@supatype/cli 0.1.0-alpha.9 → 0.1.1

package/tests/init.test.ts

@@ -2,7 +2,7 @@ import { describe, it, expect, beforeEach, afterEach } from "vitest"
 import { mkdirSync, rmSync, existsSync, readFileSync, writeFileSync } from "node:fs"
 import { join } from "node:path"
 import { tmpdir } from "node:os"
-import { scaffold } from "../src/commands/init.js"
+import { scaffold, defaultScaffoldOptions } from "../src/commands/init.js"
 
 let tmpRoot: string
 
@@ -17,7 +17,7 @@ afterEach(() => {
 
 describe("scaffold()", () => {
   it("creates all expected files", () => {
-    scaffold(tmpRoot, "my-app")
+    scaffold(tmpRoot, defaultScaffoldOptions("my-app"))
 
     const expected = [
       "package.json",
@@ -35,17 +35,18 @@ describe("scaffold()", () => {
   })
 
   it("supatype.config.ts embeds the project name and exports defineConfig", () => {
-    scaffold(tmpRoot, "blog-app")
+    scaffold(tmpRoot, defaultScaffoldOptions("blog-app"))
     const content = readFileSync(join(tmpRoot, "supatype.config.ts"), "utf8")
     expect(content).toContain("blog-app")
     expect(content).toContain("defineConfig")
-    expect(content).toContain('provider: "native"')
+    expect(content).toContain('provider: "docker"')
     expect(content).toContain("schema:")
-    expect(content).toContain("versions:")
+    expect(content).toContain("Optional: pin component versions")
+    expect(content).not.toMatch(/^\s*versions:\s*\{/m)
   })
 
   it("package.json includes @supatype/cli and @supatype/types", () => {
-    scaffold(tmpRoot, "pkg-app")
+    scaffold(tmpRoot, defaultScaffoldOptions("pkg-app"))
     const content = readFileSync(join(tmpRoot, "package.json"), "utf8")
     expect(content).toContain("@supatype/cli")
     expect(content).toContain("@supatype/types")
@@ -55,18 +56,18 @@ describe("scaffold()", () => {
   it("skips package.json when it already exists", () => {
     const pkgPath = join(tmpRoot, "package.json")
     writeFileSync(pkgPath, '{"name":"existing"}', "utf8")
-    scaffold(tmpRoot, "my-app")
+    scaffold(tmpRoot, defaultScaffoldOptions("my-app"))
     expect(readFileSync(pkgPath, "utf8")).toBe('{"name":"existing"}')
   })
 
   it("supatype.config.ts documents self-host workflow", () => {
-    scaffold(tmpRoot, "my-app")
+    scaffold(tmpRoot, defaultScaffoldOptions("my-app"))
     const content = readFileSync(join(tmpRoot, "supatype.config.ts"), "utf8")
     expect(content).toContain("self-host")
   })
 
   it(".env contains DATABASE_URL, JWT_SECRET, POSTGRES_USER, POSTGRES_PASSWORD, POSTGRES_DB", () => {
-    scaffold(tmpRoot, "my-app")
+    scaffold(tmpRoot, defaultScaffoldOptions("my-app"))
     const content = readFileSync(join(tmpRoot, ".env"), "utf8")
     expect(content).toContain("DATABASE_URL=")
     expect(content).toContain("JWT_SECRET=")
@@ -76,44 +77,45 @@ describe("scaffold()", () => {
   })
 
   it(".env contains ANON_KEY, SERVICE_ROLE_KEY, and SITE_URL placeholders", () => {
-    scaffold(tmpRoot, "my-app")
+    scaffold(tmpRoot, defaultScaffoldOptions("my-app"))
     const content = readFileSync(join(tmpRoot, ".env"), "utf8")
     expect(content).toContain("ANON_KEY=")
     expect(content).toContain("SERVICE_ROLE_KEY=")
     expect(content).toContain("SITE_URL=")
   })
 
