			reference: reference(),
+			capture: "manual"
+		}).orThrow();
+		await authorize?.(created);
+		return created;
+	};
+	return conform(`PaymentProvider "${provider.name}"`, [
+		["has apiVersion 1 and a name", () => {
+			const version = provider.apiVersion;
+			expect(version === 1, `apiVersion is ${String(version)}`);
+			expect(provider.name.length > 0, "name is empty");
+		}],
+		["refuses a zero amount and a number instead of Money", async () => {
+			const zero = await provider.createPayment({
+				amount: {
+					amount: 0n,
+					currency: amount.currency
+				},
+				reference: reference()
+			});
+			expect(kindOf$2(zero) === "invalid_input", `zero gave ${kindOf$2(zero)}`);
+			const plain = await provider.createPayment({
+				amount: 1e3,
+				reference: reference()
+			});
+			expect(kindOf$2(plain) === "invalid_input", `a number gave ${kindOf$2(plain)}`);
+		}],
+		["creates a payment with its amount, reference and provider", async () => {
+			const ref = reference();
+			const payment = await provider.createPayment({
+				amount,
+				reference: ref
+			}).orThrow();
+			expect(payment.id.length > 0, "the payment has no id");
+			expect(payment.provider === provider.name, `provider is ${payment.provider}`);
+			expect(payment.reference === ref, `reference is ${payment.reference}`);
+			expect(payment.amount.amount === amount.amount && payment.amount.currency === amount.currency, `amount is ${String(payment.amount.amount)} ${payment.amount.currency}`);
+			expect(payment.refunded.amount === 0n, "a new payment has refunds");
+			expect(typeof payment.amount.amount === "bigint", "the amount is not a bigint");
+		}],
+		["pays once for one idempotency key", async () => {
+			const key = crypto.randomUUID();
+			const input = {
+				amount,
+				reference: reference()
+			};
+			const first = await provider.createPayment(input, { idempotencyKey: key }).orThrow();
+			const again = await provider.createPayment(input, { idempotencyKey: key }).orThrow();
+			expect(first.id === again.id, "the same key created a second payment");
+		}],
+		["returns not_found for an unknown payment", async () => {
+			const id = `conformance_missing_${crypto.randomUUID()}`;
+			const captured = await provider.capture(id);
+			expect(kindOf$2(captured) === "not_found", `capture gave ${kindOf$2(captured)}`);
+			const refunded = await provider.refund(id);
+			expect(kindOf$2(refunded) === "not_found", `refund gave ${kindOf$2(refunded)}`);
+		}],
+		provider.get !== void 0 && ["reads a payment back", async () => {
+			const created = await provider.createPayment({
+				amount,
+				reference: reference()
+			}).orThrow();
+			const read = await provider.get?.(created.id).orThrow();
+			expect(read?.id === created.id, "get returned another payment");
+			expect(read.reference === created.reference, "get lost the reference");
+		}],
+		authorize !== void 0 && ["captures an authorized payment", async () => {
+			const payment = await authorized();
+			const captured = await provider.capture(payment.id).orThrow();
+			expect(captured.status === "succeeded", `status is ${captured.status}`);
+			expect(captured.captured.amount === amount.amount, `captured ${String(captured.captured.amount)}`);
+		}],
+		authorize !== void 0 && ["refunds part of a payment and refuses more than is left", async () => {
+			const payment = await authorized();
+			await provider.capture(payment.id).orThrow();
+			const part = half(amount);
+			const refund = await provider.refund(payment.id, { amount: part }).orThrow();
+			expect(refund.paymentId === payment.id, "the refund names another payment");
+			expect(refund.amount.amount === part.amount, `refunded ${String(refund.amount.amount)}`);
+			expect(refund.status === "succeeded" || refund.status === "pending", `refund status is ${refund.status}`);
+			const tooMuch = await provider.refund(payment.id, { amount });
+			expect(kindOf$2(tooMuch) === "invalid_input", `refunding more than is left gave ${kindOf$2(tooMuch)}`);
+		}],
+		provider.cancel !== void 0 && ["cancels a payment that was not captured", async () => {
+			const created = await provider.createPayment({
+				amount,
+				reference: reference(),
+				capture: "manual"
+			}).orThrow();
+			const canceled = await provider.cancel?.(created.id).orThrow();
+			expect(canceled?.status === "canceled", `status is ${String(canceled?.status)}`);
+		}],
+		webhook !== void 0 && ["parses a signed webhook and refuses a tampered one", async () => {
+			const payment = await provider.createPayment({
+				amount,
+				reference: reference()
+			}).orThrow();
+			const { valid, tampered } = await webhook(payment);
+			const events = await provider.parseWebhook(valid).orThrow();
+			expect(events.length > 0, "a signed delivery gave no events");
+			for (const event of events) {
+				expect(event.id.length > 0, "an event has no id");
+				expect(event.paymentId === payment.id, `an event names payment ${event.paymentId}`);
+			}
+			const refused = await provider.parseWebhook(tampered);
+			expect(kindOf$2(refused) === "unauthorized", `a tampered delivery gave ${kindOf$2(refused)}`);
+		}]
+	]);
+}
+//#endregion
+//#region src/testing/kits/tax-provider.ts
+const kindOf$1 = (result) => result.ok ? "ok" : result.error.kind;
+const sum = (values) => values.reduce((total, value) => total + value.amount, 0n);
+/**
+* Runs the `TaxProvider` contract against `provider`: the API version,
+* refused carts, a quote with one line per cart line in order and a total
+* that adds up, inclusive prices, shipping, exempt customers, commit, and
+* full and partial reversals with their limits. Every commit carries a
+* fresh reference, so the kit runs against a test account without cleanup.
+*/
+function testTaxProvider(provider, options) {
+	const currency = options.currency ?? "EUR";
+	const { address, taxCategory } = options;
+	const expectTax = options.expectTax ?? true;
+	const line = (id, minor, inclusive = false) => ({
+		id,
+		amount: money(minor, currency),
+		inclusive,
+		...taxCategory === void 0 ? {} : { taxCategory }
+	});
+	const cart = (overrides = {}) => ({
+		currency,
+		address,
+		lines: [line("a", 10000n), line("b", 2500n)],
+		...overrides
+	});
+	const reference = () => `conformance-${crypto.randomUUID()}`;
+	const committed = async () => {
+		const quote = await provider.quote(cart()).orThrow();
+		return provider.commit({
+			quote,
+			reference: reference()
+		}).orThrow();
+	};
+	const addsUp = (quote) => {
+		expect(quote.totalTax.amount === sum(quote.lines.map((each) => each.tax)), "totalTax is not the sum of the lines' tax");
+		for (const each of quote.lines) {
+			expect(isRate(each.rate), `line ${each.lineId} has rate "${each.rate}"`);
+			expect(each.tax.currency === currency && each.taxable.currency === currency, `line ${each.lineId} is not in ${currency}`);
+		}
+	};
+	return conform(`TaxProvider "${provider.name}"`, [
+		["has apiVersion 1 and a name", () => {
+			const version = provider.apiVersion;
+			expect(version === 1, `apiVersion is ${String(version)}`);
+			expect(provider.name.length > 0, "name is empty");
+		}],
+		["refuses a cart that mixes currencies or has no country", async () => {
+			const other = currency === "USD" ? "EUR" : "USD";
+			const mixed = await provider.quote(cart({ lines: [{
+				id: "a",
+				amount: money(100n, other)
+			}] }));
+			expect(kindOf$1(mixed) === "invalid_input", `mixed currencies gave ${kindOf$1(mixed)}`);
+			const nowhere = await provider.quote(cart({ address: {
+				...address,
+				country: ""
+			} }));
+			expect(kindOf$1(nowhere) === "invalid_input", `no country gave ${kindOf$1(nowhere)}`);
+		}],
+		["quotes one line per cart line, in order, with a total that adds up", async () => {
+			const quote = await provider.quote(cart()).orThrow();
+			expect(quote.provider === provider.name, `provider is ${quote.provider}`);
+			expect(quote.lines.map((each) => each.lineId).join(",") === "a,b", `lines are ${quote.lines.map((each) => each.lineId).join(",")}`);
+			expect(quote.lines[0]?.taxable.amount === 10000n, "line a lost its amount");
+			addsUp(quote);
+			expect(expectTax ? quote.totalTax.amount > 0n : quote.totalTax.amount === 0n, `totalTax is ${String(quote.totalTax.amount)}`);
+		}],
+		["splits an inclusive price into taxable and tax", async () => {
+			const only = (await provider.quote(cart({ lines: [line("a", 12100n, true)] })).orThrow()).lines[0];
+			expect(only?.inclusive === true, "the line is not inclusive");
+			expect(only.taxable.amount + only.tax.amount === 12100n, "taxable and tax don't add up to the price");
+		}],
+		["quotes shipping as the last line", async () => {
+			const quote = await provider.quote(cart({ shipping: { amount: money(500n, currency) } })).orThrow();
+			expect(quote.lines.at(-1)?.lineId === SHIPPING_LINE, "the last line is not shipping");
+			addsUp(quote);
+		}],
+		["charges an exempt customer no tax", async () => {
+			const quote = await provider.quote(cart({ customer: { exempt: true } })).orThrow();
+			expect(quote.totalTax.amount === 0n, `totalTax is ${String(quote.totalTax.amount)}`);
+		}],
+		["commits a quote as a transaction", async () => {
+			const quote = await provider.quote(cart()).orThrow();
+			const ref = reference();
+			const transaction = await provider.commit({
+				quote,
+				reference: ref
+			}).orThrow();
+			expect(transaction.id.length > 0, "the transaction has no id");
+			expect(transaction.reference === ref, "the reference changed");
+			expect(transaction.totalTax.amount === quote.totalTax.amount, "the transaction's tax differs from the quote");
+		}],
+		["reverses a whole sale", async () => {
+			const sale = await committed();
+			const reversal = await provider.reverse({
+				transaction: sale,
+				reference: reference()
+			}).orThrow();
+			expect(reversal.totalTax.amount === -sale.totalTax.amount, `reversed ${String(reversal.totalTax.amount)} of ${String(sale.totalTax.amount)}`);
+		}],
+		["reverses part of a line and refuses more than was sold", async () => {
+			const sale = await committed();
+			const sold = sale.lines[0];
+			expect(sold !== void 0, "the sale has no lines");
+			const part = {
+				lineId: sold.lineId,
+				amount: money(sold.taxable.amount / 2n, currency),
+				tax: money(sold.tax.amount / 2n, currency)
+			};
+			const reversal = await provider.reverse({
+				transaction: sale,
+				reference: reference(),
+				lines: [part]
+			}).orThrow();
+			expect(reversal.totalTax.amount === -part.tax.amount, `reversed ${String(reversal.totalTax.amount)}`);
+			const tooMuch = await provider.reverse({
+				transaction: sale,
+				reference: reference(),
+				lines: [{
+					...part,
+					amount: money(sold.taxable.amount + 1n, currency)
+				}]
+			});
+			expect(kindOf$1(tooMuch) === "invalid_input", `reversing more than was sold gave ${kindOf$1(tooMuch)}`);
+			const unknown = await provider.reverse({
+				transaction: sale,
+				reference: reference(),
+				lines: [{
+					...part,
+					lineId: "conformance-unknown"
+				}]
+			});
+			expect(kindOf$1(unknown) === "invalid_input", `an unknown line gave ${kindOf$1(unknown)}`);
+		}]
+	]);
+}
+//#endregion
+//#region src/testing/kits/incoming-destination.ts
+/**
+* Proves an `IncomingDestination` accepts a delivery once per endpoint and
+* message id: a repeat reports the first id as a duplicate, while another
+* message id or another endpoint is new.
