@supatype/cli 0.1.0-alpha.8 → 0.1.0

package/tests/link.test.ts

@@ -0,0 +1,148 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest"
+import { mkdtempSync, writeFileSync, rmSync, mkdirSync } from "node:fs"
+import { join } from "node:path"
+import { tmpdir } from "node:os"
+import { resolveTarget, targetSchemaRollback } from "../src/resolve-target.js"
+import { loadProjectLink, migrateLegacyLinkFiles } from "../src/link.js"
+import { scaffold } from "../src/commands/init.js"
+
+function writePlainConfig(dir: string): void {
+  writeFileSync(
+    join(dir, "supatype.config.ts"),
+    `export default ${JSON.stringify({
+      project: { name: "demo" },
+      database: { provider: "docker" },
+      server: { mode: "dev" },
+      app: { mode: "none" },
+      schema: { path: "schema/index.ts", pg_schema: "public" },
+    })}
+`,
+  )
+}
+
+describe("link model", () => {
+  let tmp: string
+
+  beforeEach(() => {
+    tmp = mkdtempSync(join(tmpdir(), "supatype-link-"))
+  })
+
+  afterEach(() => {
+    rmSync(tmp, { recursive: true, force: true })
+  })
+
+  it("migrates cloud.json into link.json", () => {
+    scaffold(tmp, "demo")
+    mkdirSync(join(tmp, ".supatype"), { recursive: true })
+    writeFileSync(join(tmp, ".supatype", "cloud.json"), JSON.stringify({
+      apiUrl: "https://api.example.com",
+      token: "pat",
+      projectSlug: "myproj",
+      orgId: "org1",
+    }), { encoding: "utf8" })
+
+    migrateLegacyLinkFiles(tmp)
+    const link = loadProjectLink(tmp)
+    expect(link?.kind).toBe("cloud")
+    expect(link?.projectRef).toBe("myproj")
+    expect(link?.environments.production?.apiUrl).toBe("https://api.example.com")
+  })
+
+  it("resolveTarget returns cloud mode with /api/v1 prefix", () => {
+    writePlainConfig(tmp)
+    mkdirSync(join(tmp, ".supatype"), { recursive: true })
+    writeFileSync(join(tmp, ".supatype", "link.json"), JSON.stringify({
+      version: 1,
+      kind: "cloud",
+      projectRef: "myproj",
+      defaultEnvironment: "production",
+      token: "pat",
+      orgId: "org1",
+      cloudApiUrl: "https://api.example.com",
+      linkedAt: new Date().toISOString(),
+      environments: {
+        production: {
+          name: "production",
+          apiUrl: "https://myproj.supatype.dev",
+          linkedAt: new Date().toISOString(),
+        },
+      },
+    }))
+
+    const target = resolveTarget(tmp)
+    expect(target.mode).toBe("cloud")
+    expect(target.apiPrefix).toBe("/api/v1")
+    expect(target.apiBaseUrl).toBe("https://api.example.com")
+  })
+
+  it("resolveTarget returns self-host mode with /platform/v1 prefix", () => {
+    writePlainConfig(tmp)
+    mkdirSync(join(tmp, ".supatype"), { recursive: true })
+    writeFileSync(join(tmp, ".supatype", "link.json"), JSON.stringify({
+      version: 1,
+      kind: "self-host",
+      projectRef: "demo",
+      defaultEnvironment: "production",
+      linkedAt: new Date().toISOString(),
+      environments: {
+        production: {
+          name: "production",
+          apiUrl: "https://app.example.com",
+          token: "srk",
+          linkedAt: new Date().toISOString(),
+        },
+      },
+    }))
+
+    const target = resolveTarget(tmp)
+    expect(target.mode).toBe("self-host")
+    expect(target.apiPrefix).toBe("/platform/v1")
+    expect(target.token).toBe("srk")
+  })
+
+  it("targetSchemaRollback posts to /platform/v1 when linked", async () => {
+    writePlainConfig(tmp)
+    mkdirSync(join(tmp, ".supatype"), { recursive: true })
+    writeFileSync(join(tmp, ".supatype", "link.json"), JSON.stringify({
+      version: 1,
+      kind: "self-host",
+      projectRef: "demo",
+      defaultEnvironment: "production",
+      linkedAt: new Date().toISOString(),
+      environments: {
+        production: {
+          name: "production",
+          apiUrl: "https://app.example.com",
+          token: "srk",
+          linkedAt: new Date().toISOString(),
+        },
+      },
+    }))
+
+    const fetchMock = vi.fn().mockResolvedValue({
+      ok: true,
+      json: async () => ({
+        data: {
+          status: "rolled_back",
+          name: "push_test",
+          message: "Rolled back migration push_test.",
+        },
+      }),
+    })
+    vi.stubGlobal("fetch", fetchMock)
+
+    const target = resolveTarget(tmp)
+    await targetSchemaRollback(target, { schema: "public" })
+
+    expect(fetchMock).toHaveBeenCalledOnce()
+    const [url, init] = fetchMock.mock.calls[0] as [string, RequestInit]
+    expect(url).toBe("https://app.example.com/platform/v1/projects/demo/schema/rollback")
+    expect(init.method).toBe("POST")
+    expect(init.headers).toMatchObject({
+      Authorization: "Bearer srk",
+      "Content-Type": "application/json",
+    })
+
+    vi.unstubAllGlobals()
+  })
+})

