@contember/cli 2.1.0-beta.2 → 2.2.0-alpha.2

package/src/lib/tenant/TenantClient.ts

@@ -1,4 +1,27 @@
 import { GraphQlClient } from '@contember/graphql-client'
+import {
+	addIDPError$$,
+	addIDPResponse$$,
+	addMailTemplateError$$,
+	addMailTemplateResponse$$,
+	type ConfigInput,
+	configureError$$,
+	configureResponse$$,
+	createProjectResponse$$,
+	createProjectResponseError$$,
+	disableIDPError$$,
+	disableIDPResponse$$,
+	enableIDPError$$,
+	enableIDPResponse$$,
+	identityProvider$,
+	type MailTemplate,
+	mutation$,
+	query$,
+	updateIDPError$$,
+	updateIDPResponse$$,
+} from '@contember/graphql-client-tenant'
+import { Fetcher, TextWriter, util } from 'graphql-ts-client-api'
+import { TenantGlobalConfig, TenantIdpOptions, TenantMailTemplate } from './tenantConfig.js'
 
 export const createTenantApiUrl = (url: string) => {
 	if (url.endsWith('/')) {
@@ -10,6 +33,27 @@ export const createTenantApiUrl = (url: string) => {
 	return url + '/tenant'
 }
 
+export interface RemoteIdentityProvider {
+	slug: string
+	type: string
+	disabledAt: string | null
+}
+
+interface MutationResult {
+	ok: boolean
+	error?: { code: string; developerMessage?: string } | null
+}
+
+// Fetchers are immutable and reusable, so they are built once at module load.
+const createProjectFetcher = mutation$.createProject(createProjectResponse$$.error(createProjectResponseError$$))
+const configureFetcher = mutation$.configure(configureResponse$$.error(configureError$$))
+const identityProvidersFetcher = query$.identityProviders(identityProvider$.slug.type.disabledAt)
+const addIdpFetcher = mutation$.addIDP(addIDPResponse$$.error(addIDPError$$))
+const updateIdpFetcher = mutation$.updateIDP(updateIDPResponse$$.error(updateIDPError$$))
+const enableIdpFetcher = mutation$.enableIDP(enableIDPResponse$$.error(enableIDPError$$))
+const disableIdpFetcher = mutation$.disableIDP(disableIDPResponse$$.error(disableIDPError$$))
+const addMailTemplateFetcher = mutation$.addMailTemplate(addMailTemplateResponse$$.error(addMailTemplateError$$))
+
 export class TenantClient {
 	constructor(private readonly apiClient: GraphQlClient) {}
 