+* It delivers four messages with random endpoint ids; the destination keeps them.
+*/
+function testIncomingDestination(destination, options) {
+	const endpoint = crypto.randomUUID();
+	const delivery = (messageId, endpointId = endpoint) => ({
+		endpoint: {
+			id: endpointId,
+			tenant: options.tenant,
+			metadata: {}
+		},
+		source: options.source ?? "conformance",
+		messageId,
+		type: "conformance.test",
+		payload: {
+			type: "conformance.test",
+			messageId
+		},
+		headers: {}
+	});
+	return conform(`IncomingDestination "${destination.name}"`, [
+		hasName(destination),
+		["has apiVersion 1", () => {
+			const version = destination.apiVersion;
+			expect(version === 1, "apiVersion must be 1");
+		}],
+		["reports a repeated endpoint and message id as a duplicate of the first", async () => {
+			const first = await destination.deliver(delivery("m1"));
+			expect(!first.duplicate, "the first delivery must not be a duplicate");
+			const again = await destination.deliver(delivery("m1"));
+			expect(again.duplicate, "a repeated delivery must be a duplicate");
+			expect(String(again.id) === String(first.id), "a duplicate must return the first delivery's id");
+		}],
+		["treats another message id or another endpoint as a new delivery", async () => {
+			expect(!(await destination.deliver(delivery("m2"))).duplicate, "another message id must be new");
+			expect(!(await destination.deliver(delivery("m1", crypto.randomUUID()))).duplicate, "the same id on another endpoint must be new");
+		}]
+	]);
+}
+//#endregion
+//#region src/testing/kits/plugin.ts
 /**
 * Proves a `Plugin` targets API v1, installs cleanly on its own and next to
 * the first-party plugins in either order, adds repository methods without
@@ -998,356 +1818,292 @@ function testPlugin(plugin, options) {
 	]);
 }
 //#endregion
-//#region src/testing/isolation.ts
-const scalar = (value) => typeof value === "string" || typeof value === "number" || typeof value === "boolean";
-function keyOf(table, row) {
-	return Object.fromEntries(table.primaryKey.map((column) => [column, row[column]]));
-}
-async function rowsOf(outcome) {
-	const result = await outcome;
-	if (!result.ok) throw new Error(result.error.message);
-	return Array.isArray(result.data) ? result.data : [result.data];
-}
-function env(names) {
-	if (typeof process === "undefined") return void 0;
-	for (const name of names) {
-		const value = process.env[name];
-		if (value) return value;
-	}
+//#region src/testing/kits/queue-backend.ts
+function claimedJob(queue, row) {
+	const instant = temporal().Instant.fromEpochMilliseconds(0);
+	return {
+		id: Number(row.id),
+		queue,
+		payload: row.message?.payload,
+		attempts: row.attempts,
+		maxAttempts: row.message?.max_attempts ?? 5,
+		enqueuedAt: instant,
+		visibleUntil: instant,
+		lastError: row.message?.last_error ?? null,
+		context: {}
+	};
 }
 /**
-* Checks row-level security between two tenants against a running stack: for
-* each table, a user of one tenant must not select, insert, update or delete
-* the other tenant's rows. Runs without `betterSupabase`'s plugins, so the `tenant()`
-* plugin can't hide a missing policy. Throws a `ConformanceError` naming each
-* table and command that leaks; removes every row it created.
-*
-* ```ts
-* await expectTenantIsolation(betterSupabase, {
-*   tenants: [
-*     { id: ACME, claims: { sub: alice, tenant_id: ACME } },
-*     { id: GLOBEX, claims: { sub: bob, tenant_id: GLOBEX } },
-*   ],
-*   tables: {
-*     tags: {
-*       row: (tenant, n) => ({ organizationId: tenant.id, name: `iso-${n}` }),
-*       update: { name: 'changed' },
-*     },
-*   },
-* });
-* ```
+* Proves a `QueueBackend` round-trips payloads, hides claimed messages for
+* their lease, counts attempts, retries and dead-letters on `fail`, and
+* (when it has `leases`) rejects a stale attempt and extends a lease. It
+* writes to `options.queue` on the backend's real store.
