@supatype/cli 0.1.6 → 0.1.7

package/src/model-hooks.ts

@@ -0,0 +1,260 @@
+/**
+ * Validate the lifecycle hooks a schema declares against the functions that exist.
+ *
+ * A hook names a function directory. If the name is wrong, the honest failure is at push time with
+ * the path we searched — not at runtime, where the symptom is a hook that never fires and a write
+ * that quietly succeeds unvalidated. That silence is the whole reason this check exists.
+ *
+ * Kept out of the extractor on purpose: resolving the functions directory needs the project config,
+ * and the extractor is a leaf that reads type syntax and nothing else.
+ */
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs"
+import { join, relative } from "node:path"
+import { generateHooksModule } from "./hooks-generator.js"
+
+export interface DeclaredHook {
+  model: string
+  event: string
+  function: string
+}
+
+/** Every hook declared across the schema, in a stable order for reporting. */
+export function declaredHooks(ast: unknown): DeclaredHook[] {
+  const models = (ast as { models?: unknown[] })?.models
+  if (!Array.isArray(models)) return []
+
+  const out: DeclaredHook[] = []
+  for (const model of models) {
+    const shaped = model as {
+      name?: string
+      annotations?: { platform?: { hooks?: Record<string, unknown> } }
+    }
+    const hooks = shaped.annotations?.platform?.hooks
+    if (typeof hooks !== "object" || hooks === null) continue
+
+    for (const [event, value] of Object.entries(hooks)) {
+      const fn = (value as { function?: unknown })?.function
+      if (typeof fn === "string" && fn.length > 0) {
+        out.push({ model: shaped.name ?? "?", event, function: fn })
+      }
+    }
+  }
+  return out.sort((a, b) => `${a.model}.${a.event}`.localeCompare(`${b.model}.${b.event}`))
+}
+
+/** Function directory names available to be used as hooks. */
+function availableFunctions(functionsDir: string): string[] {
+  if (!existsSync(functionsDir)) return []
+  return readdirSync(functionsDir)
+    .filter((entry) => !entry.startsWith("_") && !entry.startsWith("."))
+    .filter((entry) => {
+      const full = join(functionsDir, entry)
+      // A function is a directory with an index.ts, matching how the worker discovers them.
+      return statSync(full).isDirectory() && existsSync(join(full, "index.ts"))
+    })
+    .sort()
+}
+
+/**
+ * Lines describing every hook whose function is missing, empty when all resolve.
+ *
+ * Returns the message rather than throwing so the caller decides how to fail: `push` stops, while
+ * `doctor` can report several problems at once.
+ */
+export function validateModelHooks(
+  ast: unknown,
+  functionsDir: string,
+  cwd: string,
+): string[] {
+  const hooks = declaredHooks(ast)
+  if (hooks.length === 0) return []
+
+  const available = availableFunctions(functionsDir)
+  const known = new Set(available)
+  const missing = hooks.filter((hook) => !known.has(hook.function))
+  if (missing.length === 0) return []
+
+  const where = relative(cwd, functionsDir) || functionsDir
+  const lines = missing.map(
+    (hook) => `  ${hook.model}.${hook.event} → "${hook.function}" (no ${where}/${hook.function}/index.ts)`,
+  )
+  lines.push("")
+  lines.push(
+    available.length > 0
+      ? `Hooks found in ${where}: ${available.join(", ")}`
+      : `No hooks found in ${where}. Create one with: supatype hooks new <name>`,
+  )
+  return lines
+}
+
+/**
+ * Write `functions/_supatype/hooks.ts`, or remove a stale one when no hooks remain.
+ *
+ * Removal matters as much as writing: deleting the last hook from a schema should leave no typed
+ * module behind claiming tables are hooked, and a handler importing it should start failing to
+ * compile rather than sitting there dead.
+ *
+ * Returns the project-relative path written, or null when there was nothing to write.
+ */
+export function writeHooksModule(cwd: string, functionsDir: string, ast: unknown): string | null {
+  const module = generateHooksModule(ast)
+  const dir = join(functionsDir, "_supatype")
+  const file = join(dir, "hooks.ts")
+
+  if (module === null) {
+    if (existsSync(file)) rmSync(file, { force: true })
+    return null
+  }
+
+  mkdirSync(dir, { recursive: true })
+  writeFileSync(file, module, "utf8")
+  return relative(cwd, file) || file
+}
+
+/** Per-table hook config, in the shape `proxy.RouteManifest` reads. */
+export interface ManifestHookEntry {
+  function: string
+  timeout?: number
+  onUnavailable?: "reject" | "log"
+}
+
+/**
+ * The hook map for `.supatype/manifest.json`, keyed by **table name** — because that is what the
+ * server matches a request path against, not the model name.
+ *
+ * Defaults are resolved here rather than in the server: one place decides that a `before*` hook
+ * rejects when it cannot be reached and an `after*` hook only logs, so the two implementations
+ * cannot disagree about the safe direction.
+ */
+export function manifestHooks(ast: unknown): Record<string, Record<string, ManifestHookEntry>> {