@@ -19,22 +63,87 @@ export class TenantClient {
 	}
 
 	public async createProject(slug: string, ignoreExisting = false): Promise<void> {
-		const query = `mutation($slug: String!) {
-  createProject(projectSlug: $slug) {
-    ok
-    error {
-      code
-    }
-  }
-}`
-		const result = await this.apiClient.execute<{
-			createProject: { ok: boolean; error: { code: string } }
-		}>(query, { variables: { slug } })
-		if (!result.createProject.ok) {
-			if (ignoreExisting && result.createProject.error.code === 'ALREADY_EXISTS') {
+		const result = await this.exec(createProjectFetcher, { projectSlug: slug })
+		if (!result.createProject?.ok) {
+			const code = result.createProject?.error?.code
+			if (ignoreExisting && code === 'ALREADY_EXISTS') {
 				return
 			}
-			throw result.createProject.error.code
+			throw code ?? 'UNKNOWN'
+		}
+	}
+
+	public async configure(config: TenantGlobalConfig): Promise<void> {
+		// `TenantGlobalConfig` widens a few fields to `| null` (the API accepts an
+		// explicit null to clear/disable); the generated wire type omits that.
+		const result = await this.exec(configureFetcher, { config: config as ConfigInput })
+		this.assertOk(result.configure, 'configure')
+	}
+
+	public async listIdentityProviders(): Promise<RemoteIdentityProvider[]> {
+		const result = await this.exec(identityProvidersFetcher, {})
+		return result.identityProviders.map(it => ({
+			slug: it.slug,
+			type: it.type,
+			disabledAt: it.disabledAt ?? null,
+		}))
+	}
+
+	public async addIdp(slug: string, type: string, configuration: unknown, options?: TenantIdpOptions): Promise<void> {
+		const result = await this.exec(addIdpFetcher, { identityProvider: slug, type, configuration, options })
+		this.assertOk(result.addIDP, `addIDP(${slug})`)
+	}
+
+	public async updateIdp(slug: string, type: string, configuration: unknown, options?: TenantIdpOptions): Promise<void> {
+		const result = await this.exec(updateIdpFetcher, {
+			identityProvider: slug,
+			type,
+			configuration,
+			options,
+			mergeConfiguration: false,
+		})
+		this.assertOk(result.updateIDP, `updateIDP(${slug})`)
+	}
+
+	public async enableIdp(slug: string): Promise<void> {
+		const result = await this.exec(enableIdpFetcher, { identityProvider: slug })
+		this.assertOk(result.enableIDP, `enableIDP(${slug})`)
+	}
+
+	public async disableIdp(slug: string): Promise<void> {
+		const result = await this.exec(disableIdpFetcher, { identityProvider: slug })
+		this.assertOk(result.disableIDP, `disableIDP(${slug})`)
+	}
+
+	public async addMailTemplate(template: TenantMailTemplate): Promise<void> {
+		const result = await this.exec(addMailTemplateFetcher, { template: template as MailTemplate })
+		this.assertOk(result.addMailTemplate, `addMailTemplate(${template.type}/${template.variant ?? ''})`)
+	}
+
+	private async exec<TData extends object, TVariables extends object>(
+		fetcher: Fetcher<'Query' | 'Mutation', TData, TVariables>,
+		variables: TVariables,
+	): Promise<TData> {
+		const writer = new TextWriter()
+		writer.text(fetcher.fetchableType.name.toLowerCase())
+		if (fetcher.variableTypeMap.size !== 0) {
+			writer.scope({ type: 'ARGUMENTS', multiLines: fetcher.variableTypeMap.size > 2, suffix: ' ' }, () => {
+				util.iterateMap(fetcher.variableTypeMap, ([name, type]) => {
+					writer.seperator()
+					writer.text(`$${name}: ${type}`)
+				})
+			})
+		}
+		writer.text(fetcher.toString())
+		writer.text(fetcher.toFragmentString())
+		return this.apiClient.execute<TData>(writer.toString(), { variables })
+	}
+
+	private assertOk(result: MutationResult | undefined, operation: string): void {
+		if (!result?.ok) {
+			const code = result?.error?.code ?? 'UNKNOWN'
+			const message = result?.error?.developerMessage
+			throw `${operation} failed: ${code}${message ? ` — ${message}` : ''}`
 		}
 	}
 }