-  it("schema/index.ts exports a User model using RFC v2 Model<>", () => {
-    scaffold(tmpRoot, "my-app")
+  it("schema/index.ts exports a Profile model using RFC v2 Model<>", () => {
+    scaffold(tmpRoot, defaultScaffoldOptions("my-app"))
     const content = readFileSync(join(tmpRoot, "schema/index.ts"), "utf8")
-    expect(content).toContain("export type User")
+    expect(content).toContain("export type Profile")
+    expect(content).toContain("display_name")
     expect(content).toContain("Model<")
     expect(content).toContain("access:")
   })
 
   it(".gitignore excludes .env, node_modules, and engine binary", () => {
-    scaffold(tmpRoot, "my-app")
+    scaffold(tmpRoot, defaultScaffoldOptions("my-app"))
     const content = readFileSync(join(tmpRoot, ".gitignore"), "utf8")
     expect(content).toContain(".env")
     expect(content).toContain("node_modules/")
-    expect(content).toContain(".supatype/engine/")
+    expect(content).toContain(".supatype/")
     expect(content).toContain("supatype.local.config.ts")
   })
 
   it("seed.ts references the project name", () => {
-    scaffold(tmpRoot, "acme")
+    scaffold(tmpRoot, defaultScaffoldOptions("acme"))
     const content = readFileSync(join(tmpRoot, "seed.ts"), "utf8")
     expect(content).toContain("acme")
   })
 
   it("different project names produce different config bodies", () => {
-    scaffold(tmpRoot, "alpha")
+    scaffold(tmpRoot, defaultScaffoldOptions("alpha"))
     const alpha = readFileSync(join(tmpRoot, "supatype.config.ts"), "utf8")
 