+  const models = (ast as { models?: unknown[] })?.models
+  if (!Array.isArray(models)) return {}
+
+  const out: Record<string, Record<string, ManifestHookEntry>> = {}
+  for (const model of models) {
+    const shaped = model as {
+      annotations?: {
+        db?: { tableName?: string }
+        platform?: { hooks?: Record<string, { function?: string; timeout?: number; onUnavailable?: string }> }
+      }
+    }
+    const table = shaped.annotations?.db?.tableName
+    const hooks = shaped.annotations?.platform?.hooks
+    if (typeof table !== "string" || table.length === 0) continue
+    if (typeof hooks !== "object" || hooks === null) continue
+
+    const entries: Record<string, ManifestHookEntry> = {}
+    for (const [event, value] of Object.entries(hooks)) {
+      const fn = value?.function
+      if (typeof fn !== "string" || fn.length === 0) continue
+      const onUnavailable =
+        value.onUnavailable === "reject" || value.onUnavailable === "log"
+          ? value.onUnavailable
+          : event.startsWith("before")
+            ? "reject"
+            : "log"
+      entries[event] = {
+        function: fn,
+        timeout: typeof value.timeout === "number" ? value.timeout : DEFAULT_HOOK_TIMEOUT_MS,
+        onUnavailable,
+      }
+    }
+    if (Object.keys(entries).length > 0) out[table] = entries
+  }
+  return out
+}
+
+/** Well below the 10s edge-function ceiling, so a hung hook fails fast instead of holding a slot. */
+export const DEFAULT_HOOK_TIMEOUT_MS = 2000
+
+/**
+ * Merge the hook map into an existing `.supatype/manifest.json`.
+ *
+ * **Only updates a manifest that is already there.** Creating one from scratch here would be a
+ * hazard: `functions_enabled` is a plain bool on the server's side, so a manifest carrying only
+ * hooks would read as functions *disabled* — the exact defect this repo fixed a commit ago, arriving
+ * by a different door. The compose path owns creation; this owns one key.
+ *
+ * Returns true when the file was rewritten.
+ */
+export function syncManifestHooks(cwd: string, ast: unknown): boolean {
+  const manifestPath = join(cwd, ".supatype", "manifest.json")
+  if (!existsSync(manifestPath)) return false
+
+  let parsed: Record<string, unknown>
+  try {
+    parsed = JSON.parse(readFileSync(manifestPath, "utf8")) as Record<string, unknown>
+  } catch {
+    return false // Malformed: the server will complain about it far more clearly than we can here.
+  }
+  if (typeof parsed !== "object" || parsed === null) return false
+
+  const hooks = manifestHooks(ast)
+  const next = JSON.stringify(hooks)
+  const current = JSON.stringify(parsed["hooks"] ?? {})
+  if (next === current) return false
+
+  if (Object.keys(hooks).length === 0) {
+    delete parsed["hooks"]
+  } else {
+    parsed["hooks"] = hooks
+  }
+  writeFileSync(manifestPath, `${JSON.stringify(parsed, null, 2)}\n`, "utf8")
+  return true
+}
+
+export interface HooksReport {
+  declared: DeclaredHook[]
+  /** Hooks whose function directory is missing. */
+  missing: DeclaredHook[]
+  /** True when a manifest exists and says the functions subsystem is off. */
+  functionsDisabled: boolean
+  /** True when a manifest exists but carries no hook map, so the server has nothing to call. */
+  mapMissing: boolean
+}
+
+/**
+ * What `supatype doctor` needs to answer "will my hooks actually run?".
+ *
+ * Local facts only — the schema, the functions on disk, and the manifest the server reads. No probe
+ * of a running worker, so the answer is the same whether or not the stack is up, and a report that
+ * needs a stack is a report nobody runs before deploying.
+ *
+ * The case worth catching: hooks declared while `functions_enabled` is false. Nothing fails, no error
+ * appears, and every hook silently never fires.
+ */
+export function hooksReport(cwd: string, functionsDir: string, ast: unknown): HooksReport {
+  const declared = declaredHooks(ast)
+  const manifestPath = join(cwd, ".supatype", "manifest.json")
+
+  let functionsDisabled = false
+  let mapMissing = false
+  if (declared.length > 0 && existsSync(manifestPath)) {
+    try {
+      const parsed = JSON.parse(readFileSync(manifestPath, "utf8")) as Record<string, unknown>
+      functionsDisabled = parsed["functions_enabled"] === false
+      mapMissing = parsed["hooks"] === undefined
+    } catch {
+      // Unparseable: the server reports that far better than a doctor line could.
+    }
+  }
+
+  const known = new Set(
+    existsSync(functionsDir)
+      ? readdirSync(functionsDir).filter(
+          (entry) =>
+            !entry.startsWith("_") &&
+            !entry.startsWith(".") &&
+            statSync(join(functionsDir, entry)).isDirectory() &&
+            existsSync(join(functionsDir, entry, "index.ts")),
+        )
+      : [],
+  )
+
+  return {
+    declared,
+    missing: declared.filter((hook) => !known.has(hook.function)),
+    functionsDisabled,
+    mapMissing,
+  }
+}

