@supatype/cli 0.1.12 → 0.2.0

package/tests/field-validators.test.ts

@@ -0,0 +1,139 @@
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs"
+import { tmpdir } from "node:os"
+import { join } from "node:path"
+import { afterEach, describe, expect, it } from "vitest"
+import {
+  declaredValidators,
+  hooksReport,
+  manifestValidators,
+  validateModelValidators,
+} from "../src/model-hooks.js"
+import { extractSchemaAstFromTypes } from "../src/type-extractor.js"
+
+// A per-field validator that silently never fires is the failure this feature cannot have: the
+// schema would say the field is checked and nothing would be checking it. So the tests here are
+// mostly about the ways that could happen, and each one fails the push instead.
+
+const dirs: string[] = []
+
+afterEach(() => {
+  for (const dir of dirs.splice(0)) rmSync(dir, { recursive: true, force: true })
+})
+
+function extract(meta: string, fields = "  id: UUID\n  sku: string\n  setupItems: JSON<{ label: string }[]>"): unknown {
+  const dir = mkdtempSync(join(tmpdir(), "supatype-validators-"))
+  dirs.push(dir)
+  const schemaPath = join(dir, "schema.ts")
+  writeFileSync(
+    schemaPath,
+    `
+import type { JSON, Model, Public, UUID } from "@supatype/types"
+
+export type Product = Model<{
+${fields}
+}, {
+  access: { read: Public }
+${meta}
+}>
+`,
+    "utf8",
+  )
+  return extractSchemaAstFromTypes(schemaPath, dir)
+}
+
+/** A functions directory containing the named handlers. */
+function functionsDir(...names: string[]): string {
+  const dir = mkdtempSync(join(tmpdir(), "supatype-fns-"))
+  dirs.push(dir)
+  for (const name of names) {
+    mkdirSync(join(dir, name), { recursive: true })
+    writeFileSync(join(dir, name, "index.ts"), "export default () => new Response()", "utf8")
+  }
+  return dir
+}
+
+describe("declaring a field validator", () => {
+  it("extracts the field and its function", () => {
+    const ast = extract('  validate: { setupItems: "check-items" }')
+    expect(declaredValidators(ast)).toEqual([
+      { model: "Product", field: "setupItems", function: "check-items" },
+    ])
+  })
+
+  it("accepts per-validator options, as hooks do", () => {
+    const ast = extract('  validate: { sku: { function: "check-sku", timeout: 3000 } }')
+    const manifest = manifestValidators(ast)
+    expect(manifest["product"]?.["sku"]).toEqual({
+      function: "check-sku",
+      timeout: 3000,
+      onUnavailable: "reject",
+    })
+  })
+
+  it("writes onUnavailable explicitly rather than relying on the server's default", () => {
+    // The server does default to refusing, but its policy matches exact event names, and a value
+    // missing from that switch is how an unreachable validator came to accept writes once already.
+    const ast = extract('  validate: { setupItems: "check-items" }')
+    expect(manifestValidators(ast)["product"]?.["setupItems"]?.onUnavailable).toBe("reject")
+  })
+
+  it("refuses a validator naming a field the model does not have", () => {
+    // Caught here, where the message can list the real fields, rather than becoming a manifest entry
+    // for a column that will never appear in a write.
+    expect(() => extract('  validate: { noSuchField: "check-it" }')).toThrow(
+      /names "noSuchField", which is not a field on this model.*id, sku, setupItems/s,
+    )
+  })
+
+  it("refuses a validate block that is not an object", () => {
+    expect(() => extract("  validate: string")).toThrow(/`validate` must be an object/)
+  })
+
+  it("emits nothing when a model declares none", () => {
+    const ast = extract("")
+    expect(declaredValidators(ast)).toEqual([])
+    expect(manifestValidators(ast)).toEqual({})
+  })
+})
+
+describe("push refuses a validator whose function is missing", () => {
+  it("names the field and where the function should be", () => {
+    const ast = extract('  validate: { setupItems: "check-items" }')
+    const problems = validateModelValidators(ast, functionsDir("something-else"), process.cwd())
+
+    expect(problems.join("\n")).toMatch(/Product\.setupItems → "check-items"/)
+    expect(problems.join("\n")).toMatch(/something-else/)
+  })
+
+  it("says nothing when every function exists", () => {
+    const ast = extract('  validate: { setupItems: "check-items" }')
+    expect(validateModelValidators(ast, functionsDir("check-items"), process.cwd())).toEqual([])
+  })
+})
+
+describe("doctor reports what will and will not run", () => {
+  it("separates a missing validator from a missing hook", () => {
+    const cwd = mkdtempSync(join(tmpdir(), "supatype-doctor-"))
+    dirs.push(cwd)
+    const ast = extract('  validate: { setupItems: "check-items", sku: "check-sku" }')
+
+    const report = hooksReport(cwd, functionsDir("check-sku"), ast)
+
+    expect(report.validators).toHaveLength(2)
+    expect(report.validatorsMissing.map((v) => v.field)).toEqual(["setupItems"])
+    // A validator problem is not a hook problem: the fix and the consequence differ.
+    expect(report.missing).toEqual([])
+  })
+
+  it("notices a manifest with no validator map, which means nothing is being checked", () => {
+    const cwd = mkdtempSync(join(tmpdir(), "supatype-doctor-"))
+    dirs.push(cwd)
+    mkdirSync(join(cwd, ".supatype"), { recursive: true })
+    writeFileSync(join(cwd, ".supatype", "manifest.json"), JSON.stringify({ hooks: {} }), "utf8")
+
+    const ast = extract('  validate: { setupItems: "check-items" }')
+    const report = hooksReport(cwd, functionsDir("check-items"), ast)
+
+    expect(report.validatorMapMissing).toBe(true)
+  })
+})