package/src/lib/tenant/TenantConfigApplier.ts

@@ -0,0 +1,72 @@
+import { TenantClient } from './TenantClient.js'
+import { TenantConfig } from './tenantConfig.js'
+
+export interface TenantConfigApplyOptions {
+	dryRun?: boolean
+}
+
+/**
+ * Applies a {@link TenantConfig} to a tenant idempotently:
+ * - `configure` is a partial merge, so it is always (re)sent.
+ * - identity providers are added or updated based on the current state, then
+ *   enabled/disabled to match `disabled`.
+ * - mail templates are upserted server-side by `addMailTemplate`.
+ *
+ * Nothing is ever removed — entries missing from the config are left untouched.
+ */
+export class TenantConfigApplier {
+	public async apply(client: TenantClient, config: TenantConfig, options: TenantConfigApplyOptions = {}): Promise<void> {
+		const dryRun = options.dryRun === true
+		const log = (message: string) => console.log(`${dryRun ? '[dry-run] ' : ''}${message}`)
+
+		if (config.config) {
+			log('configure: applying global tenant config')
+			if (!dryRun) {
+				await client.configure(config.config)
+			}
+		}
+
+		if (config.identityProviders && Object.keys(config.identityProviders).length > 0) {
+			const existing = await client.listIdentityProviders()
+			const existingBySlug = new Map(existing.map(it => [it.slug, it]))
+
+			for (const [slug, idp] of Object.entries(config.identityProviders)) {
+				const current = existingBySlug.get(slug)
+				if (!current) {
+					log(`addIDP: ${slug} (${idp.type})`)
+					if (!dryRun) {
+						await client.addIdp(slug, idp.type, idp.configuration, idp.options)
+					}
+				} else {
+					log(`updateIDP: ${slug} (${idp.type})`)
+					if (!dryRun) {
+						await client.updateIdp(slug, idp.type, idp.configuration, idp.options)
+					}
+				}
+
+				const wantDisabled = idp.disabled === true
+				const isDisabled = current ? current.disabledAt !== null : false
+				if (wantDisabled && !isDisabled) {
+					log(`disableIDP: ${slug}`)
+					if (!dryRun) {
+						await client.disableIdp(slug)
+					}
+				} else if (!wantDisabled && isDisabled) {
+					log(`enableIDP: ${slug}`)
+					if (!dryRun) {
+						await client.enableIdp(slug)
+					}
+				}
+			}
+		}
+
+		if (config.mailTemplates && config.mailTemplates.length > 0) {
+			for (const template of config.mailTemplates) {
+				log(`addMailTemplate: ${template.type}${template.variant ? `/${template.variant}` : ''}`)
+				if (!dryRun) {
+					await client.addMailTemplate(template)
+				}
+			}
+		}
+	}
+}

package/src/lib/tenant/TenantConfigLoader.ts

@@ -0,0 +1,41 @@
+import { isAbsolute, resolve } from 'node:path'
+import { JsCodeRunner } from '../js/JsCodeRunner.js'
+import { TenantConfig } from './tenantConfig.js'
+
+const resolvePath = (path: string): string => isAbsolute(path) ? path : resolve(process.cwd(), path)
+
+const extractDefault = (result: unknown): TenantConfig => {
+	if (typeof result !== 'object' || result === null || !('default' in result)) {
+		throw `Tenant config file must have a default export (use \`export default defineTenantConfig({ ... })\`).`
+	}
+	const config = (result as { default: unknown }).default
+	if (typeof config !== 'object' || config === null) {
+		throw `Default export of the tenant config file must be an object.`
+	}
+	return config as TenantConfig
+}
+
+export interface TenantConfigLoader {
+	loadConfig(path: string): Promise<TenantConfig>
+}
+
+/** Loads a `tenant.config.ts` directly via dynamic import (Bun runtime). */
+export class ImportTenantConfigLoader implements TenantConfigLoader {
+	async loadConfig(path: string): Promise<TenantConfig> {
+		const result = await import(resolvePath(path))
+		return extractDefault(result)
+	}
+}
+
+/** Loads a `tenant.config.ts` by transpiling it first (Node runtime). */
+export class TranspilingTenantConfigLoader implements TenantConfigLoader {
+	constructor(
+		private readonly jsCodeRunner: JsCodeRunner,
+	) {
+	}
+
+	async loadConfig(path: string): Promise<TenantConfig> {
+		const result = await this.jsCodeRunner.run(resolvePath(path))
+		return extractDefault(result)
+	}
+}