 */
-async function expectTenantIsolation(betterSupabase, options) {
-	const stack = options.stack ?? {};
-	const bare = new BetterSupabase(betterSupabase.schema);
-	const url = stack.url ?? env(ENV_VARIABLES.url) ?? "http://127.0.0.1:54321";
-	const secretKey = stack.secretKey ?? env(ENV_VARIABLES.secretKey);
-	if (!secretKey) throw new TypeError("expectTenantIsolation needs stack.secretKey or $SUPABASE_SECRET_KEY to seed rows.");
-	const admin = bare.connect(createClient(url, secretKey, { auth: {
-		persistSession: false,
-		autoRefreshToken: false
-	} }));
-	await options.seed?.();
-	const tenants = options.tenants;
-	const users = await Promise.all(tenants.map(async (tenant) => (await asUser(bare, tenant.claims, stack)).db));
-	const label = (tenant) => tenant.name ?? tenant.id;
-	const cleanup = [];
-	const reads = [];
-	const deletes = [];
-	try {
-		for (const [key, spec] of Object.entries(options.tables)) {
-			const table = bare.meta.tables[key];
-			if (!table || table.primaryKey.length === 0) throw new TypeError(`expectTenantIsolation: "${key}" is not a table with a primary key`);
-			const seeded = [];
-			for (const tenant of tenants) {
-				const [row] = await rowsOf(admin[key].create(spec.row(tenant, 0)));
-				const where = keyOf(table, row);
-				cleanup.push(() => admin[key].deleteMany({ where }));
-				seeded.push(row);
-			}
-			for (const [self, other] of [[0, 1], [1, 0]]) {
-				const user = users[self][key];
-				const who = label(tenants[self]);
-				const whose = `${label(tenants[other])}'s`;
-				const own = keyOf(table, seeded[self]);
-				const target = keyOf(table, seeded[other]);
-				const current = async () => (await rowsOf(admin[key].findMany({ where: target })))[0];
-				reads.push([`${key}: ${who} reads its own row`, async () => {
-					expect((await rowsOf(user.findMany({ where: own }))).length === 1, `${who} can't read its own row, so the other checks prove nothing; check its claims and memberships`);
-				}], [`${key}: ${who} can't select ${whose} rows`, async () => {
-					expect((await rowsOf(user.findMany({ where: target }))).length === 0, `select returned ${whose} row`);
-				}], [`${key}: ${who} can't insert ${whose} rows`, async () => {
-					const row = spec.row(tenants[other], 1);
-					const result = await user.create(row, { returning: false });
-					if (result.ok) {
-						const where = Object.fromEntries(Object.entries(row).filter(([, value]) => scalar(value)));
-						cleanup.push(() => admin[key].deleteMany({ where }));
-					}
-					expect(!result.ok, `insert of a row for ${whose} tenant succeeded`);
-					expect(result.error.kind === "forbidden", `insert failed with ${result.error.kind} (${result.error.message}), not an RLS error; check the row factory`);
-				}], [`${key}: ${who} can't update ${whose} rows`, async () => {
-					const before = await current();
-					const patch = spec.update;
-					expect(Object.entries(patch).some(([column, value]) => before?.[column] !== value), "update must change the row to detect a leak");
-					await user.updateMany({
-						where: target,
-						data: patch,
-						returning: false
-					});
-					const after = await current();
-					expect(Object.entries(patch).every(([column]) => after?.[column] === before?.[column]), `update changed ${whose} row`);
-				}]);
-				deletes.push([`${key}: ${who} can't delete ${whose} rows`, async () => {
-					await user.deleteMany({ where: target });
-					expect(await current() !== void 0, `delete removed ${whose} row`);
-				}]);
+function testQueueBackend(backend, options) {
+	const { queue } = options;
+	const claimOne = async () => {
+		const [row] = await backend.read(queue, 30, 1);
+		return row && claimedJob(queue, row);
+	};
+	return conform(`QueueBackend "${backend.name}"`, [
+		hasName(backend),
+		["has apiVersion 1", () => {
+			const version = backend.apiVersion;
+			expect(version === 1, "apiVersion must be 1");
+		}],
+		["round-trips a payload and leases it", async () => {
+			const id = await backend.send(queue, { n: 1 }, 0, 3, void 0);
+			expect(Number.isFinite(id), "send must return a numeric id");
+			const job = await claimOne();
+			expect(job?.id === id, "read must return the sent message");
+			expect(same(job.payload, { n: 1 }), "the payload must round-trip");
+			expect(job.attempts === 1, "the first claim must be attempt 1");
+			expect(job.maxAttempts === 3, "max_attempts must round-trip");
+			expect(await claimOne() === void 0, "a leased message must stay hidden from other reads");
+			expect(await backend.complete(job), "complete must return true");
+		}],
+		backend.leases && ["rejects a stale attempt and extends a lease", async () => {
+			await backend.send(queue, { n: 2 }, 0, 3, void 0);
+			const job = await claimOne();
+			expect(job, "read must return the sent message");
+			expect(!await backend.complete({
+				...job,
+				attempts: job.attempts + 1
+			}), "complete with another attempt must return false");
+			expect(await backend.extend(job, 60), "extend must return true");
+			expect(await backend.complete(job), "complete must return true");
+		}],
+		["retries, then dead-letters at max attempts", async () => {
+			await backend.send(queue, { n: 3 }, 0, 2, void 0);
+			const first = await claimOne();
+			expect(first, "read must return the sent message");
+			expect(await backend.fail(first, "boom", 0) === "queued", "fail before max_attempts must return queued");
+			const second = await claimOne();
+			expect(second?.attempts === 2, "a retried message must be attempt 2");
+			expect(await backend.fail(second, "boom", 0) === "dead", "fail at max_attempts must return dead");
+			expect(await claimOne() === void 0, "a dead message must not be claimed again");
+		}],
+		backend.stats && backend.listDead && ["counts and lists dead letters", async () => {
+			expect(((await backend.stats?.(queue))?.dead ?? 0) >= 1, "stats must count the dead letter");
+			const [dead] = await backend.listDead?.(queue, 10, void 0) ?? [];
+			expect(dead, "listDead must return the dead letter");
+			expect(same(dead.message?.payload, { n: 3 }), "listDead must return the newest dead letter first");
+			if (backend.retryDead) {
+				expect(await backend.retryDead(queue, [Number(dead.id)], 10) === 1, "retryDead must enqueue the dead letter again");
+				const job = await claimOne();
+				expect(job, "the retried job must be claimable");
+				expect(same(job.payload, { n: 3 }), "the retried job must keep its payload");
+				await backend.complete(job);
 			}
-		}
-		return await conform("Tenant isolation", [...reads, ...deletes]);
-	} finally {
-		for (const remove of cleanup.reverse()) await remove();
-	}
+		}],
+		(options.dedupe ?? backend.leases) && ["returns the first id for a repeated dedupe key", async () => {
+			expect(await backend.send(queue, { n: 4 }, 0, 3, "same") === await backend.send(queue, { n: 4 }, 0, 3, "same"), "a waiting dedupe key must return its id");
+			const job = await claimOne();
+			expect(job, "read must return the sent message");
+			await backend.complete(job);
+		}],
+		backend.sendOnce && ["sends once per key, counting completed messages, when it has sendOnce", async () => {
+			const key = `once-${Date.now()}`;
+			const first = await backend.sendOnce?.(queue, { n: 5 }, 0, 3, key);
+			expect(first && !first.duplicate, "the first sendOnce must send");
+			const job = await claimOne();
+			expect(job?.id === first.id, "read must return the sent message");
+			await backend.complete(job);
+			const again = await backend.sendOnce?.(queue, { n: 5 }, 0, 3, key);
+			expect(again?.duplicate === true && again.id === first.id, "sendOnce after completion must return the first id as a duplicate");
+		}]
+	]);
 }
 //#endregion
-//#region src/testing/claims-fixtures.ts
-const base = {
-	sub: "6f1c2c1e-5d0a-4d9e-9a51-6b1f0e7c2a10",
-	aud: "authenticated",
-	role: "authenticated",
-	iss: "https://project.supabase.co/auth/v1",
-	aal: "aal1",
-	session_id: "b7a8f9c0-1111-4222-8333-944455556666",
-	is_anonymous: false
-};
-const admin = "9a8b7c6d-5e4f-4a3b-8c2d-1e0f9a8b7c6d";
-const supportSessionId = "4e5f6a7b-8c9d-4e0f-9a1b-2c3d4e5f6a7b";
-const client = "5f0e4d3c-2b1a-4098-8776-655443322110";
-const chain = {
-	sub: "agent-runner",
-	act: { sub: "mcp-client-42" }
-};
+//#region src/testing/kits/support-session-store.ts
 /**
-* `supportSession` and `supportSessionReadOnly` are what `supportClaims`
-* mints (`act.kind: "support"`), `impersonation` what `actingAs` mints
-* (`act.kind: "impersonation"`), `oauthClient` a Supabase OAuth server token
-* and `agentChain` an RFC 8693 chain without `kind`.
+* Proves a `SupportSessionStore` starts sessions with the input it was
+* given, shows a running session only to its admin, ends the admin's
+* previous session on start, ends a session once, lists sessions and, with
+* `expire`, leaves running sessions alone.
+* It writes sessions to the store; they are all ended when it returns.