package/tests/hooks-generator.test.ts

@@ -210,3 +210,89 @@ export default nope
     expect(output).toContain("comments")
   })
 })
+
+describe("field validators", () => {
+  const VALIDATED_SCHEMA = `
+import type { JSON, Model, Public, UUID } from "@supatype/types"
+
+export type Product = Model<{
+  id: UUID
+  sku: string
+  setupItems: JSON<{ label: string }[]>
+}, {
+  access: { read: Public }
+  validate: { setupItems: "check-setup-items", sku: { function: "check-sku", timeout: 3000 } }
+}>
+`
+
+  it("generates the module for a model that declares only validators", () => {
+    // Validators need the same row types hooks do. A model declaring only validators used to produce
+    // no module at all, which would make `FieldValidator<"product", ...>` fail to resolve.
+    const module = generateHooksModule(astFor(VALIDATED_SCHEMA))
+    expect(module).not.toBeNull()
+    expect(module).toContain("FieldValidator")
+    expect(module).toContain("export function fieldValidator(")
+  })
+
+  it("typechecks with a validator written the way the docs will show it", () => {
+    const dir = mkdtempSync(join(tmpdir(), "supatype-validatorcompile-"))
+    dirs.push(dir)
+
+    const module = generateHooksModule(astFor(VALIDATED_SCHEMA))
+    writeFileSync(join(dir, "hooks.ts"), module ?? "", "utf8")
+    writeFileSync(
+      join(dir, "deno.d.ts"),
+      `declare namespace Deno {
+  const env: { get(key: string): string | undefined }
+}
+`,
+      "utf8",
+    )
+    writeFileSync(
+      join(dir, "handler.ts"),
+      `import { fieldValidator, type FieldValidator } from "./hooks.ts"
+
+// The value is the column's real type, so this narrows without a cast.
+const checkItems: FieldValidator<"product", "setupItems"> = (ctx) => {
+  if (!Array.isArray(ctx.value) || ctx.value.length === 0) {
+    return "At least one setup item is required."
+  }
+  return true
+}
+
+export default fieldValidator(checkItems)
+`,
+      "utf8",
+    )
+    writeFileSync(
+      join(dir, "tsconfig.json"),
+      JSON.stringify({
+        compilerOptions: {
+          strict: true,
+          exactOptionalPropertyTypes: true,
+          noEmit: true,
+          target: "ES2022",
+          module: "ESNext",
+          moduleResolution: "Bundler",
+          allowImportingTsExtensions: true,
+          lib: ["ES2022", "DOM"],
+        },
+        include: ["*.ts"],
+      }),
+      "utf8",
+    )
+
+    const tsc = join(__dirname, "..", "..", "..", "node_modules", "typescript", "bin", "tsc")
+    let output = ""
+    try {
+      execFileSync(process.execPath, [tsc, "-p", join(dir, "tsconfig.json")], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+      })
+    } catch (err) {
+      const failure = err as { stdout?: string; stderr?: string }
+      output = `${failure.stdout ?? ""}${failure.stderr ?? ""}`
+    }
+    expect(output, "the generated validator surface must compile").toBe("")
+  })
+})