package/tests/minisign.test.ts

@@ -0,0 +1,102 @@
+import { describe, it, expect } from "vitest"
+import {
+  createHash,
+  generateKeyPairSync,
+  randomBytes,
+  sign as edSign,
+  type KeyObject,
+} from "node:crypto"
+import { verifyMinisign } from "../src/binary-cache.js"
+
+/**
+ * Build a minisign public-key string + signature file for the given mode so we
+ * can exercise {@link verifyMinisign} without shelling out to the minisign tool.
+ *
+ * Layout mirrors the minisign format the verifier parses:
+ *   public key payload: [2 algo]["Ed"][8 keyId][32 raw ed25519 pubkey]
+ *   signature payload : [2 algo][8 keyId][64 ed25519 signature]
+ */
+function makeMinisign(
+  data: Buffer,
+  mode: "legacy" | "prehashed",
+  opts: { keyId?: Buffer; privateKey?: KeyObject; publicKey?: KeyObject } = {},
+): { pubKeyStr: string; sigFile: string } {
+  const { publicKey, privateKey } =
+    opts.privateKey && opts.publicKey
+      ? { publicKey: opts.publicKey, privateKey: opts.privateKey }
+      : generateKeyPairSync("ed25519")
+
+  const keyId = opts.keyId ?? randomBytes(8)
+
+  // Raw 32-byte ed25519 key = SPKI DER minus its 12-byte prefix.
+  const rawPub = publicKey.export({ format: "der", type: "spki" }).subarray(12)
+  const pkPayload = Buffer.concat([Buffer.from("Ed"), keyId, rawPub])
+  const pubKeyStr = `untrusted comment: test\n${pkPayload.toString("base64")}`
+
+  const prehashed = mode === "prehashed"
+  const signedData = prehashed
+    ? createHash("blake2b512").update(data).digest()
+    : data
+  const signature = edSign(null, signedData, privateKey)
+
+  const algo = prehashed ? Buffer.from("ED") : Buffer.from("Ed")
+  const sigPayload = Buffer.concat([algo, keyId, signature])
+  const sigFile =
+    `untrusted comment: signature\n${sigPayload.toString("base64")}\n` +
+    `trusted comment: timestamp\n${Buffer.alloc(64).toString("base64")}`
+
+  return { pubKeyStr, sigFile }
+}
+
+describe("verifyMinisign", () => {
+  const data = Buffer.from("the quick brown fox\n")
+
+  it("accepts a valid legacy ('Ed') signature", () => {
+    const keyId = randomBytes(8)
+    const { publicKey, privateKey } = generateKeyPairSync("ed25519")
+    const { pubKeyStr, sigFile } = makeMinisign(data, "legacy", { keyId, privateKey, publicKey })
+    expect(() => verifyMinisign(data, sigFile, pubKeyStr)).not.toThrow()
+  })
+
+  it("accepts a valid prehashed ('ED', BLAKE2b-512) signature", () => {
+    const keyId = randomBytes(8)
+    const { publicKey, privateKey } = generateKeyPairSync("ed25519")
+    const { pubKeyStr, sigFile } = makeMinisign(data, "prehashed", { keyId, privateKey, publicKey })
+    expect(() => verifyMinisign(data, sigFile, pubKeyStr)).not.toThrow()
+  })
+
+  it("rejects a prehashed signature when the file was tampered", () => {
+    const { pubKeyStr, sigFile } = makeMinisign(data, "prehashed")
+    const tampered = Buffer.from("the quick brown dog\n")
+    expect(() => verifyMinisign(tampered, sigFile, pubKeyStr)).toThrow(/verification FAILED/i)
+  })
+
+  it("rejects when the signature key id does not match the public key", () => {
+    const { publicKey, privateKey } = generateKeyPairSync("ed25519")
+    const { sigFile } = makeMinisign(data, "prehashed", {
+      keyId: randomBytes(8),
+      privateKey,
+      publicKey,
+    })
+    // Public key advertising a different key id.
+    const { pubKeyStr } = makeMinisign(data, "prehashed", {
+      keyId: randomBytes(8),
+      privateKey,
+      publicKey,
+    })
+    expect(() => verifyMinisign(data, sigFile, pubKeyStr)).toThrow(/key ID mismatch/i)
+  })
+
+  it("rejects an unsupported algorithm", () => {
+    const { pubKeyStr, sigFile } = makeMinisign(data, "legacy")
+    // Corrupt the algorithm bytes in the signature payload to "XX".
+    const lines = sigFile.split("\n")
+    const sigBytes = Buffer.from(lines[1]!, "base64")
+    sigBytes[0] = 0x58
+    sigBytes[1] = 0x58
+    lines[1] = sigBytes.toString("base64")
+    expect(() => verifyMinisign(data, lines.join("\n"), pubKeyStr)).toThrow(
+      /Unsupported minisign algorithm/i,
+    )
+  })
+})