 */
-const supabaseClaimFixtures = {
-	supportSession: {
-		claims: {
-			...base,
-			act: {
-				kind: "support",
-				sub: admin,
-				reason: "ticket 42",
-				session_id: supportSessionId,
-				read_only: false
-			}
-		},
-		expect: {
-			actor: {
-				kind: "support",
-				id: admin,
-				sessionId: supportSessionId,
-				readOnly: false,
-				reason: "ticket 42"
-			},
-			impersonator: {
-				kind: "support",
-				id: admin,
-				sessionId: supportSessionId,
-				readOnly: false,
-				reason: "ticket 42"
-			}
-		}
-	},
-	supportSessionReadOnly: {
-		claims: {
-			...base,
-			act: {
-				kind: "support",
-				sub: admin,
-				reason: "ticket 42",
-				session_id: supportSessionId,
-				read_only: true
-			}
-		},
-		expect: {
-			actor: {
-				kind: "support",
-				id: admin,
-				sessionId: supportSessionId,
-				readOnly: true,
-				reason: "ticket 42"
-			},
-			impersonator: {
-				kind: "support",
-				id: admin,
-				sessionId: supportSessionId,
-				readOnly: true,
-				reason: "ticket 42"
-			}
-		}
-	},
-	impersonation: {
-		claims: {
-			...base,
-			act: {
-				kind: "impersonation",
-				sub: admin,
-				reason: "ticket 42"
+function testSupportSessionStore(store, options) {
+	const { admin } = options;
+	const [first, second] = options.targets;
+	const start = (targetUserId) => store.start({
+		adminId: admin.id,
+		adminClaims: admin.claims,
+		targetUserId,
+		reason: "conformance",
+		ttlSeconds: 600,
+		readOnly: true,
+		metadata: { ticket: "T-1" }
+	});
+	return conform(`SupportSessionStore "${store.name}"`, [
+		hasName(store),
+		["has apiVersion 1", () => {
+			const version = store.apiVersion;
+			expect(version === 1, "apiVersion must be 1");
+		}],
+		["starts a session with its input and shows it to its admin only", async () => {
+			const session = await start(first);
+			try {
+				expect(session.id.length > 0, "start must return an id");
+				expect(session.adminId === admin.id, "adminId must round-trip");
+				expect(session.targetUserId === first, "targetUserId must round-trip");
+				expect(session.reason === "conformance", "reason must round-trip");
+				expect(session.readOnly, "readOnly must round-trip");
+				expect(same(session.metadata, { ticket: "T-1" }), "metadata must round-trip");
+				const seconds = (session.expiresAt.epochMilliseconds - session.startedAt.epochMilliseconds) / 1e3;
+				expect(Math.abs(seconds - 600) < 5, "expiresAt must be ttlSeconds after startedAt");
+				expect((await store.get(session.id, admin.id))?.id === session.id, "get must return the running session");
+				expect(await store.get(session.id, first) === void 0, "get must hide a session from anyone but its admin");
+			} finally {
+				await store.end(session.id, "admin");
 			}
-		},
-		expect: {
-			actor: {
-				kind: "impersonation",
-				id: admin,
-				reason: "ticket 42"
-			},
-			impersonator: {
-				kind: "impersonation",
-				id: admin,
-				reason: "ticket 42"
+		}],
+		["ends the admin's previous session on start", async () => {
+			const older = await start(first);
+			const newer = await start(second);
+			try {
+				expect(await store.get(older.id, admin.id) === void 0, "starting a session must end the admin's previous one");
+				expect((await store.get(newer.id, admin.id))?.id === newer.id, "the new session must be running");
+			} finally {
+				await store.end(newer.id, "admin");
 			}
-		}
-	},
-	oauthClient: {
-		claims: {
-			...base,
-			client_id: client,
-			scope: "openid email posts:read"
-		},
-		expect: {
-			actor: {
-				kind: "oauth-client",
-				id: client
-			},
-			delegation: { scopes: [
-				"openid",
-				"email",
-				"posts:read"
-			] }
-		}
-	},
-	agentChain: {
-		claims: {
-			...base,
-			scope: "posts:read",
-			act: chain
-		},
-		expect: {
-			actor: {
-				kind: "oauth-client",
-				id: "agent-runner",
-				chain
-			},
-			delegation: {
-				scopes: ["posts:read"],
-				chain
+		}],
+		["ends a session once and lists it", async () => {
+			const session = await start(first);
+			expect(await store.end(session.id, "admin"), "end must return true");
+			expect(!await store.end(session.id, "admin"), "ending an ended session must return false");
+			expect(await store.get(session.id, admin.id) === void 0, "get must not return an ended session");
+			const entry = (await store.list({
+				adminId: admin.id,
+				active: false
+			})).find((item) => item.id === session.id);
+			expect(entry, "list must include the ended session");
+			expect(entry.endedAt !== void 0, "an ended session has endedAt");
+			expect((await store.list({
+				adminId: admin.id,
+				active: true
+			})).every((item) => item.id !== session.id), "list({ active: true }) must leave out ended sessions");
+		}],
+		["expires only sessions past their expiry, when it has expire", async () => {
+			if (!store.expire) return;
+			const session = await start(first);
+			try {
+				const expired = await store.expire();
+				expect(expired.every((item) => item.id !== session.id), "expire must leave a running session alone");
+				expect(expired.every((item) => item.endedBy === "expired"), "expire must end sessions with endedBy expired");
+				expect((await store.get(session.id, admin.id))?.id === session.id, "the running session must still be running after expire");
+			} finally {
+				await store.end(session.id, "admin");
 			}
-		}
-	}
-};
-//#endregion
-//#region src/testing/seed.ts
-const SEED = Symbol.for("better-supabase.seed");
-function isSeed(value) {
-	return typeof value === "object" && value !== null && SEED in value;
-}
-const quote = (text) => `'${text.replaceAll("'", "''")}'`;
-function arrayLiteral(values) {
-	return `{${values.map((value) => {
-		if (value === null) return "NULL";
-		if (Array.isArray(value)) return arrayLiteral(value);
-		return `"${(temporalText(value) ?? String(value)).replaceAll(/[\\"]/g, "\\$&")}"`;
-	}).join(",")}}`;
-}
-function literal(value, column, where) {
-	if (value === null) return "null";
-	if (column.json) return quote(JSON.stringify(value));
-	if (Array.isArray(value)) return quote(arrayLiteral(value));
-	const temporalValue = temporalText(value);
-	if (temporalValue !== void 0) return quote(temporalValue);
-	const kind = typeof value;
-	switch (kind) {
-		case "string": return quote(value);
-		case "boolean":
-		case "bigint": return String(value);
-		case "number":
-			if (!Number.isFinite(value)) throw new TypeError(`${where}: ${String(value)} is not a finite number`);
-			return String(value);
-		case "object":
-		case "function":
-		case "symbol":
-		case "undefined": throw new TypeError(`${where}: unsupported value of type ${kind}`);
-		default: throw new TypeError(`${where}: unsupported value of type ${String(kind)}`);
-	}
+		}]
+	]);
 }
-const ident = (name) => `"${name.replaceAll("\"", "\"\"")}"`;
-/** Parents first (by forward relations), otherwise in the order given. */
-function order(meta, keys) {
-	const sorted = [];
-	const visiting = /* @__PURE__ */ new Set();
-	const visit = (key) => {
-		if (sorted.includes(key) || visiting.has(key)) return;
-		visiting.add(key);
-		for (const relation of Object.values(meta.tables[key]?.relations ?? {})) if (relation.direction === "forward" && relation.table !== key && keys.includes(relation.table)) visit(relation.table);
-		visiting.delete(key);
-		sorted.push(key);
+//#endregion
+//#region src/testing/kits/controller-binding.ts
+const PROBE_INITIAL = {
+	count: 0,
+	label: "initial"
+};
+function probe() {
+	let starts = 0;
+	let stops = 0;
+	let disposed = false;
+	let made;
+	const idle = () => void 0;
+	let emit = idle;
+	return {
+		create: () => {
+			const controller = defineController(PROBE_INITIAL, (state) => ({
+				actions: {
+					increment: () => {
+						state.set((current) => ({ count: current.count + 1 }));
+					},
+					rename: (label) => {
+						state.set({ label });
+					}
+				},
+				start: () => {
+					starts += 1;
+					emit = (patch) => {
+						state.set(patch);
+					};
+					return () => {
+						stops += 1;
+						emit = idle;
+					};
+				}
+			}));
+			made = {
+				...controller,
+				dispose: () => {
+					disposed = true;
+					controller.dispose();
+				}
+			};
+			return made;
+		},
+		emit: (patch) => {
+			emit(patch);
+		},
+		starts: () => starts,
+		stops: () => stops,
+		disposed: () => disposed,
+		controller: () => made
 	};
-	for (const key of keys) visit(key);
-	return sorted;
-}
-function statement(table, rows) {
-	const entries = Object.entries(rows);
-	if (entries.length === 0) return void 0;
-	const columns = [];
-	for (const [, row] of entries) for (const [key, value] of Object.entries(row)) {
-		if (value === void 0 || columns.includes(key)) continue;
-		const column = table.columns[key];
-		if (!column) throw new TypeError(`seed ${table.key}: unknown column "${key}"`);
-		if (column.generated) throw new TypeError(`seed ${table.key}: "${key}" is a generated column`);
-		columns.push(key);
-	}
-	const values = entries.map(([name, row]) => {
-		return `  (${columns.map((key) => row[key] === void 0 ? "default" : literal(row[key], table.columns[key], `seed ${table.key}.${name}.${key}`)).join(", ")})`;
-	});
-	return `insert into ${`${ident(table.schema)}.${ident(table.name)}`} (${columns.map((key) => ident(table.columns[key].db)).join(", ")}) values\n${values.join(",\n")}\non conflict do nothing;`;
 }
 /**
-* Typed fixtures shared by `supabase/seeds` and your tests. Rows use app
-* casing and Insert types; `better-supabase seed` renders them to SQL.
-*
-* ```ts
-* export const seed = defineSeed(betterSupabase, {
-*   organizations: { acme: { id: ACME, name: 'Acme' } },
-*   customers: { first: { organizationId: ACME, name: 'First customer' } },
-* });
-* ```
+* Proves a framework binding over a block controller renders the initial
+* snapshot, follows each change, passes the actions through and stops the
+* controller's work (and disposes it) on unmount.