package/tests/local-server-image-env.test.ts

@@ -0,0 +1,93 @@
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs"
+import { tmpdir } from "node:os"
+import { join } from "node:path"
+import { afterEach, describe, expect, it } from "vitest"
+import { syncComposeImagePins, upsertDevComposeEnv } from "../src/dev-compose.js"
+import {
+  LOCAL_SERVER_DOCKER_IMAGE,
+  usesLocalServerImage,
+} from "../src/compose-local-server-image.js"
+import type { SupatypeProjectConfig } from "../src/project-config.js"
+
+/**
+ * `overrides.server` has to survive the next `.env` write, whichever command makes it.
+ *
+ * The local image reaches compose through one variable, and several code paths rewrite the file
+ * that holds it. When only one of them knew the local image existed, the others removed the key as
+ * an unpinned managed pin: `dev` started the local server, the next `push` deleted the variable,
+ * and compose recreated the container from the published image. Nothing failed, so the symptom was
+ * a contributor testing their own build and running someone else's.
+ */
+
+const dirs: string[] = []
+
+afterEach(() => {
+  for (const dir of dirs.splice(0)) rmSync(dir, { recursive: true, force: true })
+})
+
+/** A project whose `overrides.server` points at a binary beside a Dockerfile. */
+function project(versions?: SupatypeProjectConfig["versions"]): {
+  cwd: string
+  config: SupatypeProjectConfig
+} {
+  const cwd = mkdtempSync(join(tmpdir(), "supatype-local-image-"))
+  dirs.push(cwd)
+  const serverRoot = join(cwd, "server-src")
+  mkdirSync(serverRoot, { recursive: true })
+  writeFileSync(join(serverRoot, "Dockerfile"), "FROM scratch\n", "utf8")
+
+  return {
+    cwd,
+    config: {
+      project: { name: "demo" },
+      ...(versions !== undefined && { versions }),
+      overrides: { server: join(serverRoot, "supatype-server.exe") },
+    } as SupatypeProjectConfig,
+  }
+}
+
+const envOf = (cwd: string): string => readFileSync(join(cwd, ".env"), "utf8")
+
+describe("the locally built server image", () => {
+  it("is recognised from config alone, so no caller has to be told about it", () => {
+    const { cwd, config } = project({ server: "local" })
+    expect(usesLocalServerImage(cwd, config)).toBe(true)
+  })
+
+  it("is not claimed when the override points nowhere near a Dockerfile", () => {
+    const { cwd, config } = project({ server: "local" })
+    const stray = { ...config, overrides: { server: join(cwd, "nope", "server.exe") } }
+    expect(usesLocalServerImage(cwd, stray as SupatypeProjectConfig)).toBe(false)
+  })
+
+  it("is not claimed when versions.server names a release", () => {
+    const { cwd, config } = project({ server: "1.2.3" })
+    expect(usesLocalServerImage(cwd, config)).toBe(false)
+  })
+
+  it("survives an image-pin sync that knows nothing about it", () => {
+    // The exact sequence that broke: `dev` writes the local image, then another command rewrites
+    // `.env` to reconcile pins from `versions`. The second command has no local image of its own,
+    // so the first must not leave the key looking like a pin the second is entitled to remove.
+    const { cwd, config } = project({ server: "local" })
+    writeFileSync(join(cwd, ".env"), "JWT_SECRET=x\n", "utf8")
+
+    upsertDevComposeEnv(cwd, config, "anon-key", "service-key", 54321)
+    expect(envOf(cwd)).toContain(`SUPATYPE_SERVER_IMAGE=${LOCAL_SERVER_DOCKER_IMAGE}`)
+
+    syncComposeImagePins(cwd, { project: { name: "demo" } } as SupatypeProjectConfig)
+    expect(envOf(cwd)).toContain(`SUPATYPE_SERVER_IMAGE=${LOCAL_SERVER_DOCKER_IMAGE}`)
+  })
+
+  it("is cleared once the project stops asking for a local build", () => {
+    // Otherwise compose keeps starting a stale `local-dev` image that nothing rebuilds.
+    const { cwd, config } = project({ server: "local" })
+    writeFileSync(join(cwd, ".env"), "JWT_SECRET=x\n", "utf8")
+    upsertDevComposeEnv(cwd, config, "anon-key", "service-key", 54321)
+
+    const released = { ...config, versions: { server: "1.2.3" } } as SupatypeProjectConfig
+    upsertDevComposeEnv(cwd, released, "anon-key", "service-key", 54321)
+
+    expect(envOf(cwd)).not.toContain(LOCAL_SERVER_DOCKER_IMAGE)
+  })
+})