package/tests/proxy-dev-app.test.ts

@@ -1,5 +1,12 @@
+import { mkdirSync, writeFileSync } from "node:fs"
+import { join } from "node:path"
+import { tmpdir } from "node:os"
 import { describe, expect, it } from "vitest"
-import { resolveProxyDevScript } from "../src/app/proxy-dev-app.js"
+import {
+  portFromUpstream,
+  resolveProxyDevScript,
+  resolveViteDirectSpawn,
+} from "../src/app/proxy-dev-app.js"
 import type { SupatypeProjectConfig } from "../src/project-config.js"
 
 const base = {
@@ -31,3 +38,40 @@ describe("resolveProxyDevScript()", () => {
     expect(resolveProxyDevScript(config)).toBe("dev:site")
   })
 })
+
+describe("portFromUpstream()", () => {
+  it("parses port from upstream URL", () => {
+    const config = {
+      ...base,
+      app: { mode: "proxy" as const, upstream: "http://localhost:5285" },
+    } satisfies SupatypeProjectConfig
+    expect(portFromUpstream(config)).toBe(5285)
+  })
+
+  it("returns null when upstream has no port", () => {
+    const config = {
+      ...base,
+      app: { mode: "proxy" as const, upstream: "http://localhost" },
+    } satisfies SupatypeProjectConfig
+    expect(portFromUpstream(config)).toBeNull()
+  })
+})
+
+describe("resolveViteDirectSpawn()", () => {
+  it("returns node + vite.js for a plain vite script", () => {
+    const appDir = join(tmpdir(), `supatype-vite-spawn-${Date.now()}`)
+    const viteJs = join(appDir, "node_modules", "vite", "bin", "vite.js")
+    mkdirSync(join(appDir, "node_modules", "vite", "bin"), { recursive: true })
+    writeFileSync(viteJs, "")
+    const result = resolveViteDirectSpawn(appDir, "dev:vite", { "dev:vite": "vite" })
+    expect(result).not.toBeNull()
+    expect(result?.bin).toBe(process.execPath)
+    expect(result?.args[0]).toBe(viteJs)
+    expect(result?.shell).toBe(false)
+  })
+
+  it("returns null for non-vite scripts", () => {
+    const result = resolveViteDirectSpawn(process.cwd(), "dev", { dev: "next dev" })
+    expect(result).toBeNull()
+  })
+})