 */
-function defineSeed(betterSupabase, fixtures) {
-	const meta = betterSupabase.meta;
-	const statements = () => {
-		const keys = Object.keys(fixtures).filter((key) => fixtures[key] !== void 0);
-		for (const key of keys) {
-			const table = meta.tables[key];
-			if (!table) throw new TypeError(`seed: unknown table "${key}"`);
-			if (table.kind === "view") throw new TypeError(`seed: "${key}" is a view`);
-		}
-		return order(meta, keys).flatMap((key) => {
-			const sql = statement(meta.tables[key], fixtures[key]);
-			return sql ? [sql] : [];
-		});
+function testControllerBinding(name, harness) {
+	const settle = async () => {
+		await harness.settle?.();
 	};
-	return {
-		[SEED]: true,
-		rows: fixtures,
-		statements,
-		sql: () => statements().join("\n\n"),
-		async insert(sql) {
-			for (const text of statements()) await sql.queryRaw(text);
+	const mounted = async (run) => {
+		const current = probe();
+		const binding = await harness.mount(current.create);
+		try {
+			await settle();
+			await run(binding, current);
+		} finally {
+			await binding.unmount();
 		}
 	};
+	return conform(`ControllerBinding "${name}"`, [
+		["renders the initial snapshot", () => mounted((binding, current) => {
+			const state = binding.read();
+			expect(state.count === PROBE_INITIAL.count && state.label === PROBE_INITIAL.label, `rendered ${JSON.stringify(state)} instead of the initial snapshot`);
+			expect(current.starts() === 1, `the controller started ${current.starts()} times on mount, not once`);
+		})],
+		["renders a change from the controller", () => mounted(async (binding, current) => {
+			current.emit({ label: "changed" });
+			await settle();
+			expect(binding.read().label === "changed", `rendered label ${JSON.stringify(binding.read().label)} after the controller changed it`);
+			current.emit({ count: 5 });
+			await settle();
+			expect(binding.read().count === 5, `rendered count ${binding.read().count} after a second change`);
+		})],
+		["passes the controller's actions through", () => mounted(async (binding, current) => {
+			expect(binding.actions.increment === current.controller()?.actions.increment, "the binding's actions are not the controller's");
+			binding.actions.increment();
+			binding.actions.rename("renamed");
+			await settle();
+			const state = binding.read();
+			expect(state.count === 1 && state.label === "renamed", `rendered ${JSON.stringify(state)} after the actions ran`);
+		})],
+		["stops the controller on unmount", async () => {
+			const current = probe();
+			const binding = await harness.mount(current.create);
+			await settle();
+			await binding.unmount();
+			await settle();
+			expect(current.stops() === current.starts() && current.starts() > 0, `the controller started ${current.starts()} times and stopped ${current.stops()} times`);
+			if (harness.disposes ?? true) expect(current.disposed(), "unmount didn't dispose the controller");
+			current.emit({ count: 9 });
+			await settle();
+		}]
+	]);
 }
 //#endregion
 //#region src/testing/adapter.ts
@@ -1484,13 +2240,13 @@ function testBlockTransportMiddleware(middleware) {
 }
 //#endregion
 //#region src/testing/authorization-provider.ts
-function isPlainJson(value) {
+function isPlainJson$1(value) {
 	if (value === null || typeof value === "string" || typeof value === "boolean") return true;
 	if (typeof value === "number") return Number.isFinite(value);
-	if (Array.isArray(value)) return value.every(isPlainJson);
+	if (Array.isArray(value)) return value.every(isPlainJson$1);
 	if (typeof value !== "object") return false;
 	const prototype = Object.getPrototypeOf(value);
-	return (prototype === Object.prototype || prototype === null) && Object.values(value).every((entry) => entry === void 0 || isPlainJson(entry));
+	return (prototype === Object.prototype || prototype === null) && Object.values(value).every((entry) => entry === void 0 || isPlainJson$1(entry));
 }
 const QUALIFIED = /^[a-z_][\w$]*\.[a-z_][\w${}]*$/i;
 const TABLE = /^[a-z_][\w$]*\.[a-z_][\w$]*$/i;
@@ -1520,7 +2276,7 @@ function testAuthorizationProvider(provider) {
 			expect(provider.apiVersion === 1, `apiVersion is ${String(provider.apiVersion)}`);
 		}],
 		["is plain JSON", () => {
-			expect(isPlainJson(provider), "it doesn't survive a JSON round trip");
+			expect(isPlainJson$1(provider), "it doesn't survive a JSON round trip");
 		}],
 		["names valid, unique scopes", () => {
 			expect(scopes.size > 0, "scopes is empty");
@@ -1559,6 +2315,14 @@ function testAuthorizationProvider(provider) {
 				for (const scope of permission.scopes ?? []) expect(scopes.has(scope), `permission "${permission.key}" names unknown scope "${scope}"`);
 			}
 		}],
+		provider.operations && ["operations name listed permissions", () => {
+			const keys = provider.permissions === void 0 ? void 0 : new Set(provider.permissions.map((entry) => entry.key));
+			for (const [name, operation] of Object.entries(provider.operations)) {
+				expect(name !== "", "an operation name is empty");
+				expect(operation.permission !== "", `operation "${name}" names no permission`);
+				if (keys) expect(keys.has(operation.permission), `operation "${name}" needs "${operation.permission}", which permissions doesn't list`);
+			}
+		}],
 		provider.memberships && ["memberships name known scopes", () => {
 			for (const membership of provider.memberships) {
 				expect(TABLE.test(membership.table), `membership table "${membership.table}" is not schema.table`);
@@ -1603,6 +2367,566 @@ function testAuthorizationProvider(provider) {
 	]);
 }
 //#endregion
+//#region src/testing/authorization-hooks.ts
+/**
+* Proves `AuthorizationHooks` target API v1 and fail closed for strangers:
+* fan-out returns only subscribers it was given, an identity nobody linked
+* and a forged ticket resolve to `null`, a requester never approves their
+* own request, an unknown publisher can neither publish nor run, an
+* unlinked chat author gets nothing, an admin with no claims cannot start
+* a support session and never approves their own, and a delegated token
+* with no scopes maps to no permissions.
+*/
+function testAuthorizationHooks(hooks) {
+	const stranger = crypto.randomUUID();
+	const event = {
+		type: "conformance.checked",
+		tenant: crypto.randomUUID(),
+		actorId: stranger,
+		payload: {}
+	};
+	const subscribers = [{
+		principal: crypto.randomUUID(),
+		kind: "user"
+	}, {
+		principal: crypto.randomUUID(),
+		kind: "service"
+	}];
+	const subset = async (policy, where) => {
+		const kept = await policy(event, subscribers);
+		for (const entry of kept) expect(subscribers.includes(entry), `${where} returned a subscriber it was not given`);
+		expect((await policy(event, [])).length === 0, `${where} returned subscribers from an empty list`);
+	};
+	const supportStart = (extra) => {
+		const now = Math.floor(Date.now() / 1e3);
+		const claims = {
+			sub: stranger,
+			role: "authenticated",
+			aud: "authenticated",
+			iss: "conformance",
+			exp: now + 60,
+			iat: now,
+			...extra
+		};
+		return {
+			admin: {
+				kind: "user",
+				token: "",
+				claims,
+				user: {
+					id: stranger,
+					role: "authenticated"
+				},
+				source: "conformance",
+				expiresAt: claims.exp
+			},
+			targetUserId: crypto.randomUUID(),
+			reason: "conformance",
+			readOnly: true,
+			metadata: {}
+		};
+	};
+	const { delivery, identities, approverOf, tickets, automation, chat, delegation } = hooks;
+	return conform(`AuthorizationHooks "${hooks.name}"`, [
+		["targets API v1 and has a name", () => {
+			expect(hooks.apiVersion === 1, `apiVersion is ${String(hooks.apiVersion)}`);
+			expect(hooks.name !== "", "name is empty");
+		}],
+		delivery?.subscribers && ["subscribers returns a subset", () => subset(delivery.subscribers, "delivery.subscribers")],
+		delivery?.audience && ["audience returns a subset", () => subset(delivery.audience, "delivery.audience")],
+		identities && ["an unlinked identity is null", async () => {
+			expect(await identities.principalByIdentity({
+				kind: "email",
+				value: `${stranger}@conformance.invalid`
+			}) === null, "an address nobody linked resolved to someone");
+		}],
+		approverOf && ["a requester never approves their own request", async () => {
+			expect(!await approverOf({
+				userId: stranger,
+				claims: { sub: stranger }
+			}, {
+				kind: "tool",
+				subject: crypto.randomUUID(),
+				tenant: event.tenant,
+				requester: stranger
+			}), "approverOf allowed the requester");
+		}],
+		tickets && ["a forged ticket is null", async () => {
+			expect(await tickets.subject(`forged.${stranger}.ticket`) === null, "a forged ticket resolved to a context");
+		}],
+		automation?.mayPublish && ["an unknown publisher may not publish", async () => {
+			expect(!await automation.mayPublish({
+				publisher: stranger,
+				tenant: event.tenant,
+				permissions: ["conformance.write"],
+				claims: {
+					sub: stranger,
+					role: "authenticated"
+				}
+			}), "mayPublish allowed a publisher nobody knows");
+		}],
+		automation?.runAs && ["an unknown publisher runs as no one", async () => {
+			expect(await automation.runAs({
+				publisher: stranger,
+				tenant: event.tenant,
+				permissions: ["conformance.read"]
+			}) === null, "runAs returned claims for an unknown publisher");
+		}],
+		chat?.onAction && ["an unlinked chat author is refused", async () => {
+			const decided = await chat.onAction({
+				id: "approve",
+				author: {
+					kind: "chat",
+					provider: "conformance",
+					value: stranger
+				}
+			}, null);
+			expect(decided === void 0 || !decided.allowed, "onAction allowed an author with no identity link");
+		}],
+		hooks.support && ["an admin with no claims cannot start a support session", async () => {
+			expect(await hooks.support.authorize(supportStart({})) === false, "support.authorize allowed an admin with no claims");
+		}],
+		hooks.support && ["an admin never approves their own support session", async () => {
+			const decision = await hooks.support.authorize(supportStart({
+				user_role: "admin",
+				app_role: "admin"
+			}));
+			expect(typeof decision !== "object" || decision.approvedBy !== stranger, "support.authorize named the admin as their own approver");
+		}],
+		delegation && ["a delegation with no scopes grants no permissions", async () => {
+			expect((await delegation.permissions({
+				userId: stranger,
+				tenant: event.tenant,
+				clientId: "conformance",
+				scopes: []
+			})).length === 0, "delegation.permissions granted keys to a token with no scopes");
+		}]
+	]);
+}
+//#endregion
+//#region src/testing/delivery-transport.ts
+const KEY = "00000000-0000-4000-8000-00000000d0f0";
+/**
+* Runs the `DeliveryTransport` contract against `transport`: API version 1,
+* the `email` channel, a provider name, and one frozen sample message it
+* sends without mutating, with the delivery id as its idempotency key.