package/src/postgres-ctl.ts

@@ -5,7 +5,7 @@
 
 import { spawnSync } from "node:child_process"
 import { existsSync, mkdirSync } from "node:fs"
-import { dirname, join } from "node:path"
+import { dirname, join, resolve as resolvePath } from "node:path"
 
 export interface PgOptions {
   /** Absolute path to the directory containing pg_ctl, initdb, psql, etc. */
@@ -72,15 +72,42 @@ export function initdb(opts: PgOptions): void {
  * Start Postgres using pg_ctl.
  * Returns immediately once pg_ctl has handed off to the server process.
  */
+/**
+ * Whether a native Postgres install carries the masking library.
+ *
+ * Asked of the filesystem rather than assumed from the provider, because a developer with an archive
+ * downloaded before the library was bundled has a native Postgres *without* it. Assuming otherwise
+ * would select tier 1 and their next push would be refused by the capability probe.
+ *
+ * Two layouts: Linux and macOS put extension libraries in `lib/`, the Windows archive in
+ * `lib/postgresql/`.
+ */
+export function nativeMaskLibraryPresent(pgBinDir: string | null | undefined): boolean {
+  if (!pgBinDir) return false
+  const prefix = resolvePath(pgBinDir, "..")
+  return ["supatype_mask.so", "supatype_mask.dylib", "supatype_mask.dll"].some(
+    (lib) =>
+      existsSync(join(prefix, "lib", lib)) || existsSync(join(prefix, "lib", "postgresql", lib)),
+  )
+}
+
 export function start(opts: PgOptions): void {
   const bin = pgBin(opts.pgBinDir, "pg_ctl")
   const logPath = opts.logPath ?? join(opts.dataDir, "postgres.log")
 
+  // `supatype_mask` is a planner hook, so it has to be preloaded — `CREATE EXTENSION` alone does
+  // nothing without it. Only when the archive actually carries the library: an install downloaded
+  // before it was bundled would fail to start with "could not access file".
+  //
+  // Native Postgres was started with no preloaded libraries at all until now, which is why field
+  // rules could not be enforced on the default `supatype dev`.
+  const preload = nativeMaskLibraryPresent(opts.pgBinDir) ? " -c shared_preload_libraries=supatype_mask" : ""
+
   const args = [
     "start",
     "-D", opts.dataDir,
     "-l", logPath,
-    "-o", `-p ${opts.port}`,
+    "-o", `-p ${opts.port}${preload}`,
     "--wait",
   ]
 