package/tests/pull-utils.test.ts

@@ -106,12 +106,12 @@ describe("pgTypeToField()", () => {
 })
 
 describe("introspectColumnToColumnInfo()", () => {
-  it("maps engine type → pgType and flags", () => {
+  it("maps engine column → pgType and flags", () => {
     const out = introspectColumnToColumnInfo({
       name: "id",
-      type: "uuid",
+      dataType: "uuid",
+      udtName: "uuid",
       nullable: false,
-      primaryKey: true,
       default: "gen_random_uuid()",
     })
     expect(out).toEqual({
@@ -127,7 +127,8 @@ describe("introspectColumnToColumnInfo()", () => {
   it("treats empty default as no default", () => {
     const out = introspectColumnToColumnInfo({
       name: "x",
-      type: "text",
+      dataType: "text",
+      udtName: "text",
       nullable: true,
       default: "",
     })

package/tests/runtime-contract.test.ts

@@ -4,8 +4,8 @@ import { join } from "node:path"
 import { tmpdir } from "node:os"
 import { runtimeRouteSpec } from "../src/runtime-routes.js"
 import { buildKongDeclarative } from "../src/kong-config.js"
-import { renderSelfHostCompose, writeSelfHostCompose } from "../src/self-host-compose.js"
-import { updateAppConfigInProject } from "../src/app-config.js"
+import { composeDockerImageEnv, composePullNeedsIgnoreFailures, hasLocalVersionPins, isRegistryPullableImageRef, renderSelfHostCompose, writeSelfHostCompose } from "../src/self-host-compose.js"
+import { updateAppConfigInProject, updateServerConfigInProject } from "../src/app-config.js"
 import type { SupatypeProjectConfig } from "../src/project-config.js"
 import { DENO_RELEASE_PIN } from "../src/release-pins.js"
 
@@ -109,6 +109,68 @@ describe("runtime contract", () => {
     expect(compose).toContain("supatype/schema-engine:latest")
   })
 
+  it("composeDockerImageEnv maps pinned versions to SUPATYPE_*_IMAGE", () => {
+    expect(composeDockerImageEnv(baseConfig)).toEqual({
+      SUPATYPE_ENGINE_IMAGE: "supatype/schema-engine:v0.4.2",
+      SUPATYPE_SERVER_IMAGE: "supatype/server:v0.1.0",
+      SUPATYPE_POSTGRES_IMAGE: "supatype/postgres:17-latest",
+    })
+    expect(composeDockerImageEnv({ ...baseConfig, versions: undefined })).toEqual({})
+    expect(
+      composeDockerImageEnv({
+        ...baseConfig,
+        database: { provider: "docker", image: "supatype/postgres:custom" },
+      }),
+    ).toEqual({
+      SUPATYPE_ENGINE_IMAGE: "supatype/schema-engine:v0.4.2",
+      SUPATYPE_SERVER_IMAGE: "supatype/server:v0.1.0",
+      SUPATYPE_POSTGRES_IMAGE: "supatype/postgres:custom",
+    })
+  })
+
+  it("isRegistryPullableImageRef accepts semver and latest tags", () => {
+    expect(isRegistryPullableImageRef("supatype/server:latest")).toBe(true)
+    expect(isRegistryPullableImageRef("supatype/schema-engine:v0.4.2")).toBe(true)
+    expect(isRegistryPullableImageRef("supatype/postgres:17-latest")).toBe(true)
+    expect(isRegistryPullableImageRef("supatype/control-plane:local")).toBe(false)
+    expect(isRegistryPullableImageRef("supatype/server:keepsake-local")).toBe(false)
+  })
+
+  it("composePullNeedsIgnoreFailures is false for semver pins only", () => {
+    const cwd = mkdtempSync(join(tmpdir(), "supatype-pull-"))
+    try {
+      writeFileSync(
+        join(cwd, ".env"),
+        "SUPATYPE_ENGINE_IMAGE=supatype/schema-engine:v0.4.2\n",
+        "utf8",
+      )
+      expect(hasLocalVersionPins(baseConfig)).toBe(false)
+      expect(composePullNeedsIgnoreFailures(baseConfig, cwd)).toBe(false)
+    } finally {
+      rmSync(cwd, { recursive: true, force: true })
+    }
+  })
+
+  it("composePullNeedsIgnoreFailures is true for versions.local or custom tags", () => {
+    const cwd = mkdtempSync(join(tmpdir(), "supatype-pull-local-"))
+    try {
+      writeFileSync(
+        join(cwd, ".env"),
+        "SUPATYPE_CONTROL_PLANE_IMAGE=supatype/control-plane:local\n",
+        "utf8",
+      )
+      expect(
+        composePullNeedsIgnoreFailures(
+          { ...baseConfig, versions: { engine: "local" } },
+          cwd,
+        ),
+      ).toBe(true)
+      expect(composePullNeedsIgnoreFailures(baseConfig, cwd)).toBe(true)
+    } finally {
+      rmSync(cwd, { recursive: true, force: true })
+    }
+  })
+
   it("self-host compose mounts project root at /project (project-directory relative)", () => {
     const compose = renderSelfHostCompose(baseConfig)
     expect(compose).toContain("- .:/project")
@@ -148,6 +210,18 @@ describe("runtime contract", () => {
     expect(compose).toContain("SUPATYPE_APP_UPSTREAM: http://host.docker.internal:4321")
   })
 