package/tests/model-constraints.test.ts

@@ -0,0 +1,293 @@
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs"
+import { tmpdir } from "node:os"
+import { join } from "node:path"
+import { afterEach, describe, expect, it } from "vitest"
+import { extractSchemaAstFromTypes } from "../src/type-extractor.js"
+
+// Model-level constraints reuse the access-rule vocabulary deliberately: a constraint is an access
+// rule with a narrower operand set. That reuse is the point, and it is also the risk, because the
+// wider set is one import away. Everything a CHECK cannot evaluate has to be refused at push time,
+// where the message can name the node, rather than at CREATE TABLE where Postgres names nothing.
+
+const dirs: string[] = []
+
+afterEach(() => {
+  for (const dir of dirs.splice(0)) rmSync(dir, { recursive: true, force: true })
+})
+
+function extract(body: string, prelude = ""): ReturnType<typeof extractSchemaAstFromTypes> {
+  const dir = mkdtempSync(join(tmpdir(), "supatype-constraints-"))
+  dirs.push(dir)
+  const schemaPath = join(dir, "schema.ts")
+  writeFileSync(
+    schemaPath,
+    `
+import type {
+  All, Any, AuthUid, Block, Blocks, Bytea, DateTime, Eq, Gte, IsNull, ItemCount, JSON, Length,
+  Literal, Lte, Matches, Model, NotNull, Now, Optional, Public, RichText, Role, UUID,
+} from "@supatype/types"
+
+${prelude}
+
+${body}
+`,
+    "utf8",
+  )
+  return extractSchemaAstFromTypes(schemaPath, dir)
+}
+
+const constraintsOf = (ast: ReturnType<typeof extractSchemaAstFromTypes>): unknown[] =>
+  (ast?.models[0]?.annotations.db.constraints ?? []) as unknown[]
+
+describe("model constraints", () => {
+  it("extracts a cross-column comparison, which no field modifier can express", () => {
+    const ast = extract(`
+export type Event = Model<{
+  id: UUID
+  starts_at: DateTime
+  ends_at: DateTime
+}, {
+  access: { read: Public }
+  constraints: [Lte<"starts_at", "ends_at">]
+}>`)
+
+    expect(constraintsOf(ast)).toEqual([
+      {
+        type: "compare",
+        op: "lte",
+        left: { kind: "column", name: "starts_at" },
+        right: { kind: "column", name: "ends_at" },
+      },
+    ])
+  })
+
+  it("extracts the item-count and length operands", () => {
+    const ast = extract(`
+export type Product = Model<{
+  id: UUID
+  setup_items: JSON<{ label: string }[]>
+  sku: string
+}, {
+  access: { read: Public }
+  constraints: [Gte<ItemCount<"setup_items">, Literal<1>>, Lte<Length<"sku">, Literal<32>>]
+}>`)
+
+    expect(constraintsOf(ast)).toMatchObject([
+      { type: "compare", op: "gte", left: { kind: "itemCount", column: "setup_items" } },
+      { type: "compare", op: "lte", left: { kind: "length", column: "sku" } },
+    ])
+  })
+
+  it("extracts a pattern as a pattern, never as an expression", () => {
+    const ast = extract(`
+export type Part = Model<{
+  id: UUID
+  sku: string
+}, {
+  access: { read: Public }
+  constraints: [Matches<"sku", "^[A-Z]{3}$">]
+}>`)
+
+    expect(constraintsOf(ast)).toEqual([
+      { type: "matches", column: "sku", pattern: "^[A-Z]{3}$" },
+    ])
+  })
+
+  it("extracts combinators, so a constraint can be more than one comparison", () => {
+    const ast = extract(`
+export type Page = Model<{
+  id: UUID
+  status: "draft" | "published"
+  published_at: Optional<DateTime>
+}, {
+  access: { read: Public }
+  constraints: [Any<[Eq<"status", Literal<"draft">>, NotNull<"published_at">]>]
+}>`)
+
+    const [rule] = constraintsOf(ast) as Array<{ type: string; rules: unknown[] }>
+    expect(rule?.type).toBe("any")
+    expect(rule?.rules).toHaveLength(2)
+  })
+})
+
+describe("model constraints: what a CHECK cannot evaluate is refused", () => {
+  const cases: Array<[string, string, RegExp]> = [
+    ["the caller", "Eq<\"owner_id\", AuthUid>", /cannot see who is writing/],
+    ["the caller's role", "Role<\"admin\">", /cannot see the caller's role/],
+    ["the clock", "Lte<\"starts_at\", Now>", /cannot read the clock/],
+  ]
+
+  for (const [what, rule, expected] of cases) {
+    it(`refuses ${what}, naming why`, () => {
+      expect(() =>
+        extract(`
+export type Thing = Model<{
+  id: UUID
+  owner_id: UUID
+  status: string
+  starts_at: DateTime
+}, {
+  access: { read: Public }
+  constraints: [${rule}]
+}>`),
+      ).toThrow(expected)
+    })
+  }
+
+  it("refuses one nested inside a combinator, not only at the top level", () => {
+    expect(() =>
+      extract(`
+export type Thing = Model<{
+  id: UUID
+  owner_id: UUID
+  status: string
+}, {
+  access: { read: Public }
+  constraints: [All<[Eq<"status", Literal<"live">>, Eq<"owner_id", AuthUid>]>]
+}>`),
+    ).toThrow(/cannot see who is writing/)
+  })
+