package/src/project-config.ts

@@ -31,8 +31,38 @@ export interface SupatypeProjectConfig {
      * Database backend.
      * "native" = supatype manages a native Postgres binary (downloaded from CDN).
      * "docker" = supatype runs supatype/postgres via Docker (includes all extensions).
+     *
+     * Omitted when `external` is set — there is no backend for Supatype to choose.
      */
-    provider: "native" | "docker"
+    provider?: "native" | "docker"
+    /**
+     * Point the stack at a Postgres that already exists, instead of provisioning one.
+     *
+     * The presence of this block is the switch: with it, no `db` service is generated and every
+     * service connects here. Deliberately not an overload of `connection`, which means something
+     * narrower (a DSN for CLI commands) and would become the third setting meaning two things.
+     *
+     * **Self-host only.** On the cloud path the database is part of what is being provided, so the
+     * block is rejected rather than ignored.
+     */
+    external?: {
+      /**
+       * Postgres URL for every service in the stack.
+       *
+       * The role in it owns the schema and runs migrations. PostgREST connects as `authenticator`
+       * separately — see `supatype db check`, which reports what this database is missing.
+       */
+      url: string
+      /**
+       * Force realtime off.
+       *
+       * Realtime needs logical replication (`wal_level = logical`, a replication slot, and
+       * `wal2json`), which a managed provider may not offer. Left unset, the stack probes for the
+       * capability and records the answer, so this is only for overriding a probe that says yes when
+       * you would rather it did not run.
+       */
+      realtime?: boolean
+    }
     /**
      * Directory where Postgres stores its data files (provider=native).
      * Defaults to ~/.supatype/projects/{name}/data when omitted.
@@ -182,10 +212,36 @@ export interface SupatypeProjectConfig {
     path?: string
     /** Postgres schema name. Defaults to "public". */
     pg_schema?: string
+    /**
+     * Schemas the REST API exposes, in order (`PGRST_DB_SCHEMA`).
+     *
+     * Defaults to `pg_schema` plus the ones the stack needs for itself — `supatype` for Studio's
+     * views, `graphql_public`, `auth` — so setting `pg_schema` alone does the sensible thing.
+     *
+     * It used to be a hardcoded literal, which meant choosing a non-`public` `pg_schema` gave you
+     * a correct push and an API that answered `PGRST106` for everything: the engine had moved and
+     * PostgREST had not been told. State this explicitly when you need a different set — an extra
+     * schema of your own, or to stop exposing one.
+     */
+    api_schemas?: readonly string[]
   }
   functions?: {
     /** Path to edge functions directory, relative to `supatype.root` when not absolute. */
     path?: string
+    /**
+     * **Public functions** allowed to see the service-role key, which reads and writes past every
+     * access rule.
+     *
+     * Empty by default, and that default is the point: a function is a public endpoint anyone holding
+     * the anon key can invoke, so an ambient admin credential made every one of them able to read the
+     * whole database. Naming one here is a reviewable line in a diff; ambient privilege is not.
+     *
+     * **Model hooks are not listed here and do not need to be.** A hook is procedural: only the API
+     * server calls it, around a write the caller was already permitted to make, and the gateway
+     * refuses its route from outside — so there is no attacker to withhold it from, and the trust is
+     * the same a trigger already has.
+     */
+    serviceRole?: readonly string[]
   }
   output?: {
     /** Path for generated TypeScript types. */
@@ -350,9 +406,75 @@ export function validateProjectConfig(raw: unknown, filename: string): SupatypeP
     throw new Error(`${filename}: app section is required`)
   }
 
+  validateExternalDatabase(cfg, filename)
+
   return raw as SupatypeProjectConfig
 }
 