     const tmp2 = join(tmpdir(), `dt-init-test2-${Date.now()}`)
     mkdirSync(tmp2, { recursive: true })
     try {
-      scaffold(tmp2, "beta")
+      scaffold(tmp2, defaultScaffoldOptions("beta"))
       const beta = readFileSync(join(tmp2, "supatype.config.ts"), "utf8")
       expect(alpha).toContain("alpha")
       expect(beta).toContain("beta")
@@ -123,4 +125,181 @@ describe("scaffold()", () => {
       rmSync(tmp2, { recursive: true, force: true })
     }
   })
+
+  it("self-host target emits standalone mode + domain and a local override", () => {
+    scaffold(tmpRoot, { ...defaultScaffoldOptions("my-app", "self-host"), domain: "api.example.com" })
+    const content = readFileSync(join(tmpRoot, "supatype.config.ts"), "utf8")
+    expect(content).toContain('mode: "standalone"')
+    expect(content).toContain('domain: "api.example.com"')
+    expect(content).toContain('environments: { default: "production" }')
+    expect(existsSync(join(tmpRoot, "supatype.local.config.ts"))).toBe(true)
+    const local = readFileSync(join(tmpRoot, "supatype.local.config.ts"), "utf8")
+    expect(local).toContain('mode: "dev"')
+    expect(local).toContain("Partial<SupatypeConfig>")
+  })
+
+  it("self-host with a TLS email emits an active tls block", () => {
+    scaffold(tmpRoot, {
+      ...defaultScaffoldOptions("my-app", "self-host"),
+      domain: "api.example.com",
+      tlsEmail: "ops@example.com",
+    })
+    const content = readFileSync(join(tmpRoot, "supatype.config.ts"), "utf8")
+    expect(content).toContain('tls: { email: "ops@example.com" }')
+  })
+
+  it("self-host without a TLS email emits a commented tls hint", () => {
+    scaffold(tmpRoot, { ...defaultScaffoldOptions("my-app", "self-host"), domain: "api.example.com" })
+    const content = readFileSync(join(tmpRoot, "supatype.config.ts"), "utf8")
+    expect(content).toContain('// tls: { email: "you@example.com" }')
+  })
+
+  it("cloud target emits managed mode + environments and a local override", () => {
+    scaffold(tmpRoot, defaultScaffoldOptions("my-app", "cloud"))
+    const content = readFileSync(join(tmpRoot, "supatype.config.ts"), "utf8")
+    expect(content).toContain('mode: "managed"')
+    expect(content).toContain('environments: { default: "production" }')
+    expect(existsSync(join(tmpRoot, "supatype.local.config.ts"))).toBe(true)
+  })
+
+  it("later target stays in dev mode with no local override", () => {
+    scaffold(tmpRoot, defaultScaffoldOptions("my-app", "later"))
+    const content = readFileSync(join(tmpRoot, "supatype.config.ts"), "utf8")
+    expect(content).toContain('mode: "dev"')
+    expect(content).not.toContain("environments:")
+    expect(existsSync(join(tmpRoot, "supatype.local.config.ts"))).toBe(false)
+  })
+
+  it("static app mode writes the static dir and config block", () => {
+    scaffold(tmpRoot, {
+      ...defaultScaffoldOptions("my-app"),
+      app: { mode: "static", staticDir: "./dist" },
+    })
+    const content = readFileSync(join(tmpRoot, "supatype.config.ts"), "utf8")
+    expect(content).toContain('mode: "static"')
+    expect(content).toContain('static_dir: "./dist"')
+    expect(existsSync(join(tmpRoot, "dist/index.html"))).toBe(true)
+    const html = readFileSync(join(tmpRoot, "dist/index.html"), "utf8")
+    expect(html).toContain("Supatype")
+    expect(html).toContain("supatype.github.io/supatype/")
+    expect(html).toContain("github.com/supatype")
+  })
+
+  it("static app mode with Vite scaffolds root index.html and vite.config.ts", () => {
+    scaffold(tmpRoot, {
+      ...defaultScaffoldOptions("my-app"),
+      app: {
+        mode: "static",
+        staticDir: "./public",
+        viteDevUrl: "http://127.0.0.1:5173",
+      },
+    })
+    expect(existsSync(join(tmpRoot, "public/index.html"))).toBe(true)
+    expect(existsSync(join(tmpRoot, "index.html"))).toBe(true)
+    expect(existsSync(join(tmpRoot, "vite.config.ts"))).toBe(true)
+    const pkg = readFileSync(join(tmpRoot, "package.json"), "utf8")
+    expect(pkg).toContain('"vite": "vite"')
+    expect(pkg).toContain('"vite": "^6"')
+    const viteConfig = readFileSync(join(tmpRoot, "vite.config.ts"), "utf8")
+    expect(viteConfig).toContain("port: 5173")
+  })
+
+  it("proxy app mode writes upstream and start in the config when target is later", () => {
+    scaffold(tmpRoot, {
+      ...defaultScaffoldOptions("my-app"),