package/src/lib/tenant/tenantConfig.ts

@@ -0,0 +1,101 @@
+import type {
+	ConfigCaptchaInput,
+	ConfigInput,
+	ConfigLoginInput,
+	ConfigPasswordInput,
+	ConfigPasswordlessInput,
+	ConfigRateLimitsInput,
+	ConfigRateLimitWindowInput,
+	IDPOptions,
+	MailTemplate,
+} from '@contember/graphql-client-tenant'
+
+// Enums and leaf input shapes are re-derived from the generated tenant client
+// (`@contember/graphql-client-tenant`, generated from `tenant.graphql`), so they
+// stay in sync with the schema. The only thing layered on top is `| null` on the
+// fields where the API treats an explicit `null`/`''` as "clear/disable" — the
+// codegen renders nullable inputs as optional only and drops the `| null`.
+export type { CaptchaProvider, ConfigPolicy, MailType } from '@contember/graphql-client-tenant'
+
+/**
+ * ISO 8601 duration string, e.g. `"P1D"` (1 day) or `"PT5M"` (5 minutes).
+ */
+export type Interval = string
+
+/** Adds `| null` to the given keys of an otherwise non-nullable generated input. */
+type WithNullable<T, K extends keyof T> = Omit<T, K> & { readonly [P in K]?: T[P] | null }
+
+export type TenantPasswordConfig = WithNullable<ConfigPasswordInput, 'pattern'>
+
+export type TenantLoginConfig = WithNullable<ConfigLoginInput, 'maxTokenExpiration'>
+
+export type TenantPasswordlessConfig = WithNullable<ConfigPasswordlessInput, 'url'>
+
+/**
+ * `provider: null` disables captcha verification.
+ * `secret` is write-only: `null`/omitted leaves the stored value unchanged, `''` clears it.
+ */
+export type TenantCaptchaConfig = WithNullable<ConfigCaptchaInput, 'provider' | 'secret' | 'threshold'>
+
+export type TenantRateLimitWindow = ConfigRateLimitWindowInput
+
+export type TenantRateLimitsConfig = ConfigRateLimitsInput
+
+/**
+ * Maps to the tenant `configure(config: ConfigInput!)` mutation. New config
+ * groups added to the schema flow through automatically; only the groups that
+ * need `| null` overrides are pinned.
+ */
+export type TenantGlobalConfig = Omit<ConfigInput, 'password' | 'login' | 'passwordless' | 'captcha'> & {
+	readonly password?: TenantPasswordConfig
+	readonly login?: TenantLoginConfig
+	readonly passwordless?: TenantPasswordlessConfig
+	readonly captcha?: TenantCaptchaConfig
+}
+
+export type TenantIdpOptions = IDPOptions
+
+/**
+ * A single identity provider. The record key is used as the provider slug.
+ * `type` is the handler key registered on the server (built-in: `oidc`,
+ * `facebook`, `apple`).
+ *
+ * This is a CLI-specific composite — the `addIDP`/`updateIDP` mutations take
+ * `type`/`configuration`/`options` as separate arguments, not a single input.
+ */
+export interface TenantIdpConfig {
+	type: string
+	configuration: Record<string, unknown>
+	options?: TenantIdpOptions
+	/** When `true`, the provider is disabled (kept, but not usable for sign-in). */
+	disabled?: boolean
+}
+
+/** Maps to the `addMailTemplate(template: MailTemplate!)` mutation. */
+export type TenantMailTemplate = WithNullable<MailTemplate, 'projectSlug' | 'replyTo'>
+
+/**
+ * Declarative tenant configuration. Applied idempotently by
+ * `contember tenant:apply`.
+ */
+export interface TenantConfig {
+	config?: TenantGlobalConfig
+	/** Identity providers keyed by slug. */
+	identityProviders?: Record<string, TenantIdpConfig>
+	mailTemplates?: TenantMailTemplate[]
+}
+
+/**
+ * Type-safe helper for authoring a `tenant.config.ts`. Returns the config
+ * unchanged — it exists only to provide editor autocompletion and type
+ * checking.
+ *
+ * ```ts
+ * import { defineTenantConfig } from '@contember/cli'
+ *
+ * export default defineTenantConfig({
+ *   config: { password: { minLength: 8 } },
+ * })
+ * ```
+ */
+export const defineTenantConfig = (config: TenantConfig): TenantConfig => config