+/**
+ * Rules for `database.external`, all of them errors rather than precedence.
+ *
+ * Every one of these is a case where two settings describe the same fact and the stack would have to
+ * pick. A silent winner is how you end up with a push that went somewhere other than where the
+ * services are reading, which looks like data loss and is not.
+ */
+function validateExternalDatabase(cfg: Record<string, unknown>, filename: string): void {
+  const database = cfg["database"] as Record<string, unknown>
+  const external = database["external"]
+  if (external === undefined) return
+
+  if (typeof external !== "object" || external === null || Array.isArray(external)) {
+    throw new Error(`${filename}: database.external must be an object with a url`)
+  }
+
+  const url = (external as Record<string, unknown>)["url"]
+  if (typeof url !== "string" || url.trim().length === 0) {
+    throw new Error(
+      `${filename}: database.external.url is required — the Postgres URL every service connects to.\n` +
+        "Reading it from the environment keeps the password out of version control:\n" +
+        "  database: { external: { url: process.env.DATABASE_URL! } }\n" +
+        "The project's .env is loaded before the config module, so DATABASE_URL there is enough.",
+    )
+  }
+  if (!/^postgres(ql)?:\/\//.test(url.trim())) {
+    throw new Error(
+      `${filename}: database.external.url must be a postgres:// or postgresql:// URL (got "${url.trim()}")`,
+    )
+  }
+
+  const realtime = (external as Record<string, unknown>)["realtime"]
+  if (realtime !== undefined && typeof realtime !== "boolean") {
+    throw new Error(`${filename}: database.external.realtime must be true or false`)
+  }
+
+  if (database["provider"] !== undefined) {
+    throw new Error(
+      `${filename}: database.provider ("${String(database["provider"])}") and database.external ` +
+        "cannot both be set — provider chooses a Postgres for Supatype to run, external says one " +
+        "already exists.\n" +
+        "Remove database.provider. The runtime stack is still chosen by the top-level `provider`.",
+    )
+  }
+
+  const server = cfg["server"] as Record<string, unknown> | undefined
+  if (server?.["mode"] === "managed") {
+    throw new Error(
+      `${filename}: database.external is not supported with server.mode "managed" — on the cloud ` +
+        "path the database is part of what is being provided.\n" +
+        "Use an external database with a self-hosted stack (server.mode \"dev\" or \"standalone\").",
+    )
+  }
+
+  const connection = cfg["connection"]
+  if (typeof connection === "string" && connection.trim() !== url.trim()) {
+    throw new Error(
+      `${filename}: connection and database.external.url are both set and disagree.\n` +
+        "database.external.url is what the whole stack uses, CLI commands included — remove " +
+        "`connection`.",
+    )
+  }
+}
+
 /** Schema entry path (with fallback). */
 export function schemaPathFromProject(cfg: SupatypeProjectConfig, cwd: string): string {
   return resolve(projectRootFromConfig(cfg, cwd), cfg.schema?.path ?? "schema/index.ts")
@@ -373,6 +495,19 @@ export function functionsPathCandidatesFromProject(cfg: SupatypeProjectConfig, c
   return [resolve(root, "functions"), resolve(root, "supatype/functions")]
 }
 
+/**
+ * Directory holding **model hooks** — procedural handlers the API calls around a write.
+ *
+ * Separate from `functions/` because the two have different trust models: a function is a public
+ * endpoint anyone with the anon key may invoke, while a hook is only ever called by the server. One
+ * worker serves both, and the gateway refuses the hook namespace from outside — so keeping them in
+ * separate directories is what makes that boundary structural rather than a list to maintain.
+ */
+export function hooksPathFromProject(cfg: SupatypeProjectConfig, cwd: string): string {
+  const root = projectRootFromConfig(cfg, cwd)
+  return resolve(root, "hooks")
+}
+
 /** Preferred default functions path (used when creating new functions). */
 export function preferredFunctionsPathFromProject(cfg: SupatypeProjectConfig, cwd: string): string {
   const candidates = functionsPathCandidatesFromProject(cfg, cwd)
@@ -425,6 +560,22 @@ export function resolveRuntimeProvider(cfg: SupatypeProjectConfig): "native" | "
   return cfg.provider ?? cfg.database.provider ?? "native"
 }
 
+/**
+ * Routes entitled to the service-role key, as the worker's env expects them.
+ *
+ * Resolved here rather than in the compose template so there is one definition of the format.
+ *
+ * This does **not** check that the names exist — it cannot, since it has only the config. An earlier
+ * version of this comment claimed a typo was "visible in one place rather than silently granting
+ * nothing", which was false: nothing read the list except the two callers that turn it into an env var.
+ * `checkServiceRoleRoutes` in `service-role-check.ts` is what actually resolves the names, and `push`
+ * refuses on it.
+ */
+export function serviceRoleRoutes(cfg: SupatypeProjectConfig): string[] {
+  const declared = cfg.functions?.serviceRole ?? []
+  return [...declared].map((entry) => entry.trim()).filter((entry) => entry.length > 0).sort()
+}
+
 /** Kong gateway port when `provider: docker` (self-host compose dev). */
 export const COMPOSE_DEV_KONG_PORT = 18473
 