+  it("devLocal compose injects SUPATYPE_VITE_DEV_URL when app.vite_dev_url is set", () => {
+    const compose = renderSelfHostCompose(
+      {
+        ...baseConfig,
+        app: { mode: "static", static_dir: "./dist", vite_dev_url: "http://127.0.0.1:5173" },
+      },
+      process.cwd(),
+      { devLocal: true },
+    )
+    expect(compose).toContain("SUPATYPE_VITE_DEV_URL: http://host.docker.internal:5173")
+  })
+
   it("devLocal compose omits studio container when overrides.studio is set", () => {
     const compose = renderSelfHostCompose(
       { ...baseConfig, overrides: { studio: "../supatype/packages/studio" } },
@@ -314,6 +388,60 @@ export default defineConfig({
     }
   })
 
+  it("server config updater sets standalone mode, domain, and tls (preserving other keys)", () => {
+    const dir = mkdtempSync(join(tmpdir(), "supatype-server-config-"))
+    try {
+      const configPath = join(dir, "supatype.config.ts")
+      writeFileSync(
+        configPath,
+        `import { defineConfig } from "@supatype/cli"
+
+export default defineConfig({
+  project: { name: "x" },
+  database: { provider: "docker" },
+  server: { mode: "dev", port: 54321 },
+  app: { mode: "none" },
+})
+`,
+        "utf8",
+      )
+      updateServerConfigInProject(dir, { domain: "demo.supatype.com", tlsEmail: "hello@supatype.com" })
+      const next = readFileSync(configPath, "utf8")
+      expect(next).toContain(`mode: "standalone"`)
+      expect(next).toContain(`domain: "demo.supatype.com"`)
+      expect(next).toContain(`tls: { email: "hello@supatype.com", provider: "kong" }`)
+      expect(next).toContain(`port: 54321`)
+    } finally {
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
+
+  it("server config updater is idempotent and overwrites a prior domain/email", () => {
+    const dir = mkdtempSync(join(tmpdir(), "supatype-server-config-"))
+    try {
+      const configPath = join(dir, "supatype.config.ts")
+      writeFileSync(
+        configPath,
+        `export default {
+  project: { name: "x" },
+  database: { provider: "docker" },
+  server: { mode: "standalone", domain: "old.example.com", tls: { email: "old@example.com", provider: "kong" } },
+  app: { mode: "none" },
+}
+`,
+        "utf8",
+      )
+      updateServerConfigInProject(dir, { domain: "new.supatype.com", tlsEmail: "new@supatype.com" })
+      const next = readFileSync(configPath, "utf8")
+      expect(next).toContain(`domain: "new.supatype.com"`)
+      expect(next).toContain(`email: "new@supatype.com"`)
+      expect(next).not.toContain("old.example.com")
+      expect(next).not.toContain("old@example.com")
+    } finally {
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
+
   it("writes self-host compose artifacts under .supatype/self-host", () => {
     const dir = mkdtempSync(join(tmpdir(), "supatype-compose-"))
     try {
@@ -337,6 +465,62 @@ export default defineConfig({
     }
   })
 