package/src/lib/transfer/DataTransferClient.ts

@@ -1,7 +1,7 @@
-import { LineTransform } from '../stream'
+import { LineTransform } from '../stream.js'
 import { Readable } from 'node:stream'
 import { createGzip } from 'node:zlib'
-import { RemoteProject } from '../project/RemoteProject'
+import { RemoteProject } from '../project/RemoteProject.js'
 
 export class DataTransferClient {
 	dataImport = async ({ printProgress, stream, project, gzip }: {

package/src/lib/workspace/WorkspaceResolver.ts

@@ -1,6 +1,6 @@
-import { Workspace } from './Workspace'
+import { Workspace } from './Workspace.js'
 import { join, resolve } from 'node:path'
-import { YamlHandler } from '../fs/YamlHandler'
+import { YamlHandler } from '../fs/YamlHandler.js'
 
 export interface LocalProjectConfig {
 	apiDir?: string

package/src/run.ts

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { join, resolve } from 'node:path'
-import { packageRoot } from './consts'
-import { createContainer } from './dic'
-import { readCliEnv } from './lib/env'
-import { WorkspaceResolver } from './lib/workspace/WorkspaceResolver'
-import { YamlHandler } from './lib/fs/YamlHandler'
-import { FileSystem } from './lib/fs/FileSystem'
+import { packageRoot } from './consts.js'
+import { createContainer } from './dic.js'
+import { readCliEnv } from './lib/env.js'
+import { WorkspaceResolver } from './lib/workspace/WorkspaceResolver.js'
+import { YamlHandler } from './lib/fs/YamlHandler.js'
+import { FileSystem } from './lib/fs/FileSystem.js'
 ;(async () => {
 	const version = require(join(packageRoot, 'package.json')).version
 	const nodeVersion = process.version.match(/^v?(\d+)\..+$/)

package/src/tsconfig.json

@@ -13,6 +13,7 @@
 		{ "path": "../../database/src" },
 		{ "path": "../../dic/src" },
 		{ "path": "../../graphql-client/src" },
+		{ "path": "../../graphql-client-tenant/src" },
 		{ "path": "../../engine-content-api/src" },
 		{ "path": "../../engine-common/src" },
 		{ "path": "../../schema/src" },

package/tenant.config.example.ts

@@ -0,0 +1,64 @@
+import { defineTenantConfig } from '@contember/cli'
+
+/**
+ * Example tenant configuration. Copy to `tenant.config.ts` and run:
+ *
+ *   contember tenant:apply --dsn "contember://app:TOKEN@api.example.com"
+ *   contember tenant:apply tenant.config.ts --dry-run
+ *
+ * The token must have PROJECT_ADMIN/SUPER_ADMIN privileges (a deploy-only
+ * token is not sufficient). Applying is idempotent and never removes entries.
+ */
+export default defineTenantConfig({
+	config: {
+		password: {
+			minLength: 8,
+			requireUppercase: 1,
+			requireLowercase: 1,
+			requireDigit: 1,
+			checkHibp: true,
+		},
+		login: {
+			defaultTokenExpiration: 'P1D',
+			maxTokenExpiration: 'P2D',
+			revealUserExists: false,
+		},
+		passwordless: {
+			enabled: 'optIn',
+			expiration: 'PT5M',
+		},
+		captcha: {
+			provider: 'turnstile',
+			secret: process.env.TURNSTILE_SECRET,
+			threshold: 0.5,
+		},
+		rateLimits: {
+			loginPerIp: { limit: 10, window: 'PT1M' },
+		},
+	},
+
+	identityProviders: {
+		google: {
+			type: 'oidc',
+			configuration: {
+				clientId: process.env.GOOGLE_CLIENT_ID,
+				clientSecret: process.env.GOOGLE_CLIENT_SECRET,
+				url: 'https://accounts.google.com',
+			},
+			options: {
+				autoSignUp: true,
+				exclusive: false,
+			},
+			disabled: false,
+		},
+	},
+
+	mailTemplates: [
+		{
+			type: 'RESET_PASSWORD_REQUEST',
+			variant: 'cs',
+			subject: 'Obnovení hesla',
+			content: 'Klikněte na odkaz pro obnovení hesla: {{link}}',
+		},
+	],
+})