@@ -439,5 +590,88 @@ export function localDSN(cfg: SupatypeProjectConfig): string {
  * Prefers optional `connection` in config, then `DATABASE_URL` env, then a local default DSN.
  */
 export function connectionString(cfg: SupatypeProjectConfig): string {
-  return cfg.connection ?? process.env["DATABASE_URL"] ?? localDSN(cfg)
+  return externalDatabaseUrl(cfg) ?? cfg.connection ?? process.env["DATABASE_URL"] ?? localDSN(cfg)
+}
+
+/** True when the project points at a Postgres it does not manage. */
+export function usesExternalDatabase(cfg: SupatypeProjectConfig): boolean {
+  return externalDatabaseUrl(cfg) !== undefined
+}
+
+/**
+ * The external Postgres URL, or undefined for a managed one.
+ *
+ * Ahead of `connection` and `DATABASE_URL` in [`connectionString`] on purpose: a stated external
+ * database is the whole stack's database, and a CLI command that pushed somewhere else while the
+ * services read from here would look exactly like data loss.
+ */
+export function externalDatabaseUrl(cfg: SupatypeProjectConfig): string | undefined {
+  const url = cfg.database.external?.url?.trim()
+  return url && url.length > 0 ? url : undefined
+}
+
+/**
+ * Whether realtime should run.
+ *
+ * `false` only when stated. An external database that cannot support logical replication is detected
+ * rather than declared — the capability record is what Studio and `doctor` read, so an operator who
+ * has not thought about it gets a truthful answer instead of a silent default.
+ */
+export function realtimeEnabled(cfg: SupatypeProjectConfig): boolean {
+  return cfg.database.external?.realtime ?? true
+}
+
+/** The Postgres schema Supatype manages. */
+export function pgSchema(cfg: SupatypeProjectConfig): string {
+  const declared = cfg.schema?.pg_schema?.trim()
+  return declared && declared.length > 0 ? declared : "public"
+}
+
+/**
+ * Schemas the stack exposes for its own sake, beyond the one Supatype manages.
+ *
+ * Dev used to omit `auth` while self-host exposed it, so the same request could work against a
+ * self-hosted stack and 404 locally. One list for both.
+ */
+export const STACK_API_SCHEMAS = ["supatype", "graphql_public", "auth"] as const
+
+/**
+ * Schemas to expose over REST, as `PGRST_DB_SCHEMA` wants them.
+ *
+ * The managed schema first, then what the stack needs for itself. Derived rather than hardcoded
+ * because the literal version silently ignored `pg_schema`: the engine would migrate into `app`
+ * while PostgREST kept serving `public`, so every request answered `PGRST106` and nothing in the
+ * output mentioned the setting that caused it.
+ *
+ * `api_schemas` replaces the whole list when stated — including the stack schemas, so dropping
+ * `supatype` from it is a supported way to stop exposing Studio's views. Order is preserved and
+ * duplicates removed: PostgREST serves the first entry as the default profile, so the managed
+ * schema has to lead.
+ */
+export function apiSchemas(cfg: SupatypeProjectConfig, tier?: "none" | "extension" | "views"): string[] {
+  const explicit = cfg.schema?.api_schemas
+  // Tier-2 field masking serves from `api`, and the managed schema must come **off** the list: a
+  // client picks its schema per request with `Accept-Profile`, so leaving it exposed would let any
+  // caller read the unmasked table and make the mask opt-out. The API roles hold no privileges there
+  // under tier 2 either, so exposing it would only produce denials.
+  const managed = tier === "views" ? "api" : pgSchema(cfg)
+  const list = explicit && explicit.length > 0 ? explicit : [managed, ...STACK_API_SCHEMAS]
+
+  const seen = new Set<string>()
+  const out: string[] = []
+  for (const raw of list) {
+    const name = raw.trim()
+    if (name.length === 0 || seen.has(name)) continue
+    seen.add(name)
+    out.push(name)
+  }
+  return out
+}
+
+/** `PGRST_DB_SCHEMA` value: comma-separated, in order. */
+export function apiSchemaList(
+  cfg: SupatypeProjectConfig,
+  tier?: "none" | "extension" | "views",
+): string {
+  return apiSchemas(cfg, tier).join(", ")
 }