+      app: { mode: "proxy", upstream: "http://localhost:4000", start: "dev" },
+    })
+    const content = readFileSync(join(tmpRoot, "supatype.config.ts"), "utf8")
+    expect(content).toContain('mode: "proxy"')
+    expect(content).toContain('upstream: "http://localhost:4000"')
+    expect(content).toContain('start: "dev"')
+    expect(existsSync(join(tmpRoot, "supatype.local.config.ts"))).toBe(false)
+  })
+
+  it("proxy app mode with self-host splits static production config and local proxy override", () => {
+    scaffold(tmpRoot, {
+      ...defaultScaffoldOptions("my-app", "self-host"),
+      domain: "api.example.com",
+      app: {
+        mode: "proxy",
+        upstream: "http://127.0.0.1:5173",
+        start: "vite",
+        viteDevUrl: "http://127.0.0.1:5173",
+      },
+    })
+    const committed = readFileSync(join(tmpRoot, "supatype.config.ts"), "utf8")
+    expect(committed).toContain('mode: "static"')
+    expect(committed).toContain('static_dir: "./dist"')
+    expect(committed).not.toContain('mode: "proxy"')
+
+    const local = readFileSync(join(tmpRoot, "supatype.local.config.ts"), "utf8")
+    expect(local).toContain('mode: "dev"')
+    expect(local).toContain('mode: "proxy"')
+    expect(local).toContain('upstream: "http://127.0.0.1:5173"')
+    expect(local).toContain('start: "vite"')
+    expect(local).toContain('vite_dev_url: "http://127.0.0.1:5173"')
+    expect(existsSync(join(tmpRoot, "dist/index.html"))).toBe(true)
+    expect(existsSync(join(tmpRoot, "index.html"))).toBe(true)
+    expect(existsSync(join(tmpRoot, "vite.config.ts"))).toBe(true)
+  })
+
+  it("proxy app mode with cloud target splits static production config and local proxy override", () => {
+    scaffold(tmpRoot, {
+      ...defaultScaffoldOptions("my-app", "cloud"),
+      app: { mode: "proxy", upstream: "http://localhost:3000", start: "dev" },
+    })
+    const committed = readFileSync(join(tmpRoot, "supatype.config.ts"), "utf8")
+    expect(committed).toContain('mode: "static"')
+    expect(committed).not.toContain('mode: "proxy"')
+
+    const local = readFileSync(join(tmpRoot, "supatype.local.config.ts"), "utf8")
+    expect(local).toContain('mode: "proxy"')
+    expect(local).toContain('upstream: "http://localhost:3000"')
+  })
+
+  it("hello-world function scaffolds function files and a functions script", () => {
+    scaffold(tmpRoot, { ...defaultScaffoldOptions("my-app"), helloFunction: true })
+    expect(existsSync(join(tmpRoot, "functions/hello/index.ts"))).toBe(true)
+    expect(existsSync(join(tmpRoot, "functions/_shared/README.md"))).toBe(true)
+    expect(existsSync(join(tmpRoot, "functions/.env.local"))).toBe(true)
+    const pkg = readFileSync(join(tmpRoot, "package.json"), "utf8")
+    expect(pkg).toContain("supatype functions serve")
+  })
+
+  it("custom schema path is honored", () => {
+    scaffold(tmpRoot, { ...defaultScaffoldOptions("my-app"), schemaPath: "db/schema.ts" })
+    expect(existsSync(join(tmpRoot, "db/schema.ts"))).toBe(true)
+    const content = readFileSync(join(tmpRoot, "supatype.config.ts"), "utf8")
+    expect(content).toContain('path: "db/schema.ts"')
+  })
+
+  it("s3 storage and resend email reflect in config and .env", () => {
+    scaffold(tmpRoot, {
+      ...defaultScaffoldOptions("my-app"),
+      email: "resend",
+      storageLocal: "s3",
+      storageProduction: "s3",
+    })
+    const config = readFileSync(join(tmpRoot, "supatype.config.ts"), "utf8")
+    expect(config).toContain('email: { provider: "resend" }')
+    expect(config).toContain('storage: { provider: "s3" }')
+    const env = readFileSync(join(tmpRoot, ".env"), "utf8")
+    expect(env).toContain("RESEND_API_KEY=")
+    expect(env).toContain("S3_BUCKET=")
+    expect(env).toContain("local development and production")
+  })
+
+  it("mixed local dev and s3 production writes both storage sections", () => {
+    scaffold(tmpRoot, {
+      ...defaultScaffoldOptions("my-app"),
+      storageLocal: "local",
+      storageProduction: "s3",
+    })
+    const config = readFileSync(join(tmpRoot, "supatype.config.ts"), "utf8")
+    expect(config).toContain('provider: "local"')
+    expect(config).toContain("Production storage: external S3")
+    const env = readFileSync(join(tmpRoot, ".env"), "utf8")
+    expect(env).toContain("local development — MinIO")
+    expect(env).toContain("production — external bucket")
+  })
 })