package/tests/cases/unit/MigrationAmendCommand.test.ts

@@ -0,0 +1,156 @@
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
+import * as fs from 'node:fs/promises'
+import * as os from 'node:os'
+import * as path from 'node:path'
+import { c, createSchema } from '@contember/schema-definition'
+import { Schema } from '@contember/schema'
+import { emptySchema } from '@contember/schema-utils'
+import {
+	JsonLoader,
+	MigrationCreator,
+	MigrationFilesManager,
+	MigrationParser,
+	MigrationsResolver,
+	ModificationHandlerFactory,
+	SchemaDiffer,
+	SchemaMigrator,
+	SchemaStateManager,
+	SchemaVersionBuilder,
+	VERSION_LATEST,
+} from '@contember/migrations-client'
+import { Input } from '@contember/cli-common'
+import { MigrationAmendCommand } from '../../../src/commands/migrations/MigrationAmendCommand.js'
+import { SchemaLoader } from '../../../src/lib/schema/SchemaLoader.js'
+
+namespace BlogModel {
+	export class Author {
+		name = c.stringColumn()
+	}
+}
+
+namespace BlogModelExtended {
+	export class Author {
+		name = c.stringColumn()
+		nickname = c.stringColumn()
+	}
+}
+
+const aclWith = (role: string): Schema['acl'] => ({
+	roles: {
+		[role]: { variables: {}, stages: '*', entities: {} },
+	},
+})
+
+type SystemClientCall = { method: 'migrate' | 'migrationDelete' | 'migrationModify'; args: any[] }
+
+// A system client that records calls instead of hitting the network. `get()` throws by default so a
+// state-only amend (which must not touch the server) fails loudly if it ever reaches out.
+const recordingSystemClient = (calls?: SystemClientCall[]) => ({
+	get: () => {
+		if (!calls) {
+			throw new Error('systemClient must not be used for a state-only amend')
+		}
+		const record = (method: SystemClientCall['method']) => async (...args: any[]) => {
+			calls.push({ method, args })
+		}
+		return { migrate: record('migrate'), migrationDelete: record('migrationDelete'), migrationModify: record('migrationModify') }
+	},
+})
+
+// Builds an amend command wired with real migrations-client services backed by `migrationsDir`.
+const buildCommand = (migrationsDir: string, loadedSchema: Schema, calls?: SystemClientCall[]) => {
+	const filesManager = new MigrationFilesManager(migrationsDir, { json: new JsonLoader(new MigrationParser()) })
+	const migrationsResolver = new MigrationsResolver(filesManager)
+	const schemaMigrator = new SchemaMigrator(new ModificationHandlerFactory(ModificationHandlerFactory.defaultFactoryMap))
+	const schemaStateManager = new SchemaStateManager(path.join(migrationsDir, 'state'))
+	const schemaVersionBuilder = new SchemaVersionBuilder(migrationsResolver, schemaMigrator, schemaStateManager)
+	const migrationCreator = new MigrationCreator(filesManager, new SchemaDiffer(schemaMigrator))
+
+	const schemaLoader: SchemaLoader = { loadSchema: async () => loadedSchema }
+	const statusFacade = { resolveMigrationsStatus: async () => ({ migrationsToExecute: [] }) }
+	const migrationsValidator = { validate: async () => true }
+	const migrationPrinter = { printMigrationDescription: () => {} }
+
+	const command = new MigrationAmendCommand(
+		migrationsResolver,
+		recordingSystemClient(calls) as any,
+		statusFacade as any,
+		schemaLoader,
+		schemaVersionBuilder,
+		migrationCreator,
+		migrationsValidator as any,