+  const tlsConfig: SupatypeProjectConfig = {
+    ...baseConfig,
+    server: { mode: "standalone", domain: "api.example.com", tls: { email: "ops@example.com" } },
+  }
+
+  it("self-host compose renders Kong TLS + Valkey when standalone domain + email are set", () => {
+    const compose = renderSelfHostCompose(tlsConfig)
+    expect(compose).toContain("\n  valkey:\n")
+    expect(compose).toContain("valkey/valkey:8-alpine")
+    expect(compose).toContain('- "80:8000"')
+    expect(compose).toContain('- "443:8443"')
+    expect(compose).toContain("KONG_PROXY_LISTEN")
+    expect(compose).toContain("- valkey")
+    expect(compose).toContain("https://api.example.com")
+    expect(compose).toMatch(/^\s{2}valkey-data:/m)
+    expect(compose).not.toContain("HTTPS is off")
+  })
+
+  it("self-host compose stays plain HTTP with a discoverable hint when TLS is off", () => {
+    const compose = renderSelfHostCompose(baseConfig)
+    expect(compose).not.toContain("\n  valkey:\n")
+    expect(compose).not.toContain('- "443:8443"')
+    expect(compose).toContain("${SUPATYPE_KONG_PORT:-18473}:8000")
+    expect(compose).toContain("HTTPS is off")
+  })
+
+  it("self-host compose does not enable TLS for a domain without an ACME email", () => {
+    const compose = renderSelfHostCompose({
+      ...baseConfig,
+      server: { mode: "standalone", domain: "api.example.com" },
+    })
+    expect(compose).not.toContain("\n  valkey:\n")
+    expect(compose).not.toContain('- "443:8443"')
+  })
+
+  it("writeSelfHostCompose emits a Kong acme plugin backed by Valkey when TLS is on", () => {
+    const dir = mkdtempSync(join(tmpdir(), "supatype-tls-"))
+    try {
+      const out = writeSelfHostCompose(dir, tlsConfig)
+      const kong = readFileSync(out.kongPath, "utf8")
+      expect(kong).toContain("name: acme")
+      expect(kong).toContain('account_email: "ops@example.com"')
+      expect(kong).toContain("tos_accepted: true")
+      expect(kong).toContain('- "api.example.com"')
+      expect(kong).toContain("storage: redis")
+      expect(kong).toContain('host: "valkey"')
+    } finally {
+      rmSync(dir, { recursive: true, force: true })
+    }
+  })
+
+  it("kong declarative omits the acme plugin when no acme options are provided", () => {
+    const kong = buildKongDeclarative({ unifiedGateway: true })
+    expect(kong).not.toContain("name: acme")
+  })
+
   it("writes default manifest when missing for compose", () => {
     const dir = mkdtempSync(join(tmpdir(), "supatype-manifest-"))
     try {