package/tests/link.test.ts

@@ -0,0 +1,148 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest"
+import { mkdtempSync, writeFileSync, rmSync, mkdirSync } from "node:fs"
+import { join } from "node:path"
+import { tmpdir } from "node:os"
+import { resolveTarget, targetSchemaRollback } from "../src/resolve-target.js"
+import { loadProjectLink, migrateLegacyLinkFiles } from "../src/link.js"
+import { scaffold } from "../src/commands/init.js"
+
+function writePlainConfig(dir: string): void {
+  writeFileSync(
+    join(dir, "supatype.config.ts"),
+    `export default ${JSON.stringify({
+      project: { name: "demo" },
+      database: { provider: "docker" },
+      server: { mode: "dev" },
+      app: { mode: "none" },
+      schema: { path: "schema/index.ts", pg_schema: "public" },
+    })}
+`,
+  )
+}
+
+describe("link model", () => {
+  let tmp: string
+
+  beforeEach(() => {
+    tmp = mkdtempSync(join(tmpdir(), "supatype-link-"))
+  })
+
+  afterEach(() => {
+    rmSync(tmp, { recursive: true, force: true })
+  })
+
+  it("migrates cloud.json into link.json", () => {
+    scaffold(tmp, "demo")
+    mkdirSync(join(tmp, ".supatype"), { recursive: true })
+    writeFileSync(join(tmp, ".supatype", "cloud.json"), JSON.stringify({
+      apiUrl: "https://api.example.com",
+      token: "pat",
+      projectSlug: "myproj",
+      orgId: "org1",
+    }), { encoding: "utf8" })
+
+    migrateLegacyLinkFiles(tmp)
+    const link = loadProjectLink(tmp)
+    expect(link?.kind).toBe("cloud")
+    expect(link?.projectRef).toBe("myproj")
+    expect(link?.environments.production?.apiUrl).toBe("https://api.example.com")
+  })
+
+  it("resolveTarget returns cloud mode with /api/v1 prefix", () => {
+    writePlainConfig(tmp)
+    mkdirSync(join(tmp, ".supatype"), { recursive: true })
+    writeFileSync(join(tmp, ".supatype", "link.json"), JSON.stringify({
+      version: 1,
+      kind: "cloud",
+      projectRef: "myproj",
+      defaultEnvironment: "production",
+      token: "pat",
+      orgId: "org1",
+      cloudApiUrl: "https://api.example.com",
+      linkedAt: new Date().toISOString(),
+      environments: {
+        production: {
+          name: "production",
+          apiUrl: "https://myproj.supatype.dev",
+          linkedAt: new Date().toISOString(),
+        },
+      },
+    }))
+
+    const target = resolveTarget(tmp)
+    expect(target.mode).toBe("cloud")
+    expect(target.apiPrefix).toBe("/api/v1")
+    expect(target.apiBaseUrl).toBe("https://api.example.com")
+  })
+
+  it("resolveTarget returns self-host mode with /platform/v1 prefix", () => {
+    writePlainConfig(tmp)
+    mkdirSync(join(tmp, ".supatype"), { recursive: true })
+    writeFileSync(join(tmp, ".supatype", "link.json"), JSON.stringify({
+      version: 1,
+      kind: "self-host",
+      projectRef: "demo",
+      defaultEnvironment: "production",
+      linkedAt: new Date().toISOString(),
+      environments: {
+        production: {
+          name: "production",
+          apiUrl: "https://app.example.com",
+          token: "srk",
+          linkedAt: new Date().toISOString(),
+        },
+      },
+    }))
+
+    const target = resolveTarget(tmp)
+    expect(target.mode).toBe("self-host")
+    expect(target.apiPrefix).toBe("/platform/v1")
+    expect(target.token).toBe("srk")
+  })
+
+  it("targetSchemaRollback posts to /platform/v1 when linked", async () => {
+    writePlainConfig(tmp)
+    mkdirSync(join(tmp, ".supatype"), { recursive: true })
+    writeFileSync(join(tmp, ".supatype", "link.json"), JSON.stringify({
+      version: 1,
+      kind: "self-host",
+      projectRef: "demo",
+      defaultEnvironment: "production",
+      linkedAt: new Date().toISOString(),
+      environments: {
+        production: {
+          name: "production",
+          apiUrl: "https://app.example.com",
+          token: "srk",
+          linkedAt: new Date().toISOString(),
+        },
+      },
+    }))
+
+    const fetchMock = vi.fn().mockResolvedValue({
+      ok: true,
+      json: async () => ({
+        data: {
+          status: "rolled_back",
+          name: "push_test",
+          message: "Rolled back migration push_test.",
+        },
+      }),
+    })
+    vi.stubGlobal("fetch", fetchMock)
+
+    const target = resolveTarget(tmp)
+    await targetSchemaRollback(target, { schema: "public" })
+
+    expect(fetchMock).toHaveBeenCalledOnce()
+    const [url, init] = fetchMock.mock.calls[0] as [string, RequestInit]
+    expect(url).toBe("https://app.example.com/platform/v1/projects/demo/schema/rollback")
+    expect(init.method).toBe("POST")
+    expect(init.headers).toMatchObject({
+      Authorization: "Bearer srk",
+      "Content-Type": "application/json",
+    })
+
+    vi.unstubAllGlobals()
+  })
+})