+* Throws a `ConformanceError` listing every failed check.
+*/
+function testDeliveryTransport(transport, options = {}) {
+	const message = deepFreeze({
+		from: "Conformance <conformance@example.test>",
+		to: options.to ?? "delivered@example.test",
+		subject: "Conformance check",
+		text: "Conformance check",
+		category: "notification",
+		headers: mailHeaders("notification", { url: "https://example.test/unsubscribe" })
+	});
+	return conform(`DeliveryTransport "${transport.provider}"`, [
+		["has apiVersion 1", () => {
+			const version = transport.apiVersion;
+			expect(version === 1, "apiVersion must be 1");
+		}],
+		["sends on the email channel", () => {
+			const channel = transport.channel;
+			expect(channel === "email", `channel must be "email", got ${String(channel)}`);
+		}],
+		["has a provider name", () => {
+			expect(typeof transport.provider === "string" && transport.provider !== "", "provider must be a non-empty string");
+		}],
+		["sends a message without mutating it and returns a valid receipt", async () => {
+			const receipt = await transport.send(message, { idempotencyKey: KEY });
+			if (receipt === void 0) return;
+			expect(receipt.providerMessageId === void 0 || typeof receipt.providerMessageId === "string", "providerMessageId must be a string");
+		}],
+		options.received && ["passes the idempotency key and the headers to the provider", async () => {
+			const found = (await options.received()).find((entry) => entry.idempotencyKey === KEY);
+			expect(found, `no message arrived with idempotency key ${KEY}`);
+			for (const [name, value] of Object.entries(message.headers)) expect(found.headers[name] === value, `header ${name} must be "${value}", got ${String(found.headers[name])}`);
+		}]
+	]);
+}
+//#endregion
+//#region src/testing/authorizer.ts
+const OUTCOMES = /* @__PURE__ */ new Set([
+	"granted",
+	"denied",
+	"approval-required"
+]);
+const isOutcome = (value) => typeof value === "object" && value !== null && "outcome" in value && typeof value.outcome === "string" && OUTCOMES.has(value.outcome);
+/** Input that claims a privileged caller; the subject must decide, never this. */
+const FORGED = {
+	subject: {
+		type: "service",
+		id: "service"
+	},
+	actor: {
+		id: "service",
+		kind: "service",
+		role: "service_role"
+	},
+	role: "service_role",
+	user_id: "00000000-0000-4000-8000-000000000000",
+	memberships: [{
+		tenant: "conformance",
+		role: "owner"
+	}],
+	claims: {
+		role: "service_role",
+		user_role: "admin",
+		roles: ["admin"],
+		memberships: [{
+			tenant: "conformance",
+			role: "owner"
+		}]
+	}
+};
+/**
+* Proves an `Authorizer` targets API v1, keys every permission to the same
+* string each time (and after a JSON round trip, so references are plain
+* JSON), answers every request with a known outcome without mutating it,
+* keeps the request order in `evaluations`, decides from the subject rather
+* than the input (forged roles, claims and memberships in the resource
+* properties or the context never turn a denial into a grant), never grants an unknown permission, and grants
+* `options.granted` through `checkPermission`.
+*/
+function testAuthorizer(authorizer, options) {
+	const { subject, context } = requestOf(void 0);
+	const requestFor = (action, id, properties) => ({
+		subject,
+		action,
+		resource: {
+			type: "conformance",
+			id,
+			...properties ? { properties } : {}
+		},
+		context
+	});
+	const requests = options.permissions.flatMap((permission) => [
+		"a",
+		"b",
+		"c"
+	].map((id) => requestFor(permission, id)));
+	return conform(`Authorizer "${authorizer.name}"`, [
+		hasName(authorizer),
+		["targets API v1", () => {
+			const version = authorizer.apiVersion;
+			expect(version === 1, `apiVersion is ${String(version)}`);
+			expect(options.permissions.length > 0, "options.permissions lists no permission to check");
+		}],
+		["keys every permission stably, as plain JSON", () => {
+			for (const permission of options.permissions) {
+				const key = authorizer.key(permission);
+				expect(typeof key === "string" && key.length > 0, "key() must return a non-empty string");
+				expect(authorizer.key(permission) === key, `key() gave two keys for ${key}`);
+				const copy = JSON.parse(JSON.stringify(permission));
+				expect(same(copy, permission) && authorizer.key(copy) === key, `the reference for ${key} is not plain JSON`);
+			}
+		}],
+		["answers every request with a known outcome, without mutating it", async () => {
+			for (const request of requests) {
+				const outcome = await authorizer.evaluate(frozenCopy(request));
+				expect(isOutcome(outcome), `evaluate() gave no known outcome for ${authorizer.key(request.action)}`);
+			}
+		}],
+		authorizer.evaluations !== void 0 && ["keeps the request order in evaluations", async () => {
+			const evaluations = authorizer.evaluations.bind(authorizer);
+			const single = await Promise.all(requests.map((request) => Promise.resolve(authorizer.evaluate(request))));
+			const batch = await evaluations(frozenCopy(requests));
+			expect(batch.length === requests.length, `evaluations() gave ${batch.length} outcomes for ${requests.length} requests`);
+			expect(same(batch.map((outcome) => outcome.outcome), single.map((outcome) => outcome.outcome)), "evaluations() disagrees with evaluate() for the same requests");
+			const reversed = await evaluations(frozenCopy(requests.toReversed()));
+			expect(same(reversed.toReversed().map((outcome) => outcome.outcome), batch.map((outcome) => outcome.outcome)), "evaluations() does not keep the request order");
+		}],
+		["decides from the subject, never from the input", async () => {
+			for (const permission of options.permissions) {
+				const plain = await authorizer.evaluate(requestFor(permission, "a"));
+				const forgedResource = await authorizer.evaluate(requestFor(permission, "a", FORGED));
+				const forgedContext = await authorizer.evaluate({
+					...requestFor(permission, "a"),
+					context: {
+						...context,
+						...FORGED
+					}
+				});
+				for (const forged of [forgedResource, forgedContext]) expect(forged.outcome !== "granted" || plain.outcome === "granted", `input claiming a service caller was granted ${authorizer.key(permission)}`);
+			}
+		}],
+		options.unknown !== void 0 && ["never grants an unknown permission", async () => {
+			expect(!(await checkPermission({
+				authorizer,
+				permission: options.unknown,
+				resource: { type: "conformance" },
+				context: options.granted?.context
+			})).ok, "an unknown permission was granted");
+		}],
+		options.granted !== void 0 && ["grants the granted permission through checkPermission", async () => {
+			const checked = await checkPermission({
+				authorizer,
+				permission: options.granted.permission,
+				resource: { type: "conformance" },
+				context: options.granted.context
+			});
+			expect(checked.ok, checked.ok ? "" : `the permission was refused: ${checked.error.message}`);
+		}]
+	]);
+}
+/**
+* An in-memory `Authorizer` for tests and examples: permissions come from
+* the subject's `role` and id only, never from the request's resource or
+* context, and it ignores `subject.properties.claims`.