+  it("names the model and which constraint, so a large schema stays navigable", () => {
+    expect(() =>
+      extract(`
+export type Thing = Model<{
+  id: UUID
+  a: DateTime
+  b: DateTime
+  owner_id: UUID
+}, {
+  access: { read: Public }
+  constraints: [Lte<"a", "b">, Eq<"owner_id", AuthUid>]
+}>`),
+    ).toThrow(/Model "Thing": constraint 2/)
+  })
+
+  it("refuses a constraints value that is not a tuple", () => {
+    expect(() =>
+      extract(`
+export type Thing = Model<{ id: UUID }, {
+  access: { read: Public }
+  constraints: string
+}>`),
+    ).toThrow(/`constraints` must be a tuple/)
+  })
+})
+
+describe("model constraints: absence", () => {
+  it("emits no key when a model declares none", () => {
+    const ast = extract(`
+export type Plain = Model<{ id: UUID }, { access: { read: Public } }>`)
+    expect(ast?.models[0]?.annotations.db.constraints).toBeUndefined()
+  })
+})
+
+describe("the constraint operands stay out of access rules", () => {
+  // They share a parser, so nothing syntactic stops one appearing in an `access` block. The engine's
+  // RLS renderer has no case for them, so it would emit a policy that does not say what was written.
+  it("refuses Length in an access rule, naming where it belongs", () => {
+    expect(() =>
+      extract(`
+export type Doc = Model<{ id: UUID; title: string }, {
+  access: { read: Gte<Length<"title">, Literal<5>> }
+}>`),
+    ).toThrow(/`Length<>` is not supported in an `access` rule.*belongs in `constraints`/s)
+  })
+
+  it("refuses Matches in an access rule too", () => {
+    expect(() =>
+      extract(`
+export type Doc = Model<{ id: UUID; sku: string }, {
+  access: { read: Matches<"sku", "^[A-Z]{3}$"> }
+}>`),
+    ).toThrow(/not supported in an `access` rule/)
+  })
+})
+
+describe("constraint measures resolve to the same form the modifiers use", () => {
+  it("resolves Length per storage, not per hope", () => {
+    const ast = extract(`
+export type Doc = Model<{
+  id: UUID
+  title: string
+  body: RichText
+  blob: Bytea
+}, {
+  access: { read: Public }
+  constraints: [
+    Lte<Length<"title">, Literal<10>>,
+    Lte<Length<"body">, Literal<10>>,
+    Lte<Length<"blob">, Literal<10>>,
+  ]
+}>`)
+
+    expect(constraintsOf(ast)).toMatchObject([
+      { left: { kind: "length", column: "title", form: "chars" } },
+      { left: { kind: "length", column: "body", form: "richText" } },
+      { left: { kind: "length", column: "blob", form: "octets" } },
+    ])
+  })
+
+  it("tells a real array from a JSON array, which JSONB alone cannot", () => {
+    const ast = extract(`
+export type Doc = Model<{
+  id: UUID
+  tags: string[]
+  refs: JSON<{ id: string }[]>
+  sections: Blocks<Note>
+}, {
+  access: { read: Public }
+  constraints: [
+    Lte<ItemCount<"tags">, Literal<3>>,
+    Gte<ItemCount<"refs">, Literal<1>>,
+    Gte<ItemCount<"sections">, Literal<1>>,
+  ]
+}>`, "type Note = Block<\"note\", { text: string }>")
+
+    expect(constraintsOf(ast)).toMatchObject([
+      { left: { kind: "itemCount", column: "tags", form: "array" } },
+      { left: { kind: "itemCount", column: "refs", form: "jsonbArray" } },
+      { left: { kind: "itemCount", column: "sections", form: "jsonbArray" } },
+    ])
+  })
+
+  it("refuses a measure the column cannot take, naming the alternative", () => {
+    expect(() =>
+      extract(`
+export type Doc = Model<{ id: UUID; tags: string[] }, {
+  access: { read: Public }
+  constraints: [Lte<Length<"tags">, Literal<3>>]
+}>`),
+    ).toThrow(/an array has items, not characters; use MaxItems\/MinItems/)
+
+    expect(() =>
+      extract(`
+export type Doc = Model<{ id: UUID; title: string }, {
+  access: { read: Public }
+  constraints: [Lte<ItemCount<"title">, Literal<3>>]
+}>`),
+    ).toThrow(/text has characters, not items/)
+  })
+
+  it("refuses a measure over a column that is not a field", () => {
+    // Composite columns like `created_at` exist in the table and not in `fields`, so the measure
+    // cannot be resolved. Saying so beats emitting SQL against a kind nobody classified.
+    expect(() =>
+      extract(`
+export type Doc = Model<{ id: UUID }, {
+  access: { read: Public }
+  constraints: [Lte<Length<"created_at">, Literal<3>>]
+}>`),
+    ).toThrow(/is not a field on this model/)
+  })
+
+  it("resolves a measure nested inside a combinator", () => {
+    const ast = extract(`
+export type Doc = Model<{ id: UUID; title: string }, {
+  access: { read: Public }
+  constraints: [Any<[Lte<Length<"title">, Literal<5>>, IsNull<"title">]>]
+}>`)
+    const [rule] = constraintsOf(ast) as Array<{ rules: Array<{ left?: { form?: string } }> }>
+    expect(rule?.rules[0]?.left?.form).toBe("chars")
+  })
+})