package/tests/minisign.test.ts

@@ -0,0 +1,102 @@
+import { describe, it, expect } from "vitest"
+import {
+  createHash,
+  generateKeyPairSync,
+  randomBytes,
+  sign as edSign,
+  type KeyObject,
+} from "node:crypto"
+import { verifyMinisign } from "../src/binary-cache.js"
+
+/**
+ * Build a minisign public-key string + signature file for the given mode so we
+ * can exercise {@link verifyMinisign} without shelling out to the minisign tool.
+ *
+ * Layout mirrors the minisign format the verifier parses:
+ *   public key payload: [2 algo]["Ed"][8 keyId][32 raw ed25519 pubkey]
+ *   signature payload : [2 algo][8 keyId][64 ed25519 signature]
+ */
+function makeMinisign(
+  data: Buffer,
+  mode: "legacy" | "prehashed",
+  opts: { keyId?: Buffer; privateKey?: KeyObject; publicKey?: KeyObject } = {},
+): { pubKeyStr: string; sigFile: string } {
+  const { publicKey, privateKey } =
+    opts.privateKey && opts.publicKey
+      ? { publicKey: opts.publicKey, privateKey: opts.privateKey }
+      : generateKeyPairSync("ed25519")
+
+  const keyId = opts.keyId ?? randomBytes(8)
+
+  // Raw 32-byte ed25519 key = SPKI DER minus its 12-byte prefix.
+  const rawPub = publicKey.export({ format: "der", type: "spki" }).subarray(12)
+  const pkPayload = Buffer.concat([Buffer.from("Ed"), keyId, rawPub])
+  const pubKeyStr = `untrusted comment: test\n${pkPayload.toString("base64")}`
+
+  const prehashed = mode === "prehashed"
+  const signedData = prehashed
+    ? createHash("blake2b512").update(data).digest()
+    : data
+  const signature = edSign(null, signedData, privateKey)
+
+  const algo = prehashed ? Buffer.from("ED") : Buffer.from("Ed")
+  const sigPayload = Buffer.concat([algo, keyId, signature])
+  const sigFile =
+    `untrusted comment: signature\n${sigPayload.toString("base64")}\n` +
+    `trusted comment: timestamp\n${Buffer.alloc(64).toString("base64")}`
+
+  return { pubKeyStr, sigFile }
+}
+
+describe("verifyMinisign", () => {
+  const data = Buffer.from("the quick brown fox\n")
+
+  it("accepts a valid legacy ('Ed') signature", () => {
+    const keyId = randomBytes(8)
+    const { publicKey, privateKey } = generateKeyPairSync("ed25519")
+    const { pubKeyStr, sigFile } = makeMinisign(data, "legacy", { keyId, privateKey, publicKey })
+    expect(() => verifyMinisign(data, sigFile, pubKeyStr)).not.toThrow()
+  })
+
+  it("accepts a valid prehashed ('ED', BLAKE2b-512) signature", () => {
+    const keyId = randomBytes(8)
+    const { publicKey, privateKey } = generateKeyPairSync("ed25519")
+    const { pubKeyStr, sigFile } = makeMinisign(data, "prehashed", { keyId, privateKey, publicKey })
+    expect(() => verifyMinisign(data, sigFile, pubKeyStr)).not.toThrow()
+  })
+
+  it("rejects a prehashed signature when the file was tampered", () => {
+    const { pubKeyStr, sigFile } = makeMinisign(data, "prehashed")
+    const tampered = Buffer.from("the quick brown dog\n")
+    expect(() => verifyMinisign(tampered, sigFile, pubKeyStr)).toThrow(/verification FAILED/i)
+  })
+
+  it("rejects when the signature key id does not match the public key", () => {
+    const { publicKey, privateKey } = generateKeyPairSync("ed25519")
+    const { sigFile } = makeMinisign(data, "prehashed", {
+      keyId: randomBytes(8),
+      privateKey,
+      publicKey,
+    })
+    // Public key advertising a different key id.
+    const { pubKeyStr } = makeMinisign(data, "prehashed", {
+      keyId: randomBytes(8),
+      privateKey,
+      publicKey,
+    })
+    expect(() => verifyMinisign(data, sigFile, pubKeyStr)).toThrow(/key ID mismatch/i)
+  })
+
+  it("rejects an unsupported algorithm", () => {
+    const { pubKeyStr, sigFile } = makeMinisign(data, "legacy")
+    // Corrupt the algorithm bytes in the signature payload to "XX".
+    const lines = sigFile.split("\n")
+    const sigBytes = Buffer.from(lines[1]!, "base64")
+    sigBytes[0] = 0x58
+    sigBytes[1] = 0x58
+    lines[1] = sigBytes.toString("base64")
+    expect(() => verifyMinisign(data, lines.join("\n"), pubKeyStr)).toThrow(
+      /Unsupported minisign algorithm/i,
+    )
+  })
+})