+*/
+function staticAuthorizer(options) {
+	const approvals = new Set(options.approvals);
+	const evaluate = (request) => {
+		const { subject, action } = request;
+		if (approvals.has(action)) return {
+			outcome: "approval-required",
+			approval: { id: `approval:${action}` }
+		};
+		const role = subject.properties?.["role"];
+		return [...options.roles?.[typeof role === "string" ? role : subject.type] ?? [], ...options.grants?.[subject.id] ?? []].includes(action) ? { outcome: "granted" } : {
+			outcome: "denied",
+			reason: `Permission ${action} is required`
+		};
+	};
+	return defineAuthorizer({
+		name: "static",
+		key: (ref) => ref,
+		evaluate,
+		evaluations: (requests) => Promise.resolve(requests.map(evaluate))
+	});
+}
+//#endregion
+//#region src/testing/document-format.ts
+const STATUSES$1 = /* @__PURE__ */ new Set([
+	"stable",
+	"legacy",
+	"preview"
+]);
+const SEVERITIES = /* @__PURE__ */ new Set([
+	"error",
+	"warning",
+	"info"
+]);
+const CODE = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+const jsonSchema = (schema) => ({ "~standard": {
+	version: 1,
+	vendor: "better-supabase-conformance",
+	validate: (value) => ({ value }),
+	jsonSchema: {
+		input: () => schema,
+		output: () => schema
+	}
+} });
+function sampleModel() {
+	const customer = {
+		type: "object",
+		required: ["id", "name"],
+		properties: {
+			id: {
+				type: "string",
+				format: "uuid"
+			},
+			name: { type: "string" },
+			note: { type: ["string", "null"] }
+		}
+	};
+	return buildApiModel({ meta: {
+		version: 1,
+		casing: "camel",
+		tables: {},
+		enums: {},
+		functions: {}
+	} }, {
+		info: {
+			title: "Conformance",
+			version: "1.0.0"
+		},
+		servers: [{
+			url: "https://api.test",
+			name: "test"
+		}],
+		tags: [{
+			name: "customers",
+			summary: "Customers"
+		}],
+		basePath: "/api",
+		routes: [
+			{
+				method: "get",
+				path: "/customers/{id}",
+				operationId: "getCustomer",
+				tags: ["customers"],
+				output: jsonSchema(customer)
+			},
+			{
+				method: "post",
+				path: "/customers",
+				operationId: "createCustomer",
+				tags: ["customers"],
+				input: jsonSchema(customer),
+				output: jsonSchema(customer),
+				status: 201
+			},
+			{
+				method: "get",
+				path: "/customers/changes",
+				operationId: "streamCustomerChanges",
+				stream: { item: jsonSchema(customer) }
+			}
+		],
+		webhooks: [{
+			id: "customer.created",
+			payload: customer,
+			standardWebhooks: true
+		}],
+		realtimeUrl: "wss://abc.supabase.co/realtime/v1/websocket",
+		messages: { customerChanged: {
+			id: "customerChanged",
+			payload: customer
+		} },
+		channels: [{
+			id: "customers",
+			address: "bs:t:public.customers",
+			protocol: "ws",
+			messages: ["customerChanged"],
+			operations: [{
+				id: "onCustomerChanged",
+				action: "receive"
+			}]
+		}],
+		workflows: [{
+			id: "createThenGet",
+			steps: [{
+				id: "create",
+				operationId: "createCustomer",
+				outputs: { id: "$response.body#/id" }
+			}, {
+				id: "get",
+				operationId: "getCustomer",
+				parameters: [{
+					name: "id",
+					in: "path",
+					value: "$steps.create.outputs.id"
+				}]
+			}]
+		}],
+		security: ["bearer"]
+	}).model;
+}
+function isPlainJson(value) {
+	if (value === null || typeof value === "string" || typeof value === "boolean") return true;
+	if (typeof value === "number") return Number.isFinite(value);
+	if (Array.isArray(value)) return value.every(isPlainJson);
+	if (typeof value !== "object") return false;
+	const prototype = Object.getPrototypeOf(value);
+	if (prototype !== Object.prototype && prototype !== null) return false;
+	return Object.values(value).every((entry) => entry !== void 0 && isPlainJson(entry));
+}
+function diagnosticProblem(diagnostic) {
+	if (typeof diagnostic.code !== "string" || !CODE.test(diagnostic.code)) return `the code ${JSON.stringify(diagnostic.code)} is not kebab-case`;
+	const severity = diagnostic.severity;
+	if (typeof severity !== "string" || !SEVERITIES.has(severity)) return `${diagnostic.code} has the severity ${String(severity)}`;
+	if (typeof diagnostic.message !== "string" || diagnostic.message === "") return `${diagnostic.code} has no message`;
+	if (diagnostic.pointer !== void 0 && !/^(?:\/|$)/.test(diagnostic.pointer)) return `${diagnostic.code} has the pointer ${diagnostic.pointer}, which is not a JSON Pointer`;
+}
+/**
+* Proves a `DocumentFormat` targets API v1, lists versions with pins and a
+* known status, defaults to a version it lists that is not a preview, and,
+* for every version: lowers the model without mutating it (also when the
+* model is frozen), renders the same document twice, renders plain JSON or
+* text, reports diagnostics with a kebab-case code, a severity and a
+* message, finds no error in its own output with `lint`, and names a bare,
+* stable file.
+*/
+function testDocumentFormat(format, options = {}) {
+	const subject = format;
+	const id = subject.id;
+	const defaultVersion = subject.defaultVersion;
+	const versions = options.versions ?? Object.keys(subject.versions);
+	let model;
+	const modelOf = () => model ??= options.model ?? sampleModel();
+	const lower = (version, input) => {
+		const diagnostics = [];
+		return {
+			document: subject.lower(input, version, { report: (diagnostic) => {
+				diagnostics.push(diagnostic);
+			} }),
+			diagnostics
+		};
+	};
+	return conform(`DocumentFormat "${String(id)}"`, [
+		["targets API v1 with an id", () => {
+			const version = subject.apiVersion;
+			expect(version === 1, `apiVersion is ${String(version)}`);
+			expect(typeof id === "string" && id.length > 0, "id must be a non-empty string");
+		}],
+		["lists versions with a pin and a known status", () => {
+			const listed = Object.entries(subject.versions);
+			expect(listed.length > 0, "versions lists no version");
+			for (const [version, entry] of listed) {
+				const status = entry.status;
+				expect(typeof entry.pin === "string" && entry.pin.length > 0, `version ${version} has no pin`);
+				expect(typeof status === "string" && STATUSES$1.has(status), `version ${version} has the status ${String(status)}`);
+			}
+			for (const version of versions) expect(Object.hasOwn(subject.versions, version), `options.versions names ${version}, which the format does not list`);
+		}],
+		["defaults to a listed version that is not a preview", () => {
+			const entry = Object.hasOwn(subject.versions, subject.defaultVersion) ? subject.versions[subject.defaultVersion] : void 0;
+			expect(entry !== void 0, `the default version ${String(defaultVersion)} is not in versions`);
+			expect(entry.status !== "preview", `the default version ${String(defaultVersion)} is a preview`);
+		}],
+		["lowers every version without mutating the model", () => {
+			const original = modelOf();
+			const before = JSON.stringify(original);
+			for (const version of versions) {
+				lower(version, original);
+				expect(JSON.stringify(original) === before, `lower(model, "${version}") changed the model`);
+				lower(version, frozenCopy(original));
+			}
+		}],
+		["renders the same document twice", () => {
+			for (const version of versions) {
+				const first = lower(version, structuredClone(modelOf()));
+				const second = lower(version, structuredClone(modelOf()));
+				expect(same(first.document, second.document), `lower(model, "${version}") is not deterministic`);
+				expect(same(first.diagnostics, second.diagnostics), `lower(model, "${version}") reports different diagnostics each time`);
+			}
+		}],
+		["renders plain JSON or text", () => {
+			for (const version of versions) {
+				const { document } = lower(version, modelOf());
+				expect(typeof document === "string" || typeof document === "object" && document !== null && isPlainJson(document), `lower(model, "${version}") returned something other than a JSON object or a string`);
+			}
+		}],
+		["reports diagnostics with a code, a severity and a message", () => {
+			for (const version of versions) {
+				const { document, diagnostics } = lower(version, modelOf());
+				const linted = subject.lint?.(document, version) ?? [];
+				for (const diagnostic of [...diagnostics, ...linted]) {
+					const problem = diagnosticProblem(diagnostic);
+					expect(problem === void 0, `${version}: ${problem ?? ""}`);
+				}
+			}
+		}],
+		subject.lint !== void 0 && ["finds no error in its own output", () => {
+			for (const version of versions) {
+				const { document, diagnostics } = lower(version, modelOf());
+				if (diagnostics.some((diagnostic) => diagnostic.severity === "error")) continue;
+				const errors = (subject.lint?.(document, version) ?? []).filter((diagnostic) => diagnostic.severity === "error");
+				expect(errors.length === 0, `lint(lower(model, "${version}")) reports ${errors.map((error) => error.code).join(", ")}`);
+			}
+		}],
+		["names a bare, stable file per version", () => {
+			for (const version of versions) {
+				const name = subject.fileName(version);
+				expect(typeof name === "string" && /^[^/\\]+\.[A-Za-z0-9]+$/.test(name), `fileName("${version}") is ${JSON.stringify(name)}, not a file name with an extension`);
+				expect(subject.fileName(version) === name, `fileName("${version}") changes between calls`);
+			}
+		}]
+	]);
+}
+//#endregion
 //#region src/testing/generator.ts
 function relativeImport(from, to) {
 	const fromParts = from.split("/").slice(0, -1);
@@ -1842,7 +3166,8 @@ function sample(channel, email) {
 			priority: null,
 			createdAt,
 			readAt: null,
-			resolvedAt: null
+			resolvedAt: null,
+			fields: Object.freeze({})
 		}),
 		text: Object.freeze({ title: "Conformance check" })
 	});
@@ -2078,7 +3403,7 @@ function testChatState(state, options) {
 				"d"
 			]) await state.appendToList(key, value, { maxLength: 3 });
 			const list = await state.getList(key);
-			expect(list.join() === "b,c,d", `list is ${list.join()}`);
+			expect(list.join(",") === "b,c,d", `list is ${list.join(",")}`);
 			expect((await state.getList(fresh())).length === 0, "missing list is not empty");
 		}],
 		["queues per thread, keeps the newest maxSize and reports the depth", async () => {
@@ -2350,4 +3675,327 @@ function testCredentialProvider(provider, options) {
 	]);
 }
 //#endregion
-export { ConformanceError, LOCAL_JWT_SECRET, asUser, createTestSigner, defineSeed, expectDbBudget, expectInstant, expectTenantIsolation, isSeed, localAuth, localSigningKey, signLocalJwt, signTestJwt, signTestJwtWithKey, supabaseClaimFixtures, testAdapter, testAiTaskRunner, testAuthResolver, testAuthorizationProvider, testBlockTransportMiddleware, testBuilderStarter, testCacheAdapter, testChatState, testCredentialProvider, testEmbedder, testEveDocumentBackend, testEventSink, testExecutor, testGenerator, testGraphCompiler, testNotificationChannel, testPlugin, testQueueBackend, testStreamStore, testSupportSessionStore, testWebhookSecretStore, testWebhookSigner, testWebhookTransport };
+//#region src/testing/act-cases.ts
+/**
+* The RFC 8693 `act` chains better-supabase accepts and refuses, as plain
+* JSON (`better-supabase/testing/act-cases.json`), so another library that
+* reads the same claims can run the same cases.