package/tests/schema-sources.test.ts

@@ -0,0 +1,119 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest"
+import { mkdtempSync, writeFileSync, readFileSync, rmSync, mkdirSync } from "node:fs"
+import { join } from "node:path"
+import { tmpdir } from "node:os"
+import { collectSchemaSourcePaths } from "../src/type-extractor.js"
+import {
+  packSchemaSources,
+  unpackSchemaSources,
+  buildSchemaSourcesPayload,
+  restoreSchemaSourcesFromGz,
+  findOrphanSchemaFiles,
+} from "../src/schema-sources.js"
+
+function writeMultiFileSchema(root: string): void {
+  mkdirSync(join(root, "schema", "models"), { recursive: true })
+  mkdirSync(join(root, "schema", "shared"), { recursive: true })
+  writeFileSync(
+    join(root, "schema", "index.ts"),
+    `export type { Album } from "./models/album"\nexport type { localeConfig } from "./shared/locale"\n`,
+  )
+  writeFileSync(
+    join(root, "schema", "models", "album.ts"),
+    `import type { Nullable } from "../shared/field-types"\nexport type Album = { id: string; title: Nullable<string> }\n`,
+  )
+  writeFileSync(
+    join(root, "schema", "shared", "field-types.ts"),
+    `export type Nullable<T> = T | null\n`,
+  )
+  writeFileSync(
+    join(root, "schema", "shared", "locale.ts"),
+    `export type localeConfig = { default: string }\n`,
+  )
+}
+
+describe("schema-sources", () => {
+  let tmp: string
+
+  beforeEach(() => {
+    tmp = mkdtempSync(join(tmpdir(), "schema-sources-"))
+  })
+
+  afterEach(() => {
+    rmSync(tmp, { recursive: true, force: true })
+  })
+
+  it("discovers multi-file graph from entry point", () => {
+    writeMultiFileSchema(tmp)
+    const entry = join(tmp, "schema", "index.ts")
+    const graph = collectSchemaSourcePaths(entry, tmp)
+    const paths = graph.files.map((f) => f.relativePath).sort()
+    expect(paths).toEqual([
+      "schema/index.ts",
+      "schema/models/album.ts",
+      "schema/shared/field-types.ts",
+      "schema/shared/locale.ts",
+    ])
+    expect(graph.entryPoint).toBe("schema/index.ts")
+  })
+
+  it("roundtrips tar+gzip bytes", () => {
+    writeMultiFileSchema(tmp)
+    const graph = collectSchemaSourcePaths(join(tmp, "schema", "index.ts"), tmp)
+    const tar = packSchemaSources(graph)
+    const files = unpackSchemaSources(tar, tmp)
+    for (const file of graph.files) {
+      const original = readFileSync(file.absolutePath)
+      const restored = files.get(file.relativePath.replace(/\\/g, "/"))
+      expect(restored?.equals(original)).toBe(true)
+    }
+  })
+
+  it("buildSchemaSourcesPayload includes manifest metadata", () => {
+    writeMultiFileSchema(tmp)
+    writeFileSync(
+      join(tmp, "supatype.config.ts"),
+      `export default ${JSON.stringify({
+        project: { name: "demo" },
+        database: { provider: "docker" },
+        server: { mode: "dev" },
+        app: { mode: "none" },
+        schema: { path: "schema/index.ts", pg_schema: "public" },
+      })}\n`,
+    )
+    const payload = buildSchemaSourcesPayload(tmp, "test@example.com")
+    expect(payload).not.toBeNull()
+    expect(payload!.manifest.fileCount).toBe(4)
+    expect(payload!.manifest.pushedBy).toBe("test@example.com")
+    expect(payload!.manifest.compressedBytes).toBeGreaterThan(0)
+  })
+
+  it("restore overwrites modified local files", () => {
+    writeMultiFileSchema(tmp)
+    writeFileSync(
+      join(tmp, "supatype.config.ts"),
+      `export default ${JSON.stringify({
+        project: { name: "demo" },
+        database: { provider: "docker" },
+        server: { mode: "dev" },
+        app: { mode: "none" },
+        schema: { path: "schema/index.ts", pg_schema: "public" },
+      })}\n`,
+    )
+    const payload = buildSchemaSourcesPayload(tmp)!
+    const albumPath = join(tmp, "schema", "models", "album.ts")
+    writeFileSync(albumPath, "// modified\n")
+
+    restoreSchemaSourcesFromGz(payload.gz, payload.manifest, tmp)
+    expect(readFileSync(albumPath, "utf8")).toContain("Nullable")
+  })
+
+  it("warns about orphan files not in snapshot", () => {
+    writeMultiFileSchema(tmp)
+    writeFileSync(join(tmp, "schema", "models", "experimental.ts"), "export type X = {}\n")
+    const graph = collectSchemaSourcePaths(join(tmp, "schema", "index.ts"), tmp)
+    const manifestPaths = new Set(graph.files.map((f) => f.relativePath))
+    const orphans = findOrphanSchemaFiles(tmp, graph.entryPoint, manifestPaths)
+    expect(orphans).toContain("schema/models/experimental.ts")
+  })
+})