+		migrationPrinter as any,
+		schemaMigrator,
+		schemaStateManager,
+	)
+	return { command, schemaStateManager }
+}
+
+const run = (command: MigrationAmendCommand) => command.execute(new Input({}, { force: false, yes: true }))
+
+describe('MigrationAmendCommand (schema state mode)', () => {
+	let migrationsDir: string
+
+	beforeEach(async () => {
+		migrationsDir = await fs.mkdtemp(path.join(os.tmpdir(), 'contember-amend-'))
+
+		const schemaDiffer = new SchemaDiffer(new SchemaMigrator(new ModificationHandlerFactory(ModificationHandlerFactory.defaultFactoryMap)))
+		const model = createSchema(BlogModel)
+		// model-only migration, exactly as state mode would produce (non-model parts live in state/ files)
+		const modifications = schemaDiffer.diffSchemas(emptySchema, model, { skipNonModelDiffers: true })
+		await fs.writeFile(
+			path.join(migrationsDir, '2024-01-01-120000-init.json'),
+			JSON.stringify({ formatVersion: VERSION_LATEST, modifications }, null, '\t'),
+		)
+
+		// enable state mode with an initial ACL granting the `admin` role
+		const stateManager = new SchemaStateManager(path.join(migrationsDir, 'state'))
+		await stateManager.extractState({ ...model, acl: aclWith('admin') })
+	})
+
+	afterEach(async () => {
+		await fs.rm(migrationsDir, { recursive: true, force: true })
+	})
+
+	test('rewrites state files when only non-model parts changed', async () => {
+		const model = createSchema(BlogModel)
+		// same model, different ACL — the diff is non-model only, so no migration is produced
+		const { command, schemaStateManager } = buildCommand(migrationsDir, { ...model, acl: aclWith('editor') })
+
+		const code = await run(command)
+
+		expect(code).toBe(0)
+		const state = await schemaStateManager.readState()
+		expect(Object.keys(state.acl.roles)).toStrictEqual(['editor'])
+	})
+
+	test('leaves state untouched when nothing changed', async () => {
+		const model = createSchema(BlogModel)
+		// identical model and ACL — nothing to do, state files must not be rewritten
+		const { command, schemaStateManager } = buildCommand(migrationsDir, { ...model, acl: aclWith('admin') })
+
+		const code = await run(command)
+
+		expect(code).toBe(0)
+		const state = await schemaStateManager.readState()
+		expect(Object.keys(state.acl.roles)).toStrictEqual(['admin'])
+	})
+
+	test('re-pushes schema state to the server after amending model changes', async () => {
+		// model changed (a column added) — migrationModify rebuilds the server schema from migrations
+		// and drops the non-model state, so amend must re-apply the state via a follow-up migrate call.
+		const loaded: Schema = { ...createSchema(BlogModelExtended), acl: aclWith('admin') }
+		const calls: SystemClientCall[] = []
+		const { command } = buildCommand(migrationsDir, loaded, calls)
+
+		const code = await run(command)
+
+		expect(code).toBe(0)
+		const modifyIndex = calls.findIndex(it => it.method === 'migrationModify')
+		expect(modifyIndex).toBeGreaterThanOrEqual(0)
+		// the state re-push is a migrate call carrying schemaState, after the migrationModify
+		const restate = calls.slice(modifyIndex + 1).find(it => it.method === 'migrate' && it.args[2])
+		expect(restate).toBeDefined()
+		expect(Object.keys(restate!.args[2].acl.roles)).toStrictEqual(['admin'])
+	})
+})