+*/
+const actCases = {
+	version: 1,
+	cases: [
+		{
+			"name": "no actor",
+			"claims": {},
+			"valid": true,
+			"kind": null,
+			"readOnly": null,
+			"tools": null,
+			"mayWrite": true
+		},
+		{
+			"name": "oauth client_id",
+			"claims": { "client_id": "client-1" },
+			"valid": true,
+			"kind": "oauth-client",
+			"readOnly": null,
+			"tools": null,
+			"mayWrite": true
+		},
+		{
+			"name": "chain without kind",
+			"claims": { "act": {
+				"sub": "agent-runner",
+				"act": { "sub": "mcp-client-42" }
+			} },
+			"valid": true,
+			"kind": "oauth-client",
+			"readOnly": null,
+			"tools": null,
+			"mayWrite": true
+		},
+		{
+			"name": "support, read_only missing",
+			"claims": { "act": {
+				"kind": "support",
+				"sub": "admin-1",
+				"session_id": "session-1"
+			} },
+			"valid": true,
+			"kind": "support",
+			"readOnly": true,
+			"tools": null,
+			"mayWrite": false
+		},
+		{
+			"name": "support, read_only true",
+			"claims": { "act": {
+				"kind": "support",
+				"sub": "admin-1",
+				"session_id": "session-1",
+				"read_only": true
+			} },
+			"valid": true,
+			"kind": "support",
+			"readOnly": true,
+			"tools": null,
+			"mayWrite": false
+		},
+		{
+			"name": "support, read_only false",
+			"claims": { "act": {
+				"kind": "support",
+				"sub": "admin-1",
+				"session_id": "session-1",
+				"read_only": false
+			} },
+			"valid": true,
+			"kind": "support",
+			"readOnly": false,
+			"tools": null,
+			"mayWrite": true
+		},
+		{
+			"name": "support, read_only as a string",
+			"claims": { "act": {
+				"kind": "support",
+				"sub": "admin-1",
+				"session_id": "session-1",
+				"read_only": "false"
+			} },
+			"valid": false,
+			"kind": null,
+			"readOnly": null,
+			"tools": null,
+			"mayWrite": false
+		},
+		{
+			"name": "support without session_id",
+			"claims": { "act": {
+				"kind": "support",
+				"sub": "admin-1",
+				"read_only": false
+			} },
+			"valid": false,
+			"kind": null,
+			"readOnly": null,
+			"tools": null,
+			"mayWrite": true
+		},
+		{
+			"name": "session_id without kind (0.5.0 support)",
+			"claims": { "act": {
+				"sub": "admin-1",
+				"session_id": "session-1"
+			} },
+			"valid": false,
+			"kind": null,
+			"readOnly": null,
+			"tools": null,
+			"mayWrite": false
+		},
+		{
+			"name": "impersonation",
+			"claims": { "act": {
+				"kind": "impersonation",
+				"sub": "admin-1",
+				"reason": "ticket 42"
+			} },
+			"valid": true,
+			"kind": "impersonation",
+			"readOnly": null,
+			"tools": null,
+			"mayWrite": false
+		},
+		{
+			"name": "impersonation, read_only false",
+			"claims": { "act": {
+				"kind": "impersonation",
+				"sub": "admin-1",
+				"read_only": false
+			} },
+			"valid": true,
+			"kind": "impersonation",
+			"readOnly": null,
+			"tools": null,
+			"mayWrite": false
+		},
+		{
+			"name": "agent, every tool",
+			"claims": { "act": {
+				"kind": "agent",
+				"sub": "agent-7"
+			} },
+			"valid": true,
+			"kind": "agent",
+			"readOnly": false,
+			"tools": null,
+			"mayWrite": true
+		},
+		{
+			"name": "agent, listed tools",
+			"claims": { "act": {
+				"kind": "agent",
+				"sub": "agent-7",
+				"tools": ["search_knowledge"]
+			} },
+			"valid": true,
+			"kind": "agent",
+			"readOnly": false,
+			"tools": ["search_knowledge"],
+			"mayWrite": true
+		},
+		{
+			"name": "agent, no tools",
+			"claims": { "act": {
+				"kind": "agent",
+				"sub": "agent-7",
+				"tools": []
+			} },
+			"valid": true,
+			"kind": "agent",
+			"readOnly": false,
+			"tools": [],
+			"mayWrite": true
+		},
+		{
+			"name": "agent, read_only true",
+			"claims": { "act": {
+				"kind": "agent",
+				"sub": "agent-7",
+				"read_only": true
+			} },
+			"valid": true,
+			"kind": "agent",
+			"readOnly": true,
+			"tools": null,
+			"mayWrite": false
+		},
+		{
+			"name": "agent, read_only false",
+			"claims": { "act": {
+				"kind": "agent",
+				"sub": "agent-7",
+				"read_only": false
+			} },
+			"valid": true,
+			"kind": "agent",
+			"readOnly": false,
+			"tools": null,
+			"mayWrite": true
+		},
+		{
+			"name": "agent, read_only as a string",
+			"claims": { "act": {
+				"kind": "agent",
+				"sub": "agent-7",
+				"read_only": "true"
+			} },
+			"valid": false,
+			"kind": null,
+			"readOnly": null,
+			"tools": null,
+			"mayWrite": false
+		},
+		{
+			"name": "agent over an OAuth client",
+			"claims": {
+				"scope": "posts:read",
+				"act": {
+					"kind": "agent",
+					"sub": "agent-7",
+					"tools": ["search_knowledge"],
+					"act": { "sub": "mcp-client-42" }
+				}
+			},
+			"valid": true,
+			"kind": "agent",
+			"readOnly": false,
+			"tools": ["search_knowledge"],
+			"mayWrite": true
+		},
+		{
+			"name": "agent, tools not a list",
+			"claims": { "act": {
+				"kind": "agent",
+				"sub": "agent-7",
+				"tools": "search_knowledge"
+			} },
+			"valid": false,
+			"kind": null,
+			"readOnly": null,
+			"tools": null,
+			"mayWrite": true
+		},
+		{
+			"name": "agent, empty tool name",
+			"claims": { "act": {
+				"kind": "agent",
+				"sub": "agent-7",
+				"tools": [""]
+			} },
+			"valid": false,
+			"kind": null,
+			"readOnly": null,
+			"tools": null,
+			"mayWrite": true
+		},
+		{
+			"name": "agent with session_id",
+			"claims": { "act": {
+				"kind": "agent",
+				"sub": "agent-7",
+				"session_id": "session-1"
+			} },
+			"valid": false,
+			"kind": null,
+			"readOnly": null,
+			"tools": null,
+			"mayWrite": true
+		},
+		{
+			"name": "unknown kind",
+			"claims": { "act": {
+				"kind": "robot",
+				"sub": "robot-1"
+			} },
+			"valid": false,
+			"kind": null,
+			"readOnly": null,
+			"tools": null,
+			"mayWrite": false
+		},
+		{
+			"name": "act not an object",
+			"claims": { "act": "agent-7" },
+			"valid": false,
+			"kind": null,
+			"readOnly": null,
+			"tools": null,
+			"mayWrite": true
+		},
+		{
+			"name": "act without sub",
+			"claims": { "act": { "kind": "agent" } },
+			"valid": false,
+			"kind": null,
+			"readOnly": null,
+			"tools": null,
+			"mayWrite": true
+		},
+		{
+			"name": "nested level without sub",
+			"claims": { "act": {
+				"sub": "agent-runner",
+				"act": { "sub": "" }
+			} },
+			"valid": false,
+			"kind": null,
+			"readOnly": null,
+			"tools": null,
+			"mayWrite": true
+		}
+	]
+};
+//#endregion
+export { ConformanceError, LOCAL_JWT_SECRET, PROBE_INITIAL, actCases, asUser, createTestSigner, defineSeed, expectDbBudget, expectInstant, expectTenantIsolation, isSeed, liteStack, localAuth, localSigningKey, signLocalJwt, signTestJwt, signTestJwtWithKey, staticAuthorizer, supabaseClaimFixtures, supabaseInvalidClaimFixtures, testAdapter, testAiTaskRunner, testAuthResolver, testAuthorizationHooks, testAuthorizationProvider, testAuthorizer, testBlockTransportMiddleware, testBuilderStarter, testCacheAdapter, testChatState, testControllerBinding, testCredentialProvider, testDeliveryTransport, testDocumentFormat, testEmbedder, testEveDocumentBackend, testEventSink, testExecutor, testGenerator, testGraphCompiler, testIncomingDestination, testNotificationChannel, testPaymentProvider, testPlugin, testQueueBackend, testStreamStore, testSupportSessionStore, testTaxProvider, testWebhookSecretStore, testWebhookSigner, testWebhookTransport };