package/tests/model-hooks.test.ts

@@ -218,6 +218,62 @@ export type Post = Model<{ id: UUID }, { tableName: "posts" }>
     ) as Record<string, unknown>
     expect(manifest["hooks"]).toBeUndefined()
   })
+
+  it("writes the validator map, which is what makes a validator run at all", () => {
+    // The map was built and unit-tested for a release in which nothing wrote it to the manifest.
+    // The server therefore had no validator to call, and a write that should have been refused was
+    // accepted with a 201 and no error anywhere: the one failure this feature cannot have.
+    const { dir, ast } = project(`
+import type { JSON, Model, UUID } from "@supatype/types"
+
+export type Post = Model<{
+  id: UUID
+  items: JSON<{ minutes: number }[]>
+}, {
+  tableName: "posts"
+  validate: { items: "check-items" }
+}>
+`)
+    mkdirSync(join(dir, ".supatype"), { recursive: true })
+    writeFileSync(
+      join(dir, ".supatype", "manifest.json"),
+      JSON.stringify({ functions_enabled: true }),
+      "utf8",
+    )
+
+    expect(syncManifestHooks(dir, ast)).toBe(true)
+    const manifest = JSON.parse(
+      readFileSync(join(dir, ".supatype", "manifest.json"), "utf8"),
+    ) as Record<string, unknown>
+    const validators = manifest["validators"] as Record<string, Record<string, unknown>>
+    expect(validators?.["posts"]?.["items"]).toMatchObject({
+      function: "check-items",
+      onUnavailable: "reject",
+    })
+  })
+
+  it("removes the validator map when the last validator goes away", () => {
+    const { dir, ast } = project(`
+import type { Model, UUID } from "@supatype/types"
+
+export type Post = Model<{ id: UUID }, { tableName: "posts" }>
+`)
+    mkdirSync(join(dir, ".supatype"), { recursive: true })
+    writeFileSync(
+      join(dir, ".supatype", "manifest.json"),
+      JSON.stringify({
+        functions_enabled: true,
+        validators: { posts: { items: { function: "gone" } } },
+      }),
+      "utf8",
+    )
+
+    expect(syncManifestHooks(dir, ast)).toBe(true)
+    const manifest = JSON.parse(
+      readFileSync(join(dir, ".supatype", "manifest.json"), "utf8"),
+    ) as Record<string, unknown>
+    expect(manifest["validators"]).toBeUndefined()
+  })
 })
 
 describe("model hooks: generated module on disk", () => {