package/tests/proxy-dev-app.test.ts

@@ -1,5 +1,12 @@
+import { mkdirSync, writeFileSync } from "node:fs"
+import { join } from "node:path"
+import { tmpdir } from "node:os"
 import { describe, expect, it } from "vitest"
-import { resolveProxyDevScript } from "../src/app/proxy-dev-app.js"
+import {
+  portFromUpstream,
+  resolveProxyDevScript,
+  resolveViteDirectSpawn,
+} from "../src/app/proxy-dev-app.js"
 import type { SupatypeProjectConfig } from "../src/project-config.js"
 
 const base = {
@@ -31,3 +38,40 @@ describe("resolveProxyDevScript()", () => {
     expect(resolveProxyDevScript(config)).toBe("dev:site")
   })
 })
+
+describe("portFromUpstream()", () => {
+  it("parses port from upstream URL", () => {
+    const config = {
+      ...base,
+      app: { mode: "proxy" as const, upstream: "http://localhost:5285" },
+    } satisfies SupatypeProjectConfig
+    expect(portFromUpstream(config)).toBe(5285)
+  })
+
+  it("returns null when upstream has no port", () => {
+    const config = {
+      ...base,
+      app: { mode: "proxy" as const, upstream: "http://localhost" },
+    } satisfies SupatypeProjectConfig
+    expect(portFromUpstream(config)).toBeNull()
+  })
+})
+
+describe("resolveViteDirectSpawn()", () => {
+  it("returns node + vite.js for a plain vite script", () => {
+    const appDir = join(tmpdir(), `supatype-vite-spawn-${Date.now()}`)
+    const viteJs = join(appDir, "node_modules", "vite", "bin", "vite.js")
+    mkdirSync(join(appDir, "node_modules", "vite", "bin"), { recursive: true })
+    writeFileSync(viteJs, "")
+    const result = resolveViteDirectSpawn(appDir, "dev:vite", { "dev:vite": "vite" })
+    expect(result).not.toBeNull()
+    expect(result?.bin).toBe(process.execPath)
+    expect(result?.args[0]).toBe(viteJs)
+    expect(result?.shell).toBe(false)
+  })
+
+  it("returns null for non-vite scripts", () => {
+    const result = resolveViteDirectSpawn(process.cwd(), "dev", { dev: "next dev" })
+    expect(result).toBeNull()
+  })
+})

package/tests/pull-utils.test.ts

@@ -106,12 +106,12 @@ describe("pgTypeToField()", () => {
 })
 
 describe("introspectColumnToColumnInfo()", () => {
-  it("maps engine type → pgType and flags", () => {
+  it("maps engine column → pgType and flags", () => {
     const out = introspectColumnToColumnInfo({
       name: "id",
-      type: "uuid",
+      dataType: "uuid",
+      udtName: "uuid",
       nullable: false,
-      primaryKey: true,
       default: "gen_random_uuid()",
     })
     expect(out).toEqual({
@@ -127,7 +127,8 @@ describe("introspectColumnToColumnInfo()", () => {
   it("treats empty default as no default", () => {
     const out = introspectColumnToColumnInfo({
       name: "x",
-      type: "text",
+      dataType: "text",
+      udtName: "text",
       nullable: true,
       default: "",
     })